unbound-1.6.0/0000775000175000017500000000000013024451072012624 5ustar wouterwouterunbound-1.6.0/doc/0000775000175000017500000000000013024451073013372 5ustar wouterwouterunbound-1.6.0/doc/Changelog0000664000175000017500000077105313022217210015210 0ustar wouterwouter8 December 2016: Wouter - Fix downcast warnings from visual studio in sldns code. 7 December 2016: Ralph - Add DSA support for OpenSSL 1.1.0 - Fix remote control without cert for LibreSSL 6 December 2016: George - Added generic EDNS code for registering known EDNS option codes, bypassing the cache response stage and uniquifying mesh states. Four EDNS option lists were added to module_qstate (module_qstate.edns_opts_*) to store EDNS options from/to front/back side. - Added two flags to module_qstate (no_cache_lookup, no_cache_store) that control the modules' cache interactions. - Added code for registering inplace callback functions. The registered functions can be called just before replying with local data or Chaos, replying from cache, replying with SERVFAIL, replying with a resolved query, sending a query to a nameserver. The functions can inspect the available data and maybe change response/query related data (i.e. append EDNS options). - Updated Python module for the above. - Updated Python documentation. 5 December 2016: Ralph - Fix #1173: differ local-zone type deny from unset tag_actions element. 5 December 2016: Wouter - Fix #1170: document that 'inform' local-zone uses local-data. 1 December 2016: Ralph - hyphen as minus fix, by Andreas Schulze 30 November 2016: Ralph - Added local-zones and local-data bulk addition and removal functionality in unbound-control (local_zones, local_zones_remove, local_datas and local_datas_remove). - iana portlist update 29 November 2016: Wouter - version 1.6.0 is in the development branch. - braces in view.c around lock statements. 28 November 2016: Wouter - new install-sh. 25 November 2016: Wouter - Fix that with openssl 1.1 control-use-cert: no uses less cpu, by using no encryption over the unix socket. 22 Novenber 2016: Ralph - Make access-control-tag-data RDATA absolute. This makes the RDATA origin consistent between local-data and access-control-tag-data. - Fix NSEC ENT wildcard check. Matching wildcard does not have to be a subdomain of the NSEC owner. - QNAME minimisation uses QTYPE=A, therefore always check cache for this type in harden-below-nxdomain functionality. - Added unit test for QNAME minimisation + harden below nxdomain synergy. 22 November 2016: Wouter - iana portlist update. - Fix unit tests for DS hash processing for fake-dsa test option. - patch from Dag-Erling Smorgrav that removes code that relies on sbrk(). 21 November 2016: Wouter - Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing Underneath" for the harden-below-nxdomain option. 10 November 2016: Ralph - Fix #1155: test status code of unbound-control in 04-checkconf, not the status code from the tee command. 4 November 2016: Ralph - Added stub-ssl-upstream and forward-ssl-upstream options. 4 November 2016: Wouter - configure detects ssl security level API function in the autoconf manner. Every function on its own, so that other libraries (eg. LibreSSL) can develop their API without hindrance. - Fix #1154: segfault when reading config with duplicate zones. - Note that for harden-below-nxdomain the nxdomain must be secure, this means nsec3 with optout is insufficient. 3 November 2016: Ralph - Set OpenSSL security level to 0 when using aNULL ciphers. 3 November 2016: Wouter - .gitattributes line for githubs code language display. - log-identity: config option to set sys log identity, patch from "Robin H. Johnson" 2 November 2016: Wouter - iana portlist update. 31 October 2016: Wouter - Fix failure to build on arm64 with no sbrk. - iana portlist update. 28 October 2016: Wouter - Patch for server.num.zero_ttl stats for count of expired replies, from Pavel Odintsov. 26 October 2016: Wouter - Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled with the undocumented switch 'fake-dsa'. It logs a warning. 25 October 2016: Wouter - Fix #1134: unbound-control set_option -- val-override-date: -1 works immediately to ignore datetime, or back to 0 to enable it again. The -- is to ignore the '-1' as an option flag. 24 October 2016: Wouter - serve-expired config option: serve expired responses with TTL 0. - g.root-servers.net has AAAA address. 21 October 2016: Wouter - Ported tests for local_cname unit test to testbound framework. 20 October 2016: Wouter - suppress compile warning in lex files. - init lzt variable, for older gcc compiler warnings. - fix --enable-dsa to work, instead of copying ecdsa enable. - Fix DNSSEC validation of query type ANY with DNAME answers. - Fixup query_info local_alias init. 19 October 2016: Wouter - Fix #1130: whitespace in example.conf.in more consistent. 18 October 2016: Wouter - Patch that resolves CNAMEs entered in local-data conf statements that point to data on the internet, from Jinmei Tatuya (Infoblox). - Removed patch comments from acllist.c and msgencode.c - Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, from Jinmei Tatuya (Infoblox). - Fix #1125: unbound could reuse an answer packet incorrectly for clients with different EDNS parameters, from Jinmei Tatuya. - Fix #1118: libunbound.pc sets strange Libs, Libs.private values. - Added Requires line to libunbound.pc - Please doxygen by modifying mesh.h 17 October 2016: Wouter - Re-fix #839 from view commit overwrite. - Fixup const void cast warning. 12 October 2016: Ralph - Free view config elements. 11 October 2016: Ralph - Added qname-minimisation-strict config option. - iana portlist update. - fix memoryleak logfile when in debug mode. 5 October 2016: Ralph - Added views functionality. - Fix #1117: spelling errors, from Robert Edmonds. 30 September 2016: Wouter - Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav. 29 September 2016: Wouter - Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX. - Fix #839: Memory grows unexpectedly with large RPZ files. - Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile. - Fix #841: big local-zone's make it consume large amounts of memory. 27 September 2016: Wouter - tag for 1.5.10 release - trunk contains 1.5.11 in development. - Fix dnstap relaying "random" messages instead of resolver/forwarder responses, from Nikolay Edigaryev. - Fix #836: unbound could echo back EDNS options in an error response. 20 September 2016: Wouter - iana portlist update. - Fix #835: fix --disable-dsa with nettle verify. - tag for 1.5.10rc1 release. 15 September 2016: Wouter - Fix 883: error for duplicate local zone entry. - Test for openssl init_crypto and init_ssl functions. 15 September 2016: Ralph - fix potential memory leak in daemon/remote.c and nullpointer dereference in validator/autotrust. - iana portlist update. 13 September 2016: Wouter - Silenced flex-generated sign-unsigned warning print with gcc diagnostic pragma. - Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len. 9 September 2016: Wouter - Fix #831: workaround for spurious fread_chk warning against petal.c 5 September 2016: Ralph - Take configured minimum TTL into consideration when reducing TTL to original TTL from RRSIG. 5 September 2016: Wouter - Fix #829: doc of sldns_wire2str_rdata_buf() return value has an off-by-one typo, from Jinmei Tatuya (Infoblox). - Fix incomplete prototypes reported by Dag-Erling Smørgrav. - Fix #828: missing type in access-control-tag-action redirect results in NXDOMAIN. 2 September 2016: Wouter - Fix compile with openssl 1.1.0 with api=1.1.0. 1 September 2016: Wouter - RFC 7958 is now out, updated docs for unbound-anchor. - Fix for compile without warnings with openssl 1.1.0. - Fix #826: Fix refuse_non_local could result in a broken response. - iana portlist update. 29 August 2016: Wouter - Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A. Siewior. - Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e. 25 August 2016: Ralph - Clarify local-zone-override entry in unbound.conf.5 25 August 2016: Wouter - 64bit build option for makedist windows compile, -w64. 24 August 2016: Ralph - Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter in each iteration in find_tag_datas(). - unbound.conf.5 entries for define-tag, access-control-tag, access-control-tag-action, access-control-tag-data, local-zone-tag, and local-zone-override. 23 August 2016: Wouter - Fix #804: unbound stops responding after outage. Fixes queries that attempt to wait for an empty list of subqueries. - Fix #804: lower num_target_queries for iterator also for failed lookups. 8 August 2016: Wouter - Note that OPENPGPKEY type is RFC 7929. 4 August 2016: Wouter - Fix #807: workaround for possible some "unused" function parameters in test code, from Jinmei Tatuya. 3 August 2016: Wouter - use sendmsg instead of sendto for TFO. 28 July 2016: Wouter - Fix #806: wrong comment removed. 26 July 2016: Wouter - nicer ratelimit-below-domain explanation. 22 July 2016: Wouter - Fix #801: missing error condition handling in daemon_create_workers(). - Fix #802: workaround for function parameters that are "unused" without log_assert. - Fix #803: confusing (and incorrect) code comment in daemon_cleanup(). 20 July 2016: Wouter - Fix typo in unbound.conf. 18 July 2016: Wouter - Fix #798: Client-side TCP fast open fails (Linux). 14 July 2016: Wouter - TCP Fast open patch from Sara Dickinson. - Fixed unbound.doxygen for 1.8.11. 7 July 2016: Wouter - access-control-tag-data implemented. verbose(4) prints tag debug. 5 July 2016: Wouter - Fix dynamic link of anchor-update.exe on windows. - Fix detect of mingw for MXE package build. - Fixes for 64bit windows compile. - Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and --with-libunbound-only --with-nettle. 4 July 2016: Wouter - For #787: prefer-ip6 option for unbound.conf prefers to send upstream queries to ipv6 servers. - Fix #787: outgoing-interface netblock/64 ipv6 option to use linux freebind to use 64bits of entropy for every query with random local part. 30 June 2016: Wouter - Document always_transparent, always_refuse, always_nxdomain types. 29 June 2016: Wouter - Fix static compile on windows missing gdi32. 28 June 2016: Wouter - Create a pkg-config file for libunbound in contrib. 27 June 2016: Wouter - Fix #784: Build configure assumess that having getpwnam means there is endpwent function available. - Updated repository with newer flex and bison output. 24 June 2016: Ralph - Possibility to specify local-zone type for an acl/tag pair - Possibility to specify (override) local-zone type for a source address block 16 June 2016: Ralph - Decrease dp attempts at each QNAME minimisation iteration 16 June 2016: Wouter - Fix tcp timeouts in tv.usec. 15 June 2016: Wouter - TCP_TIMEOUT is specified in milliseconds. - If more than half of tcp connections are in use, a shorter timeout is used (200 msec, vs 2 minutes) to pressure tcp for new connects. 14 June 2016: Ralph - QNAME minimisation unit test for dropped QTYPE=A queries. 14 June 2016: Wouter - Fix 775: unbound-host and unbound-anchor crash on windows, ignore null delete for wsaevent. - Fix spelling in freebind option man page text. - Fix windows link of ssl with crypt32. - Fix 779: Union casting is non-portable. - Fix 780: MAP_ANON not defined in HP-UX 11.31. - Fix 781: prealloc() is an HP-UX system library call. 13 June 2016: Ralph - Use QTYPE=A for QNAME minimisation. - Keep track of number of time-outs when performing QNAME minimisation. Stop minimising when number of time-outs for a QNAME/QTYPE pair is more than three. 13 June 2016: Wouter - Fix #778: unbound 1.5.9: -h segfault (null deref). - Fix directory: fix for unbound-checkconf, it restores cwd. 10 June 2016: Wouter - And delete service.conf.shipped on uninstall. - In unbound.conf directory: dir immediately changes to that directory, so that include: file below that is relative to that directory. With chroot, make the directory an absolute path inside chroot. - keep debug symbols in windows build. - do not delete service.conf on windows uninstall. - document directory immediate fix and allow EXECUTABLE syntax in it on windows. 9 June 2016: Wouter - Trunk is called 1.5.10 (with previous fixes already in there to 2 june). - Revert fix for NetworkService account on windows due to breakage it causes. - Fix that windows install will not overwrite existing service.conf file (and ignore gui config choices if it exists). 7 June 2016: Ralph - Lookup localzones by taglist from acl. - Possibility to lookup local_zone, regardless the taglist. - Added local_zone/taglist/acl unit test. 7 June 2016: Wouter - Fix #773: Non-standard Python location build failure with pyunbound. - Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures. 6 June 2016: Wouter - Better help text from -h (from Ray Griffith). - access-control-tag config directive. - local-zone-override config directive. - access-control-tag-action and access-control-tag-data config directives. - free acl-tags, acltag-action and acltag-data config lists during initialisation to free up memory for more entries. 3 June 2016: Wouter - Fix to not ignore return value of chown() in daemon startup. 2 June 2016: Wouter - Fix libubound for edns optlist feature. - Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc. - Fix #752: retry resource temporarily unavailable on control pipe. - un-document localzone tags. - tag for release 1.5.9rc1. And this also became release 1.5.9. - Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to Program Files with (x86) appended. - re-documented localzone tags in example.conf. 31 May 2016: Wouter - Fix windows service to be created run with limited rights, as a network service account, from Mario Turschmann. - compat strsep implementation. - generic edns option parse and store code. - and also generic edns options for upstream messages (and replies). after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID), to insert use edns_opt_append(edns, region, code, len, bindata) on the opt_list passed to send_query, or in edns_opt_inplace_reply. 30 May 2016: Wouter - Fix time in case answer comes from cache in ub_resolve_event(). - Attempted fix for #765: _unboundmodule missing for python3. 27 May 2016: Wouter - Fix #770: Small subgroup attack on DH used in unix pipe on localhost if unbound control uses a unix local named pipe. - Document write permission to directory of trust anchor needed. - Fix #768: Unbound Service Sometimes Can Not Shutdown Completely, WER Report Shown Up. Close handle before closing WSA. 26 May 2016: Wouter - Updated patch from Charles Walker. 24 May 2016: Wouter - disable-dnssec-lame-check config option from Charles Walker. - remove memory leak from lame-check patch. - iana portlist update. 23 May 2016: Wouter - Fix #767: Reference to an expired Internet-Draft in harden-below-nxdomain documentation. 20 May 2016: Ralph - No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC signed zones. - iana portlist update. 19 May 2016: Wouter - Fix #766: dns64 should synthesize results on timeout/errors. 18 May 2016: Wouter - Fix #761: DNSSEC LAME false positive resolving nic.club. 17 May 2016: Wouter - trunk updated with output of flex 2.6.0. 6 May 2016: Wouter - Fix memory leak in out-of-memory conditions of local zone add. 29 April 2016: Wouter - Fix sldns with static checking fixes copied from getdns. 28 April 2016: Wouter - Fix #759: 0x20 capsforid no longer checks type PTR, for compatibility with cisco dns guard. This lowers false positives. 18 April 2016: Wouter - Fix some malformed reponses to edns queries get fallback to nonedns. 15 April 2016: Wouter - cachedb module event handling design. 14 April 2016: Wouter - cachedb module framework (empty). - iana portlist update. 12 April 2016: Wouter - Fix #753: document dump_requestlist is for first thread. 24 March 2016: Wouter - Document permit-small-holddown for 5011 debug. - Fix #749: unbound-checkconf gets SIGSEGV when use against a malformatted conf file. 23 March 2016: Wouter - OpenSSL 1.1.0 portability, --disable-dsa configure option. 21 March 2016: Wouter - Fix compile of getentropy_linux for SLES11 servicepack 4. - Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev. - Fix test for openssl to use HMAC_Update for 1.1.0. - acx_nlnetlabs.m4 to v33, with HMAC_Update. - acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto. - ERR_remove_state deprecated since openssl 1.0.0. - OPENSSL_config is deprecated, removing. 18 March 2016: Ralph - Validate QNAME minimised NXDOMAIN responses. - If QNAME minimisation is enabled, do cache lookup for QTYPE NS in harden-below-nxdomain. 17 March 2016: Ralph - Limit number of QNAME minimisation iterations. 17 March 2016: Wouter - Fix #746: Fix unbound sets CD bit on all forwards. If no trust anchors, it'll not set CD bit when forwarding to another server. If a trust anchor, no CD bit on the first attempt to a forwarder, but CD bit thereafter on repeated attempts to get DNSSEC. - iana portlist update. 16 March 2016: Wouter - Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma. - Fix ip-transparent for tcp on freebsd. 15 March 2016: Wouter - ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for binding to an IP address while the interface or address is down. 14 March 2016: Wouter - Fix warnings in ifdef corner case, older or unknown libevent. - Fix compile for ub_event code with older libev. 11 March 2016: Wouter - Remove warning about unused parameter in event_pluggable.c. - Fix libev usage of dispatch return value. - No side effects in tolower() call, in case it is a macro. - For test put free in pluggable api in parenthesis. 10 March 2016: Wouter - Fixup backend2str for libev. 09 March 2016: Willem - User defined pluggable event API for libunbound - Fixup of compile fix for pluggable event API from P.Y. Adi Prasaja. 09 March 2016: Wouter - Updated configure and ltmain.sh. - Updated L root IPv6 address. 07 March 2016: Wouter - Fix #747: assert in outnet_serviced_query_stop. - iana ports fetched via https. - iana portlist update. 03 March 2016: Wouter - configure tests for the weak attribute support by the compiler. 02 March 2016: Wouter - 1.5.8 release tag - trunk contains 1.5.9 in development. - iana portlist update. - Fix #745: unbound.py - idn2dname throws UnicodeError when idnname contains trailing dot. 24 February 2016: Wouter - Fix OpenBSD asynclook lock free that gets used later (fix test code). - Fix that NSEC3 negative cache is used when there is no salt. 23 February 2016: Wouter - ub_ctx_set_stub() function for libunbound to config stub zones. - sorted ubsyms.def file with exported libunbound functions. 19 February 2016: Wouter - Print understandable debug log when unusable DS record is seen. - load gost algorithm if digest is seen before key algorithm. - iana portlist update. 17 February 2016: Wouter - Fix that "make install" fails due to "text file busy" error. 16 February 2016: Wouter - Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error. 15 February 2016: Wouter - ip-transparent option for FreeBSD with IP_BINDANY socket option. - wait for sendto to drain socket buffers when they are full. 9 February 2016: Wouter - Test for type OPENPGPKEY. - insecure-lan-zones: yesno config option, patch from Dag-Erling Smørgrav. 8 February 2016: Wouter - Fix patch typo in prevuous commit for 734 from Adi Prasaja. - RR Type CSYNC support RFC 7477, in debug printout and config input. - RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07). 29 January 2016: Wouter - Neater cmdline_verbose increment patch from Edgar Pettijohn. 27 January 2016: Wouter - Made netbsd sendmsg test nonfatal, in case of false positives. - Fix #741: log message for dnstap socket connection is more clear. 26 January 2016: Wouter - Fix #734: chown the pidfile if it resides inside the chroot. - Use arc4random instead of random in tests (because it is available, possibly as compat, anyway). - Fix cmsg alignment for argument to sendmsg on NetBSD. - Fix that unbound complains about unimplemented IP_PKTINFO for sendmsg on NetBSD (for interface-automatic). 25 January 2016: Wouter - Fix #738: Swig should not be invoked with CPPFLAGS. 19 January 2016: Wouter - Squelch 'cannot assign requested address' log messages unless verbosity is high, it was spammed after network down. 14 January 2016: Wouter - Fix to simplify empty string checking from Michael McConville. - iana portlist update. 12 January 2016: Wouter - Fix #734: Do not log an error when the PID file cannot be chown'ed. Patch from Simon Deziel. 11 January 2016: Wouter - Fix test if -pthreads unused to use better grep for portability. 06 January 2016: Wouter - Fix mingw crosscompile for recent mingw. - Update aclocal, autoconf output with new versions (1.15, 2.4.6). 05 January 2016: Wouter - #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch from Daisuke Higashi. - Support RFC7686: handle ".onion" Special-Use Domain. It is blocked by default, and can be unblocked with "nodefault" localzone config. 04 January 2016: Wouter - Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined, for Linux glibc 2.20. - Fixup contrib/aaaa-filter-iterator.patch for moved contents in the source code, so it applies cleanly again. Removed unused variable warnings. 15 December 2015: Ralph - Fix #729: omit use of escape sequences in echo since they are not portable (unbound-control-setup). 11 December 2015: Wouter - remove NULL-checks before free, patch from Michael McConville. - updated ax_pthread.m4 to version 21 with clang support, this removes a warning from compilation. - OSX portability, detect if sbrk is deprecated. - OSX clang, stop -pthread unused during link stage warnings. - OSX clang new flto check. 10 December 2015: Wouter - 1.5.7 release - trunk has 1.5.8 in development. 8 December 2015: Wouter - Fixup 724 for unbound-control. 7 December 2015: Ralph - Do not minimise forwarded requests. 4 December 2015: Wouter - Removed unneeded whitespace from example.conf. 3 December 2015: Ralph - (after rc1 tag) - Committed fix to qname minimisation and unit test case for it. 3 December 2015: Wouter - iana portlist update. - 1.5.7rc1 prerelease tag. 2 December 2015: Wouter - Fixup 724: Fix PCA prompt for unbound-service-install.exe. re-enable stdout printout. - For 724: Add Changelog to windows binary dist. 1 December 2015: Ralph - Qname minimisation review fixes 1 December 2015: Wouter - Fixup 724 fix for fname_after_chroot() calls. - Remove stdout printout for unbound-service-install.exe - .gitignore for git users. 30 November 2015: Ralph - Implemented qname minimisation 30 November 2015: Wouter - Fix for #724: conf syntax to read files from run dir (on Windows). 25 November 2015: Wouter - Fix for #720, fix unbound-control-setup windows batch file. 24 November 2015: Wouter - Fix #720: add windows scripts to zip bundle. - iana portlist update. 20 November 2015: Wouter - Added assert on rrset cache correctness. - Fix that malformed EDNS query gets a response without malformed EDNS. 18 November 2015: Wouter - newer acx_nlnetlabs.m4. - spelling fixes from Igor Sobrado Delgado. 17 November 2015: Wouter - Fix #594. libunbound: optionally use libnettle for crypto. Contributed by Luca Bruno. Added --with-nettle for use with --with-libunbound-only. - refactor nsec3 hash implementation to be more library-portable. - iana portlist update. - Fixup DER encoded DSA signatures for libnettle. 16 November 2015: Wouter - Fix for lenient accept of reverse order DNAME and CNAME. 6 November 2015: Wouter - Change example.conf: ftp.internic.net to https://www.internic.net 5 November 2015: Wouter - ACX_SSL_CHECKS no longer adds -ldl needlessly. 3 November 2015: Wouter - Fix #718: Fix unbound-control-setup with support for env without HEREDOC bash support. 29 October 2015: Wouter - patch from Doug Hogan for SSL_OP_NO_SSLvx options. - Fix #716: nodata proof with empty non-terminals and wildcards. 28 October 2015: Wouter - Fix checklock testcode for linux threads on exit. 27 October 2015: Wouter - isblank() compat implementation. - detect libexpat without xml_StopParser function. - portability fixes. - portability, replace snprintf if return value broken. 23 October 2015: Wouter - Fix #714: Document config to block private-address for IPv4 mapped IPv6 addresses. 22 October 2015: Wouter - Fix #712: unbound-anchor appears to not fsync root.key. 20 October 2015: Wouter - 1.5.6 release. - trunk tracks development of 1.5.7. 15 October 2015: Wouter - Fix segfault in the dns64 module in the formaterror error path. - Fix sldns_wire2str_rdata_scan for malformed RRs. - tag for 1.5.6rc1 release. 14 October 2015: Wouter - ANY responses include DNAME records if present, as per Evan Hunt's remark in dnsop. - Fix manpage to suggest using SIGTERM to terminate the server. 9 October 2015: Wouter - Default for ssl-port is port 853, the temporary port assignment for secure domain name system traffic. If you used to rely on the older default of port 443, you have to put a clause in unbound.conf for that. The new value is likely going to be the standardised port number for this traffic. - iana portlist update. 6 October 2015: Wouter - 1.5.5 release. - trunk tracks the development of 1.5.6. 28 September 2015: Wouter - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution failures. - tag for 1.5.5rc1 release. - makedist.sh: pgp sig echo commands. 25 September 2015: Wouter - Fix unbound-control flush that does not succeed in removing data. 22 September 2015: Wouter - Fix config globbed include chroot treatment, this fixes reload of globs (patch from Dag-Erling Smørgrav). - iana portlist update. - Fix #702: New IPs for for h.root-servers.net. - Remove confusion comment from canonical_compare() function. - Fix #705: ub_ctx_set_fwd() return value mishandled on windows. - testbound selftest also works in non-debug mode. - Fix minor error in unbound.conf.5.in - Fix unbound.conf(5) access-control description for precedence and default. 31 August 2015: Wouter - changed windows setup compression to be more transparent. 28 August 2015: Wouter - Fix #697: Get PY_MAJOR_VERSION failure at configure for python 2.4 to 2.6. - Feature #699: --enable-pie option to that builds PIE binary. - Feature #700: --enable-relro-now option that enables full read-only relocation. 24 August 2015: Wouter - Fix deadlock for local data add and zone add when unbound-control list_local_data printout is interrupted. - iana portlist update. - Change default of harden-algo-downgrade to off. This is lenient for algorithm rollover. 13 August 2015: Wouter - 5011 implementation does not insist on all algorithms, when harden-algo-downgrade is turned off. - Reap the child process that libunbound spawns. 11 August 2015: Wouter - Fix #694: configure script does not detect LibreSSL 2.2.2 4 August 2015: Wouter - Document that local-zone nodefault matches exactly and transparent can be used to release a subzone. 3 August 2015: Wouter - Document in the manual more text about configuring locally served zones. - Fix 5011 anchor update timer after reload. - Fix mktime in unbound-anchor not using UTC. 30 July 2015: Wouter - please afl-gcc (llvm) for uninitialised variable warning. - Added permit-small-holddown config to debug fast 5011 rollover. 24 July 2015: Wouter - Fix #690: Reload fails when so-reuseport is yes after changing num-threads. - iana portlist update. 21 July 2015: Wouter - Fix configure to detect SSL_CTX_set_ecdh_auto. - iana portlist update. 20 July 2015: Wouter - Enable ECDHE for servers. Where available, use SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to enable ECDHE. Otherwise, manually offer curve p256. Client connections should automatically use ECDHE when available. (thanks Daniel Kahn Gillmor) 18 July 2015: Willem - Allow certificate chain files to allow for intermediate certificates. (thanks Daniel Kahn Gillmor) 13 July 2015: Wouter - makedist produces sha1 and sha256 files for created binaries too. 9 July 2015: Wouter - 1.5.4 release tag - trunk has 1.5.5 in development. - Fix #681: Setting forwarders with unbound-control forward implicitly turns on forward-first. 29 June 2015: Wouter - iana portlist update. - Fix alloc with log for allocation size checks. 26 June 2015: Wouter - Fix #677 Fix DNAME responses from cache that failed internal chain test. - iana portlist update. 22 June 2015: Wouter - Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly and was therefore always synthesized (thanks to Valentin Dietrich). 4 June 2015: Wouter - RFC 7553 RR type URI support, is now enabled by default. 2 June 2015: Wouter - Fix #674: Do not free pointers given by getenv. 29 May 2015: Wouter - Fix that unparseable error responses are ratelimited. - SOA negative TTL is capped at minimumttl in its rdata section. - cache-max-negative-ttl config option, default 3600. 26 May 2015: Wouter - Document that ratelimit works with unbound-control set_option. 21 May 2015: Wouter - iana portlist update. - documentation proposes ratelimit of 1000 (closer to what upstream servers expect from us). 20 May 2015: Wouter - DLV is going to be decommissioned. Advice to stop using it, and put text in the example configuration and man page to that effect. 10 May 2015: Wouter - Change syntax of particular validator error to be easier for machine parse, swap rrset and ip adres info so it looks like: validation failure : signature crypto failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN> 1 May 2015: Wouter - caps-whitelist in unbound.conf allows whitelist of loadbalancers that cannot work with caps-for-id or its fallback. 30 April 2015: Wouter - Unit test for type ANY synthesis. 22 April 2015: Wouter - Removed contrib/unbound_unixsock.diff, because it has been integrated, use control-interface: /path in unbound.conf. - iana portlist update. 17 April 2015: Wouter - Synthesize ANY responses from cache. Does not search exhaustively, but MX,A,AAAA,SOA,NS also CNAME. - Fix leaked dns64prefix configuration string. 16 April 2015: Wouter - Add local-zone type inform_deny, that logs query and drops answer. - Ratelimit does not apply to prefetched queries, and ratelimit-factor is default 10. Repeated normal queries get resolved and with prefetch stay in the cache. - Fix bug#664: libunbound python3 related fixes (from Tomas Hozza) Use print_function also for Python2. libunbound examples: produce sorted output. libunbound-Python: libldns is not used anymore. Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns. 10 April 2015: Wouter - unbound-control ratelimit_list lists high rate domains. - ratelimit feature, ratelimit: 100, or some sensible qps, can be used to turn it on. It ratelimits recursion effort per zone. For particular names you can configure exceptions in unbound.conf. - Fix that get_option for cache-sizes does not print double newline. - Fix#663: ssl handshake fails when using unix socket because dh size is too small. 8 April 2015: Wouter - Fix crash in dnstap: Do not try to log TCP responses after timeout. 7 April 2015: Wouter - Libunbound skips dos-line-endings from etc/hosts. - Unbound exits with a fatal error when the auto-trust-anchor-file fails to be writable. This is seconds after startup. You can load a readonly auto-trust-anchor-file with trust-anchor-file. The file has to be writable to notice the trust anchor change, without it, a trust anchor change will be unnoticed and the system will then become inoperable. - unbound-control list_insecure command shows the negative trust anchors currently configured, patch from Jelte Jansen. 2 April 2015: Wouter - Fix #660: Fix interface-automatic broken in the presence of asymmetric routing. 26 March 2015: Wouter - remote.c probedelay line is easier to read. - rename ldns subdirectory to sldns to avoid name collision. 25 March 2015: Wouter - Fix #657: libunbound(3) recommends deprecated CRYPTO_set_id_callback. - If unknown trust anchor algorithm, and libressl is used, error message encourages upgrade of the libressl package. 23 March 2015: Wouter - Fix segfault on user not found at startup (from Maciej Soltysiak). 20 March 2015: Wouter - Fixed to add integer overflow checks on allocation (defense in depth). 19 March 2015: Wouter - Add ip-transparent config option for bind to non-local addresses. 17 March 2015: Wouter - Use reallocarray for integer overflow protection, patch submitted by Loganaden Velvindron. 16 March 2015: Wouter - Fixup compile on cygwin, more portable openssl thread id. 12 March 2015: Wouter - Updated default keylength in unbound-control-setup to 3k. 10 March 2015: Wouter - Fix lintian warning in unbound-checkconf man page (from Andreas Schulze). - print svnroot when building windows dist. - iana portlist update. - Fix warning on sign compare in getentropy_linux. 9 March 2015: Wouter - Fix #644: harden-algo-downgrade option, if turned off, fixes the reported excessive validation failure when multiple algorithms are present. It allows the weakest algorithm to validate the zone. - iana portlist update. 5 March 2015: Wouter - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal scripts. Contributed by Yuri Voinov. - Document that incoming-num-tcp increase is good for large servers. - stats reports tcp usage, of incoming-num-tcp buffers. 4 March 2015: Wouter - Patch from Brad Smith that syncs compat/getentropy_linux with OpenBSD's version (2015-03-04). - 0x20 fallback improved: servfail responses do not count as missing comparisons (except if all responses are errors), inability to find nameservers does not fail equality comparisons, many nameservers does not try to compare more than max-sent-count, parse failures start 0x20 fallback procedure. - store caps_response with best response in case downgrade response happens to be the last one. - Document windows 8 tests. 3 March 2015: Wouter - tag 1.5.3rc1 [ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ] 2 March 2015: Wouter - iana portlist update. 20 February 2015: Wouter - Use the getrandom syscall introduced in Linux 3.17 (from Heiner Kallweit). - Fix #645 Portability to Solaris 10, use AF_LOCAL. - Fix #646 Portability to Solaris, -lrt for getentropy_solaris. - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after reload. 19 February 2015: Wouter - 1.5.2 release tag. - svn trunk contains 1.5.3 under development. 13 February 2015: Wouter - Fix #643: doc/example.conf.in: unnecessary whitespace. 12 February 2015: Wouter - tag 1.5.2rc1 11 February 2015: Wouter - iana portlist update. 10 February 2015: Wouter - Fix scrubber with harden-glue turned off to reject NS (and other not-address) records. 9 February 2015: Wouter - Fix validation failure in case upstream forwarder (ISC BIND) does not have the same trust anchors and decides to insert unsigned NS record in authority section. 2 February 2015: Wouter - infra-cache-min-rtt patch from Florian Riehm, for expected long uplink roundtrip times. 30 January 2015: Wouter - Fix 0x20 capsforid fallback to omit gratuitous NS and additional section changes. - Portability fix for Solaris ('sun' is not usable for a variable). 29 January 2015: Wouter - Fix pyunbound byte string representation for python3. 26 January 2015: Wouter - Fix unintended use of gcc extension for incomplete enum types, compile with pedantic c99 compliance (from Daniel Dickman). 23 January 2015: Wouter - windows port fixes, no AF_LOCAL, no chown, no chmod(grp). 16 January 2015: Wouter - unit test for local unix connection. Documentation and log_addr does not inspect port for AF_LOCAL. - unbound-checkconf -f prints chroot with pidfile path. 13 January 2015: Wouter - iana portlist update. 12 January 2015: Wouter - Cast sun_len sizeof to socklen_t. - Fix pyunbound ord call, portable for python 2 and 3. 7 January 2015: Wouter - Fix warnings in pythonmod changes. 6 January 2015: Wouter - iana portlist update. - patch for remote control over local sockets, from Dag-Erling Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and control-use-cert: no. - Fixup that patch and uid lookup (only for daemon). - coded the default of control-use-cert, to yes. 5 January 2015: Wouter - getauxval test for ppc64 linux compatibility. - make strip works for unbound-host and unbound-anchor. - patch from Stephane Lapie that adds to the python API, that exposes struct delegpt, and adds the find_delegation function. - print query name when max target count is exceeded. - patch from Stuart Henderson that fixes DESTDIR in unbound-control-setup for installs where config is not in the prefix location. - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne). - Updated contrib warmup.cmd/sh to support two modes - load from pre-defined list of domains or (with filename as argument) load from user-specified list of domains, and updated contrib unbound_cache.sh/cmd to support loading/save/reload cache to/from default path or (with secondary argument) arbitrary path/filename, from Yuri Voinov. - Patch from Philip Paeps to contrib/unbound_munin_ that uses type ABSOLUTE. Allows munin.conf: [idleserver.example.net] unbound_munin_hits.graph_period minute 9 December 2014: Wouter - svn trunk has 1.5.2 in development. - config.guess and config.sub update from libtoolize. - local-zone: example.com inform makes unbound log a message with client IP for queries in that zone. Eg. for finding infected hosts. 8 December 2014: Wouter - Fix CVE-2014-8602: denial of service by making resolver chase endless series of delegations. 1 December 2014: Wouter - Fix bug#632: unbound fails to build on AArch64, protects getentropy compat code from calling sysctl if it is has been removed. 29 November 2014: Wouter - Add include to getentropy_linux.c, hopefully fixing debian build. 28 November 2014: Wouter - Fix makefile for build from noexec source tree. 26 November 2014: Wouter - Fix libunbound undefined symbol errors for main. Referencing main does not seem to be possible for libunbound. 24 November 2014: Wouter - Fix log at high verbosity and memory allocation failure. - iana portlist update. 21 November 2014: Wouter - Fix crash on multiple thread random usage on systems without arc4random. 20 November 2014: Wouter - fix compat/getentropy_win.c check if CryptGenRandom works and no immediate exit on windows. 19 November 2014: Wouter - Fix cdflag dns64 processing. 18 November 2014: Wouter - Fix that CD flag disables DNS64 processing, returning the DNSSEC signed AAAA denial. - iana portlist update. 17 November 2014: Wouter - Fix #627: SSL_CTX_load_verify_locations return code not properly checked. 14 November 2014: Wouter - parser with bison 2.7 13 November 2014: Wouter - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, added to contrib/aaaa-filter-iterator.patch. 12 November 2014: Wouter - trunk has 1.5.1 in development. - Patch from Robert Edmonds to build pyunbound python module differently. No versioninfo, with -shared and without $(LIBS). - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page. - Removed 'increased limit open files' log message that is written to console. It is only written on verbosity 4 and higher. This keeps system bootup console cleaner. - Patch from James Raftery, always print stats for rcodes 0..5. 11 November 2014: Wouter - iana portlist update. - Fix bug where forward or stub addresses with same address but different port number were not tried. - version number in svn trunk is 1.5.0 - tag 1.5.0rc1 - review fix from Ralph. 7 November 2014: Wouter - dnstap fixes by Robert Edmonds: dnstap/dnstap.m4: cosmetic fixes dnstap/: Remove compiled protoc-c output files dnstap/dnstap.m4: Error out if required libraries are not found dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of protobuf-c 1.0.0 dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0) 4 November 2014: Wouter - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically tracked trust anchor to libunbound. - Redefine internal minievent symbols to unique symbols that helps linking on platforms where the linker leaks names across modules. 27 October 2014: Wouter - Disabled use of SSLv3 in remote-control and ssl-upstream. - iana portlist update. 16 October 2014: Wouter - Documented dns64 configuration in unbound.conf man page. 13 October 2014: Wouter - Fix #617: in ldns in unbound, lowercase WKS services. - Fix ctype invocation casts. 10 October 2014: Wouter - Fix unbound-checkconf check for module config with dns64 module. - Fix unbound capsforid fallback, it ignores TTLs in comparison. 6 October 2014: Wouter - Fix #614: man page variable substitution bug. 6 October 2014: Willem - Whitespaces after $ORIGIN are not part of the origin dname (ldns). - $TTL's value starts at position 5 (ldns). 1 October 2014: Wouter - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire). 29 September 2014: Wouter - Fix #612: create service with service.conf in present directory and auto load it. - Fix for mingw compile openssl ranlib. 25 September 2014: Wouter - updated configure and aclocal with newer autoconf 1.13. 22 September 2014: Wouter - Fix swig and python examples for Python 3.x. - Fix for mingw compile with openssl-1.0.1i. 19 September 2014: Wouter - improve python configuration detection to build on Fedora 22. 18 September 2014: Wouter - patches to also build with Python 3.x (from Pavel Simerda). 16 September 2014: Wouter - Fix tcp timer waiting list removal code. - iana portlist update. - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue is longer and more tcp connections can be handled. 15 September 2014: Wouter - Fix unit test for CDS typecode. 5 September 2014: Wouter - type CDS and CDNSKEY types in sldns. 25 August 2014: Wouter - Fixup checklock code for log lock and its mutual initialization dependency. - iana portlist update. - Removed necessity for pkg-config from the dnstap.m4, new are the --with-libfstrm and --with-protobuf-c configure options. 19 August 2014: Wouter - Update unbound manpage with more explanation (from Florian Obser). 18 August 2014: Wouter - Fix #603: unbound-checkconf -o