1369939Sgit2svn2 February 2021: Wouter 2369939Sgit2svn - branch-1.13.1 is created, with release-1.13.1rc1 tag. 3369939Sgit2svn - Fix dynlibmod link on rhel8 for -ldl inclusion. 4369939Sgit2svn - Fix windows dependency on libssp.dll because of default stack 5369939Sgit2svn protector in mingw. 6369939Sgit2svn - Fix indentation of root anchor for use by windows install script. 7369939Sgit2svn 8369939Sgit2svn1 February 2021: George 9369939Sgit2svn - Attempt to fix NULL keys in the reuse_tcp tree; relates to #411. 10369939Sgit2svn 11369939Sgit2svn29 January 2021: Wouter 12369939Sgit2svn - Fix for doxygen 1.8.20 compatibility. 13369939Sgit2svn 14369939Sgit2svn28 January 2021: Wouter 15369939Sgit2svn - Annotate that we ignore the return value of if_indextoname. 16369939Sgit2svn - Fix to use correct type for label count in rpz routine. 17369939Sgit2svn - Fix empty clause warning in config_file nsid parse. 18369939Sgit2svn - Fix to use correct type for label count in ipdnametoaddr rpz routine. 19369939Sgit2svn - Fix empty clause warning in edns pass for padding. 20369939Sgit2svn - Fix fwd ancil test post script when not supported. 21369939Sgit2svn 22369939Sgit2svn26 January 2021: George 23369939Sgit2svn - Merge PR #408 from fobser: Prevent a few more yacc clashes. 24369939Sgit2svn - Merge PR #275 from Roland van Rijswijk-Deij: Add feature to return the 25369939Sgit2svn original instead of a decrementing TTL ('serve-original-ttl') 26369939Sgit2svn - Merge PR #355 from noloader: Make ICANN Update CA and DS Trust Anchor 27369939Sgit2svn static data. 28369939Sgit2svn - Ignore cache blacklisting when trying to reply with expired data from 29369939Sgit2svn cache (#394). 30369939Sgit2svn 31369939Sgit2svn26 January 2021: Wouter 32369939Sgit2svn - Fix compile of unbound-dnstap-socket without dnstap installed. 33369939Sgit2svn 34369939Sgit2svn22 January 2021: Willem 35369939Sgit2svn - Padding of queries and responses with DNS over TLS as specified in 36369939Sgit2svn RFC7830 and RFC8467. 37369939Sgit2svn 38369939Sgit2svn22 January 2021: George 39369939Sgit2svn - Fix TTL of SOA record for negative answers (localzone and 40369939Sgit2svn authzone data) to be the minimum of the SOA TTL and the SOA.MINIMUM. 41369939Sgit2svn 42369939Sgit2svn19 January 2021: Willem 43369939Sgit2svn - Support for RFC5001: DNS Name Server Identifier (NSID) Option 44369939Sgit2svn with the nsid: option in unbound.conf 45369939Sgit2svn 46369939Sgit2svn18 January 2021: Wouter 47369939Sgit2svn - Fix #404: DNS query with small edns bufsize fail. 48369939Sgit2svn - Fix declaration before statement and signed comparison warning in 49369939Sgit2svn dns64. 50369939Sgit2svn 51369939Sgit2svn15 January 2021: Wouter 52369939Sgit2svn - Merge #402 from fobser: Implement IPv4-Embedded addresses according 53369939Sgit2svn to RFC6052. 54369939Sgit2svn 55369939Sgit2svn14 January 2021: Wouter 56369939Sgit2svn - Fix for #93: dynlibmodule import library is named libunbound.dll.a. 57369939Sgit2svn 58369939Sgit2svn13 January 2021: Wouter 59369939Sgit2svn - Merge #399 from xiangbao227: The lock of lruhash table should 60369939Sgit2svn unlocked after markdel entry. 61369939Sgit2svn - Fix for #93: dynlibmodule link fix for Windows. 62369939Sgit2svn 63369939Sgit2svn12 January 2021: Wouter 64369939Sgit2svn - Fix #397: [Feature request] add new type always_null to local-zone 65369939Sgit2svn similar to always_nxdomain. 66369939Sgit2svn - Fix so local zone types always_nodata and always_deny can be used 67369939Sgit2svn from the config file. 68369939Sgit2svn 69369939Sgit2svn8 January 2021: Wouter 70369939Sgit2svn - Merge PR #391 from fhriley: Add start_time to reply callbacks so 71369939Sgit2svn modules can compute the response time. 72369939Sgit2svn - For #391: use struct timeval* start_time for callback information. 73369939Sgit2svn - For #391: fix indentation. 74369939Sgit2svn - For #391: more double casts in python start time calculation. 75369939Sgit2svn - Add comment documentation. 76369939Sgit2svn - Fix clang analysis warning. 77369939Sgit2svn 78369939Sgit2svn6 January 2021: Wouter 79369939Sgit2svn - Fix #379: zone loading over HTTP appears to have buffer issues. 80369939Sgit2svn - Merge PR #395 from mptre: add missing null check. 81369939Sgit2svn - Fix #387: client-subnet-always-forward seems to effectively bypass 82369939Sgit2svn any caching? 83369939Sgit2svn 84369939Sgit2svn5 January 2021: Wouter 85369939Sgit2svn - Fix #385: autoconf 2.70 impacts unbound build 86369939Sgit2svn - Merge PR #375 by fhriley: Add rpz_enable and rpz_disable commands 87369939Sgit2svn to unbound-control. 88369939Sgit2svn 89369939Sgit2svn4 January 2021: Wouter 90369939Sgit2svn - For #376: Fix that comm point event is not double removed or double 91369939Sgit2svn added to event map. 92369939Sgit2svn - iana portlist updated. 93369939Sgit2svn 94369939Sgit2svn16 December 2020: George 95369939Sgit2svn - Fix error cases when udp-connect is set and send() returns an error 96369939Sgit2svn (modified patch from Xin Li @delphij). 97369939Sgit2svn 98369939Sgit2svn11 December 2020: Wouter 99369939Sgit2svn - Fix #371: unbound-control timeout when Unbound is not running. 100369939Sgit2svn - Fix to squelch permission denied and other errors from remote host, 101369939Sgit2svn they are logged at higher verbosity but not on low verbosity. 102369939Sgit2svn - Merge PR #335 from fobser: Sprinkle in some static to prevent 103369939Sgit2svn missing prototype warnings. 104369939Sgit2svn - Merge PR #373 from fobser: Warning: arithmetic on a pointer to void 105369939Sgit2svn is a GNU extension. 106369939Sgit2svn - Fix missing prototypes in the code. 107369939Sgit2svn 108369939Sgit2svn3 December 2020: Wouter 109369939Sgit2svn - make depend. 110369939Sgit2svn - iana portlist updated. 111369939Sgit2svn 112369939Sgit2svn2 December 2020: Wouter 113369939Sgit2svn - Fix #360: for the additionally reported TCP Fast Open makes TCP 114369939Sgit2svn connections fail, in that case we print a hint that this is 115369939Sgit2svn happening with the error in the logs. 116369939Sgit2svn - Fix #356: deadlock when listening tcp. 117369939Sgit2svn - Fix unbound-dnstap-socket to not use log routine from interrupt 118369939Sgit2svn handler and not print so frequently when invoked in sequence. 119369939Sgit2svn - Fix on windows to ignore connection failure on UDP, unless verbose. 120369939Sgit2svn - Fix for #283: fix stream reuse and tcp fast open. 121369939Sgit2svn - Fix update, with write event check with streamreuse and fastopen. 122369939Sgit2svn 123369939Sgit2svn1 December 2020: Wouter 124369939Sgit2svn - Fix #358: Squelch udp connect 'no route to host' errors on low 125369939Sgit2svn verbosity. 126369939Sgit2svn 127368693Scy30 November 2020: Wouter 128368693Scy - Fix assertion failure on double callback when iterator loses 129368693Scy interest in query at head of line that then has the tcp stream 130368693Scy not kept for reuse. 131369939Sgit2svn - tag for the 1.13.0rc4 release. This also became the 1.13.0 132369939Sgit2svn release version on 3 dec 2020 with the streamreuse and fastopen 133369939Sgit2svn fix from 2 dec 2020. The code repo continues for 1.13.1 in 134369939Sgit2svn development. 135368693Scy 136368693Scy27 November 2020: Wouter 137368693Scy - Fix compile warning for type cast in http2_submit_dns_response. 138368693Scy - Fix when use free buffer to initialize rbtree for stream reuse. 139368693Scy - Fix compile warnings for windows. 140368693Scy - Fix compile warnings in rpz initialization. 141368693Scy - Fix contrib/metrics.awk for FreeBSD awk compatibility. 142368693Scy - tag for the 1.13.0rc3 release. 143368693Scy 144368693Scy26 November 2020: Wouter 145368693Scy - Fix to omit UDP receive errors from log, if verbosity low. 146368693Scy These happen because of udp-connect. 147368693Scy - For #352: contrib/metrics.awk for Prometheus style metrics output. 148368693Scy - Fix that after failed read, the readagain cannot activate. 149368693Scy - Clear readagain upon decommission of pending tcp structure. 150368693Scy 151368693Scy25 November 2020: Wouter 152368693Scy - with udp-connect ignore connection refused with UDP timeouts. 153368693Scy - Fix udp-connect on FreeBSD, do send calls on connected UDP socket. 154368693Scy - Better fix for reuse tree comparison for is-tls sockets. Where 155368693Scy the tree key identity is preserved after cleanup of the TLS state. 156368693Scy - Remove debug commands from reuse tests. 157368693Scy - Fix memory leak for edns client tag opcode config element. 158368693Scy - Attempt fix for libevent state in tcp reuse cases after a packet 159368693Scy is written. 160368693Scy - Fix readagain and writeagain callback functions for comm point 161368693Scy cleanup. 162368693Scy - tag for the 1.13.0rc2 release. 163368693Scy 164368693Scy24 November 2020: Wouter 165368693Scy - Merge PR #283 : Stream reuse. This implements upstream stream 166368693Scy reuse for performing several queries over the same TCP or TLS 167368693Scy channel. 168368693Scy - set version of main branch to 1.13.0 for upcoming release. 169368693Scy - iana portlist updated. 170368693Scy - Fix one port unit test for udp-connect. 171368693Scy - tag for the 1.13.0rc1 release. 172368693Scy - Fix crash when TLS connection is closed prematurely, when 173368693Scy reuse tree comparison is not properly identical to insertion. 174368693Scy - Fix padding of struct regional for 32bit systems. 175368693Scy 176368693Scy23 November 2020: George 177368693Scy - Merge PR #313 from Ralph Dolmans: Replace edns-client-tag with 178368693Scy edns-client-string option. 179368693Scy 180368693Scy23 November 2020: Wouter 181368693Scy - Merge #351 from dvzrv: Add AF_NETLINK to set of allowed socket 182368693Scy address families. 183368693Scy - Fix #350: with the AF_NETLINK permission, to fix 1.12.0 error: 184368693Scy failed to list interfaces: getifaddrs: Address family not 185368693Scy supported by protocol. 186368693Scy - Fix #347: IP_DONTFRAG broken on Apple xcode 12.2. 187368693Scy - Option to toggle udp-connect, default is enabled. 188368693Scy - Fix for #303 CVE-2020-28935 : Fix that symlink does not interfere 189368693Scy with chown of pidfile. 190368693Scy - Further fix for it and retvalue 0 fix for it. 191368693Scy 192368693Scy12 November 2020: Wouter 193368693Scy - Fix to connect() to UDP destinations, default turned on, 194368693Scy this lowers vulnerability to ICMP side channels. 195368693Scy - Retry for interfaces with unused ports if possible. 196368693Scy 197368693Scy10 November 2020: Wouter 198368693Scy - Fix #341: fixing a possible memory leak. 199368693Scy - Fix memory leak after fix for possible memory leak failure. 200368693Scy - Fix #343: Fail to build --with-libnghttp2 with error: 'SSIZE_MAX' 201368693Scy undeclared. 202368693Scy 203368693Scy27 October 2020: Wouter 204368693Scy - In man page note that tls-cert-bundle is read before permission 205368693Scy drop and chroot. 206368693Scy 207368693Scy22 October 2020: Wouter 208368693Scy - Fix #333: Unbound Segmentation Fault w/ log_info Functions From 209368693Scy Python Mod. 210368693Scy - Fix that minimal-responses does not remove addresses from a priming 211368693Scy query response. 212368693Scy 213368693Scy21 October 2020: George 214368693Scy - Fix #327: net/if.h check fails on some darwin versions; contribution by 215368693Scy Joshua Root. 216368693Scy - Fix #320: potential memory corruption due to size miscomputation upton 217368693Scy custom region alloc init. 218368693Scy 219368693Scy21 October 2020: Wouter 220368693Scy - Merge PR #228 : infra-keep-probing option to probe hosts that are 221368693Scy down. Add infra-keep-probing: yes option. Hosts that are down are 222368693Scy probed more frequently. 223368693Scy With the option turned on, it probes about every 120 seconds, 224368693Scy eventually after exponential backoff, and that keeps that way. If 225368693Scy traffic keeps up for the domain. It probes with one at a time, eg. 226368693Scy one query is allowed to probe, other queries within that 120 second 227368693Scy interval are turned away. 228368693Scy 229368693Scy19 October 2020: George 230368693Scy - Merge PR #324 from James Renken: Add modern X.509v3 extensions to 231368693Scy unbound-control TLS certificates. 232368693Scy - Fix for PR #324 to attach the x509v3 extensions to the client 233368693Scy certificate. 234368693Scy 235368693Scy19 October 2020: Ralph 236368693Scy - local-zone regional allocations outside of chunk 237368693Scy 238368693Scy19 October 2020: Wouter 239368693Scy - Fix that http settings have colon in set_option, for 240368693Scy http-endpoint, http-max-streams, http-query-buffer-size, 241368693Scy http-response-buffer-size, and http-nodelay. 242368693Scy - Fix memory leak of https port string when reading config. 243368693Scy - Fix #330: [Feature request] Add unencrypted DNS over HTTPS support. 244368693Scy This adds the option http-notls-downstream: yesno to change that, 245368693Scy and the dohclient test code has the -n option. 246368693Scy - Fix python documentation warning on functions.rst inplace_cb_reply. 247368693Scy - Fix dnstap test to wait for log timer to see if queries are logged. 248368693Scy - Log ip address when http session recv fails, eg. due to tls fail. 249368693Scy - Fix to set the tcp handler event toggle flag back to default when 250368693Scy the handler structure is reused. 251368693Scy - Clean the fix for out of order TCP processing limits on number 252368693Scy of queries. It was tested to work. 253368693Scy 254368693Scy16 October 2020: Wouter 255368693Scy - Fix that the out of order TCP processing does not limit the 256368693Scy number of outstanding queries over a connection. 257368693Scy 258368693Scy15 October 2020: George 259368693Scy - Fix that if there are reply callbacks for the given rcode, those 260368693Scy are called per reply and a new message created if that was modified 261368693Scy by the call. 262368693Scy - Pass the comm_reply information to the inplace_cb_reply* functions 263368693Scy during the mesh state and update the documentation on that. 264368693Scy 265368693Scy15 October 2020: Wouter 266368693Scy - Merge PR #326 from netblue30: DoH: implement content-length 267368693Scy header field 268368693Scy - DoH content length, simplify code, remove declaration after 269368693Scy statement and fix cast warning. 270368693Scy 271368693Scy14 October 2020: Wouter 272368693Scy - Fix for python reply callback to see mesh state reply_list member, 273368693Scy it only removes it briefly for the commpoint call so that it does 274368693Scy not drop it and attempt to modify the reply list during reply. 275368693Scy - Fix that if there are on reply callbacks, those are called per 276368693Scy reply and a new message created if that was modified by the call. 277368693Scy - Free up auth zone parse region after use for lookup of host 278368693Scy 279368693Scy13 October 2020: Wouter 280368693Scy - Fix #323: unbound testsuite fails on mock build in systemd-nspawn 281368693Scy if systemd support is build. 282368693Scy 283368693Scy9 October 2020: Wouter 284368693Scy - Fix dnstap socket and the chroot not applied properly to the dnstap 285368693Scy socket path. 286368693Scy - Fix warning in libnss compile, nss_buf2dsa is not used without DSA. 287368693Scy 288368693Scy8 October 2020: Wouter 289368693Scy - Tag for 1.12.0 release. 290368693Scy - Current repo is version 1.12.1 in development. 291368693Scy - Fix #319: potential memory leak on config failure, in rpz config. 292368693Scy 293368129Scy1 October 2020: Wouter 294368129Scy - Current repo is version 1.12.0 for release. Tag for 1.12.0rc1. 295368129Scy 296368129Scy30 September 2020: Wouter 297368129Scy - Fix doh tests when not compiled in. 298368129Scy - Add dohclient test executable to gitignore. 299368129Scy - Fix stream_ssl, ssl_req_order and ssl_req_timeout tests for 300368129Scy alloc check debug output. 301368129Scy - Easier kill of unbound-dnstap-socket tool in test. 302368129Scy - Fix memory leak of edns tags at libunbound context delete. 303368129Scy - Fix double loopexit for unbound-dnstap-socket after sigterm. 304368129Scy 305368129Scy29 September 2020: Ralph 306368129Scy - DNS Flag Day 2020: change edns-buffer-size default to 1232. 307368129Scy 308368129Scy28 September 2020: Wouter 309368129Scy - Fix unit test for dnstap changes, so that it waits for the timer. 310368129Scy 311368129Scy23 September 2020: Wouter 312368129Scy - Fix #305: dnstap logging significantly affects unbound performance 313368129Scy (regression in 1.11). 314368129Scy - Fix #305: only wake up thread when threshold reached. 315368129Scy - Fix to ifdef fptr wlist item for dnstap. 316368129Scy 317368129Scy23 September 2020: Ralph 318368129Scy - Fix edns-client-tags get_option typo 319368129Scy - Add edns-client-tag-opcode option 320368129Scy - Use inclusive language in configuration 321368129Scy 322368129Scy21 September 2020: Ralph 323368129Scy - Fix #304: dnstap logging not recovering after dnstap process restarts 324368129Scy 325368129Scy21 September 2020: Wouter 326368129Scy - Merge PR #311 by luismerino: Dynlibmod leak. 327368129Scy - Error message is logged for dynlibmod malloc failures. 328368129Scy - iana portlist updated. 329368129Scy 330368129Scy18 September 2020: Wouter 331368129Scy - Fix that prefer-ip4 and prefer-ip6 can be get and set with 332368129Scy unbound-control, with libunbound and the unbound-checkconf option 333368129Scy output function. 334368129Scy - iana portlist updated. 335368129Scy 336368129Scy15 September 2020: George 337368129Scy - Introduce test for statistics. 338368129Scy 339368129Scy15 September 2020: Wouter 340368129Scy - Spelling fix. 341368129Scy 342368129Scy11 September 2020: Wouter 343368129Scy - Remove x file mode on ipset/ipset.c and h files. 344368129Scy 345368129Scy9 September 2020: Wouter 346368129Scy - Fix num.expired statistics output. 347368129Scy 348368129Scy31 August 2020: Wouter 349368129Scy - Merge PR #293: Add missing prototype. Also refactor to use the new 350368129Scy shorthand function to clean up the code. 351368129Scy - Refactor to use sock_strerr shorthand function. 352368129Scy - Fix #296: systemd nss-lookup.target is reached before unbound can 353368129Scy successfully answer queries. Changed contrib/unbound.service.in. 354368129Scy 355368129Scy27 August 2020: Wouter 356368129Scy - Similar to NSD PR#113, implement that interface names can be used, 357368129Scy eg. something like interface: eth0 is resolved at server start and 358368129Scy uses the IP addresses for that named interface. 359368129Scy - Review fix, doxygen and assign null in case of error free. 360368129Scy 361368129Scy26 August 2020: George 362368129Scy - Update documentation in python example code. 363368129Scy 364368129Scy24 August 2020: Wouter 365368129Scy - Fix that dnstap reconnects do not spam the log with the repeated 366368129Scy attempts. Attempts on the timer are only logged on high verbosity, 367368129Scy if they produce a connection failure error. 368368129Scy - Fix to apply chroot to dnstap-socket-path, if chroot is enabled. 369368129Scy - Change configure to use EVP_sha256 instead of HMAC_Update for 370368129Scy openssl-3.0.0. 371368129Scy 372368129Scy20 August 2020: Ralph 373368129Scy - Fix stats double count issue (#289). 374368129Scy 375368129Scy13 August 2020: Ralph 376368129Scy - Create and init edns tags data for libunbound. 377368129Scy 378368129Scy10 August 2020: Ralph 379368129Scy - Merge (modified) PR #277, use EVP_MAC_CTX_set_params if available, 380368129Scy by V��t��zslav ������ek. 381368129Scy 382368129Scy10 August 2020: Wouter 383368129Scy - Fix #287: doc typo: "Additionaly". 384368129Scy - Rerun autoconf 385368129Scy 386368129Scy6 August 2020: Wouter 387368129Scy - Merge PR #284 and Fix #246: Remove DLV entirely from Unbound. 388368129Scy The DLV has been decommisioned and in unbound 1.5.4, in 2015, there 389368129Scy was advise to stop using it. The current code base does not contain 390368129Scy DLV code any more. The use of dlv options displays a warning. 391368129Scy 392368129Scy5 August 2020: Wouter 393368129Scy - contrib/aaaa-filter-iterator.patch file renewed diff content to 394368129Scy apply cleanly to the current coderepo for the current code version. 395368129Scy 396368129Scy5 August 2020: Ralph 397368129Scy - Merge PR #272: Add EDNS client tag functionality. 398368129Scy 399368129Scy4 August 2020: George 400368129Scy - Improve error log message when inserting rpz RR. 401368129Scy - Merge PR #280, Make tvOS & watchOS checks verify truthiness as well as 402368129Scy definedness, by Felipe Gasper. 403368129Scy 404368129Scy4 August 2020: Wouter 405368129Scy - Fix mini_event.h on OpenBSD cannot find fd_set. 406368129Scy 407368129Scy31 July 2020: Wouter 408368129Scy - Fix doxygen comment for no ssl for tls session ticket key callback 409368129Scy routine. 410368129Scy 411368129Scy27 July 2020: George 412368129Scy - Merge PR #268, draft-ietf-dnsop-serve-stale-10 has become RFC 8767 on 413368129Scy March 2020, by and0x000. 414368129Scy 415368129Scy27 July 2020: Ralph 416368129Scy - Merge PR #269, Fix python module len() implementations, by Torbj��rn 417368129Scy L��nnemark 418368129Scy 419368129Scy27 July 2020: Wouter 420368129Scy - branch now named 1.11.1. 1.11.0rc1 became the 1.11.0 release. 421368129Scy - Merge PR #270 from cgzones: munin plugin: always exit 0 in autoconf 422368129Scy 423366095Scy20 July 2020: Wouter 424366095Scy - Fix streamtcp to print packet data to stdout. This makes the 425366095Scy stdout and stderr not mix together lines, when parsing its output. 426366095Scy - Fix contrib/fastrpz.patch to apply cleanly. It fixes for changes 427366095Scy due to added libdynmod, but it does not compile, it conflicts with 428366095Scy new rpz code. 429366095Scy - branch now named 1.11.0 and 1.11.0rc1 tag. 430366095Scy 431366095Scy17 July 2020: Wouter 432366095Scy - Fix libnettle compile for session ticket key callback function 433366095Scy changes. 434366095Scy - Fix lock dependency cycle in rpz zone config setup. 435366095Scy 436366095Scy17 July 2020: Ralph 437366095Scy - Merge PR #234 - Ensure proper alignment of cmsg buffers by J��r��mie 438366095Scy Courr��ges-Anglas. 439366095Scy - Fix PR #234 log_assert sizeof to use union buffer. 440366095Scy 441366095Scy16 July 2020: Wouter 442366095Scy - Fix check conf test for referencing installation paths. 443366095Scy - Fix unused variable warning for clang analyzer. 444366095Scy 445366095Scy16 July 2020: George 446366095Scy - Introduce 'include-toplevel:' configuration option. 447366095Scy 448366095Scy16 July 2020: Ralph 449366095Scy - Add bidirectional frame streams support. 450366095Scy 451366095Scy8 July 2020: Wouter 452366095Scy - Fix add missing DSA header, for compilation without deprecated 453366095Scy OpenSSL APIs. 454366095Scy - Fix to use SSL_CTX_set_tlsext_ticket_key_evp_cb in OpenSSL 455366095Scy 3.0.0-alpha4. 456366095Scy - Longer keys for the test set, this avoids weak crypto errors. 457366095Scy 458366095Scy7 July 2020: Wouter 459366095Scy - Fix #259: Fix unbound-checkconf does not check view existence. 460366095Scy unbound-checkconf checks access-control-view, access-control-tags, 461366095Scy access-control-tag-actions and access-control-tag-datas. 462366095Scy - Fix offset of error printout for access-control-tag-datas. 463366095Scy - Review fixes for checkconf #259 change. 464366095Scy 465366095Scy6 July 2020: Wouter 466366095Scy - run_vm cleanup better and removes trailing slash on single argument. 467366095Scy 468366095Scy29 June 2020: Wouter 469366095Scy - Move reply list clean for serve expired mesh callback to after 470366095Scy the reply is sent, so that script callbacks have reply_info. 471366095Scy - Also move reply list clean for mesh callbacks to the scrip callback 472366095Scy can see the reply_info. 473366095Scy - Fix for mesh accounting if the reply list already empty to begin 474366095Scy with. 475366095Scy - Fix for mesh accounting when rpz decides to drop a reply with a 476366095Scy tcp stream waiting for it. 477366095Scy - Review fix for number of detached states due to use of variable 478366095Scy after end of loop. 479366095Scy - Fix tcp req info drop due to size call into mesh accounting 480366095Scy removal of mesh state during mesh send reply. 481366095Scy 482366095Scy24 June 2020: Wouter 483366095Scy - iana portlist updated. 484366095Scy - doxygen file comments for dynlibmodule. 485366095Scy 486366095Scy17 June 2020: Wouter 487366095Scy - Fix default explanation in man page for qname-minimisation-strict. 488366095Scy - Fix display of event loop method with libev. 489366095Scy 490366095Scy8 June 2020: Wouter 491366095Scy - Mention tls name possible when tls is enabled for stub-addr in the 492366095Scy man page. 493366095Scy 494366095Scy27 May 2020: George 495366095Scy - Merge PR #241 by Robert Edmonds: contrib/libunbound.pc.in: Do not use 496366095Scy "Requires:". 497366095Scy 498366095Scy25 May 2020: George 499366095Scy - Update contrib/aaaa-filter-iterator.patch for the recent 500366095Scy generate_sub_request() change and to apply cleanly. 501366095Scy 502366095Scy21 May 2020: George 503366095Scy - Fix for integer overflow when printing RDF_TYPE_TIME. 504366095Scy 505366095Scy19 May 2020: Wouter 506366095Scy - CVE-2020-12662 Unbound can be tricked into amplifying an incoming 507366095Scy query into a large number of queries directed to a target. 508366095Scy - CVE-2020-12663 Malformed answers from upstream name servers can be 509366095Scy used to make Unbound unresponsive. 510366095Scy - Release 1.10.1 is 1.10.0 with fixes, code repository continues, 511366095Scy including those fixes, towards the next release. Configure has 512366095Scy version 1.10.2 version number in it. 513366095Scy - For PR #93: windows compile warnings removal 514366095Scy - windows compile warnings removal for ip dscp option code. 515366095Scy - For PR #93: unit test for dynlib module. 516366095Scy 517366095Scy18 May 2020: Wouter 518366095Scy - For PR #93: dynlibmod can handle reloads and deinit and inits again, 519366095Scy with dlclose and dlopen of the library again. Also for multiple 520366095Scy modules. Fix memory leak by not closing dlopened content. Fix 521366095Scy to allow one dynlibmod instance by unbound-checkconf. 522366095Scy - For PR #93: checkconf allows multiple dynlib in module-config, for 523366095Scy a couple cases. 524366095Scy - For PR #93: checkconf allows python dynlib in module-config, for 525366095Scy a couple cases. 526366095Scy - For PR #93: man page spelling reference fix. 527366095Scy - For PR #93: fix link of other executables for dynlibmod dependency. 528366095Scy 529366095Scy15 May 2020: Wouter 530366095Scy - Merge PR #93: Add dynamic library support. 531366095Scy - Fixed conflicts for PR #93 and make configure, yacc, lex. 532366095Scy - For PR #93: Fix warnings for dynlibmodule. 533366095Scy 534366095Scy15 May 2020: Ralph 535366095Scy - Cache ECS answers with longest scope of CNAME chain. 536366095Scy 537366095Scy22 April 2020: George 538366095Scy - Explicitly use 'rrset-roundrobin: no' for test cases. 539366095Scy 540366095Scy21 April 2020: Wouter 541366095Scy - Merge #225 from akhait: KSK-2010 has been revoked. It removes the 542366095Scy KSK-2010 from the default list in unbound-anchor, now that the 543366095Scy revocation period is over. KSK-2017 is the only trust anchor in 544366095Scy the shipped default now. 545366095Scy 546366095Scy21 April 2020: George 547366095Scy - Change default value for 'rrset-roundrobin' to yes. 548366095Scy - Fix tests for new rrset-roundrobin default. 549366095Scy 550366095Scy20 April 2020: Wouter 551366095Scy - Fix #222: --enable-rpath, fails to rpath python lib. 552366095Scy - Fix for count of reply states in the mesh. 553366095Scy - Remove unneeded was_mesh_reply check. 554366095Scy 555366095Scy17 April 2020: George 556366095Scy - Add SNI support on more TLS connections (fixes #193). 557366095Scy - Add SNI support to unbound-anchor. 558366095Scy 559366095Scy16 April 2020: George 560366095Scy - Add doxygen documentation for DSCP. 561366095Scy 562366095Scy16 April 2020: Wouter 563366095Scy - Fix help return code in unbound-control-setup script. 564366095Scy - Fix for posix shell syntax for trap in nsd-control-setup. 565366095Scy - Fix for posix shell syntax for trap in run_msg.sh test script. 566366095Scy 567366095Scy15 April 2020: George 568366095Scy - Fix #220: auth-zone section in config may lead to segfault. 569366095Scy 570366095Scy7 April 2020: Wouter 571366095Scy - Merge PR #214 from gearnode: unbound-control-setup recreate 572366095Scy certificates. With the -r option the certificates are created 573366095Scy again, without it, only the files that do not exist are created. 574366095Scy 575366095Scy6 April 2020: Ralph 576366095Scy - Keep track of number of timeouts. Use this counter to determine if 577366095Scy capsforid fallback should be started. 578366095Scy 579366095Scy6 April 2020: George 580366095Scy - More documentation for redis-expire-records option. 581366095Scy 582366095Scy1 April 2020: George 583366095Scy - Merge PR #206: Redis TTL, by Talkabout. 584366095Scy 585366095Scy30 March 2020: Wouter 586366095Scy - Merge PR #207: Clarify if-automatic listens on 0.0.0.0 and :: 587366095Scy - Merge PR #208: Fix uncached CLIENT_RESPONSE'es on stateful 588366095Scy transports. 589366095Scy 590366095Scy27 March 2020: Wouter 591366095Scy - Merge PR #203 from noloader: Update README-Travis.md with current 592366095Scy procedures. 593366095Scy 594366095Scy27 March 2020: Ralph 595366095Scy - Make unbound-control error returned on missing domain name more user 596366095Scy friendly. 597366095Scy 598366095Scy26 March 2020: Ralph 599366095Scy - Fix RPZ concurrency issue when using auth_zone_reload. 600366095Scy 601366095Scy25 March 2020: George 602366095Scy - Merge PR #201 from noloader: Fix OpenSSL cross-compaile warnings. 603366095Scy - Fix on #201. 604366095Scy 605366095Scy24 March 2020: Wouter 606366095Scy - Merge PR #200 from yarikk: add ip-dscp option to specify the DSCP 607366095Scy tag for outgoing packets. 608366095Scy - Fixes on #200. 609366095Scy - Travis fix for ios by omitting tools from install. 610366095Scy 611366095Scy23 March 2020: Wouter 612366095Scy - Fix compile on Solaris for unbound-checkconf. 613366095Scy 614366095Scy20 March 2020: George 615366095Scy - Merge PR #198 from fobser: Declare lz_enter_rr_into_zone() static, it's 616366095Scy only used in this file. 617366095Scy 618366095Scy20 March 2020: Wouter 619366095Scy - Merge PR #197 from fobser: Make log_ident_revert_to_default() a 620366095Scy proper prototype. 621366095Scy 622366095Scy19 March 2020: Ralph 623366095Scy - Merge PR#191: Update iOS testing on Travis, by Jeffrey Walton. 624366095Scy - Fix #158: open tls-session-ticket-keys as binary, for Windows. By 625366095Scy Daisuke HIGASHI. 626366095Scy - Merge PR#134, Allow the kernel to provide random source ports. By 627366095Scy Florian Obser. 628366095Scy - Log warning when using outgoing-port-permit and outgoing-port-avoid 629366095Scy while explicit port randomisation is disabled. 630366095Scy - Merge PR#194: Add libevent testing to Travis, by Jeffrey Walton. 631366095Scy - Fix .travis.yml error, missing 'env' option. 632366095Scy 633366095Scy16 March 2020: Wouter 634366095Scy - Fix #192: In the unbound-checkconf tool, the module config of 635366095Scy dns64 subnetcache respip validator iterator is whitelisted, it was 636366095Scy reported it seems to work. 637366095Scy 638366095Scy12 March 2020: Wouter 639366095Scy - Fix compile of test tools without protobuf. 640366095Scy 641366095Scy11 March 2020: Ralph 642366095Scy - Add check to make sure RPZ records are subdomains of configured 643366095Scy zone origin. 644366095Scy 645366095Scy11 March 2020: George 646366095Scy - Fix #189: mini_event.h:142:17: error: field 'ev_timeout' has incomplete 647366095Scy type, by noloader. 648366095Scy - Changelog entry for (Fix #189, Merge PR #190). 649366095Scy 650366095Scy11 March 2020: Wouter 651366095Scy - Fix #188: unbound-control.c:882:6: error: 'execlp' is 652366095Scy unavailable: not available on tvOS. 653366095Scy 654366095Scy6 March 2020: George 655366095Scy - Merge PR #186, fix #183: Fix unrecognized 'echo -n' option on OS X, by 656366095Scy noloader 657366095Scy 658366095Scy5 March 2020: Wouter 659366095Scy - Fix PR #182 from noloader: Add iOS testing to Travis. 660366095Scy 661366095Scy4 March 2020: Ralph 662366095Scy - Update README-Travis.md (from PR #179), by Jeffrey Walton. 663366095Scy 664366095Scy4 March 2020: George 665366095Scy - Merge PR #181 from noloader: Fix OpenSSL -pie warning on Android. 666366095Scy 667366095Scy4 March 2020: Wouter 668366095Scy - Merge PR #180 from noloader: Avoid calling exit in Travis script. 669366095Scy 670366095Scy3 March 2020: George 671366095Scy - Upgrade config.guess(2020-01-01) and config.sub(2020-01-01). 672366095Scy 673366095Scy2 March 2020: Ralph 674366095Scy - Fix #175, Merge PR #176: fix link error when OpenSSL is configured 675366095Scy with no-engine, thanks noloader. 676366095Scy 677366095Scy2 March 2020: George 678366095Scy - Fix compiler warning in dns64/dns64.c 679366095Scy - Merge PR #174: Add Android to Travis testing, by noloader. 680366095Scy - Move android build scripts to contrib/ and allow android tests to fail. 681366095Scy 682366095Scy2 March 2020: Wouter 683366095Scy - Fix #177: dnstap does not build on macOS. 684366095Scy 685366095Scy28 February 2020: Ralph 686366095Scy - Merge PR #172: Add IBM s390x arch for testing, by noloader. 687366095Scy 688366095Scy28 February 2020: Wouter 689366095Scy - Merge PR #173: updated makedist.sh for config.guess and 690366095Scy config.sub and sha256 digest for gpg, by noloader. 691366095Scy - Merge PR #164: Framestreams, this branch implements dnstap 692366095Scy unidirectional connectivity in unbound. This has a number of 693366095Scy new features. 694366095Scy 695366095Scy The dependency on libfstrm is removed. The fstrm protocol code 696366095Scy resides in dnstap/dnstap_fstrm.h and dnstap/dnstap_fstrm.c. This 697366095Scy contains a brief definition of what unbound needs. 698366095Scy 699366095Scy The make unbound-dnstap-socket builds a debug tool, 700366095Scy unbound-dnstap-socket. It can listen, accept multiple DNSTAP 701366095Scy streams and print information. Commandline options control it. 702366095Scy 703366095Scy Unbound can reconnect if the unix domain socket file socket is 704366095Scy closed. This uses exponential backoff after which it uses a 705366095Scy one second timer to throttle cpu down. There is also support 706366095Scy to use TCP and TLS for connecting to the log server. There 707366095Scy are new config options to turn them on, in the dnstap section 708366095Scy in the man page and example config file. dnstap-ip with IP 709366095Scy address of server for TCP or TLS use. dnstap-tls to turn 710366095Scy on TLS. And dnstap-tls-server-name, dnstap-tls-cert-bundle, 711366095Scy dnstap-tls-client-key-file and dnstap-tls-client-cert-file 712366095Scy to configure the certificates for server authentication and 713366095Scy client authentication, or leave at "" to not use that. 714366095Scy 715366095Scy27 February 2020: George 716366095Scy - Merge PR #171: Add additional compilers and platforms to Travis 717366095Scy testing, by noloader. 718366095Scy 719366095Scy27 February 2020: Wouter 720366095Scy - Fix #169: Fix warning for daemon/remote.c output may be truncated 721366095Scy from snprintf. 722366095Scy - Fix #170: Fix gcc undefined sanitizer signed integer overflow 723366095Scy warning in signature expiry RFC1982 serial number arithmetic. 724366095Scy - Fix more undefined sanitizer issues, in respip copy_rrset null 725366095Scy dname, and in the client_info_compare routine for null memcmp. 726366095Scy 727366095Scy26 February 2020: Wouter 728366095Scy - iana portlist updated. 729366095Scy 730366095Scy25 February 2020: Wouter 731366095Scy - Fix #165: Add prefer-ip4: yesno config option to prefer ipv4 for 732366095Scy using ipv4 filters, because the hosts ip6 netblock /64 is not owned 733366095Scy by one operator, and thus reputation is shared. 734366095Scy 735366095Scy24 February 2020: George 736366095Scy - Merge PR #166: Fix typo in unbound.service.in, by glitsj16. 737366095Scy 738361435Scy20 February 2020: Wouter 739361435Scy - Updated contrib/unbound_smf23.tar.gz with Solaris SMF service for 740361435Scy Unbound from Yuri Voinov. 741366095Scy - master branch has 1.10.1 version. 742361435Scy 743366095Scy18 February 2020: Wouter 744366095Scy - protect X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS with ifdef for 745366095Scy different openssl versions. 746366095Scy 747366095Scy17 February 2020: Wouter 748366095Scy - changelog point where the tag for 1.10.0rc2 release is. And with 749366095Scy the unbound_smf23 commit added to it, that is the 1.10.0 release. 750366095Scy 751361435Scy17 February 2020: Ralph 752361435Scy - Add respip to supported module-config options in unbound-checkconf. 753361435Scy 754361435Scy17 February 2020: George 755361435Scy - Remove unused variable. 756361435Scy 757361435Scy17 February 2020: Wouter 758361435Scy - contrib/drop2rpz: perl script that converts the Spamhaus DROP-List 759361435Scy in RPZ-Format, contributed by Andreas Schulze. 760361435Scy 761361435Scy14 February 2020: Wouter 762361435Scy - Fix spelling in unbound.conf.5.in. 763361435Scy - Stop unbound-checkconf from insisting that auth-zone and rpz 764361435Scy zonefiles have to exist. They can not exist, and download later. 765361435Scy 766361435Scy13 February 2020: Wouter 767361435Scy - tag for 1.10.0rc1 release. 768361435Scy 769361435Scy12 February 2020: Wouter 770361435Scy - Fix with libnettle make test with dsa disabled. 771361435Scy - Fix contrib/fastrpz.patch to apply cleanly. Fix for serve-stale 772361435Scy fixes, but it does not compile, conflicts with new rpz code. 773361435Scy - Fix to clean memory leak of respip_addr.lock when ip_tree deleted. 774361435Scy - Fix compile warning when threads disabled. 775361435Scy - updated version number to 1.10.0. 776361435Scy 777361435Scy10 February 2020: George 778361435Scy - Document 'ub_result.was_ratelimited' in libunbound. 779361435Scy - Fix use after free on log-identity after a reload; Fixes #163. 780361435Scy 781361435Scy6 February 2020: George 782361435Scy - Fix num_reply_states and num_detached_states counting with 783361435Scy serve_expired_callback. 784361435Scy - Cleaner code in mesh_serve_expired_lookup. 785361435Scy - Document in unbound.conf manpage that configuration clauses can be 786361435Scy repeated in the configuration file. 787361435Scy 788361435Scy6 February 2020: Wouter 789361435Scy - Fix num_reply_addr counting in mesh and tcp drop due to size 790361435Scy after serve_stale commit. 791361435Scy - Fix to create and destroy rpz_lock in auth_zones structure. 792361435Scy - Fix to lock zone before adding rpz qname trigger. 793361435Scy - Fix to lock and release once in mesh_serve_expired_lookup. 794361435Scy - Fix to put braces around empty if body when threading is disabled. 795361435Scy 796361435Scy5 February 2020: George 797361435Scy - Added serve-stale functionality as described in 798361435Scy draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used 799361435Scy to configure the behavior. 800361435Scy - Updated cachedb to honor `serve-expired-ttl`; Fixes #107. 801361435Scy - Renamed statistic `num.zero_ttl` to `num.expired` as expired replies 802361435Scy come with a configurable TTL value (`serve-expired-reply-ttl`). 803361435Scy - Fixed stats when replying with cached, cname-aliased records. 804361435Scy - Added missing default values for redis cachedb backend. 805361435Scy 806361435Scy3 February 2020: Ralph 807361435Scy - Add assertion to please static analyzer 808361435Scy 809361435Scy31 January 2020: Wouter 810361435Scy - Fix fclose on error in TLS session ticket code. 811361435Scy 812361435Scy30 January 2020: Ralph 813361435Scy - Fix memory leak in error condition remote.c 814361435Scy - Fix double free in error condition view.c 815361435Scy - Fix memory leak in do_auth_zone_transfer on success 816361435Scy - Merge RPZ support into master. Only QNAME and Response IP triggers are 817361435Scy supported. 818361435Scy - Stop working on socket when socket() call returns an error. 819361435Scy - Check malloc return values in TLS session ticket code 820361435Scy 821361435Scy30 January 2020: Wouter 822361435Scy - Fix subnet tests for disabled DSA algorithm by default. 823361435Scy - Update contrib/fastrpz.patch for clean diff with current code. 824361435Scy - Merge PR#151: Fixes for systemd units, by Maryse47, Edmonds 825361435Scy and Frzk. Updates the unbound.service systemd file and adds 826361435Scy a portable systemd service file. 827361435Scy - updated .gitignore for added contrib file. 828361435Scy - Add build rule for ipset to Makefile 829361435Scy - Add getentropy_freebsd.o to Makefile dependencies. 830361435Scy 831361435Scy29 January 2020: Ralph 832361435Scy - Merge PR#156 from Alexander Berkes; Added unbound-control 833361435Scy view_local_datas_remove command. 834361435Scy 835361435Scy29 January 2020: Wouter 836361435Scy - Fix #157: undefined reference to `htobe64'. 837361435Scy 838361435Scy28 January 2020: Ralph 839361435Scy - Merge PR#147; change rfc reference for reserved top level dns names. 840361435Scy 841361435Scy28 January 2020: Wouter 842361435Scy - iana portlist updated. 843361435Scy - Fix to silence the tls handshake errors for broken pipe and reset 844361435Scy by peer, unless verbosity is set to 2 or higher. 845361435Scy 846361435Scy27 January 2020: Ralph 847361435Scy - Merge PR#154; Allow use of libbsd functions with configure option 848361435Scy --with-libbsd. By Robert Edmonds and Steven Chamberlain. 849361435Scy - Merge PR#148; Add some TLS stats to unbound_munin_. By Fredrik Pettai. 850361435Scy 851361435Scy27 January 2020: Wouter 852361435Scy - Merge PR#155 from Robert Edmonds: contrib/libunbound.pc.in: Fixes 853361435Scy to Libs/Requires for crypto library dependencies. 854361435Scy - Fix #153: Disable validation for DSA algorithms. RFC 8624 855361435Scy compliance. 856361435Scy 857361435Scy23 January 2020: Wouter 858361435Scy - Merge PR#150 from Frzk: Systemd unit without chroot. It add 859361435Scy contrib/unbound_nochroot.service.in, a systemd file for use with 860361435Scy chroot: "", see comments in the file, it uses systemd protections 861361435Scy instead. 862361435Scy 863361435Scy14 January 2020: Wouter 864361435Scy - Removed the dnscrypt_queries and dnscrypt_queries_chacha tests, 865361435Scy because dnscrypt-proxy (2.0.36) does not support the test setup 866361435Scy any more, and also the config file format does not seem to have 867361435Scy the appropriate keys to recreate that setup. 868361435Scy - Fix crash after reload where a stats lookup could reference old key 869361435Scy cache and neg cache structures. 870361435Scy - Fix for memory leak when edns subnet config options are read when 871361435Scy compiled without edns subnet support. 872361435Scy - Fix auth zone support for NSEC3 records without salt. 873361435Scy 874361435Scy10 January 2020: Wouter 875361435Scy - Fix the relationship between serve-expired and prefetch options, 876361435Scy patch from Saksham Manchanda from Secure64. 877361435Scy - Fix unreachable code in ssl set options code. 878361435Scy 879361435Scy8 January 2020: Ralph 880361435Scy - Fix #138: stop binding pidfile inside chroot dir in systemd service 881361435Scy file. 882361435Scy 883361435Scy8 January 2020: Wouter 884361435Scy - Fix 'make test' to work for --disable-sha1 configure option. 885361435Scy - Fix out-of-bounds null-byte write in sldns_bget_token_par while 886361435Scy parsing type WKS, reported by Luis Merino from X41 D-Sec. 887361435Scy - Updated sldns_bget_token_par fix for also space for the zero 888361435Scy delimiter after the character. And update for more spare space. 889361435Scy 890361435Scy6 January 2020: George 891361435Scy - Downgrade compat/getentropy_solaris.c to version 1.4 from OpenBSD. 892361435Scy The dl_iterate_phdr() function introduced in newer versions raises 893361435Scy compilation errors on solaris 10. 894361435Scy - Changes to compat/getentropy_solaris.c for, 895361435Scy ifdef stdint.h inclusion for older systems. 896361435Scy ifdef sha2.h inclusion for older systems. 897361435Scy 898361435Scy6 January 2020: Wouter 899361435Scy - Merge #135 from Florian Obser: Use passed in neg and key cache 900361435Scy if non-NULL. 901361435Scy - Fix #140: Document slave not downloading new zonefile upon update. 902361435Scy 903361435Scy16 December 2019: George 904361435Scy - Update mailing list URL. 905361435Scy 906361435Scy12 December 2019: Ralph 907361435Scy - Master is 1.9.7 in development. 908361435Scy - Fix typo to let serve-expired-ttl work with ub_ctx_set_option(), by 909361435Scy Florian Obser 910361435Scy 911361435Scy10 December 2019: Wouter 912361435Scy - Fix to make auth zone IXFR to fallback to AXFR if a single 913361435Scy response RR is received over TCP with the SOA in it. 914361435Scy 915356345Scy6 December 2019: Wouter 916356345Scy - Fix ipsecmod compile. 917356345Scy - Fix Makefile.in for ipset module compile, from Adi Prasaja. 918361435Scy - release-1.9.6 tag, which became the 1.9.6 release 919356345Scy 920356345Scy5 December 2019: Wouter 921356345Scy - unbound-fuzzers.tar.bz2: three programs for fuzzing, that are 1:1 922356345Scy replacements for unbound-fuzzme.c that gets created after applying 923356345Scy the contrib/unbound-fuzzme.patch. They are contributed by 924356345Scy Eric Sesterhenn from X41 D-Sec. 925356345Scy - tag for 1.9.6rc1. 926356345Scy 927356345Scy4 December 2019: Wouter 928356345Scy - Fix lock type for memory purify log lock deletion. 929356345Scy - Fix testbound for alloccheck runs, memory purify and lock checks. 930356345Scy - update contrib/fastrpz.patch to apply more cleanly. 931356345Scy - Fix Make Test Fails when Configured With --enable-alloc-nonregional, 932356345Scy reported by X41 D-Sec. 933356345Scy 934356345Scy3 December 2019: Wouter 935356345Scy - Merge pull request #124 from rmetrich: Changed log lock 936356345Scy from 'quick' to 'basic' because this is an I/O lock. 937356345Scy - Fix text around serial arithmatic used for RRSIG times to refer 938356345Scy to correct RFC number. 939356345Scy - Fix Assert Causing DoS in synth_cname(), 940356345Scy reported by X41 D-Sec. 941356345Scy - Fix similar code in auth_zone synth cname to add the extra checks. 942356345Scy - Fix Assert Causing DoS in dname_pkt_copy(), 943356345Scy reported by X41 D-Sec. 944356345Scy - Fix OOB Read in sldns_wire2str_dname_scan(), 945356345Scy reported by X41 D-Sec. 946356345Scy - Fix Out of Bounds Write in sldns_str2wire_str_buf(), 947356345Scy reported by X41 D-Sec. 948356345Scy - Fix Out of Bounds Write in sldns_b64_pton(), 949356345Scy fixed by check in sldns_str2wire_int16_data_buf(), 950356345Scy reported by X41 D-Sec. 951356345Scy - Fix Insufficient Handling of Compressed Names in dname_pkt_copy(), 952356345Scy reported by X41 D-Sec. 953356345Scy - Fix Out of Bound Write Compressed Names in rdata_copy(), 954356345Scy reported by X41 D-Sec. 955356345Scy - Fix Hang in sldns_wire2str_pkt_scan(), 956356345Scy reported by X41 D-Sec. 957356345Scy This further lowers the max to 256. 958356345Scy - Fix snprintf() supports the n-specifier, 959356345Scy reported by X41 D-Sec. 960356345Scy - Fix Bad Indentation, in dnscrypt.c, 961356345Scy reported by X41 D-Sec. 962356345Scy - Fix Client NONCE Generation used for Server NONCE, 963356345Scy reported by X41 D-Sec. 964356345Scy - Fix compile error in dnscrypt. 965356345Scy - Fix _vfixed not Used, removed from sbuffer code, 966356345Scy reported by X41 D-Sec. 967356345Scy - Fix Hardcoded Constant, reported by X41 D-Sec. 968356345Scy - make depend 969356345Scy 970356345Scy2 December 2019: Wouter 971356345Scy - Merge pull request #122 from he32: In tcp_callback_writer(), 972356345Scy don't disable time-out when changing to read. 973356345Scy 974356345Scy22 November 2019: George 975356345Scy - Fix compiler warnings. 976356345Scy 977356345Scy22 November 2019: Wouter 978356345Scy - Fix dname loop maximum, reported by Eric Sesterhenn from X41 D-Sec. 979356345Scy - Add make distclean that removes everything configure produced, 980356345Scy and make maintainer-clean that removes bison and flex output. 981356345Scy 982356345Scy20 November 2019: Wouter 983356345Scy - Fix Out of Bounds Read in rrinternal_get_owner(), 984356345Scy reported by X41 D-Sec. 985356345Scy - Fix Race Condition in autr_tp_create(), 986356345Scy reported by X41 D-Sec. 987356345Scy - Fix Shared Memory World Writeable, 988356345Scy reported by X41 D-Sec. 989356345Scy - Adjust unbound-control to make stats_shm a read only operation. 990356345Scy - Fix Weak Entropy Used For Nettle, 991356345Scy reported by X41 D-Sec. 992356345Scy - Fix Randomness Error not Handled Properly, 993356345Scy reported by X41 D-Sec. 994356345Scy - Fix Out-of-Bounds Read in dname_valid(), 995356345Scy reported by X41 D-Sec. 996356345Scy - Fix Config Injection in create_unbound_ad_servers.sh, 997356345Scy reported by X41 D-Sec. 998356345Scy - Fix Local Memory Leak in cachedb_init(), 999356345Scy reported by X41 D-Sec. 1000356345Scy - Fix Integer Underflow in Regional Allocator, 1001356345Scy reported by X41 D-Sec. 1002356345Scy - Upgrade compat/getentropy_linux.c to version 1.46 from OpenBSD. 1003356345Scy - Synchronize compat/getentropy_win.c with version 1.5 from 1004356345Scy OpenBSD, no changes but makes the file, comments, identical. 1005356345Scy - Upgrade compat/getentropy_solaris.c to version 1.13 from OpenBSD. 1006356345Scy - Upgrade compat/getentropy_osx.c to version 1.12 from OpenBSD. 1007356345Scy - Changes to compat/getentropy files for, 1008356345Scy no link to openssl if using nettle, and hence config.h for 1009356345Scy HAVE_NETTLE variable. 1010356345Scy compat definition of MAP_ANON, for older systems. 1011356345Scy ifdef stdint.h inclusion for older systems. 1012356345Scy ifdef sha2.h inclusion for older systems. 1013356345Scy - Fixed Compat Code Diverging from Upstream, reported by X41 D-Sec. 1014356345Scy - Fix compile with --enable-alloc-checks, reported by X41 D-Sec. 1015356345Scy - Fix Terminating Quotes not Written, reported by X41 D-Sec. 1016356345Scy - Fix Useless memset() in validator, reported by X41 D-Sec. 1017356345Scy - Fix Unrequired Checks, reported by X41 D-Sec. 1018356345Scy - Fix Enum Name not Used, reported by X41 D-Sec. 1019356345Scy - Fix NULL Pointer Dereference via Control Port, 1020356345Scy reported by X41 D-Sec. 1021356345Scy - Fix Bad Randomness in Seed, reported by X41 D-Sec. 1022356345Scy - Fix python examples/calc.py for eval, reported by X41 D-Sec. 1023356345Scy - Fix comments for doxygen in dns64. 1024356345Scy 1025356345Scy19 November 2019: Wouter 1026356345Scy - Fix CVE-2019-18934, shell execution in ipsecmod. 1027356345Scy - 1.9.5 is 1.9.4 with bugfix, trunk is 1.9.6 in development. 1028356345Scy - Fix authzone printout buffer length check. 1029356345Scy - Fixes to please lint checks. 1030356345Scy - Fix Integer Overflow in Regional Allocator, 1031356345Scy reported by X41 D-Sec. 1032356345Scy - Fix Unchecked NULL Pointer in dns64_inform_super() 1033356345Scy and ipsecmod_new(), reported by X41 D-Sec. 1034356345Scy - Fix Out-of-bounds Read in rr_comment_dnskey(), 1035356345Scy reported by X41 D-Sec. 1036356345Scy - Fix Integer Overflows in Size Calculations, 1037356345Scy reported by X41 D-Sec. 1038356345Scy - Fix Integer Overflow to Buffer Overflow in 1039356345Scy sldns_str2wire_dname_buf_origin(), reported by X41 D-Sec. 1040356345Scy - Fix Out of Bounds Read in sldns_str2wire_dname(), 1041356345Scy reported by X41 D-Sec. 1042356345Scy - Fix Out of Bounds Write in sldns_bget_token_par(), 1043356345Scy reported by X41 D-Sec. 1044356345Scy 1045356345Scy18 November 2019: Wouter 1046356345Scy - In unbound-host use separate variable for get_option to please 1047356345Scy code checkers. 1048356345Scy - update to bison output of 3.4.1 in code repository. 1049356345Scy - Provide a prototype for compat malloc to remove compile warning. 1050356345Scy - Portable grep usage for reuseport configure test. 1051356345Scy - Check return type of HMAC_Init_ex for openssl 0.9.8. 1052356345Scy - gitignore .source tempfile used for compatible make. 1053356345Scy 1054356345Scy13 November 2019: Wouter 1055356345Scy - iana portlist updated. 1056356345Scy - contrib/fastrpz.patch updated to apply for current code. 1057356345Scy - fixes for splint cleanliness, long vs int in SSL set_mode. 1058356345Scy 1059356345Scy11 November 2019: Wouter 1060356345Scy - Fix #109: check number of arguments for stdin-pipes in 1061356345Scy unbound-control and fail if too many arguments. 1062356345Scy - Merge #102 from jrtc27: Add getentropy emulation for FreeBSD. 1063356345Scy 1064356345Scy24 October 2019: Wouter 1065356345Scy - Fix #99: Memory leak in ub_ctx (event_base will never be freed). 1066356345Scy 1067356345Scy23 October 2019: George 1068356345Scy - Add new configure option `--enable-fully-static` to enable full static 1069356345Scy build if requested; in relation to #91. 1070356345Scy 1071356345Scy23 October 2019: Wouter 1072356345Scy - Merge #97: manpage: Add missing word on unbound.conf, 1073356345Scy from Erethon. 1074356345Scy 1075356345Scy22 October 2019: Wouter 1076356345Scy - drop-tld.diff: adds option drop-tld: yesno that drops 2 label 1077356345Scy queries, to stop random floods. Apply with 1078356345Scy patch -p1 < contrib/drop-tld.diff and compile. 1079356345Scy From Saksham Manchanda (Secure64). Please note that we think this 1080356345Scy will drop DNSKEY and DS lookups for tlds and hence break DNSSEC 1081356345Scy lookups for downstream clients. 1082356345Scy 1083356345Scy7 October 2019: Wouter 1084356345Scy - Add doxygen comments to unbound-anchor source address code, in #86. 1085356345Scy 1086356345Scy3 October 2019: Wouter 1087356345Scy - Merge #90 from vcunat: fix build with nettle-3.5. 1088356345Scy - Merge 1.9.4 release with fix for vulnerability CVE-2019-16866. 1089356345Scy - Continue with development of 1.9.5. 1090356345Scy - Merge #86 from psquarejho: Added -b source address option to 1091356345Scy smallapp/unbound-anchor.c, from Lukas Wunner. 1092356345Scy 1093356345Scy26 September 2019: Wouter 1094356345Scy - Merge #87 from hardfalcon: Fix contrib/unbound.service.in, 1095356345Scy Drop CAP_KILL, use + prefix for ExecReload= instead. 1096356345Scy 1097356345Scy25 September 2019: Wouter 1098356345Scy - The unbound.conf includes are sorted ascending, for include 1099356345Scy statements with a '*' from glob. 1100356345Scy 1101356345Scy23 September 2019: Wouter 1102356345Scy - Merge #85 for #84 from sam-lunt: Add kill capability to systemd 1103356345Scy service file to fix that systemctl reload fails. 1104356345Scy 1105356345Scy20 September 2019: Wouter 1106356345Scy - Merge #82 from hardfalcon: Downgrade CAP_NET_ADMIN to CAP_NET_RAW 1107356345Scy in unbound.service. 1108356345Scy - Merge #81 from Maryse47: Consistently use /dev/urandom instead 1109356345Scy of /dev/random in scripts and docs. 1110356345Scy - Merge #83 from Maryse47: contrib/unbound.service.in: do not fork 1111356345Scy into the background. 1112356345Scy 1113356345Scy19 September 2019: Wouter 1114356345Scy - Fix #78: Memory leak in outside_network.c. 1115356345Scy - Merge pull request #76 from Maryse47: Improvements and fixes for 1116356345Scy systemd unbound.service. 1117356345Scy - oss-fuzz badge on README.md. 1118356345Scy - Fix fix for #78 to also free service callback struct. 1119356345Scy - Fix for oss-fuzz build warning. 1120356345Scy - Fix wrong response ttl for prepended short CNAME ttls, this would 1121356345Scy create a wrong zero_ttl response count with serve-expired enabled. 1122356345Scy - Merge #80 from stasic: Improve wording in man page. 1123356345Scy 1124356345Scy11 September 2019: Wouter 1125356345Scy - Use explicit bzero for wiping clear buffer of hash in cachedb, 1126356345Scy reported by Eric Sesterhenn from X41 D-Sec. 1127356345Scy 1128356345Scy9 September 2019: Wouter 1129356345Scy - Fix #72: configure --with-syslog-facility=LOCAL0-7 with default 1130356345Scy LOG_DAEMON (as before) can set the syslog facility that the server 1131356345Scy uses to log messages. 1132356345Scy 1133356345Scy4 September 2019: Wouter 1134356345Scy - Fix #71: fix openssl error squelch commit compilation error. 1135356345Scy 1136356345Scy3 September 2019: Wouter 1137356345Scy - squelch DNS over TLS errors 'ssl handshake failed crypto error' 1138356345Scy on low verbosity, they show on verbosity 3 (query details), because 1139356345Scy there is a high volume and the operator cannot do anything for the 1140356345Scy remote failure. Specifically filters the high volume errors. 1141356345Scy 1142356345Scy2 September 2019: Wouter 1143356345Scy - ipset module #28: log that an address is added, when verbosity high. 1144356345Scy - ipset: refactor long routine into three smaller ones. 1145356345Scy - updated Makefile dependencies. 1146356345Scy 1147356345Scy23 August 2019: Wouter 1148356345Scy - Fix contrib/fastrpz.patch asprintf return value checks. 1149356345Scy 1150356345Scy22 August 2019: Wouter 1151356345Scy - Fix that pkg-config is setup before --enable-systemd needs it. 1152356345Scy - 1.9.3rc2 release candidate tag. And this became the 1.9.3 release. 1153356345Scy Master is 1.9.4 in development. 1154356345Scy 1155356345Scy21 August 2019: Wouter 1156356345Scy - Fix log_dns_msg to log irrespective of minimal responses config. 1157356345Scy 1158356345Scy19 August 2019: Ralph 1159356345Scy - Document limitation of pidfile removal outside of chroot directory. 1160356345Scy 1161356345Scy16 August 2019: Wouter 1162356345Scy - Fix unittest valgrind false positive uninitialised value report, 1163356345Scy where if gcc 9.1.1 uses -O2 (but not -O1) then valgrind 3.15.0 1164356345Scy issues an uninitialised value for the token buffer at the str2wire.c 1165356345Scy rrinternal_get_owner() strcmp with the '@' value. Rewritten to use 1166356345Scy straight character comparisons removes the false positive. Also 1167356345Scy valgrinds --expensive-definedness-checks=yes can stop this false 1168356345Scy positive. 1169356345Scy - Please doxygen's parser for "@" occurrence in doxygen comment. 1170356345Scy - Fixup contrib/fastrpz.patch 1171356345Scy - Remove warning about unknown cast-function-type warning pragma. 1172356345Scy 1173356345Scy15 August 2019: Wouter 1174356345Scy - iana portlist updated. 1175356345Scy - Fix autotrust temp file uniqueness windows compile. 1176356345Scy - avoid warning about upcast on 32bit systems for autotrust. 1177356345Scy - escape commandline contents for -V. 1178356345Scy - Fix character buffer size in ub_ctx_hosts. 1179356345Scy - 1.9.3rc1 release candidate tag. 1180356345Scy - Option -V prints if TCP fastopen is available. 1181356345Scy 1182356345Scy14 August 2019: George 1183356345Scy - Fix #59, when compiled with systemd support check that we can properly 1184356345Scy communicate with systemd through the `NOTIFY_SOCKET`. 1185356345Scy 1186356345Scy14 August 2019: Wouter 1187356345Scy - Generate configlexer with newer flex. 1188356345Scy - Fix warning for unused variable for compilation without systemd. 1189356345Scy 1190356345Scy12 August 2019: George 1191356345Scy - Introduce `-V` option to print the version number and build options. 1192356345Scy Previously reported build options like linked libs and linked modules 1193356345Scy are now moved from `-h` to `-V` as well for consistency. 1194356345Scy - PACKAGE_BUGREPORT now also includes link to GitHub issues. 1195356345Scy 1196356345Scy1 August 2019: Wouter 1197356345Scy - For #52 #53, second context does not close logfile override. 1198356345Scy - Fix #52 #53, fix for example fail program. 1199356345Scy - Fix to return after failed auth zone http chunk write. 1200356345Scy - Fix to remove unused test for task_probe existance. 1201356345Scy - Fix to timeval_add for remaining second in microseconds. 1202356345Scy - Check repinfo in worker_handle_request, if null, drop it. 1203356345Scy 1204356345Scy29 July 2019: Wouter 1205356345Scy - Add verbose log message when auth zone file is written, at level 4. 1206356345Scy - Add hex print of trust anchor pointer to trust anchor file temp 1207356345Scy name to make it unique, for libunbound created multiple contexts. 1208356345Scy 1209356345Scy23 July 2019: Wouter 1210356345Scy - Fix question section mismatch in local zone redirect. 1211356345Scy 1212356345Scy19 July 2019: Wouter 1213356345Scy - Fix #49: Set no renegotiation on the SSL context to stop client 1214356345Scy session renegotiation. 1215356345Scy 1216356345Scy12 July 2019: Wouter 1217356345Scy - Fix #48: Unbound returns additional records on NODATA response, 1218356345Scy if minimal-responses is enabled, also the additional for negative 1219356345Scy responses is removed. 1220356345Scy 1221356345Scy9 July 2019: Ralph 1222356345Scy - Fix in respip addrtree selection. Absence of addr_tree_init_parents() 1223356345Scy call made it impossible to go up the tree when the matching netmask is 1224356345Scy too specific. 1225356345Scy 1226356345Scy5 July 2019: Ralph 1227356345Scy - Fix for possible assertion failure when answering respip CNAME from 1228356345Scy cache. 1229356345Scy 1230356345Scy25 June 2019: Wouter 1231356345Scy - For #45, check that 127.0.0.1 and ::1 are not used in unbound.conf 1232356345Scy when do-not-query-localhost is turned on, or at default on, 1233356345Scy unbound-checkconf prints a warning if it is found in forward-addr or 1234356345Scy stub-addr statements. 1235356345Scy 1236356345Scy24 June 2019: Wouter 1237356345Scy - Fix memleak in unit test, reported from the clang 8.0 static analyzer. 1238356345Scy 1239356345Scy18 June 2019: Wouter 1240356345Scy - PR #28: IPSet module, by Kevin Chou. Created a module to support 1241356345Scy the ipset that could add the domain's ip to a list easily. 1242356345Scy Needs libmnl, and --enable-ipset and config it, doc/README.ipset.md. 1243356345Scy - Fix to omit RRSIGs from addition to the ipset. 1244356345Scy - Fix to make unbound-control with ipset, remove unused variable, 1245356345Scy use unsigned type because of comparison, and assign null instead 1246356345Scy of compare with it. Remade lex and yacc output. 1247356345Scy - make depend 1248356345Scy - Added documentation to the ipset files (for doxygen output). 1249356345Scy - Merge PR #6: Python module: support multiple instances 1250356345Scy - Merge PR #5: Python module: define constant MODULE_RESTART_NEXT 1251356345Scy - Merge PR #4: Python module: assign something useful to the 1252356345Scy per-query data store 'qdata' 1253356345Scy - Fix python dict reference and double free in config. 1254356345Scy 1255356345Scy17 June 2019: Wouter 1256356345Scy - Master contains version 1.9.3 in development. 1257356345Scy - Fix #39: In libunbound, leftover logfile is close()d unpredictably. 1258356345Scy - Fix for #24: Fix abort due to scan of auth zone masters using old 1259356345Scy address from previous scan. 1260356345Scy 1261356345Scy12 June 2019: Wouter 1262356345Scy - Fix another spoolbuf storage code point, in prefetch. 1263356345Scy - 1.9.2rc3 release candidate tag. Which became the 1.9.2 release 1264356345Scy on 17 June 2019. 1265356345Scy 1266356345Scy11 June 2019: Wouter 1267356345Scy - Fix that fixes the Fix that spoolbuf is not used to store tcp 1268356345Scy pipelined response between mesh send and callback end, this fixes 1269356345Scy error cases that did not use the correct spoolbuf. 1270356345Scy - 1.9.2rc2 release candidate tag. 1271356345Scy 1272356345Scy6 June 2019: Wouter 1273356345Scy - 1.9.2rc1 release candidate tag. 1274356345Scy 1275356345Scy4 June 2019: Wouter 1276356345Scy - iana portlist updated. 1277356345Scy 1278356345Scy29 May 2019: Wouter 1279356345Scy - Fix to guard _OPENBSD_SOURCE from redefinition. 1280356345Scy 1281356345Scy28 May 2019: Wouter 1282356345Scy - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD. 1283356345Scy - gitignore config.h.in~. 1284356345Scy 1285356345Scy27 May 2019: Wouter 1286356345Scy - Fix double file close in tcp pipelined response code. 1287356345Scy 1288356345Scy24 May 2019: Wouter 1289356345Scy - Fix that spoolbuf is not used to store tcp pipelined response 1290356345Scy between mesh send and callback end. 1291356345Scy 1292356345Scy20 May 2019: Wouter 1293356345Scy - Note that so-reuseport at extreme load is better turned off, 1294356345Scy otherwise queries are not distributed evenly, on Linux 4.4.x. 1295356345Scy 1296356345Scy16 May 2019: Wouter 1297356345Scy - Fix #31: swig 4.0 and python module. 1298356345Scy 1299356345Scy13 May 2019: Wouter 1300356345Scy - Squelch log messages from tcp send about connection reset by peer. 1301356345Scy They can be enabled with verbosity at higher values for diagnosing 1302356345Scy network connectivity issues. 1303356345Scy - Attempt to fix malformed tcp response. 1304356345Scy 1305356345Scy9 May 2019: Wouter 1306356345Scy - Revert fix for oss-fuzz, error is in that build script that 1307356345Scy unconditionally includes .o files detected by configure, also 1308356345Scy when the machine architecture uses different LIBOBJS files. 1309356345Scy 1310356345Scy8 May 2019: Wouter 1311356345Scy - Attempt to fix build failure in oss-fuzz because of reallocarray. 1312356345Scy https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14648. 1313356345Scy Does not omit compile flags from commandline. 1314356345Scy 1315356345Scy7 May 2019: Wouter 1316356345Scy - Fix edns-subnet locks, in error cases the lock was not unlocked. 1317356345Scy - Fix doxygen output error on readme markdown vignettes. 1318356345Scy 1319356345Scy6 May 2019: Wouter 1320356345Scy - Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64. 1321356345Scy - Fix #30: AddressSanitizer finding in lookup3.c. This sets the 1322356345Scy hash function to use a slower but better auditable code that does 1323356345Scy not read beyond array boundaries. This makes code better security 1324356345Scy checkable, and is better for security. It is fixed to be slower, 1325356345Scy but not read outside of the array. 1326356345Scy 1327356345Scy2 May 2019: Wouter 1328356345Scy - contrib/fastrpz.patch updated for code changes, and with git diff. 1329356345Scy - Fix .gitignore, add pythonmod and dnstap generated files. 1330356345Scy And unit test generated files, and generated doc files. 1331356345Scy 1332356345Scy1 May 2019: Wouter 1333356345Scy - Update makedist for git. 1334356345Scy - Nicer travis output for clang analysis. 1335356345Scy - PR #16: XoT support, AXFR over TLS, turn it on with 1336356345Scy master: <ip>#<authname> in unbound.conf. This uses TLS to 1337356345Scy download the AXFR (or IXFR). 1338356345Scy 1339356345Scy25 April 2019: Wouter 1340356345Scy - Fix wrong query name in local zone redirect answers with a CNAME, 1341356345Scy the copy of the local alias is in unpacked form. 1342356345Scy 1343356345Scy18 April 2019: Ralph 1344356345Scy - Scrub RRs from answer section when reusing NXDOMAIN message for 1345356345Scy subdomain answers. 1346356345Scy - For harden-below-nxdomain: do not consider a name to be non-exitent 1347356345Scy when message contains a CNAME record. 1348356345Scy 1349356345Scy18 April 2019: Wouter 1350356345Scy - travis build file. 1351356345Scy 1352356345Scy16 April 2019: Wouter 1353356345Scy - Better braces in if statement in TCP fastopen code. 1354356345Scy - iana portlist updated. 1355356345Scy 1356356345Scy15 April 2019: Wouter 1357356345Scy - Fix tls write event for read state change to re-call SSL_write and 1358356345Scy not resume the TLS handshake. 1359356345Scy 1360356345Scy11 April 2019: George 1361356345Scy - Update python documentation for init_standard(). 1362356345Scy - Typos. 1363356345Scy 1364356345Scy11 April 2019: Wouter 1365356345Scy - Fix that auth zone uses correct network type for sockets for 1366356345Scy SOA serial probes. This fixes that probes fail because earlier 1367356345Scy probe addresses are unreachable. 1368356345Scy - Fix that auth zone fails over to next master for timeout in tcp. 1369356345Scy - Squelch SSL read and write connection reset by peer and broken pipe 1370356345Scy messages. Verbosity 2 and higher enables them. 1371356345Scy 1372356345Scy8 April 2019: Wouter 1373356345Scy - Fix to use event_assign with libevent for thread-safety. 1374356345Scy - verbose information about auth zone lookup process, also lookup 1375356345Scy start, timeout and fail. 1376356345Scy - Fix #17: Add python module example from Jan Janak, that is a 1377356345Scy plugin for the Unbound DNS resolver to resolve DNS records in 1378356345Scy multicast DNS [RFC 6762] via Avahi. The plugin communicates 1379356345Scy with Avahi via DBus. The comment section at the beginning of 1380356345Scy the file contains detailed documentation. 1381356345Scy - Fix to wipe ssl ticket keys from memory with explicit_bzero, 1382356345Scy if available. 1383356345Scy 1384356345Scy5 April 2019: Wouter 1385356345Scy - Fix to reinit event structure for accepted TCP (and TLS) sockets. 1386356345Scy 1387356345Scy4 April 2019: Wouter 1388356345Scy - Fix spelling error in log output for event method. 1389356345Scy 1390356345Scy3 April 2019: Wouter 1391356345Scy - Move goto label in answer_from_cache to the end of the function 1392356345Scy where it is more visible. 1393356345Scy - Fix auth-zone NSEC3 response for wildcard nodata answers, 1394356345Scy include the closest encloser in the answer. 1395356345Scy 1396356345Scy2 April 2019: Wouter 1397356345Scy - Fix auth-zone NSEC3 response for empty nonterminals with exact 1398356345Scy match nsec3 records. 1399356345Scy - Fix for out of bounds integers, thanks to OSTIF audit. It is in 1400356345Scy allocation debug code. 1401356345Scy - Fix for auth zone nsec3 ent fix for wildcard nodata. 1402356345Scy 1403356345Scy25 March 2019: Wouter 1404356345Scy - Fix that tls-session-ticket-keys: "" on its own in unbound.conf 1405356345Scy disables the tls session ticker key calls into the OpenSSL API. 1406356345Scy - Fix crash if tls-servic-pem not filled in when necessary. 1407356345Scy 1408356345Scy21 March 2019: Wouter 1409356345Scy - Fix #4240: Fix whitespace cleanup in example.conf. 1410356345Scy 1411356345Scy19 March 2019: Wouter 1412356345Scy - add type CAA to libpyunbound (accessing libunbound from python). 1413356345Scy 1414356345Scy18 March 2019: Wouter 1415356345Scy - Add log message, at verbosity 4, that says the query is encrypted 1416356345Scy with TLS, if that is enabled for the query. 1417356345Scy - Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482. 1418356345Scy 1419356345Scy7 March 2019: Wouter 1420356345Scy - Fix for #4233: guard use of NDEBUG, so that it can be passed in 1421356345Scy CFLAGS into configure. 1422356345Scy 1423356345Scy5 March 2019: Wouter 1424356345Scy - Tag release 1.9.1rc1. Which became 1.9.1 on 12 March 2019. Trunk 1425356345Scy has 1.9.2 in development. 1426356345Scy 1427356345Scy1 March 2019: Wouter 1428356345Scy - output forwarder log in ssl_req_order test. 1429356345Scy 1430356345Scy28 February 2019: Wouter 1431356345Scy - Remove memory leak on pythonmod python2 script file init. 1432356345Scy - Remove swig gcc8 python function cast warnings, they are ignored. 1433356345Scy - Print correct module that failed when module-config is wrong. 1434356345Scy 1435356345Scy27 February 2019: Wouter 1436356345Scy - Fix #4229: Unbound man pages lack information, about access-control 1437356345Scy order and local zone tags, and elements in views. 1438356345Scy - Fix #14: contrib/unbound.init: Fix wrong comparison judgment 1439356345Scy before copying. 1440356345Scy - Fix for python module on Windows, fix fopen. 1441356345Scy 1442356345Scy25 February 2019: Wouter 1443356345Scy - Fix #4227: pair event del and add for libevent for tcp_req_info. 1444356345Scy 1445356345Scy21 February 2019: Wouter 1446356345Scy - Fix the error for unknown module in module-config is understandable, 1447356345Scy and explains it was not compiled in and where to see the list. 1448356345Scy - In example.conf explain where to put cachedb module in module-config. 1449356345Scy - In man page and example config explain that most modules have to 1450356345Scy be listed at the start of module-config. 1451356345Scy 1452356345Scy20 February 2019: Wouter 1453356345Scy - Fix pythonmod include and sockaddr_un ifdefs for compile on 1454356345Scy Windows, and for libunbound. 1455356345Scy 1456356345Scy18 February 2019: Wouter 1457356345Scy - Print query name with ip_ratelimit exceeded log lines. 1458356345Scy - Spaces instead of tabs in that log message. 1459356345Scy - Print query name and IP address when domain rate limit exceeded. 1460356345Scy 1461356345Scy14 February 2019: Wouter 1462356345Scy - Fix capsforid canonical sort qsort callback. 1463356345Scy 1464356345Scy11 February 2019: Wouter 1465356345Scy - Note default for module-config in man page. 1466356345Scy - Fix recursion lame test for qname minimisation asked queries, 1467356345Scy that were not present in the set of prepared answers. 1468356345Scy - Fix #13: Remove left-over requirements on OpenSSL >= 1.1.0 for 1469356345Scy cert name matching, from man page. 1470356345Scy - make depend, with newer gcc, nicer layout. 1471356345Scy 1472356345Scy7 February 2019: Wouter 1473356345Scy - Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2. 1474356345Scy - Fix that qname minimisation does not skip a label when missing 1475356345Scy nameserver targets need to be fetched. 1476356345Scy - Fix #4225: clients seem to erroneously receive no answer with 1477356345Scy DNS-over-TLS and qname-minimisation. 1478356345Scy 1479356345Scy4 February 2019: Wouter 1480356345Scy - Fix that log-replies prints the correct name for local-alias 1481356345Scy names, for names that have a CNAME in local-data configuration. 1482356345Scy It logs the original query name, not the target of the CNAME. 1483356345Scy - Add local-zone type inform_redirect, which logs like type inform, 1484356345Scy and redirects like type redirect. 1485356345Scy - Perform canonical sort for 0x20 capsforid compare of replies, 1486356345Scy this sorts rrsets in the authority and additional section before 1487356345Scy comparison, so that out of order rrsets do not cause failure. 1488356345Scy 1489356345Scy31 January 2019: Wouter 1490356345Scy - Set ub_ctx_set_tls call signature in ltrace config file for 1491356345Scy libunbound in contrib/libunbound.so.conf. 1492356345Scy - improve documentation for tls-service-key and forward-first. 1493356345Scy - #10: fixed pkg-config operations, PKG_PROG_PKG_CONFIG moved out of 1494356345Scy conditional section, fixes systemd builds, from Enrico Scholz. 1495356345Scy - #9: For openssl 1.0.2 use the CRYPTO_THREADID locking callbacks, 1496356345Scy still supports the set_id_callback previous API. And for 1.1.0 1497356345Scy no locking callbacks are needed. 1498356345Scy - #8: Fix OpenSSL without ENGINE support compilation. 1499356345Scy - Wipe TLS session key data from memory on exit. 1500356345Scy 1501356345Scy30 January 2019: Ralph 1502356345Scy - Fix case in which query timeout can result in marking delegation 1503356345Scy as edns_lame_known. 1504356345Scy 1505356345Scy29 January 2019: Wouter 1506356345Scy - Fix spelling of tls-ciphers in example.conf.in. 1507356345Scy - Fix #4224: auth_xfr_notify.rpl test broken due to typo 1508356345Scy - Fix locking for libunbound context setup with broken port config. 1509356345Scy 1510356345Scy28 January 2019: Wouter 1511356345Scy - ub_ctx_set_tls call for libunbound that enables DoT for the machines 1512356345Scy set with ub_ctx_set_fwd. Patch from Florian Obser. 1513356345Scy - Set build system for added call in the libunbound API. 1514356345Scy - List example config for root zone copy locally hosted with auth-zone 1515356345Scy as suggested from draft-ietf-dnsop-7706-bis-02. But with updated 1516356345Scy B root address. 1517356345Scy - set version to 1.9.0 for release. And this was released with the 1518356345Scy spelling for tls-ciphers fix as 1.9.0 on Feb 5. Trunk has 1.9.1 in 1519356345Scy development. 1520356345Scy 1521356345Scy25 January 2019: Wouter 1522356345Scy - Fix that tcp for auth zone and outgoing does not remove and 1523356345Scy then gets the ssl read again applied to the deleted commpoint. 1524356345Scy - updated contrib/fastrpz.patch to cleanly diff. 1525356345Scy - no lock when threads disabled in tcp request buffer count. 1526356345Scy - remove compile warnings from libnettle compile. 1527356345Scy - output of newer lex 2.6.1 and bison 3.0.5. 1528356345Scy 1529356345Scy24 January 2019: Wouter 1530356345Scy - Newer aclocal and libtoolize used for generating configure scripts, 1531356345Scy aclocal 1.16.1 and libtoolize 2.4.6. 1532356345Scy - Fix unit test for python 3.7 new keyword 'async'. 1533356345Scy - clang analysis fixes, assert arc4random buffer in init, 1534356345Scy no check for already checked delegation pointer in iterator, 1535356345Scy in testcode check for NULL packet matches, in perf do not copy 1536356345Scy from NULL start list when growing capacity. Adjust host and file 1537356345Scy only when present in test header read to please checker. In 1538356345Scy testcode for unknown macro operand give zero result. Initialise the 1539356345Scy passed argv array in test code. In test code add EDNS data 1540356345Scy segment copy only when nonempty. 1541356345Scy - Patch from Florian Obser fixes some compiler warnings: 1542356345Scy include mini_event.h to have a prototype for mini_ev_cmp 1543356345Scy include edns.h to have a prototype for apply_edns_options 1544356345Scy sldns_wire2str_edns_keepalive_print is only called in the wire2str, 1545356345Scy module declare it static to get rid of compiler warning: 1546356345Scy no previous prototype for function 1547356345Scy infra_find_ip_ratedata() is only called in the infra module, 1548356345Scy declare it static to get rid of compiler warning: 1549356345Scy no previous prototype for function 1550356345Scy do not shadow local variable buf in authzone 1551356345Scy auth_chunks_delete and az_nsec3_findnode are only called in the 1552356345Scy authzone module, declare them static to get rid of compiler warning: 1553356345Scy no previous prototype for function... 1554356345Scy copy_rrset() is only called in the respip module, declare it 1555356345Scy static to get rid of compiler warning: 1556356345Scy no previous prototype for function 'copy_rrset' 1557356345Scy no need for another variable "r"; gets rid of compiler warning: 1558356345Scy declaration shadows a local variable in libunbound.c 1559356345Scy no need for another variable "ns"; gets rid of compiler warning: 1560356345Scy declaration shadows a local variable in iterator.c 1561356345Scy - Moved includes and make depend. 1562356345Scy 1563356345Scy23 January 2019: Wouter 1564356345Scy - Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites 1565356345Scy options for unbound.conf. 1566356345Scy - Fixes for the patch, and man page entry. 1567356345Scy - Fix configure to detect SSL_CTX_set_ciphersuites, for better 1568356345Scy library compatibility when compiling. 1569356345Scy - Patch for TLS session resumption from Manabu Sonoda, 1570356345Scy enable with tls-session-ticket-keys in unbound.conf. 1571356345Scy - Fixes for patch (includes, declarations, warnings). Free at end 1572356345Scy and keep config options in order read from file to keep the first 1573356345Scy one as the first one. 1574356345Scy - Fix for IXFR fallback to reset counter when IXFR does not timeout. 1575356345Scy 1576356345Scy22 January 2019: Wouter 1577356345Scy - Fix space calculation for tcp req buffer size. 1578356345Scy - Doc for stream-wait-size and unit test. 1579356345Scy - unbound-control stats has mem.streamwait that counts TCP and TLS 1580356345Scy waiting result buffers. 1581356345Scy - Fix for #4219: secondaries not updated after serial change, unbound 1582356345Scy falls back to AXFR after IXFR gives several timeout failures. 1583356345Scy - Fix that auth zone after IXFR fallback tries the same master. 1584356345Scy 1585356345Scy21 January 2019: Wouter 1586356345Scy - Fix tcp idle timeout test, for difference in the tcp reply code. 1587356345Scy - Unit test for tcp request reorder and timeouts. 1588356345Scy - Unit tests for ssl out of order processing. 1589356345Scy - Fix that multiple dns fragments can be carried in one TLS frame. 1590356345Scy - Add stream-wait-size: 4m config option to limit the maximum 1591356345Scy memory used by waiting tcp and tls stream replies. This avoids 1592356345Scy a denial of service where these replies use up all of the memory. 1593356345Scy 1594356345Scy17 January 2019: Wouter 1595356345Scy - For caps-for-id fallback, use the whitelist to avoid timeout 1596356345Scy starting a fallback sequence for it. 1597356345Scy - increase mesh max activation count for capsforid long fetches. 1598356345Scy 1599356345Scy16 January 2019: Ralph 1600356345Scy - Get ready for the DNS flag day: remove EDNS lame procedure, do not 1601356345Scy re-query without EDNS after timeout. 1602356345Scy 1603356345Scy15 January 2019: Wouter 1604356345Scy - In the out of order processing, reset byte count for (potential) 1605356345Scy partial read. 1606356345Scy - Review fixes in out of order processing. 1607356345Scy 1608356345Scy14 January 2019: Wouter 1609356345Scy - streamtcp option -a send queries consecutively and prints answers 1610356345Scy as they arrive. 1611356345Scy - Fix for out of order processing administration quit cleanup. 1612356345Scy - unit test for tcp out of order processing. 1613356345Scy 1614356345Scy11 January 2019: Wouter 1615356345Scy - Initial commit for out-of-order processing for TCP and TLS. 1616356345Scy 1617356345Scy9 January 2019: Wouter 1618356345Scy - Log query name for looping module errors. 1619356345Scy 1620356345Scy8 January 2019: Wouter 1621356345Scy - Fix syntax in comment of local alias processing. 1622356345Scy - Fix NSEC3 record that is returned in wildcard replies from 1623356345Scy auth-zone zones with NSEC3 and wildcards. 1624356345Scy 1625356345Scy7 January 2019: Wouter 1626356345Scy - On FreeBSD warn if systcl settings do not allow server TCP FASTOPEN, 1627356345Scy and server tcp fastopen is enabled at compile time. 1628356345Scy - Document interaction between the tls-upstream option in the server 1629356345Scy section and forward-tls-upstream option in the forward-zone sections. 1630356345Scy - Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews, 1631356345Scy the patch adds a program used for fuzzing. 1632356345Scy 1633356345Scy12 December 2018: Wouter 1634356345Scy - Fix for crash in dns64 module if response is null. 1635356345Scy 1636356345Scy10 December 2018: Wouter 1637356345Scy - Fix config parser memory leaks. 1638356345Scy - ip-ratelimit-factor of 1 allows all traffic through, instead of the 1639356345Scy previous blocking everything. 1640356345Scy - Fix for FreeBSD port make with dnscrypt and dnstap enabled. 1641356345Scy - Fix #4206: support openssl 1.0.2 for TLS hostname verification, 1642356345Scy alongside the 1.1.0 and later support that is already there. 1643356345Scy - Fixup openssl 1.0.2 compile 1644356345Scy 1645356345Scy6 December 2018: Wouter 1646356345Scy - Fix dns64 allocation in wrong region for returned internal queries. 1647356345Scy 1648356345Scy3 December 2018: Wouter 1649356345Scy - Fix icon, no ragged edges and nicer resolutions available, for eg. 1650356345Scy Win 7 and Windows 10 display. 1651356345Scy - cache-max-ttl also defines upperbound of initial TTL in response. 1652356345Scy 1653356345Scy30 November 2018: Wouter 1654356345Scy - Patch for typo in unbound.conf man page. 1655356345Scy - log-tag-queryreply: yes in unbound.conf tags the log-queries and 1656356345Scy log-replies in the log file for easier log filter maintenance. 1657356345Scy 1658356345Scy29 November 2018: Wouter 1659356345Scy - iana portlist updated. 1660356345Scy - Fix chroot auth-zone fix to remove chroot prefix. 1661356345Scy - tag for 1.8.2rc1, which became 1.8.2 on 4 dec 2018, with icon 1662356345Scy updated. Trunk contains 1.8.3 in development. 1663356345Scy Which became 1.8.3 on 11 december with only the dns64 fix of 6 dec. 1664356345Scy Trunk then became 1.8.4 in development. 1665356345Scy - Fix that unbound-checkconf does not complains if the config file 1666356345Scy is not placed inside the chroot. 1667356345Scy - Refuse to start with no ports. 1668356345Scy - Remove clang analysis warnings. 1669356345Scy 1670356345Scy28 November 2018: Wouter 1671356345Scy - Fix leak in chroot fix for auth-zone. 1672356345Scy - Fix clang analysis for outside directory build test. 1673356345Scy 1674356345Scy27 November 2018: Wouter 1675356345Scy - Fix DNS64 to not store intermediate results in cache, this avoids 1676356345Scy other threads from picking up the wrong data. The module restores 1677356345Scy the previous no_cache_store setting when the the module is finished. 1678356345Scy - Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work. 1679356345Scy - New and better fix for Fix #4193: Fix that prefetch failure does 1680356345Scy not overwrite valid cache entry with SERVFAIL. 1681356345Scy - auth-zone give SERVFAIL when expired, fallback activates when 1682356345Scy expired, and this is documented in the man page. 1683356345Scy - stat count SERVFAIL downstream auth-zone queries for expired zones. 1684356345Scy - Put new logos into windows installer. 1685356345Scy - Fix windows compile for new rrset roundrobin fix. 1686356345Scy - Update contrib fastrpz patch for latest release. 1687356345Scy 1688356345Scy26 November 2018: Wouter 1689356345Scy - Fix to not set GLOB_NOSORT so the unbound.conf include: files are 1690356345Scy sorted and in a predictable order. 1691356345Scy - Fix #4193: Fix that prefetch failure does not overwrite valid cache 1692356345Scy entry with SERVFAIL. 1693356345Scy - Add unbound-control view_local_datas command, like local_datas. 1694356345Scy - Fix that unbound-control can send file for view_local_datas. 1695356345Scy 1696356345Scy22 November 2018: Wouter 1697356345Scy - With ./configure --with-pyunbound --with-pythonmodule 1698356345Scy PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests 1699356345Scy succeed for the python module. 1700356345Scy - pythonmod logs the python error and traceback on failure. 1701356345Scy - ignore debug python module for test in doxygen output. 1702356345Scy - review fixes for python module. 1703356345Scy - Fix #4209: Crash in libunbound when called from getdns. 1704356345Scy - auth zone zonefiles can be in a chroot, the chroot directory 1705356345Scy components are removed before use. 1706356345Scy - Fix that empty zonefile means the zonefile is not set and not used. 1707356345Scy - make depend. 1708356345Scy 1709356345Scy21 November 2018: Wouter 1710356345Scy - Scrub NS records from NODATA responses as well. 1711356345Scy 1712356345Scy20 November 2018: Wouter 1713356345Scy - Scrub NS records from NXDOMAIN responses to stop fragmentation 1714356345Scy poisoning of the cache. 1715356345Scy - Add patch from Jan Vcelak for pythonmod, 1716356345Scy add sockaddr_storage getters, add support for query callbacks, 1717356345Scy allow raw address access via comm_reply and update API documentation. 1718356345Scy - Removed compile warnings in pythonmod sockaddr routines. 1719356345Scy 1720356345Scy19 November 2018: Wouter 1721356345Scy - Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes 1722356345Scy option in unbound.conf. 1723356345Scy 1724356345Scy6 November 2018: Ralph 1725356345Scy - Bugfix min-client-subnet-ipv6 1726356345Scy 1727356345Scy25 October 2018: Ralph 1728356345Scy - Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options. 1729356345Scy 1730356345Scy25 October 2018: Wouter 1731356345Scy - Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query. 1732356345Scy - Fix #4190: Please create a "ANY" deny option, adds the option 1733356345Scy deny-any: yes in unbound.conf. This responds with an empty message 1734356345Scy to queries of type ANY. 1735356345Scy - Fix #4141: More randomness to rrset-roundrobin. 1736356345Scy - Fix #4132: Openness/closeness of RANGE intervals in rpl files. 1737356345Scy - Fix #4126: RTT_band too low on VSAT links with 600+ms latency, 1738356345Scy adds the option unknown-server-time-limit to unbound.conf that 1739356345Scy can be increased to avoid the problem. 1740356345Scy - remade makefile dependencies. 1741356345Scy - Fix #4152: Logs shows wrong time when using log-time-ascii: yes. 1742356345Scy 1743356345Scy24 October 2018: Ralph 1744356345Scy - Add markdel function to ECS slabhash. 1745356345Scy - Limit ECS scope returned to client to the scope used for caching. 1746356345Scy - Make lint like previous #4154 fix. 1747356345Scy 1748356345Scy22 October 2018: Wouter 1749356345Scy - Fix #4192: unbound-control-setup generates keys not readable by 1750356345Scy group. 1751356345Scy - check that the dnstap socket file can be opened and exists, print 1752356345Scy error if not. 1753356345Scy - Fix #4154: make ECS_MAX_TREESIZE configurable, with 1754356345Scy the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options. 1755356345Scy 1756356345Scy22 October 2018: Ralph 1757356345Scy - Change fast-server-num default to 3. 1758356345Scy 1759356345Scy8 October 2018: Ralph 1760356345Scy - Add fast-server-permil and fast-server-num options. 1761356345Scy - Deprecate low-rtt and low-rtt-permil options. 1762356345Scy 1763356345Scy8 October 2018: Wouter 1764356345Scy - Squelch log of failed to tcp initiate after TCP Fastopen failure. 1765356345Scy 1766356345Scy5 October 2018: Wouter 1767356345Scy - Squelch EADDRNOTAVAIL errors when the interface goes away, 1768356345Scy this omits 'can't assign requested address' errors unless 1769356345Scy verbosity is set to a high value. 1770356345Scy - Set default for so-reuseport to no for FreeBSD. It is enabled 1771356345Scy by default for Linux and DragonFlyBSD. The setting can 1772356345Scy be configured in unbound.conf to override the default. 1773356345Scy - iana port update. 1774356345Scy 1775356345Scy2 October 2018: Wouter 1776356345Scy - updated contrib/fastrpz.patch to apply for this version 1777356345Scy - dnscrypt.c removed sizeof to get array bounds. 1778356345Scy - Fix testlock code to set noreturn on error routine. 1779356345Scy - Remove unused variable from contrib fastrpz/rpz.c and 1780356345Scy remove unused diagnostic pragmas that themselves generate warnings 1781356345Scy - clang analyze test is used only when assertions are enabled. 1782356345Scy 1783356345Scy1 October 2018: Wouter 1784356345Scy - tag for release 1.8.1rc1. Became release 1.8.1 on 8 oct, with 1785356345Scy fastrpz.patch fix included. Trunk has 1.8.2 in development. 1786356345Scy 1787356345Scy27 September 2018: Wouter 1788356345Scy - Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes 1789356345Scy qname minimisation with a forwarder when connectivity has issues 1790356345Scy from rejecting responses. 1791356345Scy 1792356345Scy25 September 2018: Wouter 1793356345Scy - Perform TLS SNI indication of the host that is being contacted 1794356345Scy for DNS over TLS service. It sets the configured tls auth name. 1795356345Scy This is useful for hosts that apart from the DNS over TLS services 1796356345Scy also provide other (web) services. 1797356345Scy - Fix #4149: Add SSL cleanup for tcp timeout. 1798356345Scy 1799356345Scy17 September 2018: Wouter 1800356345Scy - Fix compile on Mac for unbound, provide explicit_bzero when libc 1801356345Scy does not have it. 1802356345Scy - Fix unbound for openssl in FIPS mode, it uses the digests with 1803356345Scy the EVP call contexts. 1804356345Scy - Fix that with harden-below-nxdomain and qname minisation enabled 1805356345Scy some iterator states for nonresponsive domains can get into a 1806356345Scy state where they waited for an empty list. 1807356345Scy - Stop UDP to TCP failover after timeouts that causes the ping count 1808356345Scy to be reset by the TCP time measurement (that exists for TLS), 1809356345Scy because that causes the UDP part to not be measured as timeout. 1810356345Scy - Fix #4156: Fix systemd service manager state change notification. 1811356345Scy 1812356345Scy13 September 2018: Wouter 1813356345Scy - Fix seed for random backup code to use explicit zero when wiped. 1814356345Scy - exit log routine is annotated as noreturn function. 1815356345Scy - free memory leaks in config strlist and str2list insert functions. 1816356345Scy - do not move unused argv variable after getopt. 1817356345Scy - Remove unused if clause in testcode. 1818356345Scy - in testcode, free async ids, initialise array, and check for null 1819356345Scy pointer during test of the test. And use exit for return to note 1820356345Scy irregular program stop. 1821356345Scy - Free memory leak in config strlist append. 1822356345Scy - make sure nsec3 comparison salt is initialized. 1823356345Scy - unit test has clang analysis. 1824356345Scy - remove unused variable assignment from iterator scrub routine. 1825356345Scy - check for null in delegation point during iterator refetch 1826356345Scy in forward zone. 1827356345Scy - neater pointer cast in libunbound context quit routine. 1828356345Scy - initialize statistics totals for printout. 1829356345Scy - in authzone check that node exists before adding rrset. 1830356345Scy - in unbound-anchor, use readwrite memory BIO. 1831356345Scy - assertion in autotrust that packed rrset is formed correctly. 1832356345Scy - Fix memory leak when message parse fails partway through copy. 1833356345Scy - remove unused udpsize assignment in message encode. 1834356345Scy - nicer bio free code in unbound-anchor. 1835356345Scy - annotate exit functions with noreturn in unbound-control. 1836356345Scy 1837356345Scy11 September 2018: Wouter 1838356345Scy - Fixed unused return value warnings in contrib/fastrpz.patch for 1839356345Scy asprintf. 1840356345Scy - Fix to squelch respip warning in unit test, it is printed at 1841356345Scy higher verbosity settings. 1842356345Scy - Fix spelling errors. 1843356345Scy - Fix initialisation in remote.c 1844356345Scy 1845356345Scy10 September 2018: Wouter 1846356345Scy - 1.8.1 in svn trunk. (changes from 4,5,.. sep apply). 1847356345Scy - iana port update. 1848356345Scy 1849356345Scy5 September 2018: Wouter 1850356345Scy - Fix spelling error in header, from getdns commit by Andreas Gelmini. 1851356345Scy 1852356345Scy4 September 2018: Ralph 1853356345Scy - More explicitly mention the type of ratelimit when applying 1854356345Scy ip-ratelimit. 1855356345Scy 1856356345Scy4 September 2018: Wouter 1857356345Scy - Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018. 1858356345Scy 1859356345Scy31 August 2018: Wouter 1860356345Scy - Disable minimal-responses in subnet unit tests. 1861356345Scy 1862356345Scy30 August 2018: Wouter 1863356345Scy - Fix that a local-zone with a local-zone-type that is transparent 1864356345Scy in a view with view-first, makes queries check for answers from the 1865356345Scy local-zones defined outside of views. 1866356345Scy 1867356345Scy28 August 2018: Ralph 1868356345Scy - Disable minimal-responses in ipsecmod unit tests. 1869356345Scy - Added serve-expired-ttl and serve-expired-ttl-reset options. 1870356345Scy 1871356345Scy27 August 2018: Wouter 1872356345Scy - Set defaults to yes for a number of options to increase speed and 1873356345Scy resilience of the server. The so-reuseport, harden-below-nxdomain, 1874356345Scy and minimal-responses options are enabled by default. They used 1875356345Scy to be disabled by default, waiting to make sure they worked. They 1876356345Scy are enabled by default now, and can be disabled explicitly by 1877356345Scy setting them to "no" in the unbound.conf config file. The reuseport 1878356345Scy and minimal options increases speed of the server, and should be 1879356345Scy otherwise harmless. The harden-below-nxdomain option works well 1880356345Scy together with the recently default enabled qname minimisation, this 1881356345Scy causes more fetches to use information from the cache. 1882356345Scy - next release is called 1.8.0. 1883356345Scy - Fix lintflags for lint on FreeBSD. 1884356345Scy 1885356345Scy22 August 2018: George 1886356345Scy - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This 1887356345Scy gives access to reply information for the client's communication 1888356345Scy point when the callback is called before the mesh state (modules). 1889356345Scy Changes to C and Python's inplace_callback signatures were also 1890356345Scy necessary. 1891356345Scy 1892356345Scy21 August 2018: Wouter 1893356345Scy - log-local-actions: yes option for unbound.conf that logs all the 1894356345Scy local zone actions, a patch from Saksham Manchanda (Secure64). 1895356345Scy - #4146: num.query.subnet and num.query.subnet_cache counters. 1896356345Scy - Fix only misc failure from log-servfail when val-log-level is not 1897356345Scy enabled. 1898356345Scy 1899356345Scy17 August 2018: Ralph 1900356345Scy - Fix classification for QTYPE=CNAME queries when QNAME minimisation is 1901356345Scy enabled. 1902356345Scy 1903356345Scy17 August 2018: Wouter 1904356345Scy - Set libunbound to increase current, because the libunbound change 1905356345Scy to the event callback function signature. That needs programs, 1906356345Scy that use it, to recompile against the new header definition. 1907356345Scy - print servfail info to log as error. 1908356345Scy - added more servfail printout statements, to the iterator. 1909356345Scy - log-servfail: yes prints log lines that say why queries are 1910356345Scy returning SERVFAIL to clients. 1911356345Scy 1912356345Scy16 August 2018: Wouter 1913356345Scy - Fix warning on compile without threads. 1914356345Scy - Fix contrib/fastrpz.patch. 1915356345Scy 1916356345Scy15 August 2018: Wouter 1917356345Scy - Fix segfault in auth-zone read and reorder of RRSIGs. 1918356345Scy 1919356345Scy14 August 2018: Wouter 1920356345Scy - Fix that printout of error for cycle targets is a verbosity 4 1921356345Scy printout and does not wrongly print it is a memory error. 1922356345Scy - Upgraded crosscompile script to include libunbound DLL in the 1923356345Scy zipfile. 1924356345Scy 1925356345Scy10 August 2018: Wouter 1926356345Scy - Fix #4144: dns64 module caches wrong (negative) information. 1927356345Scy 1928356345Scy9 August 2018: Wouter 1929356345Scy - unbound-checkconf checks if modules exist and prints if they are 1930356345Scy not compiled in the name of the wrong module. 1931356345Scy - document --enable-subnet in doc/README. 1932356345Scy - Patch for stub-no-cache and forward-no-cache options that disable 1933356345Scy caching for the contents of that stub or forward, for when you 1934356345Scy want immediate changes visible, from Bjoern A. Zeeb. 1935356345Scy 1936356345Scy7 August 2018: Ralph 1937356345Scy - Make capsforid fallback QNAME minimisation aware. 1938356345Scy 1939356345Scy7 August 2018: Wouter 1940356345Scy - Fix #4142: unbound.service.in: improvements and fixes. 1941356345Scy Add unit dependency ordering (based on systemd-resolved). 1942356345Scy Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings 1943356345Scy about missing privileges during startup). Add 'AF_INET6' to 1944356345Scy 'RestrictAddressFamilies' (without it IPV6 can't work). From 1945356345Scy Guido Shanahan. 1946356345Scy - Patch to implement tcp-connection-limit from Jim Hague (Sinodun). 1947356345Scy This limits the number of simultaneous TCP client connections 1948356345Scy from a nominated netblock. 1949356345Scy - make depend, yacc, lex, doc, headers. And log the limit exceeded 1950356345Scy message only on high verbosity, so as to not spam the logs when 1951356345Scy it is busy. 1952356345Scy 1953356345Scy6 August 2018: Wouter 1954356345Scy - Fix for #4136: Fix to unconditionally call destroy in daemon.c. 1955356345Scy 1956356345Scy3 August 2018: George 1957356345Scy - Expose if a query (or a subquery) was ratelimited (not src IP 1958356345Scy ratelimiting) to libunbound under 'ub_result.was_ratelimited'. 1959356345Scy This also introduces a change to 'ub_event_callback_type' in 1960356345Scy libunbound/unbound-event.h. 1961356345Scy - Tidy pylib tests. 1962356345Scy 1963356345Scy3 August 2018: Wouter 1964356345Scy - Revert previous change for #4136: because it introduces build 1965356345Scy problems. 1966356345Scy - New fix for #4136: This one ignores lex without without 1967356345Scy yylex_destroy. 1968356345Scy 1969356345Scy1 August 2018: Wouter 1970356345Scy - Fix to remove systemd sockaddr function check, that is not 1971356345Scy always present. Make socket activation more lenient. But not 1972356345Scy different when socket activation is not used. 1973356345Scy - iana port list update. 1974356345Scy 1975356345Scy31 July 2018: Wouter 1976356345Scy - Patches from Jim Hague (Sinodun) for EDNS KeepAlive. 1977356345Scy - Sort out test runs when the build directory isn't the project 1978356345Scy root directory. 1979356345Scy - Add config tcp-idle-timeout (default 30s). This applies to 1980356345Scy client connections only; the timeout on TCP connections upstream 1981356345Scy is unaffected. 1982356345Scy - Error if EDNS Keepalive received over UDP. 1983356345Scy - Add edns-tcp-keepalive and edns-tcp-keepalive timeout options 1984356345Scy and implement option in client responses. 1985356345Scy - Correct and expand manual page entries for keepalive and idle timeout. 1986356345Scy - Implement progressive backoff of TCP idle/keepalive timeout. 1987356345Scy - Fix 'make depend' to work when build dir is not project root. 1988356345Scy - Add delay parameter to streamtcp, -d secs. 1989356345Scy To be used when testing idle timeout. 1990356345Scy - From Wouter: make depend, the dependencies in the patches did not 1991356345Scy apply cleanly. Also remade yacc and lex. 1992356345Scy - Fix mesh.c incompatible pointer pass. 1993356345Scy - Please doxygen so it passes. 1994356345Scy - Fix #4139: Fix unbound-host leaks memory on ANY. 1995356345Scy 1996356345Scy30 July 2018: Wouter 1997356345Scy - Fix #4136: insufficiency from mismatch of FLEX capability between 1998356345Scy released tarball and build host. 1999356345Scy 2000356345Scy27 July 2018: Wouter 2001356345Scy - Fix man page, say that chroot is enabled by default. 2002356345Scy 2003356345Scy26 July 2018: Wouter 2004356345Scy - Fix #4135: 64-bit Windows Installer Creates Entries Under The 2005356345Scy Wrong Registry Key, reported by Brian White. 2006356345Scy 2007356345Scy23 July 2018: Wouter 2008356345Scy - Fix use-systemd readiness signalling, only when use-systemd is yes 2009356345Scy and not in signal handler. 2010356345Scy 2011356345Scy20 July 2018: Wouter 2012356345Scy - Fix #4130: print text describing -dd and unbound-checkconf on 2013356345Scy config file read error at startup, the errors may have been moved 2014356345Scy away by the startup process. 2015356345Scy - Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared. 2016356345Scy 2017356345Scy19 July 2018: Wouter 2018356345Scy - Fix #4129 unbound-control error message with wrong cert permissions 2019356345Scy is too cryptic. 2020356345Scy 2021356345Scy17 July 2018: Wouter 2022356345Scy - Fix #4127 unbound -h does not list -p help. 2023356345Scy - Print error if SSL name verification configured but not available 2024356345Scy in the ssl library. 2025356345Scy - Fix that ratelimit and ip-ratelimit are applied after reload of 2026356345Scy changed config file. 2027356345Scy - Resize ratelimit and ip-ratelimit caches if changed on reload. 2028356345Scy 2029356345Scy16 July 2018: Wouter 2030356345Scy - Fix qname minimisation NXDOMAIN validation lookup failures causing 2031356345Scy error_supers assertion fails. 2032356345Scy - Squelch can't bind socket errors with Permission denied unless 2033356345Scy verbosity is 4 or higher, for UDP outgoing sockets. 2034356345Scy 2035356345Scy12 July 2018: Wouter 2036356345Scy - Fix to improve systemd socket activation code file descriptor 2037356345Scy assignment. 2038356345Scy - Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more 2039356345Scy easily changed to adjust default rtt assumptions. 2040356345Scy 2041356345Scy10 July 2018: Wouter 2042356345Scy - Note in documentation that the cert name match code needs 2043356345Scy OpenSSL 1.1.0 or later to be enabled. 2044356345Scy 2045356345Scy6 July 2018: Wouter 2046356345Scy - Fix documentation ambiguity for tls-win-cert in tls-upstream and 2047356345Scy forward-tls-upstream docs. 2048356345Scy - iana port update. 2049356345Scy - Note RFC8162 support. SMIMEA record type can be read in by the 2050356345Scy zone record parser. 2051356345Scy - Fix round robin for failed addresses with prefer-ip6: yes 2052356345Scy 2053356345Scy4 July 2018: Wouter 2054356345Scy - Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass 2055356345Scy if DNSSEC is not enabled. New option -R allows fallback from 2056356345Scy resolv.conf to direct queries. 2057356345Scy 2058356345Scy3 July 2018: Wouter 2059356345Scy - Better documentation for unblock-lan-zones and insecure-lan-zones 2060356345Scy config statements. 2061356345Scy - Fix permission denied printed for auth zone probe random port nrs. 2062356345Scy 2063356345Scy2 July 2018: Wouter 2064356345Scy - Fix checking for libhiredis printout in configure output. 2065356345Scy - Fix typo on man page in ip-address description. 2066356345Scy - Update libunbound/python/examples/dnssec_test.py example code to 2067356345Scy also set the 20326 trust anchor for the root in the example code. 2068356345Scy 2069356345Scy29 June 2018: Wouter 2070356345Scy - dns64-ignore-aaaa: config option to list domain names for which the 2071356345Scy existing AAAA is ignored and dns64 processing is used on the A 2072356345Scy record. 2073356345Scy 2074356345Scy28 June 2018: Wouter 2075356345Scy - num.queries.tls counter for queries over TLS. 2076356345Scy - log port number with err_addr logs. 2077356345Scy 2078356345Scy27 June 2018: Wouter 2079356345Scy - #4109: Fix that package config depends on python unconditionally. 2080356345Scy - Patch, do not export python from pkg-config, from Petr Men����k. 2081356345Scy 2082356345Scy26 June 2018: Wouter 2083356345Scy - Partial fix for permission denied on IPv6 address on FreeBSD. 2084356345Scy - Fix that auth-zone master reply with current SOA serial does not 2085356345Scy stop scan of masters for an updated zone. 2086356345Scy - Fix that auth-zone does not start the wait timer without checking 2087356345Scy if the wait timer has already been started. 2088356345Scy 2089356345Scy21 June 2018: Wouter 2090356345Scy - #4108: systemd reload hang fix. 2091356345Scy - Fix usage printout for unbound-host, hostname has to be last 2092356345Scy argument on BSDs and Windows. 2093356345Scy 2094356345Scy19 June 2018: Wouter 2095356345Scy - Fix for unbound-control on Windows and set TCP socket parameters 2096356345Scy more closely. 2097356345Scy This fix is part of 1.7.3. 2098356345Scy - Windows example service.conf edited with more windows specific 2099356345Scy configuration. 2100356345Scy - Fix windows unbound-control no cert bad file descriptor error. 2101356345Scy This fix is part of 1.7.3. 2102356345Scy 2103356345Scy18 June 2018: Wouter 2104356345Scy - Fix that control-use-cert: no works for 127.0.0.1 to disable certs. 2105356345Scy This fix is part of 1.7.3rc2. 2106356345Scy - Fix unbound-checkconf for control-use-cert. 2107356345Scy This fix is part of 1.7.3. 2108356345Scy 2109356345Scy15 June 2018: Wouter 2110356345Scy - tag for 1.7.3rc1. 2111356345Scy - trunk has 1.7.4. 2112356345Scy - unbound-control auth_zone_reload _zone_ option rereads the zonefile. 2113356345Scy - unbound-control auth_zone_transfer _zone_ option starts the probe 2114356345Scy sequence for a master to transfer the zone from and transfers when 2115356345Scy a new zone version is available. 2116356345Scy 2117356345Scy14 June 2018: Wouter 2118356345Scy - #4103: Fix that auth-zone does not insist on SOA record first in 2119356345Scy file for url downloads. 2120356345Scy - Fix that first control-interface determines if TLS is used. Warn 2121356345Scy when IP address interfaces are used without TLS. 2122356345Scy - Fix nettle compile. 2123356345Scy 2124356345Scy12 June 2018: Ralph 2125356345Scy - Don't count CNAME response types received during qname minimisation as 2126356345Scy query restart. 2127356345Scy 2128356345Scy12 June 2018: Wouter 2129356345Scy - #4102 for NSD, but for Unbound. Named unix pipes do not use 2130356345Scy certificate and key files, access can be restricted with file and 2131356345Scy directory permissions. The option control-use-cert is no longer 2132356345Scy used, and ignored if found in unbound.conf. 2133356345Scy - Rename tls-additional-ports to tls-additional-port, because every 2134356345Scy line adds one port. 2135356345Scy - Fix buffer size warning in unit test. 2136356345Scy - remade dependencies in the Makefile. 2137356345Scy 2138356345Scy6 June 2018: Wouter 2139356345Scy - Patch to fix openwrt for mac os build darwin detection in configure. 2140356345Scy 2141356345Scy5 June 2018: Wouter 2142356345Scy - Fix crash if ratelimit taken into use with unbound-control 2143356345Scy instead of with unbound.conf. 2144356345Scy 2145356345Scy4 June 2018: Wouter 2146356345Scy - Fix deadlock caused by incoming notify for auth-zone. 2147356345Scy - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018, 2148356345Scy trunk is 1.7.3 in development from this point. 2149356345Scy - #4100: Fix stub reprime when it becomes useless. 2150356345Scy 2151356345Scy1 June 2018: Wouter 2152356345Scy - Rename additional-tls-port to tls-additional-ports. 2153356345Scy The older name is accepted for backwards compatibility. 2154356345Scy 2155356345Scy30 May 2018: Wouter 2156356345Scy - Patch from Syzdek: Add ability to ignore RD bit and treat all 2157356345Scy requests as if the RD bit is set. 2158356345Scy 2159356345Scy29 May 2018: Wouter 2160356345Scy - in compat/arc4random call getentropy_urandom when getentropy fails 2161356345Scy with ENOSYS. 2162356345Scy - Fix that fallback for windows port. 2163356345Scy 2164356345Scy28 May 2018: Wouter 2165356345Scy - Fix windows tcp and tls spin on events. 2166356345Scy - Add routine from getdns to add windows cert store to the SSL_CTX. 2167356345Scy - tls-win-cert option that adds the system certificate store for 2168356345Scy authenticating DNS-over-TLS connections. It can be used instead 2169356345Scy of the tls-cert-bundle option, or with it to add certificates. 2170356345Scy 2171356345Scy25 May 2018: Wouter 2172356345Scy - For TCP and TLS connections that don't establish, perform address 2173356345Scy update in infra cache, so future selections can exclude them. 2174356345Scy - Fix that tcp sticky events are removed for closed fd on windows. 2175356345Scy - Fix close events for tcp only. 2176356345Scy 2177356345Scy24 May 2018: Wouter 2178356345Scy - Fix that libunbound can do DNS-over-TLS, when configured. 2179356345Scy - Fix that windows unbound service can use DNS-over-TLS. 2180356345Scy - unbound-host initializes ssl (for potential DNS-over-TLS usage 2181356345Scy inside libunbound), when ssl upstream or a cert-bundle is configured. 2182356345Scy 2183356345Scy23 May 2018: Wouter 2184356345Scy - Use accept4 to speed up incoming TCP (and TLS) connections, 2185356345Scy available on Linux, FreeBSD and OpenBSD. 2186356345Scy 2187356345Scy17 May 2018: Ralph 2188356345Scy - Qname minimisation default changed to yes. 2189356345Scy 2190356345Scy15 May 2018: Wouter 2191356345Scy - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand. 2192356345Scy 2193356345Scy11 May 2018: Wouter 2194356345Scy - Fix contrib/libunbound.pc for libssl libcrypto references, 2195356345Scy from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914 2196356345Scy 2197356345Scy7 May 2018: Wouter 2198356345Scy - Fix windows to not have sticky TLS events for TCP. 2199356345Scy - Fix read of DNS over TLS length and data in one read call. 2200356345Scy - Fix mesh state assertion failure due to callback removal. 2201356345Scy 2202356345Scy3 May 2018: Wouter 2203356345Scy - Fix that configure --with-libhiredis also turns on cachedb. 2204356345Scy - Fix gcc 8 buffer warning in testcode. 2205356345Scy - Fix function type cast warning in libunbound context callback type. 2206356345Scy 2207356345Scy2 May 2018: Wouter 2208356345Scy - Fix fail to reject dead peers in forward-zone, with ssl-upstream. 2209356345Scy 2210356345Scy1 May 2018: Wouter 2211356345Scy - Fix that unbound-control reload frees the rrset keys and returns 2212356345Scy the memory pages to the system. 2213356345Scy 2214356345Scy30 April 2018: Wouter 2215356345Scy - Fix spelling error in man page and note defaults as no instead of 2216356345Scy off. 2217356345Scy 2218356345Scy26 April 2018: Wouter 2219356345Scy - Fix for crash in daemon_cleanup with dnstap during reload, 2220356345Scy from Saksham Manchanda. 2221356345Scy - Also that for dnscrypt. 2222356345Scy - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk 2223356345Scy is from here 1.7.2 in development. 2224356345Scy 2225356345Scy25 April 2018: Ralph 2226356345Scy - Fix memory leak when caching wildcard records for aggressive NSEC use 2227356345Scy 2228356345Scy24 April 2018: Wouter 2229356345Scy - Fix contrib/fastrpz.patch for this release. 2230356345Scy - Fix auth https for libev. 2231356345Scy 2232356345Scy24 April 2018: Ralph 2233356345Scy - Added root-key-sentinel support 2234356345Scy 2235356345Scy23 April 2018: Wouter 2236356345Scy - makedist uses bz2 for expat code, instead of tar.gz. 2237356345Scy - Fix #4092: libunbound: use-caps-for-id lacks colon in 2238356345Scy config_set_option. 2239356345Scy - auth zone http download stores exact copy of downloaded file, 2240356345Scy including comments in the file. 2241356345Scy - Fix sldns parse failure for CDS alternate delete syntax empty hex. 2242356345Scy - Attempt for auth zone fix; add of callback in mesh gets from 2243356345Scy callback does not skip callback of result. 2244356345Scy - Fix cname classification with qname minimisation enabled. 2245356345Scy - list_auth_zones unbound-control command. 2246356345Scy 2247356345Scy20 April 2018: Wouter 2248356345Scy - man page documentation for dns-over-tls forward-addr '#' notation. 2249356345Scy - removed free from failed parse case. 2250356345Scy - Fix #4091: Fix that reload of auth-zone does not merge the zonefile 2251356345Scy with the previous contents. 2252356345Scy - Delete auth zone when removed from config. 2253356345Scy 2254356345Scy19 April 2018: Wouter 2255356345Scy - Can set tls authentication with forward-addr: IP#tls.auth.name 2256356345Scy And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem". 2257356345Scy such as forward-addr: 9.9.9.9@853#dns.quad9.net or 2258356345Scy 1.1.1.1@853#cloudflare-dns.com 2259356345Scy - Fix #658: unbound using TLS in a forwarding configuration does not 2260356345Scy verify the server's certificate (RFC 8310 support). 2261356345Scy - For addr with #authname and no @port notation, the default is 853. 2262356345Scy 2263356345Scy18 April 2018: Wouter 2264356345Scy - Fix auth-zone retry timer to be on schedule with retry timeout, 2265356345Scy with backoff. Also time a refresh at the zone expiry. 2266356345Scy 2267356345Scy17 April 2018: Wouter 2268356345Scy - auth zone notify work. 2269356345Scy - allow-notify: config statement for auth-zones. 2270356345Scy - unit test for allow-notify 2271356345Scy 2272356345Scy16 April 2018: Wouter 2273356345Scy - Fix auth zone target lookup iterator. 2274356345Scy - auth zone notify with prefix 2275356345Scy - auth zone notify work. 2276356345Scy 2277356345Scy13 April 2018: Wouter 2278356345Scy - Fix for max include depth for authzones. 2279356345Scy - Fix memory free on fail for $INCLUDE in authzone. 2280356345Scy - Fix that an internal error to look up the wrong rr type for 2281356345Scy auth zone gets stopped, before trying to send there. 2282356345Scy - auth zone notify work. 2283356345Scy 2284356345Scy10 April 2018: Ralph 2285356345Scy - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN 2286356345Scy statistics counters. 2287356345Scy 2288356345Scy10 April 2018: Wouter 2289356345Scy - documentation for low-rtt and low-rtt-pct. 2290356345Scy - auth zone notify work. 2291356345Scy 2292356345Scy9 April 2018: Wouter 2293356345Scy - Fix that flush_zone sets prefetch ttl expired, so that with 2294356345Scy serve-expired enabled it'll start prefetching those entries. 2295356345Scy - num.query.authzone.up and num.query.authzone.down statistics counters. 2296356345Scy - Fix downstream auth zone, only fallback when auth zone fails to 2297356345Scy answer and fallback is enabled. 2298356345Scy - Accept both option names with and without colon for get_option 2299356345Scy and set_option. 2300356345Scy - low-rtt and low-rtt-pct in unbound.conf enable the server selection 2301356345Scy of fast servers for some percentage of the time. 2302356345Scy 2303356345Scy5 April 2018: Wouter 2304356345Scy - Combine write of tcp length and tcp query for dns over tls. 2305356345Scy - nitpick fixes in example.conf. 2306356345Scy - Fix above stub queries for type NS and useless delegation point. 2307356345Scy - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3 2308356345Scy tls_choose_sigalg routine does not allow the ciphers for the pipe, 2309356345Scy so use TLSv1.2. 2310356345Scy - ED448 support. 2311356345Scy 2312356345Scy3 April 2018: Wouter 2313356345Scy - Fix #4043: make test fails due to v6 presentation issue in macOS. 2314356345Scy - Fix unable to resolve after new WLAN connection, due to auth-zone 2315356345Scy failing with a forwarder set. Now, auth-zone is only used for 2316356345Scy answers (not referrals) when a forwarder is set. 2317356345Scy 2318356345Scy29 March 2018: Ralph 2319356345Scy - Check "result" in dup_all(), by Florian Obser. 2320356345Scy 2321356345Scy23 March 2018: Ralph 2322356345Scy - Fix unbound-control get_option aggressive-nsec 2323356345Scy 2324356345Scy21 March 2018: Ralph 2325356345Scy - Do not use cached NSEC records to generate negative answers for 2326356345Scy domains under DNSSEC Negative Trust Anchors. 2327356345Scy 2328356345Scy19 March 2018: Wouter 2329356345Scy - iana port update. 2330356345Scy 2331356345Scy16 March 2018: Wouter 2332356345Scy - corrected a minor typo in the changelog. 2333356345Scy - move htobe64/be64toh portability code to cachedb.c. 2334356345Scy 2335356345Scy15 March 2018: Wouter 2336356345Scy - Add --with-libhiredis, unbound support for a new cachedb backend 2337356345Scy that uses a Redis server as the storage. This implementation 2338356345Scy depends on the hiredis client library (https://redislabs.com/lp/hiredis/). 2339356345Scy And unbound should be built with both --enable-cachedb and 2340356345Scy --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h 2341356345Scy should exist). Patch from Jinmei Tatuya (Infoblox). 2342356345Scy - Fix #3817: core dump happens in libunbound delete, when queued 2343356345Scy servfail hits deleted message queue. 2344356345Scy - Create additional tls service interfaces by opening them on other 2345356345Scy portnumbers and listing the portnumbers as additional-tls-port: nr. 2346356345Scy 2347356345Scy13 March 2018: Wouter 2348356345Scy - Fix typo in documentation. 2349356345Scy - Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually 2350356345Scy flushed with serve-expired on. 2351356345Scy 2352356345Scy12 March 2018: Wouter 2353356345Scy - Added documentation for aggressive-nsec: yes. 2354356345Scy - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk 2355356345Scy now has 1.7.1 in development. 2356356345Scy - Fix #3727: Protocol name is TLS, options have been renamed but 2357356345Scy documentation is not consistent. 2358356345Scy - Check IXFR start serial. 2359356345Scy 2360356345Scy9 March 2018: Wouter 2361356345Scy - Fix #3598: Fix swig build issue on rhel6 based system. 2362356345Scy configure --disable-swig-version-check stops the swig version check. 2363356345Scy 2364356345Scy8 March 2018: Wouter 2365356345Scy - tag 1.7.0rc2. 2366356345Scy 2367356345Scy7 March 2018: Wouter 2368356345Scy - Fixed contrib/fastrpz.patch, even though this already applied 2369356345Scy cleanly for me, now also for others. 2370356345Scy - patch to log creates keytag queries, from A. Schulze. 2371356345Scy - patch suggested by Debian lintian: allow to -> allow one to, from 2372356345Scy A. Schulze. 2373356345Scy - Attempt to remove warning about trailing whitespace. 2374356345Scy 2375356345Scy6 March 2018: Wouter 2376356345Scy - Reverted fix for #3512, this may not be the best way forward; 2377356345Scy although it could be changed at a later time, to stay similar to 2378356345Scy other implementations. 2379356345Scy - svn trunk contains 1.7.0, this is the number for the next release. 2380356345Scy - Fix for windows compile. 2381356345Scy - tag 1.7.0rc1. 2382356345Scy 2383356345Scy5 March 2018: Wouter 2384356345Scy - Fix to check define of DSA for when openssl is without deprecated. 2385356345Scy - iana port update. 2386356345Scy - Fix #3582: Squelch address already in use log when reuseaddr option 2387356345Scy causes same port to be used twice for tcp connections. 2388356345Scy 2389356345Scy27 February 2018: Wouter 2390356345Scy - Fixup contrib/fastrpz.patch so that it applies. 2391356345Scy - Fix compile without threads, and remove unused variable. 2392356345Scy - Fix compile with staticexe and python module. 2393356345Scy - Fix nettle compile. 2394356345Scy 2395356345Scy22 February 2018: Ralph 2396356345Scy - Save wildcard RRset from answer with original owner for use in 2397356345Scy aggressive NSEC. 2398356345Scy 2399356345Scy21 February 2018: Wouter 2400356345Scy - Fix #3512: unbound incorrectly reports SERVFAIL for CAA query 2401356345Scy when there is a CNAME loop. 2402356345Scy - Fix validation for CNAME loops. When it detects a cname loop, 2403356345Scy by finding the cname, cname in the existing list, it returns 2404356345Scy the partial result with the validation result up to then. 2405356345Scy - more robust cachedump rrset routine. 2406356345Scy 2407356345Scy19 February 2018: Wouter 2408356345Scy - Fix #3505: Documentation for default local zones references 2409356345Scy wrong RFC. 2410356345Scy - Fix #3494: local-zone noview can be used to break out of the view 2411356345Scy to the global local zone contents, for queries for that zone. 2412356345Scy - Fix for more maintainable code in localzone. 2413356345Scy 2414356345Scy16 February 2018: Wouter 2415356345Scy - Fixes for clang static analyzer, the missing ; in 2416356345Scy edns-subnet/addrtree.c after the assert made clang analyzer 2417356345Scy produce a failure to analyze it. 2418356345Scy 2419356345Scy13 February 2018: Ralph 2420356345Scy - Aggressive NSEC tests 2421356345Scy 2422356345Scy13 February 2018: Wouter 2423356345Scy - tls-cert-bundle option in unbound.conf enables TLS authentication. 2424356345Scy - iana port update. 2425356345Scy 2426356345Scy12 February 2018: Wouter 2427356345Scy - Unit test for auth zone https url download. 2428356345Scy 2429356345Scy12 February 2018: Ralph 2430356345Scy - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) 2431356345Scy - Processed aggressive NSEC code review remarks Wouter 2432356345Scy 2433356345Scy8 February 2018: Ralph 2434356345Scy - Aggressive use of NSEC implementation. Use cached NSEC records to 2435356345Scy generate NXDOMAIN, NODATA and positive wildcard answers. 2436356345Scy 2437356345Scy8 February 2018: Wouter 2438356345Scy - iana port update. 2439356345Scy - auth zone url config. 2440356345Scy 2441356345Scy5 February 2018: Wouter 2442356345Scy - Fix #3451: dnstap not building when you have a separate build dir. 2443356345Scy And removed protoc warning, set dnstap.proto syntax to proto2. 2444356345Scy - auth-zone provides a way to configure RFC7706 from unbound.conf, 2445356345Scy eg. with auth-zone: name: "." for-downstream: no for-upstream: yes 2446356345Scy fallback-enabled: yes and masters or a zonefile with data. 2447356345Scy 2448356345Scy2 February 2018: Wouter 2449356345Scy - Fix unfreed locks in log and arc4random at exit of unbound. 2450356345Scy - unit test with valgrind 2451356345Scy - Fix lock race condition in dns cache dname synthesis. 2452356345Scy - lock subnet new item before insertion to please checklocks, 2453356345Scy no modification of critical regions outside of lock region. 2454356345Scy 2455356345Scy1 February 2018: Wouter 2456356345Scy - fix unaligned structure making a false positive in checklock 2457356345Scy unitialised memory. 2458356345Scy 2459356345Scy29 January 2018: Ralph 2460356345Scy - Use NSEC with longest ce to prove wildcard absence. 2461356345Scy - Only use *.ce to prove wildcard absence, no longer names. 2462356345Scy 2463356345Scy25 January 2018: Wouter 2464356345Scy - ltrace.conf file for libunbound in contrib. 2465356345Scy 2466356345Scy23 January 2018: Wouter 2467356345Scy - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file 2468356345Scy for startup scripts to get the full pathname(s) of anchor file(s). 2469356345Scy - Print fatal errors about remote control setup before log init, 2470356345Scy so that it is printed to console. 2471356345Scy 2472356345Scy22 January 2018: Wouter 2473356345Scy - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is 2474356345Scy also recognized and means the same. Also for tls-port, 2475356345Scy tls-service-key, tls-service-pem, stub-tls-upstream and 2476356345Scy forward-tls-upstream. 2477356345Scy - Fix #3397: Fix that cachedb could return a partial CNAME chain. 2478356345Scy - Fix #3397: Fix that when the cache contains an unsigned DNAME in 2479356345Scy the middle of a cname chain, a result without the DNAME could 2480356345Scy be returned. 2481356345Scy 2482356345Scy19 January 2018: Wouter 2483356345Scy - tag 1.6.8 for release with CVE fix. 2484356345Scy - trunk has 1.6.9 with fix and previous commits. 2485356345Scy - patch for CVE-2017-15105: vulnerability in the processing of 2486356345Scy wildcard synthesized NSEC records. 2487356345Scy - iana port update. 2488356345Scy - make depend: code dependencies updated in Makefile. 2489356345Scy 2490356345Scy4 January 2018: Ralph 2491356345Scy - Copy query and correctly set flags on REFUSED answers when cache 2492356345Scy snooping is not allowed. 2493356345Scy 2494356345Scy3 January 2018: Ralph 2495356345Scy - Fix queries being leaked above stub when refetching glue. 2496356345Scy 2497356345Scy2 January 2017: Wouter 2498356345Scy - Fix that DS queries with referral replies are answered straight 2499356345Scy away, without a repeat query picking the DS from cache. 2500356345Scy The correct reply should have been an answer, the reply is fixed 2501356345Scy by the scrubber to have the answer in the answer section. 2502356345Scy - Remove clang optimizer disable, 2503356345Scy Fix that expiration date checks don't fail with clang -O2. 2504356345Scy 2505356345Scy15 December 2017: Wouter 2506356345Scy - Fix timestamp failure because of clang optimizer failure, by 2507356345Scy disabling -O2 when the compiler --version is clang. 2508356345Scy - iana port update. 2509356345Scy - Also disable -flto for clang, to make incep-expi signature check 2510356345Scy work. 2511356345Scy 2512356345Scy12 December 2017: Ralph 2513356345Scy - Fix qname-minimisation documentation (A QTYPE, not NS) 2514356345Scy 2515356345Scy12 December 2017: Wouter 2516356345Scy - authzone work, transfer connect. 2517356345Scy 2518356345Scy7 December 2017: Ralph 2519356345Scy - Check whether --with-libunbound-only is set when using --with-nettle 2520356345Scy or --with-nss. 2521356345Scy 2522356345Scy4 December 2017: Wouter 2523356345Scy - Fix link failure on OmniOS. 2524356345Scy 2525356345Scy1 December 2017: Wouter 2526356345Scy - auth zone work. 2527356345Scy 2528356345Scy30 November 2017: Wouter 2529356345Scy - Fix #3299 - forward CNAME daisy chain is not working 2530356345Scy 2531356345Scy14 November 2017: Wouter 2532356345Scy - Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is 2533356345Scy set for stub zone. It no longer searches for DNSSEC information. 2534356345Scy - auth xfer work on probe timer and lookup. 2535356345Scy 2536356345Scy13 November 2017: Wouter 2537356345Scy - Fix #2801: Install libunbound.pc. 2538356345Scy - Fix qname minimisation to send AAAA queries at zonecut like type A. 2539356345Scy - reverted AAAA change. 2540356345Scy 2541356345Scy7 November 2017: Wouter 2542356345Scy - Fix #2492: Documentation libunbound. 2543356345Scy 2544356345Scy3 November 2017: Wouter 2545356345Scy - Fix #2362: TLS1.3/openssl-1.1.1 not working. 2546356345Scy - Fix #2034 - Autoconf and -flto. 2547356345Scy - Fix #2141 - for libsodium detect lack of entropy in chroot, print 2548356345Scy a message and exit. 2549356345Scy 2550356345Scy2 November 2017: Wouter 2551356345Scy - Fix #1913: ub_ctx_config is under circumstances thread-safe. 2552356345Scy - make ip-transparent option work on OpenBSD. 2553356345Scy 2554356345Scy31 October 2017: Wouter 2555356345Scy - Document that errno is left informative on libunbound config read 2556356345Scy fail. 2557356345Scy - lexer output. 2558356345Scy - iana port update. 2559356345Scy 2560356345Scy25 October 2017: Ralph 2561356345Scy - Fixed libunbound manual typo. 2562356345Scy - Fix #1949: [dnscrypt] make provider name mismatch more obvious. 2563356345Scy - Fix #2031: Double included headers 2564356345Scy 2565356345Scy24 October 2017: Ralph 2566356345Scy - Update B root ipv4 address. 2567356345Scy 2568356345Scy19 October 2017: Wouter 2569356345Scy - authzone work, probe timer setup. 2570356345Scy 2571356345Scy18 October 2017: Wouter 2572356345Scy - lint for recent authzone commit. 2573356345Scy 2574356345Scy17 October 2017: Wouter 2575356345Scy - Fix #1749: With harden-referral-path: performance drops, due to 2576356345Scy circular dependency in NS and DS lookups. 2577356345Scy - [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert 2578356345Scy duplicates 2579356345Scy - [dnscrypt] introduce dnscrypt-provider-cert-rotated option, 2580356345Scy from Manu Bretelle. 2581356345Scy This option allows handling multiple cert/key pairs while only 2582356345Scy distributing some of them. 2583356345Scy In order to reliably match a client magic with a given key without 2584356345Scy strong assumption as to how those were generated, we need both key and 2585356345Scy cert. Likewise, in order to know which ES version should be used. 2586356345Scy On the other hand, when rotating a cert, it can be desirable to only 2587356345Scy serve the new cert but still be able to handle clients that are still 2588356345Scy using the old certs's public key. 2589356345Scy The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not 2590356345Scy publish the cert as part of the DNS's provider_name's TXT answer. 2591356345Scy - Better documentation for cache-max-negative-ttl. 2592356345Scy - Work on local root zone code. 2593356345Scy 2594356345Scy10 October 2017: Wouter 2595356345Scy - tag 1.6.7 2596356345Scy - trunk has version 1.6.8. 2597356345Scy 2598356345Scy6 October 2017: Wouter 2599356345Scy - Fix spelling in unbound-control man page. 2600356345Scy 2601356345Scy5 October 2017: Wouter 2602356345Scy - Fix trust-anchor-signaling works in libunbound. 2603356345Scy - Fix some more crpls in testdata for different signaling default. 2604356345Scy - tag 1.6.7rc1 2605356345Scy 2606356345Scy5 October 2017: Ralph 2607356345Scy - Set trust-anchor-signaling default to yes 2608356345Scy - Use RCODE from A query on DNS64 synthesized answer. 2609356345Scy 2610356345Scy2 October 2017: Wouter 2611356345Scy - Fix param unused warning for windows exportsymbol compile. 2612356345Scy 2613356345Scy25 September 2017: Ralph 2614356345Scy - Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch 2615356345Scy (by Danilo G. Baio). 2616356345Scy 2617356345Scy21 September 2017: Ralph 2618356345Scy - Log name of looping module 2619356345Scy 2620356345Scy19 September 2017: Wouter 2621356345Scy - use a cachedb answer even if it's "expired" when serve-expired is yes 2622356345Scy (patch from Jinmei Tatuya). 2623356345Scy - trigger refetching of the answer in that case (this will bypass 2624356345Scy cachedb lookup) 2625356345Scy - allow storing a 0-TTL answer from cachedb in the in-memory message 2626356345Scy cache when serve-expired is yes 2627356345Scy - Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff. 2628356345Scy 2629356345Scy18 September 2017: Ralph 2630356345Scy - Fix #1400: allowing use of global cache on ECS-forwarding unless 2631356345Scy always-forward. 2632356345Scy 2633356345Scy18 September 2017: Wouter 2634356345Scy - tag 1.6.6 (is 1.6.6rc2) 2635356345Scy - Fix that looping modules always stop the query, and don't pass 2636356345Scy control. 2637356345Scy - Fix #1435: Please allow UDP to be disabled separately upstream and 2638356345Scy downstream. 2639356345Scy - Fix #1440: [dnscrypt] client nonce cache. 2640356345Scy 2641356345Scy15 September 2017: Wouter 2642356345Scy - Fix unbound-host to report error for DNSSEC state of failed lookups. 2643356345Scy - Spelling fixes, from Josh Soref. 2644356345Scy 2645356345Scy13 September 2017: Wouter 2646356345Scy - tag 1.6.6rc2, became 1.6.6 on 18 sep. trunk 1.6.7 in development. 2647356345Scy 2648356345Scy12 September 2017: Wouter 2649356345Scy - Add dns64 for client-subnet in unbound-checkconf. 2650356345Scy 2651356345Scy4 September 2017: Ralph 2652356345Scy - Fix #1412: QNAME minimisation strict mode not honored 2653356345Scy - Fix #1434: Fix windows openssl 1.1.0 linking. 2654356345Scy 2655356345Scy4 September 2017: Wouter 2656356345Scy - tag 1.6.6rc1 2657356345Scy - makedist fix for windows binaries, with openssl 1.1.0 windres fix, 2658356345Scy and expat 2.2.4 install target fix. 2659356345Scy 2660356345Scy1 September 2017: Wouter 2661356345Scy - Recommend 1472 buffer size in unbound.conf 2662356345Scy 2663356345Scy31 August 2017: Wouter 2664356345Scy - Fix #1424: cachedb:testframe is not thread safe. 2665356345Scy - For #1417: escape ; in dnscrypt tests. 2666356345Scy - but reverted that, tests fails with that escape. 2667356345Scy - Fix #1417: [dnscrypt] shared secret cache counters, and works when 2668356345Scy dnscrypt is not enabled. And cache size configuration option. 2669356345Scy - make depend 2670356345Scy - Fix #1418: [ip ratelimit] initialize slabhash using 2671356345Scy ip-ratelimit-slabs. 2672356345Scy 2673356345Scy30 August 2017: Wouter 2674356345Scy - updated contrib/fastrpz.patch to apply with configparser changes. 2675356345Scy - Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs. 2676356345Scy 2677356345Scy29 August 2017: Wouter 2678356345Scy - Fix #1414: fix segfault on parse failure and log_replies. 2679356345Scy - zero qinfo in handle_request, this zeroes local_alias and also the 2680356345Scy qname member. 2681356345Scy - new keys and certs for dnscrypt tests. 2682356345Scy - fixup WKS test on buildhost without servicebyname. 2683356345Scy 2684356345Scy28 August 2017: Wouter 2685356345Scy - Fix #1415: patch to free dnscrypt environment on reload. 2686356345Scy - iana portlist update 2687356345Scy - Fix #1415: [dnscrypt] shared secret cache, patch from 2688356345Scy Manu Bretelle. 2689356345Scy - Small fixes for the shared secret cache patch. 2690356345Scy - Fix WKS records on kvm autobuild host, with default protobyname 2691356345Scy entries for udp and tcp. 2692356345Scy 2693356345Scy23 August 2017: Wouter 2694356345Scy - Fix #1407: Add ECS options check to unbound-checkconf. 2695356345Scy - make depend 2696356345Scy - Fix to reclaim tcp handler when it is closed due to dnscrypt buffer 2697356345Scy allocation failure. 2698356345Scy 2699356345Scy22 August 2017: Wouter 2700356345Scy - Fix install of trust anchor when two anchors are present, makes both 2701356345Scy valid. Checks hash of DS but not signature of new key. This fixes 2702356345Scy the root.key file if created when unbound is installed between 2703356345Scy sep11 and oct11 2017. 2704356345Scy - tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix). 2705356345Scy - trunk version 1.6.6 in development. 2706356345Scy - Fix issue on macOX 10.10 where TCP fast open is detected but not 2707356345Scy implemented causing TCP to fail. The fix allows fallback to regular 2708356345Scy TCP in this case and is also more robust for cases where connectx() 2709356345Scy fails for some reason. 2710356345Scy - Fix #1402: squelch invalid argument error for fd_set_block on windows. 2711356345Scy 2712356345Scy10 August 2017: Wouter 2713356345Scy - Patch to show DNSCrypt status in help output, from Carsten 2714356345Scy Strotmann. 2715356345Scy 2716356345Scy8 August 2017: Wouter 2717356345Scy - Fix #1398: make cachedb secret configurable. 2718356345Scy - Remove spaces from Makefile. 2719356345Scy 2720356345Scy7 August 2017: Wouter 2721356345Scy - Fix #1397: Recursive DS lookups for AS112 zones names should recurse. 2722356345Scy 2723356345Scy3 August 2017: Ralph 2724356345Scy - Remove unused iter_env member (ip6arpa_dname) 2725356345Scy - Do not reset rrset.bogus stats when called using stats_noreset. 2726356345Scy - Added stats for queries that have been ratelimited by domain 2727356345Scy recursion. 2728356345Scy - Do not add rrset_bogus and query ratelimiting stats per thread, these 2729356345Scy module stats are global. 2730356345Scy 2731356345Scy3 August 2017: Wouter 2732356345Scy - Fix #1394: mix of serve-expired and response-ip could cause a crash. 2733356345Scy 2734356345Scy24 July 2017: Wouter 2735356345Scy - upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02), 2736356345Scy config.sub(2016-09-05). 2737356345Scy - annotate case statement fallthrough for gcc 7.1.1. 2738356345Scy - flex output from flex 2.6.1. 2739356345Scy - snprintf of thread number does not warn about truncated string. 2740356345Scy - squelch TCP fast open error on FreeBSD when kernel has it disabled, 2741356345Scy unless verbosity is high. 2742356345Scy - remove warning from windows compile. 2743356345Scy - Fix compile with libnettle 2744356345Scy - Fix DSA configure switch (--disable dsa) for libnettle and libnss. 2745356345Scy - Fix #1365: Add Ed25519 support using libnettle. 2746356345Scy - iana portlist update 2747356345Scy 2748356345Scy17 July 2017: Wouter 2749356345Scy - Fix #1350: make cachedb backend configurable (from JINMEI Tatuya). 2750356345Scy - Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor). 2751356345Scy With the -p option unbound does not create a pidfile. 2752356345Scy 2753356345Scy11 July 2017: Wouter 2754356345Scy - Fix #1344: RFC6761-reserved domains: test. and invalid. 2755356345Scy - Redirect all localhost names to localhost address for RFC6761. 2756356345Scy 2757356345Scy6 July 2017: Wouter 2758356345Scy - Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg. 2759356345Scy - Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists).. 2760356345Scy 2761356345Scy4 July 2017: Wouter 2762356345Scy - Fix 1332: Bump verbosity of failed chown'ing of the control socket. 2763356345Scy 2764356345Scy3 July 2017: Wouter 2765356345Scy - Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned 2766356345Scy on. 2767356345Scy - Fix #1331: libunbound segfault in threaded mode when context is 2768356345Scy deleted. 2769356345Scy - Fix pythonmod link line option flag. 2770356345Scy - Fix openssl 1.1.0 load of ssl error strings from ssl init. 2771356345Scy 2772356345Scy29 June 2017: Wouter 2773356345Scy - Fix python example0 return module wait instead of error for pass. 2774356345Scy - iana portlist update 2775356345Scy - enhancement for hardened-tls for DNS over TLS. Removed duplicated 2776356345Scy security settings. 2777356345Scy 2778356345Scy27 June 2017: Wouter 2779356345Scy - Tag 1.6.4 is created with the 1.6.4rc2 contents. 2780356345Scy - Trunk contains 1.6.5, with changes from 26, 27 june. 2781356345Scy - Remove signed unsigned warning from authzone. 2782356345Scy - Fix that infra cache host hash does not change after reconfig. 2783356345Scy 2784356345Scy26 June 2017: Wouter 2785356345Scy - (for 1.6.5) 2786356345Scy Better fixup of dnscrypt_cert_chacha test for different escapes. 2787356345Scy - First fix for zero b64 and hex text zone format in sldns. 2788356345Scy - unbound-control dump_infra prints port number for address if not 53. 2789356345Scy 2790356345Scy23 June 2017: Wouter 2791356345Scy - (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle). 2792356345Scy 2793356345Scy22 June 2017: Wouter 2794356345Scy - Tag 1.6.4rc2 2795356345Scy 2796356345Scy22 June 2017: Ralph 2797356345Scy - Added fastrpz patch to contrib 2798356345Scy 2799356345Scy21 June 2017: Wouter 2800356345Scy - Fix #1316: heap read buffer overflow in parse_edns_options. 2801356345Scy 2802356345Scy20 June 2017: Wouter 2803356345Scy - Fix warning in pythonmod under clang compiler. 2804356345Scy - Tag 1.6.4rc1 2805356345Scy - Fix lintian typo. 2806356345Scy 2807356345Scy16 June 2017: Ralph 2808356345Scy - Fix #1277: disable domain ratelimit by setting value to 0. 2809356345Scy 2810356345Scy16 June 2017: Wouter 2811356345Scy - Fix #1301: memory leak in respip and tests. 2812356345Scy - Free callback in edns-subnetmod on exit and restart. 2813356345Scy - Fix memory leak in sldns_buffer_new_frm_data. 2814356345Scy - Fix memory leak in dnscrypt config read. 2815356345Scy - Fix dnscrypt chacha cert support ifdefs. 2816356345Scy - Fix dnscrypt chacha cert unit test escapes in grep. 2817356345Scy - Remove asynclook tests that cause test and purifier problems. 2818356345Scy - Fix to unlock view in view test. 2819356345Scy 2820356345Scy15 June 2017: Wouter 2821356345Scy - Fix stub zone queries leaking to the internet for 2822356345Scy harden-referral-path ns checks. 2823356345Scy - Fix query for refetch_glue of stub leaking to internet. 2824356345Scy 2825356345Scy13 June 2017: Wouter 2826356345Scy - Fix #1279: Memory leak on reload when python module is enabled. 2827356345Scy - Fix #1280: Unbound fails assert when response from authoritative 2828356345Scy contains malformed qname. When 0x20 caps-for-id is enabled, when 2829356345Scy assertions are not enabled the malformed qname is handled correctly. 2830356345Scy - 1.6.3 tag created, with only #1280 fix, trunk is 1.6.4 development. 2831356345Scy - More fixes in depth for buffer checks in 0x20 qname checks. 2832356345Scy 2833356345Scy12 June 2017: Wouter 2834356345Scy - Fix #1278: Incomplete wildcard proof. 2835356345Scy 2836356345Scy8 June 2017: Ralph 2837356345Scy - Added domain name based ECS whitelist. 2838356345Scy 2839356345Scy8 June 2017: Wouter 2840356345Scy - Detect chacha for dnscrypt at configure time. 2841356345Scy - dnscrypt unit tests with chacha. 2842356345Scy 2843356345Scy7 June 2017: Wouter 2844356345Scy - Fix that unbound-control can set val_clean_additional and val_permissive_mode. 2845356345Scy - Add dnscrypt XChaCha20 tests. 2846356345Scy 2847356345Scy6 June 2017: Wouter 2848356345Scy - Add an explicit type cast for TCP FASTOPEN fix. 2849356345Scy - renumbering B-Root's IPv6 address to 2001:500:200::b. 2850356345Scy - Fix #1275: cached data in cachedb is never used. 2851356345Scy - Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher. 2852356345Scy 2853356345Scy1 June 2017: Ralph 2854356345Scy - Fix #1274: automatically trim chroot path from dnscrypt key/cert paths 2855356345Scy (from Manu Bretelle). 2856356345Scy 2857356345Scy1 June 2017: Wouter 2858356345Scy - Fix fastopen EPIPE fallthrough to perform connect. 2859356345Scy 2860356345Scy31 May 2017: Ralph 2861356345Scy - Also use global local-zones when there is a matching view that does 2862356345Scy not have any local-zone specified. 2863356345Scy 2864356345Scy31 May 2017: Wouter 2865356345Scy - Fix #1273: cachedb.c doesn't compile with -Wextra. 2866356345Scy - If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write. 2867356345Scy 2868356345Scy30 May 2017: Ralph 2869356345Scy - Fix #1269: inconsistent use of built-in local zones with views. 2870356345Scy - Add defaults for new local-zone trees added to views using 2871356345Scy unbound-control. 2872356345Scy 2873356345Scy30 May 2017: Wouter 2874356345Scy - Support for openssl EVP_DigestVerify. 2875356345Scy - Support for the ED25519 algorithm with openssl (from openssl 1.1.1). 2876356345Scy 2877356345Scy29 May 2017: Wouter 2878356345Scy - Fix assertion for low buffer size and big edns payload when worker 2879356345Scy overrides udpsize. 2880356345Scy 2881356345Scy26 May 2017: Ralph 2882356345Scy - Added redirect-bogus.patch to contrib directory. 2883356345Scy 2884356345Scy26 May 2017: Wouter 2885356345Scy - Fix #1270: unitauth.c doesn't compile with higher warning level 2886356345Scy and optimization 2887356345Scy - exec_prefix is by default equal to prefix. 2888356345Scy - printout localzone for duplicate local-zone warnings. 2889356345Scy 2890356345Scy24 May 2017: Wouter 2891356345Scy - authzone cname chain, no rrset duplicates, wildcard doesn't change 2892356345Scy rrsets added for cname chain. 2893356345Scy 2894356345Scy23 May 2017: Wouter 2895356345Scy - first services/authzone check in, it compiles and reads and writes 2896356345Scy zonefiles. 2897356345Scy - iana portlist update 2898356345Scy 2899356345Scy22 May 2017: Wouter 2900356345Scy - Fix #1268: SIGSEGV after log_reopen. 2901356345Scy 2902356345Scy18 May 2017: Wouter 2903356345Scy - Fix #1265 to use /bin/kill. 2904356345Scy - Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs, 2905356345Scy and compatibility with BoringSSL. 2906356345Scy 2907356345Scy17 May 2017: Wouter 2908356345Scy - Fix #1265: contrib/unbound.service contains hardcoded path. 2909356345Scy 2910356345Scy17 May 2017: George 2911356345Scy - Use qstate's region for IPSECKEY rrset (ipsecmod). 2912356345Scy 2913356345Scy16 May 2017: George 2914356345Scy - Implemented opportunistic IPsec support module (ipsecmod). 2915356345Scy - Some whitespace fixup. 2916356345Scy 2917356345Scy16 May 2017: Wouter 2918356345Scy - updated dependencies in the makefile. 2919356345Scy - document trust-anchor-signaling in example config file. 2920356345Scy - updated configure, dependencies and flex output. 2921356345Scy - better module memory lookup, fix of unbound-control shm names for 2922356345Scy module memory printout of statistics. 2923356345Scy - Fix type AVC sldns rrdef. 2924356345Scy 2925356345Scy12 May 2017: Wouter 2926356345Scy - Adjust servfail by iterator to not store in cache when serve-expired 2927356345Scy is enabled, to avoid overwriting useful information there. 2928356345Scy - Fix queries for nameservers under a stub leaking to the internet. 2929356345Scy 2930356345Scy9 May 2017: Ralph 2931356345Scy - Add 'c' to getopt() in testbound. 2932356345Scy - iana portlist update 2933356345Scy 2934356345Scy8 May 2017: Wouter 2935356345Scy - Fix tcp-mss failure printout text. 2936356345Scy - Set SO_REUSEADDR on outgoing tcp connections to fix the bind before 2937356345Scy connect limited tcp connections. With the option tcp connections 2938356345Scy can share the same source port (for different destinations). 2939356345Scy 2940356345Scy2 May 2017: Ralph 2941356345Scy - Added mesh_add_sub to add detached mesh entries. 2942356345Scy - Use mesh_add_sub for key tag signaling query. 2943356345Scy 2944356345Scy2 May 2017: Wouter 2945356345Scy - Added test for leak of stub information. 2946356345Scy - Fix sldns wire2str printout of RR type CAA tags. 2947356345Scy - Fix sldns int16_data parse. 2948356345Scy - Fix sldns parse and printout of TSIG RRs. 2949356345Scy - sldns SMIMEA and AVC definitions, same as getdns definitions. 2950356345Scy 2951356345Scy1 May 2017: Wouter 2952356345Scy - Fix #1259: "--disable-ecdsa" argument overwritten 2953356345Scy by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c". 2954356345Scy - iana portlist update 2955356345Scy - Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start. 2956356345Scy and fix that 64bit getting installed in C:\Program Files (x86). 2957356345Scy 2958356345Scy26 April 2017: Ralph 2959356345Scy - Implemented trust anchor signaling using key tag query. 2960356345Scy 2961356345Scy26 April 2017: Wouter 2962356345Scy - Based on #1257: check parse limit before t increment in sldns RR 2963356345Scy string parse routine. 2964356345Scy 2965356345Scy24 April 2017: Wouter 2966356345Scy - unbound-checkconf -o allows query of dnstap config variables. 2967356345Scy Also unbound-control get_option. Also for dnscrypt. 2968356345Scy - trunk contains 1.6.3 version number (changes from 1.6.2 back from 2969356345Scy when the 1.6.2rc1 tag has been created). 2970356345Scy 2971356345Scy21 April 2017: Ralph 2972356345Scy - Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle). 2973356345Scy - iana portlist update 2974356345Scy 2975356345Scy18 April 2017: Ralph 2976356345Scy - Fix #1252: more indentation inconsistencies. 2977356345Scy - Fix #1253: unused variable in edns-subnet/addrtree.c:getbit(). 2978356345Scy 2979356345Scy13 April 2017: Ralph 2980356345Scy - Added ECS unit test (from Manu Bretelle). 2981356345Scy - ECS documentation fix (from Manu Bretelle). 2982356345Scy 2983356345Scy13 April 2017: Wouter 2984356345Scy - Fix #1250: inconsistent indentation in services/listen_dnsport.c. 2985356345Scy - tag for 1.6.2rc1 2986356345Scy - (for 1.6.3:) unbound.h exports the shm stats structures. They use 2987356345Scy type long long and no ifdefs, and ub_ before the typenames. 2988356345Scy 2989356345Scy12 April 2017: Wouter 2990356345Scy - subnet mem value is available in shm, also when not enabled, 2991356345Scy to make the struct easier to memmap by other applications, 2992356345Scy independent of the configuration of unbound. 2993356345Scy 2994356345Scy12 April 2017: Ralph 2995356345Scy - Fix #1247: unbound does not shorten source prefix length when 2996356345Scy forwarding ECS. 2997356345Scy - Properly check for allocation failure in local_data_find_tag_datas. 2998356345Scy - Fix #1249: unbound doesn't return FORMERR to bogus ECS. 2999356345Scy - Set SHM ECS memory usage to 0 when module not loaded. 3000356345Scy 3001356345Scy11 April 2017: Ralph 3002356345Scy - Display ECS module memory usage. 3003356345Scy 3004356345Scy10 April 2017: Wouter 3005356345Scy - harden-algo-downgrade: no also makes unbound more lenient about 3006356345Scy digest algorithms in DS records. 3007356345Scy 3008356345Scy10 April 2017: Ralph 3009356345Scy - Remove ECS option after REFUSED answer. 3010356345Scy - Fix small memory leak in edns_opt_copy_alloc. 3011356345Scy - Respip dereference after NULL check. 3012356345Scy - Zero initialize addrtree allocation. 3013356345Scy - Use correct identifier for SHM destroy. 3014356345Scy 3015356345Scy7 April 2017: George 3016356345Scy - Fix pythonmod for cb changes. 3017356345Scy - Some whitespace fixup. 3018356345Scy 3019356345Scy7 April 2017: Ralph 3020356345Scy - Unlock view in respip unit test 3021356345Scy 3022356345Scy6 April 2017: Ralph 3023356345Scy - Generalise inplace callback (de)registration 3024356345Scy - (de)register inplace callbacks for module id 3025356345Scy - No unbound-control set_option for ECS options 3026356345Scy - Deprecated client-subnet-opcode config option 3027356345Scy - Introduced client-subnet-always-forward config option 3028356345Scy - Changed max-client-subnet-ipv6 default to 56 (as in RFC) 3029356345Scy - Removed extern ECS config options 3030356345Scy - module_restart_next now calls clear on all following modules 3031356345Scy - Also create ECS module qstate on module_event_pass event 3032356345Scy - remove malloc from inplace_cb_register 3033356345Scy 3034356345Scy6 April 2017: Wouter 3035356345Scy - Small fixup for documentation. 3036356345Scy - iana portlist update 3037356345Scy - Fix respip for braces when locks arent used. 3038356345Scy - Fix pythonmod for cb changes. 3039356345Scy 3040356345Scy4 April 2017: Wouter 3041356345Scy - Fix #1244: document that use of chroot requires trust anchor file to 3042356345Scy be under chroot. 3043356345Scy - iana portlist update 3044356345Scy 3045356345Scy3 April 2017: Ralph 3046356345Scy - Do not add current time twice to TTL before ECS cache store. 3047356345Scy - Do not touch rrset cache after ECS cache message generation. 3048356345Scy - Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode. 3049356345Scy 3050356345Scy3 April 2017: Wouter 3051356345Scy - Fix #1217: Add metrics to unbound-control interface showing 3052356345Scy crypted, cert request, plaintext and malformed queries (from 3053356345Scy Manu Bretelle). 3054356345Scy - iana portlist update 3055356345Scy 3056356345Scy27 March 2017: Wouter 3057356345Scy - Remove (now unused) event2 include from dnscrypt code. 3058356345Scy 3059356345Scy24 March 2017: George 3060356345Scy - Fix to prevent non-referal query from being cached as referal when the 3061356345Scy no_cache_store flag was set. 3062356345Scy 3063356345Scy23 March 2017: Wouter 3064356345Scy - Fix #1239: configure fails to find python distutils if python 3065356345Scy prints warning. 3066356345Scy 3067356345Scy22 March 2017: Wouter 3068356345Scy - Fix #1238: segmentation fault when adding through the remote 3069356345Scy interface a per-view local zone to a view with no previous 3070356345Scy (configured) local zones. 3071356345Scy - Fix #1229: Systemd service sandboxing, options in wrong sections. 3072356345Scy 3073356345Scy21 March 2017: Ralph 3074356345Scy - Merge EDNS Client subnet implementation from feature branch into main 3075356345Scy branch, using new EDNS processing framework. 3076356345Scy 3077356345Scy21 March 2017: Wouter 3078356345Scy - Fix doxygen for dnscrypt files. 3079356345Scy 3080356345Scy20 March 2017: Wouter 3081356345Scy - #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then 3082356345Scy enabled in the config file from Manu Bretelle. 3083356345Scy - make depend, autoconf, remove warnings about statement before var. 3084356345Scy - lru_demote and lruhash_insert_or_retrieve functions for getdns. 3085356345Scy - fixup for lruhash (whitespace and header file comment). 3086356345Scy - dnscrypt tests. 3087356345Scy 3088356345Scy17 March 2017: Wouter 3089356345Scy - Patch for view functionality for local-data-ptr from Bj��rn Ketelaars. 3090356345Scy - Fix #1237 - Wrong resolving in chain, for norec queries that get 3091356345Scy SERVFAIL returned. 3092356345Scy 3093356345Scy16 March 2017: Wouter 3094356345Scy - Fix that SHM is not inited if not enabled. 3095356345Scy - Add trustanchor.unbound CH TXT that gets a response with a number 3096356345Scy of TXT RRs with a string like "example.com. 2345 1234" with 3097356345Scy the trust anchors and their keytags. 3098356345Scy - Fix that looped DNAMEs do not cause unbound to spend effort. 3099356345Scy - trustanchor tags are sorted. reusable routine to fetch taglist. 3100356345Scy 3101356345Scy13 March 2017: Wouter 3102356345Scy - testbound understands Deckard MATCH rcode question answer commands. 3103356345Scy - Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead 3104356345Scy of YXDOMAIN + query loop, reported by Petr Spacek. 3105356345Scy 3106356345Scy10 March 2017: Wouter 3107356345Scy - Fix #1234: shortening DNAME loop produces duplicate DNAME records 3108356345Scy in ANSWER section. 3109356345Scy 3110356345Scy9 March 2017: Wouter 3111356345Scy - --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and 3112356345Scy DS records. NSEC3 is not disabled. 3113356345Scy - fake-sha1 test option; print warning if used. To make unit tests. 3114356345Scy - unbound-control list local zone and data commands listed in the 3115356345Scy help output. 3116356345Scy 3117356345Scy8 March 2017: Wouter 3118356345Scy - make depend for build dependencies. 3119356345Scy - swig version 2.0.1 required. 3120356345Scy - fix enum conversion warnings 3121356345Scy 3122356345Scy7 March 2017: Wouter 3123356345Scy - Fix #1230: swig version 2.0.0 is required for pythonmod, with 3124356345Scy 1.3.40 it crashes when running repeatly unbound-control reload. 3125356345Scy - Response actions based on IP address from Jinmei Tatuya (Infoblox). 3126356345Scy 3127356345Scy6 March 2017: Wouter 3128356345Scy - Fix #1229: Systemd service sandboxing in contrib/unbound.service. 3129356345Scy - iana portlist update 3130356345Scy 3131356345Scy28 February 2017: Ralph 3132356345Scy - Fix testpkts.c, check if DO bit is set, not only if there is an OPT 3133356345Scy record. 3134356345Scy 3135356345Scy28 February 2017: Wouter 3136356345Scy - For #1227: if we have sha256, set the cipher list to have no 3137356345Scy known vulns. 3138356345Scy 3139356345Scy27 February 2017: Wouter 3140356345Scy - Fix #1227: Fix that Unbound control allows weak ciphersuits. 3141356345Scy - Fix #1226: provide official 32bit binary for windows. 3142356345Scy 3143356345Scy24 February 2017: Wouter 3144356345Scy - include sys/time.h for new shm code on NetBSD. 3145356345Scy 3146356345Scy23 February 2017: Wouter 3147356345Scy - Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to 3148356345Scy redirect. 3149356345Scy - Patch from Luiz Fernando Softov for Stats Shared Memory. 3150356345Scy - unbound-control stats_shm command prints stats using shared memory, 3151356345Scy which uses less cpu. 3152356345Scy - make depend, autoconf, doxygen and lint fixed up. 3153356345Scy 3154356345Scy22 February 2017: Wouter 3155356345Scy - Fix #1224: Fix that defaults should not fall back to "Program Files 3156356345Scy (x86) if Unbound is 64bit by default on windows. 3157356345Scy 3158356345Scy21 February 2017: Wouter 3159356345Scy - iana portlist update 3160356345Scy 3161356345Scy16 February 2017: Wouter 3162356345Scy - sldns updated for vfixed and buffer resize indication from getdns. 3163356345Scy 3164356345Scy15 February 2017: Wouter 3165356345Scy - sldns has ED25519 and ED448 algorithm number and name for display. 3166356345Scy 3167356345Scy14 February 2017: Wouter 3168356345Scy - tag 1.6.1rc3. -- which became 1.6.1 on 21feb, trunk has 1.6.2 3169356345Scy 3170356345Scy13 February 2017: Wouter 3171356345Scy - Fix autoconf of systemd check for lack of pkg-config. 3172356345Scy 3173356345Scy10 February 2017: Wouter 3174356345Scy - Fix pythonmod for typedef changes. 3175356345Scy - Fix dnstap for warning of set but not used. 3176356345Scy - tag 1.6.1rc2. 3177356345Scy 3178356345Scy9 February 2017: Wouter 3179356345Scy - tag 1.6.1rc1. 3180356345Scy 3181356345Scy8 February 2017: Wouter 3182356345Scy - Fix for type name change and fix warning on windows compile. 3183356345Scy 3184356345Scy7 February 2017: Wouter 3185356345Scy - Include root trust anchor id 20326 in unbound-anchor. 3186356345Scy 3187356345Scy6 February 2017: Wouter 3188356345Scy - Fix compile on solaris of the fix to use $host detect. 3189356345Scy 3190356345Scy4 February 2017: Wouter 3191356345Scy - fix root_anchor test for updated icannbundle.pem lower certificates. 3192356345Scy 3193356345Scy26 January 2017: Wouter 3194356345Scy - Fix 1211: Fix can't enable interface-automatic if no IPv6 with 3195356345Scy more helpful error message. 3196356345Scy 3197356345Scy20 January 2017: Wouter 3198356345Scy - Increase MAX_MODULE to 16. 3199356345Scy 3200356345Scy19 January 2017: Wouter 3201356345Scy - Fix to Rename ub_callback_t to ub_callback_type, because POSIX 3202356345Scy reserves _t typedefs. 3203356345Scy - Fix to rename internally used types from _t to _type, because _t 3204356345Scy type names are reserved by POSIX. 3205356345Scy - iana portlist update 3206356345Scy 3207356345Scy12 January 2017: Wouter 3208356345Scy - Fix to also block meta types 128 through to 248 with formerr. 3209356345Scy - Fix #1206: Some view-related commands are missing from 'unbound-control -h' 3210356345Scy 3211356345Scy9 January 2017: Wouter 3212356345Scy - Fix #1202: Fix code comment that packed_rrset_data is not always 3213356345Scy 'packed'. 3214356345Scy 3215356345Scy6 January 2017: Wouter 3216356345Scy - Fix #1201: Fix missing unlock in answer_from_cache error condition. 3217356345Scy 3218356345Scy5 January 2017: Wouter 3219356345Scy - Fix to return formerr for queries for meta-types, to avoid 3220356345Scy packet amplification if this meta-type is sent on to upstream. 3221356345Scy - Fix #1184: Log DNS replies. This includes the same logging 3222356345Scy information that DNS queries and response code and response size, 3223356345Scy patch from Larissa Feng. 3224356345Scy - Fix #1187: Source IP rate limiting, patch from Larissa Feng. 3225356345Scy 3226356345Scy3 January 2017: Wouter 3227356345Scy - configure --enable-systemd and lets unbound use systemd sockets if 3228356345Scy you enable use-systemd: yes in unbound.conf. 3229356345Scy Also there are contrib/unbound.socket and contrib/unbound.service: 3230356345Scy systemd files for unbound, install them in /usr/lib/systemd/system. 3231356345Scy Contributed by Sami Kerola and Pavel Odintsov. 3232356345Scy - Fix reload chdir failure when also chrooted to that directory. 3233356345Scy 3234356345Scy2 January 2017: Wouter 3235356345Scy - Fix #1194: Cross build fails when $host isn't `uname` for getentropy. 3236356345Scy 3237356345Scy23 December 2016: Ralph 3238356345Scy - Fix #1190: Do not echo back EDNS options in local-zone error response. 3239356345Scy - iana portlist update 3240356345Scy 3241356345Scy21 December 2016: Ralph 3242356345Scy - Fix #1188: Unresolved symbol 'fake_dsa' in libunbound.so when built 3243356345Scy with Nettle 3244356345Scy 3245356345Scy19 December 2016: Ralph 3246356345Scy - Fix #1191: remove comment about view deletion. 3247356345Scy 3248356345Scy15 December 2016: Wouter 3249356345Scy - iana portlist update 3250356345Scy - 64bit is default for windows builds. 3251356345Scy - Fix inet_ntop and inet_pton warnings in windows compile. 3252356345Scy 3253356345Scy14 December 2016: Wouter 3254356345Scy - Fix #1178: attempt to fix setup error at end, pop result values 3255356345Scy at end of install. 3256356345Scy 3257356345Scy13 December 2016: Wouter 3258356345Scy - Fix #1182: Fix Resource leak (socket), at startup. 3259356345Scy - Fix unbound-control and ipv6 only. 3260356345Scy 3261356345Scy9 December 2016: Wouter 3262356345Scy - Fix #1176: stack size too small for Alpine Linux. 3263356345Scy 3264356345Scy8 December 2016: Wouter 3265356345Scy - Fix downcast warnings from visual studio in sldns code. 3266356345Scy - tag 1.6.0rc1 which became 1.6.0 on 15 dec, and trunk is 1.6.1. 3267356345Scy 3268356345Scy7 December 2016: Ralph 3269356345Scy - Add DSA support for OpenSSL 1.1.0 3270356345Scy - Fix remote control without cert for LibreSSL 3271356345Scy 3272356345Scy6 December 2016: George 3273356345Scy - Added generic EDNS code for registering known EDNS option codes, 3274356345Scy bypassing the cache response stage and uniquifying mesh states. Four EDNS 3275356345Scy option lists were added to module_qstate (module_qstate.edns_opts_*) to 3276356345Scy store EDNS options from/to front/back side. 3277356345Scy - Added two flags to module_qstate (no_cache_lookup, no_cache_store) that 3278356345Scy control the modules' cache interactions. 3279356345Scy - Added code for registering inplace callback functions. The registered 3280356345Scy functions can be called just before replying with local data or Chaos, 3281356345Scy replying from cache, replying with SERVFAIL, replying with a resolved 3282356345Scy query, sending a query to a nameserver. The functions can inspect the 3283356345Scy available data and maybe change response/query related data (i.e. append 3284356345Scy EDNS options). 3285356345Scy - Updated Python module for the above. 3286356345Scy - Updated Python documentation. 3287356345Scy 3288356345Scy5 December 2016: Ralph 3289356345Scy - Fix #1173: differ local-zone type deny from unset 3290356345Scy tag_actions element. 3291356345Scy 3292356345Scy5 December 2016: Wouter 3293356345Scy - Fix #1170: document that 'inform' local-zone uses local-data. 3294356345Scy 3295356345Scy1 December 2016: Ralph 3296356345Scy - hyphen as minus fix, by Andreas Schulze 3297356345Scy 3298356345Scy30 November 2016: Ralph 3299356345Scy - Added local-zones and local-data bulk addition and removal 3300356345Scy functionality in unbound-control (local_zones, local_zones_remove, 3301356345Scy local_datas and local_datas_remove). 3302356345Scy - iana portlist update 3303356345Scy 3304356345Scy29 November 2016: Wouter 3305356345Scy - version 1.6.0 is in the development branch. 3306356345Scy - braces in view.c around lock statements. 3307356345Scy 3308356345Scy28 November 2016: Wouter 3309356345Scy - new install-sh. 3310356345Scy 3311356345Scy25 November 2016: Wouter 3312356345Scy - Fix that with openssl 1.1 control-use-cert: no uses less cpu, by 3313356345Scy using no encryption over the unix socket. 3314356345Scy 3315356345Scy22 Novenber 2016: Ralph 3316356345Scy - Make access-control-tag-data RDATA absolute. This makes the RDATA 3317356345Scy origin consistent between local-data and access-control-tag-data. 3318356345Scy - Fix NSEC ENT wildcard check. Matching wildcard does not have to be a 3319356345Scy subdomain of the NSEC owner. 3320356345Scy - QNAME minimisation uses QTYPE=A, therefore always check cache for 3321356345Scy this type in harden-below-nxdomain functionality. 3322356345Scy - Added unit test for QNAME minimisation + harden below nxdomain 3323356345Scy synergy. 3324356345Scy 3325356345Scy22 November 2016: Wouter 3326356345Scy - iana portlist update. 3327356345Scy - Fix unit tests for DS hash processing for fake-dsa test option. 3328356345Scy - patch from Dag-Erling Smorgrav that removes code that relies 3329356345Scy on sbrk(). 3330356345Scy 3331356345Scy21 November 2016: Wouter 3332356345Scy - Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing 3333356345Scy Underneath" for the harden-below-nxdomain option. 3334356345Scy 3335356345Scy10 November 2016: Ralph 3336356345Scy - Fix #1155: test status code of unbound-control in 04-checkconf, 3337356345Scy not the status code from the tee command. 3338356345Scy 3339356345Scy4 November 2016: Ralph 3340356345Scy - Added stub-ssl-upstream and forward-ssl-upstream options. 3341356345Scy 3342356345Scy4 November 2016: Wouter 3343356345Scy - configure detects ssl security level API function in the autoconf 3344356345Scy manner. Every function on its own, so that other libraries (eg. 3345356345Scy LibreSSL) can develop their API without hindrance. 3346356345Scy - Fix #1154: segfault when reading config with duplicate zones. 3347356345Scy - Note that for harden-below-nxdomain the nxdomain must be secure, 3348356345Scy this means nsec3 with optout is insufficient. 3349356345Scy 3350356345Scy3 November 2016: Ralph 3351356345Scy - Set OpenSSL security level to 0 when using aNULL ciphers. 3352356345Scy 3353356345Scy3 November 2016: Wouter 3354356345Scy - .gitattributes line for githubs code language display. 3355356345Scy - log-identity: config option to set sys log identity, patch from 3356356345Scy "Robin H. Johnson" <robbat2@gentoo.org> 3357356345Scy 3358356345Scy2 November 2016: Wouter 3359356345Scy - iana portlist update. 3360356345Scy 3361356345Scy31 October 2016: Wouter 3362356345Scy - Fix failure to build on arm64 with no sbrk. 3363356345Scy - iana portlist update. 3364356345Scy 3365356345Scy28 October 2016: Wouter 3366356345Scy - Patch for server.num.zero_ttl stats for count of expired replies, 3367356345Scy from Pavel Odintsov. 3368356345Scy 3369356345Scy26 October 2016: Wouter 3370356345Scy - Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled 3371356345Scy with the undocumented switch 'fake-dsa'. It logs a warning. 3372356345Scy 3373356345Scy25 October 2016: Wouter 3374356345Scy - Fix #1134: unbound-control set_option -- val-override-date: -1 works 3375356345Scy immediately to ignore datetime, or back to 0 to enable it again. 3376356345Scy The -- is to ignore the '-1' as an option flag. 3377356345Scy 3378356345Scy24 October 2016: Wouter 3379356345Scy - serve-expired config option: serve expired responses with TTL 0. 3380356345Scy - g.root-servers.net has AAAA address. 3381356345Scy 3382356345Scy21 October 2016: Wouter 3383356345Scy - Ported tests for local_cname unit test to testbound framework. 3384356345Scy 3385356345Scy20 October 2016: Wouter 3386356345Scy - suppress compile warning in lex files. 3387356345Scy - init lzt variable, for older gcc compiler warnings. 3388356345Scy - fix --enable-dsa to work, instead of copying ecdsa enable. 3389356345Scy - Fix DNSSEC validation of query type ANY with DNAME answers. 3390356345Scy - Fixup query_info local_alias init. 3391356345Scy 3392356345Scy19 October 2016: Wouter 3393356345Scy - Fix #1130: whitespace in example.conf.in more consistent. 3394356345Scy 3395356345Scy18 October 2016: Wouter 3396356345Scy - Patch that resolves CNAMEs entered in local-data conf statements that 3397356345Scy point to data on the internet, from Jinmei Tatuya (Infoblox). 3398356345Scy - Removed patch comments from acllist.c and msgencode.c 3399356345Scy - Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, 3400356345Scy from Jinmei Tatuya (Infoblox). 3401356345Scy - Fix #1125: unbound could reuse an answer packet incorrectly for 3402356345Scy clients with different EDNS parameters, from Jinmei Tatuya. 3403356345Scy - Fix #1118: libunbound.pc sets strange Libs, Libs.private values. 3404356345Scy - Added Requires line to libunbound.pc 3405356345Scy - Please doxygen by modifying mesh.h 3406356345Scy 3407356345Scy17 October 2016: Wouter 3408356345Scy - Re-fix #839 from view commit overwrite. 3409356345Scy - Fixup const void cast warning. 3410356345Scy 3411356345Scy12 October 2016: Ralph 3412356345Scy - Free view config elements. 3413356345Scy 3414356345Scy11 October 2016: Ralph 3415356345Scy - Added qname-minimisation-strict config option. 3416356345Scy - iana portlist update. 3417356345Scy - fix memoryleak logfile when in debug mode. 3418356345Scy 3419356345Scy5 October 2016: Ralph 3420356345Scy - Added views functionality. 3421356345Scy - Fix #1117: spelling errors, from Robert Edmonds. 3422356345Scy 3423356345Scy30 September 2016: Wouter 3424356345Scy - Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav. 3425356345Scy 3426356345Scy29 September 2016: Wouter 3427356345Scy - Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX. 3428356345Scy - Fix #839: Memory grows unexpectedly with large RPZ files. 3429356345Scy - Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile. 3430356345Scy - Fix #841: big local-zone's make it consume large amounts of memory. 3431356345Scy 3432356345Scy27 September 2016: Wouter 3433356345Scy - tag for 1.5.10 release 3434356345Scy - trunk contains 1.5.11 in development. 3435356345Scy - Fix dnstap relaying "random" messages instead of resolver/forwarder 3436356345Scy responses, from Nikolay Edigaryev. 3437356345Scy - Fix #836: unbound could echo back EDNS options in an error response. 3438356345Scy 3439307729Sdes20 September 2016: Wouter 3440307729Sdes - iana portlist update. 3441307729Sdes - Fix #835: fix --disable-dsa with nettle verify. 3442307729Sdes - tag for 1.5.10rc1 release. 3443307729Sdes 3444307729Sdes15 September 2016: Wouter 3445307729Sdes - Fix 883: error for duplicate local zone entry. 3446307729Sdes - Test for openssl init_crypto and init_ssl functions. 3447307729Sdes 3448307729Sdes15 September 2016: Ralph 3449307729Sdes - fix potential memory leak in daemon/remote.c and nullpointer 3450307729Sdes dereference in validator/autotrust. 3451307729Sdes - iana portlist update. 3452307729Sdes 3453307729Sdes13 September 2016: Wouter 3454307729Sdes - Silenced flex-generated sign-unsigned warning print with gcc 3455307729Sdes diagnostic pragma. 3456307729Sdes - Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len. 3457307729Sdes 3458307729Sdes9 September 2016: Wouter 3459307729Sdes - Fix #831: workaround for spurious fread_chk warning against petal.c 3460307729Sdes 3461307729Sdes5 September 2016: Ralph 3462307729Sdes - Take configured minimum TTL into consideration when reducing TTL 3463307729Sdes to original TTL from RRSIG. 3464307729Sdes 3465307729Sdes5 September 2016: Wouter 3466307729Sdes - Fix #829: doc of sldns_wire2str_rdata_buf() return value has an 3467307729Sdes off-by-one typo, from Jinmei Tatuya (Infoblox). 3468307729Sdes - Fix incomplete prototypes reported by Dag-Erling Sm��rgrav. 3469307729Sdes - Fix #828: missing type in access-control-tag-action redirect results 3470307729Sdes in NXDOMAIN. 3471307729Sdes 3472307729Sdes2 September 2016: Wouter 3473307729Sdes - Fix compile with openssl 1.1.0 with api=1.1.0. 3474307729Sdes 3475307729Sdes1 September 2016: Wouter 3476307729Sdes - RFC 7958 is now out, updated docs for unbound-anchor. 3477307729Sdes - Fix for compile without warnings with openssl 1.1.0. 3478307729Sdes - Fix #826: Fix refuse_non_local could result in a broken response. 3479307729Sdes - iana portlist update. 3480307729Sdes 3481307729Sdes29 August 2016: Wouter 3482307729Sdes - Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A. 3483307729Sdes Siewior. 3484307729Sdes - Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e. 3485307729Sdes 3486307729Sdes25 August 2016: Ralph 3487307729Sdes - Clarify local-zone-override entry in unbound.conf.5 3488307729Sdes 3489307729Sdes25 August 2016: Wouter 3490307729Sdes - 64bit build option for makedist windows compile, -w64. 3491307729Sdes 3492307729Sdes24 August 2016: Ralph 3493307729Sdes - Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter 3494307729Sdes in each iteration in find_tag_datas(). 3495307729Sdes - unbound.conf.5 entries for define-tag, access-control-tag, 3496307729Sdes access-control-tag-action, access-control-tag-data, local-zone-tag, 3497307729Sdes and local-zone-override. 3498307729Sdes 3499307729Sdes23 August 2016: Wouter 3500307729Sdes - Fix #804: unbound stops responding after outage. Fixes queries 3501307729Sdes that attempt to wait for an empty list of subqueries. 3502307729Sdes - Fix #804: lower num_target_queries for iterator also for failed 3503307729Sdes lookups. 3504307729Sdes 3505307729Sdes8 August 2016: Wouter 3506307729Sdes - Note that OPENPGPKEY type is RFC 7929. 3507307729Sdes 3508307729Sdes4 August 2016: Wouter 3509307729Sdes - Fix #807: workaround for possible some "unused" function parameters 3510307729Sdes in test code, from Jinmei Tatuya. 3511307729Sdes 3512307729Sdes3 August 2016: Wouter 3513307729Sdes - use sendmsg instead of sendto for TFO. 3514307729Sdes 3515307729Sdes28 July 2016: Wouter 3516307729Sdes - Fix #806: wrong comment removed. 3517307729Sdes 3518307729Sdes26 July 2016: Wouter 3519307729Sdes - nicer ratelimit-below-domain explanation. 3520307729Sdes 3521307729Sdes22 July 2016: Wouter 3522307729Sdes - Fix #801: missing error condition handling in 3523307729Sdes daemon_create_workers(). 3524307729Sdes - Fix #802: workaround for function parameters that are "unused" 3525307729Sdes without log_assert. 3526307729Sdes - Fix #803: confusing (and incorrect) code comment in daemon_cleanup(). 3527307729Sdes 3528307729Sdes20 July 2016: Wouter 3529307729Sdes - Fix typo in unbound.conf. 3530307729Sdes 3531307729Sdes18 July 2016: Wouter 3532307729Sdes - Fix #798: Client-side TCP fast open fails (Linux). 3533307729Sdes 3534307729Sdes14 July 2016: Wouter 3535307729Sdes - TCP Fast open patch from Sara Dickinson. 3536307729Sdes - Fixed unbound.doxygen for 1.8.11. 3537307729Sdes 3538307729Sdes7 July 2016: Wouter 3539307729Sdes - access-control-tag-data implemented. verbose(4) prints tag debug. 3540307729Sdes 3541307729Sdes5 July 2016: Wouter 3542307729Sdes - Fix dynamic link of anchor-update.exe on windows. 3543307729Sdes - Fix detect of mingw for MXE package build. 3544307729Sdes - Fixes for 64bit windows compile. 3545307729Sdes - Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and 3546307729Sdes --with-libunbound-only --with-nettle. 3547307729Sdes 3548307729Sdes4 July 2016: Wouter 3549307729Sdes - For #787: prefer-ip6 option for unbound.conf prefers to send 3550307729Sdes upstream queries to ipv6 servers. 3551307729Sdes - Fix #787: outgoing-interface netblock/64 ipv6 option to use linux 3552307729Sdes freebind to use 64bits of entropy for every query with random local 3553307729Sdes part. 3554307729Sdes 3555307729Sdes30 June 2016: Wouter 3556307729Sdes - Document always_transparent, always_refuse, always_nxdomain types. 3557307729Sdes 3558307729Sdes29 June 2016: Wouter 3559307729Sdes - Fix static compile on windows missing gdi32. 3560307729Sdes 3561307729Sdes28 June 2016: Wouter 3562307729Sdes - Create a pkg-config file for libunbound in contrib. 3563307729Sdes 3564307729Sdes27 June 2016: Wouter 3565307729Sdes - Fix #784: Build configure assumess that having getpwnam means there 3566307729Sdes is endpwent function available. 3567307729Sdes - Updated repository with newer flex and bison output. 3568307729Sdes 3569307729Sdes24 June 2016: Ralph 3570307729Sdes - Possibility to specify local-zone type for an acl/tag pair 3571307729Sdes - Possibility to specify (override) local-zone type for a source address 3572307729Sdes block 3573307729Sdes16 June 2016: Ralph 3574307729Sdes - Decrease dp attempts at each QNAME minimisation iteration 3575307729Sdes 3576307729Sdes16 June 2016: Wouter 3577307729Sdes - Fix tcp timeouts in tv.usec. 3578307729Sdes 3579307729Sdes15 June 2016: Wouter 3580307729Sdes - TCP_TIMEOUT is specified in milliseconds. 3581307729Sdes - If more than half of tcp connections are in use, a shorter timeout 3582307729Sdes is used (200 msec, vs 2 minutes) to pressure tcp for new connects. 3583307729Sdes 3584307729Sdes14 June 2016: Ralph 3585307729Sdes - QNAME minimisation unit test for dropped QTYPE=A queries. 3586307729Sdes 3587307729Sdes14 June 2016: Wouter 3588307729Sdes - Fix 775: unbound-host and unbound-anchor crash on windows, ignore 3589307729Sdes null delete for wsaevent. 3590307729Sdes - Fix spelling in freebind option man page text. 3591307729Sdes - Fix windows link of ssl with crypt32. 3592307729Sdes - Fix 779: Union casting is non-portable. 3593307729Sdes - Fix 780: MAP_ANON not defined in HP-UX 11.31. 3594307729Sdes - Fix 781: prealloc() is an HP-UX system library call. 3595307729Sdes 3596307729Sdes13 June 2016: Ralph 3597307729Sdes - Use QTYPE=A for QNAME minimisation. 3598307729Sdes - Keep track of number of time-outs when performing QNAME minimisation. 3599307729Sdes Stop minimising when number of time-outs for a QNAME/QTYPE pair is 3600307729Sdes more than three. 3601307729Sdes 3602307729Sdes13 June 2016: Wouter 3603307729Sdes - Fix #778: unbound 1.5.9: -h segfault (null deref). 3604307729Sdes - Fix directory: fix for unbound-checkconf, it restores cwd. 3605307729Sdes 3606307729Sdes10 June 2016: Wouter 3607307729Sdes - And delete service.conf.shipped on uninstall. 3608307729Sdes - In unbound.conf directory: dir immediately changes to that directory, 3609307729Sdes so that include: file below that is relative to that directory. 3610307729Sdes With chroot, make the directory an absolute path inside chroot. 3611307729Sdes - keep debug symbols in windows build. 3612307729Sdes - do not delete service.conf on windows uninstall. 3613307729Sdes - document directory immediate fix and allow EXECUTABLE syntax in it 3614307729Sdes on windows. 3615307729Sdes 3616307729Sdes9 June 2016: Wouter 3617307729Sdes - Trunk is called 1.5.10 (with previous fixes already in there to 2 3618307729Sdes june). 3619307729Sdes - Revert fix for NetworkService account on windows due to breakage 3620307729Sdes it causes. 3621307729Sdes - Fix that windows install will not overwrite existing service.conf 3622307729Sdes file (and ignore gui config choices if it exists). 3623307729Sdes 3624307729Sdes7 June 2016: Ralph 3625307729Sdes - Lookup localzones by taglist from acl. 3626307729Sdes - Possibility to lookup local_zone, regardless the taglist. 3627307729Sdes - Added local_zone/taglist/acl unit test. 3628307729Sdes 3629307729Sdes7 June 2016: Wouter 3630307729Sdes - Fix #773: Non-standard Python location build failure with pyunbound. 3631307729Sdes - Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures. 3632307729Sdes 3633307729Sdes6 June 2016: Wouter 3634307729Sdes - Better help text from -h (from Ray Griffith). 3635307729Sdes - access-control-tag config directive. 3636307729Sdes - local-zone-override config directive. 3637307729Sdes - access-control-tag-action and access-control-tag-data config 3638307729Sdes directives. 3639307729Sdes - free acl-tags, acltag-action and acltag-data config lists during 3640307729Sdes initialisation to free up memory for more entries. 3641307729Sdes 3642307729Sdes3 June 2016: Wouter 3643307729Sdes - Fix to not ignore return value of chown() in daemon startup. 3644307729Sdes 3645307729Sdes2 June 2016: Wouter 3646307729Sdes - Fix libubound for edns optlist feature. 3647307729Sdes - Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc. 3648307729Sdes - Fix #752: retry resource temporarily unavailable on control pipe. 3649307729Sdes - un-document localzone tags. 3650307729Sdes - tag for release 1.5.9rc1. 3651307729Sdes And this also became release 1.5.9. 3652307729Sdes - Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to 3653307729Sdes Program Files with (x86) appended. 3654307729Sdes - re-documented localzone tags in example.conf. 3655307729Sdes 3656307729Sdes31 May 2016: Wouter 3657307729Sdes - Fix windows service to be created run with limited rights, as a 3658307729Sdes network service account, from Mario Turschmann. 3659307729Sdes - compat strsep implementation. 3660307729Sdes - generic edns option parse and store code. 3661307729Sdes - and also generic edns options for upstream messages (and replies). 3662307729Sdes after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID), 3663307729Sdes to insert use edns_opt_append(edns, region, code, len, bindata) on 3664307729Sdes the opt_list passed to send_query, or in edns_opt_inplace_reply. 3665307729Sdes 3666307729Sdes30 May 2016: Wouter 3667307729Sdes - Fix time in case answer comes from cache in ub_resolve_event(). 3668307729Sdes - Attempted fix for #765: _unboundmodule missing for python3. 3669307729Sdes 3670307729Sdes27 May 2016: Wouter 3671307729Sdes - Fix #770: Small subgroup attack on DH used in unix pipe on localhost 3672307729Sdes if unbound control uses a unix local named pipe. 3673307729Sdes - Document write permission to directory of trust anchor needed. 3674307729Sdes - Fix #768: Unbound Service Sometimes Can Not Shutdown 3675307729Sdes Completely, WER Report Shown Up. Close handle before closing WSA. 3676307729Sdes 3677307729Sdes26 May 2016: Wouter 3678307729Sdes - Updated patch from Charles Walker. 3679307729Sdes 3680307729Sdes24 May 2016: Wouter 3681307729Sdes - disable-dnssec-lame-check config option from Charles Walker. 3682307729Sdes - remove memory leak from lame-check patch. 3683307729Sdes - iana portlist update. 3684307729Sdes 3685307729Sdes23 May 2016: Wouter 3686307729Sdes - Fix #767: Reference to an expired Internet-Draft in 3687307729Sdes harden-below-nxdomain documentation. 3688307729Sdes 3689307729Sdes20 May 2016: Ralph 3690307729Sdes - No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC 3691307729Sdes signed zones. 3692307729Sdes - iana portlist update. 3693307729Sdes 3694307729Sdes19 May 2016: Wouter 3695307729Sdes - Fix #766: dns64 should synthesize results on timeout/errors. 3696307729Sdes 3697307729Sdes18 May 2016: Wouter 3698307729Sdes - Fix #761: DNSSEC LAME false positive resolving nic.club. 3699307729Sdes 3700307729Sdes17 May 2016: Wouter 3701307729Sdes - trunk updated with output of flex 2.6.0. 3702307729Sdes 3703307729Sdes6 May 2016: Wouter 3704307729Sdes - Fix memory leak in out-of-memory conditions of local zone add. 3705307729Sdes 3706307729Sdes29 April 2016: Wouter 3707307729Sdes - Fix sldns with static checking fixes copied from getdns. 3708307729Sdes 3709307729Sdes28 April 2016: Wouter 3710307729Sdes - Fix #759: 0x20 capsforid no longer checks type PTR, for 3711307729Sdes compatibility with cisco dns guard. This lowers false positives. 3712307729Sdes 3713307729Sdes18 April 2016: Wouter 3714356345Scy - Fix some malformed responses to edns queries get fallback to nonedns. 3715307729Sdes 3716307729Sdes15 April 2016: Wouter 3717307729Sdes - cachedb module event handling design. 3718307729Sdes 3719307729Sdes14 April 2016: Wouter 3720307729Sdes - cachedb module framework (empty). 3721307729Sdes - iana portlist update. 3722307729Sdes 3723307729Sdes12 April 2016: Wouter 3724307729Sdes - Fix #753: document dump_requestlist is for first thread. 3725307729Sdes 3726307729Sdes24 March 2016: Wouter 3727307729Sdes - Document permit-small-holddown for 5011 debug. 3728307729Sdes - Fix #749: unbound-checkconf gets SIGSEGV when use against a 3729307729Sdes malformatted conf file. 3730307729Sdes 3731307729Sdes23 March 2016: Wouter 3732307729Sdes - OpenSSL 1.1.0 portability, --disable-dsa configure option. 3733307729Sdes 3734307729Sdes21 March 2016: Wouter 3735307729Sdes - Fix compile of getentropy_linux for SLES11 servicepack 4. 3736307729Sdes - Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev. 3737307729Sdes - Fix test for openssl to use HMAC_Update for 1.1.0. 3738307729Sdes - acx_nlnetlabs.m4 to v33, with HMAC_Update. 3739307729Sdes - acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto. 3740307729Sdes - ERR_remove_state deprecated since openssl 1.0.0. 3741307729Sdes - OPENSSL_config is deprecated, removing. 3742307729Sdes 3743307729Sdes18 March 2016: Ralph 3744307729Sdes - Validate QNAME minimised NXDOMAIN responses. 3745307729Sdes - If QNAME minimisation is enabled, do cache lookup for QTYPE NS in 3746307729Sdes harden-below-nxdomain. 3747307729Sdes 3748307729Sdes17 March 2016: Ralph 3749307729Sdes - Limit number of QNAME minimisation iterations. 3750307729Sdes 3751307729Sdes17 March 2016: Wouter 3752307729Sdes - Fix #746: Fix unbound sets CD bit on all forwards. 3753307729Sdes If no trust anchors, it'll not set CD bit when forwarding to another 3754307729Sdes server. If a trust anchor, no CD bit on the first attempt to a 3755307729Sdes forwarder, but CD bit thereafter on repeated attempts to get DNSSEC. 3756307729Sdes - iana portlist update. 3757307729Sdes 3758307729Sdes16 March 2016: Wouter 3759307729Sdes - Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma. 3760307729Sdes - Fix ip-transparent for tcp on freebsd. 3761307729Sdes 3762307729Sdes15 March 2016: Wouter 3763307729Sdes - ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for 3764307729Sdes binding to an IP address while the interface or address is down. 3765307729Sdes 3766307729Sdes14 March 2016: Wouter 3767307729Sdes - Fix warnings in ifdef corner case, older or unknown libevent. 3768307729Sdes - Fix compile for ub_event code with older libev. 3769307729Sdes 3770307729Sdes11 March 2016: Wouter 3771307729Sdes - Remove warning about unused parameter in event_pluggable.c. 3772307729Sdes - Fix libev usage of dispatch return value. 3773307729Sdes - No side effects in tolower() call, in case it is a macro. 3774307729Sdes - For test put free in pluggable api in parenthesis. 3775307729Sdes 3776307729Sdes10 March 2016: Wouter 3777307729Sdes - Fixup backend2str for libev. 3778307729Sdes 3779307729Sdes09 March 2016: Willem 3780307729Sdes - User defined pluggable event API for libunbound 3781307729Sdes - Fixup of compile fix for pluggable event API from P.Y. Adi 3782307729Sdes Prasaja. 3783307729Sdes 3784307729Sdes09 March 2016: Wouter 3785307729Sdes - Updated configure and ltmain.sh. 3786307729Sdes - Updated L root IPv6 address. 3787307729Sdes 3788307729Sdes07 March 2016: Wouter 3789307729Sdes - Fix #747: assert in outnet_serviced_query_stop. 3790307729Sdes - iana ports fetched via https. 3791307729Sdes - iana portlist update. 3792307729Sdes 3793307729Sdes03 March 2016: Wouter 3794307729Sdes - configure tests for the weak attribute support by the compiler. 3795307729Sdes 3796307729Sdes02 March 2016: Wouter 3797307729Sdes - 1.5.8 release tag 3798307729Sdes - trunk contains 1.5.9 in development. 3799307729Sdes - iana portlist update. 3800307729Sdes - Fix #745: unbound.py - idn2dname throws UnicodeError when idnname 3801307729Sdes contains trailing dot. 3802307729Sdes 3803296415Sdes24 February 2016: Wouter 3804296415Sdes - Fix OpenBSD asynclook lock free that gets used later (fix test code). 3805296415Sdes - Fix that NSEC3 negative cache is used when there is no salt. 3806296415Sdes 3807296415Sdes23 February 2016: Wouter 3808296415Sdes - ub_ctx_set_stub() function for libunbound to config stub zones. 3809296415Sdes - sorted ubsyms.def file with exported libunbound functions. 3810296415Sdes 3811296415Sdes19 February 2016: Wouter 3812296415Sdes - Print understandable debug log when unusable DS record is seen. 3813296415Sdes - load gost algorithm if digest is seen before key algorithm. 3814296415Sdes - iana portlist update. 3815296415Sdes 3816296415Sdes17 February 2016: Wouter 3817296415Sdes - Fix that "make install" fails due to "text file busy" error. 3818296415Sdes 3819296415Sdes16 February 2016: Wouter 3820296415Sdes - Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error. 3821296415Sdes 3822296415Sdes15 February 2016: Wouter 3823296415Sdes - ip-transparent option for FreeBSD with IP_BINDANY socket option. 3824296415Sdes - wait for sendto to drain socket buffers when they are full. 3825296415Sdes 3826296415Sdes9 February 2016: Wouter 3827296415Sdes - Test for type OPENPGPKEY. 3828296415Sdes - insecure-lan-zones: yesno config option, patch from Dag-Erling 3829296415Sdes Sm��rgrav. 3830296415Sdes 3831296415Sdes8 February 2016: Wouter 3832296415Sdes - Fix patch typo in prevuous commit for 734 from Adi Prasaja. 3833296415Sdes - RR Type CSYNC support RFC 7477, in debug printout and config input. 3834296415Sdes - RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07). 3835296415Sdes 3836296415Sdes29 January 2016: Wouter 3837296415Sdes - Neater cmdline_verbose increment patch from Edgar Pettijohn. 3838296415Sdes 3839296415Sdes27 January 2016: Wouter 3840296415Sdes - Made netbsd sendmsg test nonfatal, in case of false positives. 3841296415Sdes - Fix #741: log message for dnstap socket connection is more clear. 3842296415Sdes 3843296415Sdes26 January 2016: Wouter 3844296415Sdes - Fix #734: chown the pidfile if it resides inside the chroot. 3845296415Sdes - Use arc4random instead of random in tests (because it is 3846296415Sdes available, possibly as compat, anyway). 3847296415Sdes - Fix cmsg alignment for argument to sendmsg on NetBSD. 3848296415Sdes - Fix that unbound complains about unimplemented IP_PKTINFO for 3849296415Sdes sendmsg on NetBSD (for interface-automatic). 3850296415Sdes 3851296415Sdes25 January 2016: Wouter 3852296415Sdes - Fix #738: Swig should not be invoked with CPPFLAGS. 3853296415Sdes 3854296415Sdes19 January 2016: Wouter 3855296415Sdes - Squelch 'cannot assign requested address' log messages unless 3856296415Sdes verbosity is high, it was spammed after network down. 3857296415Sdes 3858296415Sdes14 January 2016: Wouter 3859296415Sdes - Fix to simplify empty string checking from Michael McConville. 3860296415Sdes - iana portlist update. 3861296415Sdes 3862296415Sdes12 January 2016: Wouter 3863296415Sdes - Fix #734: Do not log an error when the PID file cannot be chown'ed. 3864296415Sdes Patch from Simon Deziel. 3865296415Sdes 3866296415Sdes11 January 2016: Wouter 3867296415Sdes - Fix test if -pthreads unused to use better grep for portability. 3868296415Sdes 3869296415Sdes06 January 2016: Wouter 3870296415Sdes - Fix mingw crosscompile for recent mingw. 3871296415Sdes - Update aclocal, autoconf output with new versions (1.15, 2.4.6). 3872296415Sdes 3873296415Sdes05 January 2016: Wouter 3874296415Sdes - #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch 3875296415Sdes from Daisuke Higashi. 3876296415Sdes - Support RFC7686: handle ".onion" Special-Use Domain. It is blocked 3877296415Sdes by default, and can be unblocked with "nodefault" localzone config. 3878296415Sdes 3879296415Sdes04 January 2016: Wouter 3880296415Sdes - Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined, 3881296415Sdes for Linux glibc 2.20. 3882296415Sdes - Fixup contrib/aaaa-filter-iterator.patch for moved contents in the 3883296415Sdes source code, so it applies cleanly again. Removed unused variable 3884296415Sdes warnings. 3885296415Sdes 3886296415Sdes15 December 2015: Ralph 3887296415Sdes - Fix #729: omit use of escape sequences in echo since they are not 3888296415Sdes portable (unbound-control-setup). 3889296415Sdes 3890296415Sdes11 December 2015: Wouter 3891296415Sdes - remove NULL-checks before free, patch from Michael McConville. 3892296415Sdes - updated ax_pthread.m4 to version 21 with clang support, this 3893296415Sdes removes a warning from compilation. 3894296415Sdes - OSX portability, detect if sbrk is deprecated. 3895296415Sdes - OSX clang, stop -pthread unused during link stage warnings. 3896296415Sdes - OSX clang new flto check. 3897296415Sdes 3898296415Sdes10 December 2015: Wouter 3899296415Sdes - 1.5.7 release 3900296415Sdes - trunk has 1.5.8 in development. 3901296415Sdes 3902292206Sdes8 December 2015: Wouter 3903292206Sdes - Fixup 724 for unbound-control. 3904292206Sdes 3905292206Sdes7 December 2015: Ralph 3906292206Sdes - Do not minimise forwarded requests. 3907292206Sdes 3908292206Sdes4 December 2015: Wouter 3909292206Sdes - Removed unneeded whitespace from example.conf. 3910292206Sdes 3911292206Sdes3 December 2015: Ralph 3912292206Sdes - (after rc1 tag) 3913292206Sdes - Committed fix to qname minimisation and unit test case for it. 3914292206Sdes 3915292206Sdes3 December 2015: Wouter 3916292206Sdes - iana portlist update. 3917292206Sdes - 1.5.7rc1 prerelease tag. 3918292206Sdes 3919292206Sdes2 December 2015: Wouter 3920292206Sdes - Fixup 724: Fix PCA prompt for unbound-service-install.exe. 3921292206Sdes re-enable stdout printout. 3922292206Sdes - For 724: Add Changelog to windows binary dist. 3923292206Sdes 3924292206Sdes1 December 2015: Ralph 3925292206Sdes - Qname minimisation review fixes 3926292206Sdes 3927292206Sdes1 December 2015: Wouter 3928292206Sdes - Fixup 724 fix for fname_after_chroot() calls. 3929292206Sdes - Remove stdout printout for unbound-service-install.exe 3930292206Sdes - .gitignore for git users. 3931292206Sdes 3932292206Sdes30 November 2015: Ralph 3933292206Sdes - Implemented qname minimisation 3934292206Sdes 3935292206Sdes30 November 2015: Wouter 3936292206Sdes - Fix for #724: conf syntax to read files from run dir (on Windows). 3937292206Sdes 3938292206Sdes25 November 2015: Wouter 3939292206Sdes - Fix for #720, fix unbound-control-setup windows batch file. 3940292206Sdes 3941292206Sdes24 November 2015: Wouter 3942292206Sdes - Fix #720: add windows scripts to zip bundle. 3943292206Sdes - iana portlist update. 3944292206Sdes 3945292206Sdes20 November 2015: Wouter 3946292206Sdes - Added assert on rrset cache correctness. 3947292206Sdes - Fix that malformed EDNS query gets a response without malformed EDNS. 3948292206Sdes 3949292206Sdes18 November 2015: Wouter 3950292206Sdes - newer acx_nlnetlabs.m4. 3951292206Sdes - spelling fixes from Igor Sobrado Delgado. 3952292206Sdes 3953292206Sdes17 November 2015: Wouter 3954292206Sdes - Fix #594. libunbound: optionally use libnettle for crypto. 3955292206Sdes Contributed by Luca Bruno. Added --with-nettle for use with 3956292206Sdes --with-libunbound-only. 3957292206Sdes - refactor nsec3 hash implementation to be more library-portable. 3958292206Sdes - iana portlist update. 3959292206Sdes - Fixup DER encoded DSA signatures for libnettle. 3960292206Sdes 3961292206Sdes16 November 2015: Wouter 3962292206Sdes - Fix for lenient accept of reverse order DNAME and CNAME. 3963292206Sdes 3964292206Sdes6 November 2015: Wouter 3965292206Sdes - Change example.conf: ftp.internic.net to https://www.internic.net 3966292206Sdes 3967292206Sdes5 November 2015: Wouter 3968292206Sdes - ACX_SSL_CHECKS no longer adds -ldl needlessly. 3969292206Sdes 3970292206Sdes3 November 2015: Wouter 3971292206Sdes - Fix #718: Fix unbound-control-setup with support for env 3972292206Sdes without HEREDOC bash support. 3973292206Sdes 3974292206Sdes29 October 2015: Wouter 3975292206Sdes - patch from Doug Hogan for SSL_OP_NO_SSLvx options. 3976292206Sdes - Fix #716: nodata proof with empty non-terminals and wildcards. 3977292206Sdes 3978292206Sdes28 October 2015: Wouter 3979292206Sdes - Fix checklock testcode for linux threads on exit. 3980292206Sdes 3981292206Sdes27 October 2015: Wouter 3982292206Sdes - isblank() compat implementation. 3983292206Sdes - detect libexpat without xml_StopParser function. 3984292206Sdes - portability fixes. 3985292206Sdes - portability, replace snprintf if return value broken. 3986292206Sdes 3987292206Sdes23 October 2015: Wouter 3988292206Sdes - Fix #714: Document config to block private-address for IPv4 3989292206Sdes mapped IPv6 addresses. 3990292206Sdes 3991292206Sdes22 October 2015: Wouter 3992292206Sdes - Fix #712: unbound-anchor appears to not fsync root.key. 3993292206Sdes 3994292206Sdes20 October 2015: Wouter 3995292206Sdes - 1.5.6 release. 3996292206Sdes - trunk tracks development of 1.5.7. 3997292206Sdes 3998292206Sdes15 October 2015: Wouter 3999292206Sdes - Fix segfault in the dns64 module in the formaterror error path. 4000292206Sdes - Fix sldns_wire2str_rdata_scan for malformed RRs. 4001292206Sdes - tag for 1.5.6rc1 release. 4002292206Sdes 4003292206Sdes14 October 2015: Wouter 4004292206Sdes - ANY responses include DNAME records if present, as per Evan Hunt's 4005292206Sdes remark in dnsop. 4006292206Sdes - Fix manpage to suggest using SIGTERM to terminate the server. 4007292206Sdes 4008292206Sdes9 October 2015: Wouter 4009292206Sdes - Default for ssl-port is port 853, the temporary port assignment 4010292206Sdes for secure domain name system traffic. 4011292206Sdes If you used to rely on the older default of port 443, you have 4012292206Sdes to put a clause in unbound.conf for that. The new value is likely 4013292206Sdes going to be the standardised port number for this traffic. 4014292206Sdes - iana portlist update. 4015292206Sdes 4016292206Sdes6 October 2015: Wouter 4017292206Sdes - 1.5.5 release. 4018292206Sdes - trunk tracks the development of 1.5.6. 4019292206Sdes 4020289063Sdes28 September 2015: Wouter 4021289063Sdes - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution 4022289063Sdes failures. 4023289063Sdes - tag for 1.5.5rc1 release. 4024289063Sdes - makedist.sh: pgp sig echo commands. 4025289063Sdes 4026289063Sdes25 September 2015: Wouter 4027289063Sdes - Fix unbound-control flush that does not succeed in removing data. 4028289063Sdes 4029289063Sdes22 September 2015: Wouter 4030289063Sdes - Fix config globbed include chroot treatment, this fixes reload of 4031289063Sdes globs (patch from Dag-Erling Sm��rgrav). 4032289063Sdes - iana portlist update. 4033289063Sdes - Fix #702: New IPs for for h.root-servers.net. 4034289063Sdes - Remove confusion comment from canonical_compare() function. 4035289063Sdes - Fix #705: ub_ctx_set_fwd() return value mishandled on windows. 4036289063Sdes - testbound selftest also works in non-debug mode. 4037289063Sdes - Fix minor error in unbound.conf.5.in 4038289063Sdes - Fix unbound.conf(5) access-control description for precedence 4039289063Sdes and default. 4040289063Sdes 4041289063Sdes31 August 2015: Wouter 4042289063Sdes - changed windows setup compression to be more transparent. 4043289063Sdes 4044289063Sdes28 August 2015: Wouter 4045289063Sdes - Fix #697: Get PY_MAJOR_VERSION failure at configure for python 4046289063Sdes 2.4 to 2.6. 4047289063Sdes - Feature #699: --enable-pie option to that builds PIE binary. 4048289063Sdes - Feature #700: --enable-relro-now option that enables full read-only 4049289063Sdes relocation. 4050289063Sdes 4051289063Sdes24 August 2015: Wouter 4052289063Sdes - Fix deadlock for local data add and zone add when unbound-control 4053289063Sdes list_local_data printout is interrupted. 4054289063Sdes - iana portlist update. 4055289063Sdes - Change default of harden-algo-downgrade to off. This is lenient 4056289063Sdes for algorithm rollover. 4057289063Sdes 4058289063Sdes13 August 2015: Wouter 4059289063Sdes - 5011 implementation does not insist on all algorithms, when 4060289063Sdes harden-algo-downgrade is turned off. 4061289063Sdes - Reap the child process that libunbound spawns. 4062289063Sdes 4063289063Sdes11 August 2015: Wouter 4064289063Sdes - Fix #694: configure script does not detect LibreSSL 2.2.2 4065289063Sdes 4066289063Sdes4 August 2015: Wouter 4067289063Sdes - Document that local-zone nodefault matches exactly and transparent 4068289063Sdes can be used to release a subzone. 4069289063Sdes 4070289063Sdes3 August 2015: Wouter 4071289063Sdes - Document in the manual more text about configuring locally served 4072289063Sdes zones. 4073289063Sdes - Fix 5011 anchor update timer after reload. 4074289063Sdes - Fix mktime in unbound-anchor not using UTC. 4075289063Sdes 4076289063Sdes30 July 2015: Wouter 4077289063Sdes - please afl-gcc (llvm) for uninitialised variable warning. 4078289063Sdes - Added permit-small-holddown config to debug fast 5011 rollover. 4079289063Sdes 4080289063Sdes24 July 2015: Wouter 4081289063Sdes - Fix #690: Reload fails when so-reuseport is yes after changing 4082289063Sdes num-threads. 4083289063Sdes - iana portlist update. 4084289063Sdes 4085289063Sdes21 July 2015: Wouter 4086289063Sdes - Fix configure to detect SSL_CTX_set_ecdh_auto. 4087289063Sdes - iana portlist update. 4088289063Sdes 4089289063Sdes20 July 2015: Wouter 4090289063Sdes - Enable ECDHE for servers. Where available, use 4091289063Sdes SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to 4092289063Sdes enable ECDHE. Otherwise, manually offer curve p256. 4093289063Sdes Client connections should automatically use ECDHE when available. 4094289063Sdes (thanks Daniel Kahn Gillmor) 4095289063Sdes 4096289063Sdes18 July 2015: Willem 4097289063Sdes - Allow certificate chain files to allow for intermediate certificates. 4098289063Sdes (thanks Daniel Kahn Gillmor) 4099289063Sdes 4100289063Sdes13 July 2015: Wouter 4101289063Sdes - makedist produces sha1 and sha256 files for created binaries too. 4102289063Sdes 4103289063Sdes9 July 2015: Wouter 4104289063Sdes - 1.5.4 release tag 4105289063Sdes - trunk has 1.5.5 in development. 4106289063Sdes - Fix #681: Setting forwarders with unbound-control forward 4107289063Sdes implicitly turns on forward-first. 4108289063Sdes 4109287917Sdes29 June 2015: Wouter 4110287917Sdes - iana portlist update. 4111287917Sdes - Fix alloc with log for allocation size checks. 4112287917Sdes 4113287917Sdes26 June 2015: Wouter 4114287917Sdes - Fix #677 Fix DNAME responses from cache that failed internal chain 4115287917Sdes test. 4116287917Sdes - iana portlist update. 4117287917Sdes 4118287917Sdes22 June 2015: Wouter 4119287917Sdes - Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly 4120287917Sdes and was therefore always synthesized (thanks to Valentin Dietrich). 4121287917Sdes 4122287917Sdes4 June 2015: Wouter 4123287917Sdes - RFC 7553 RR type URI support, is now enabled by default. 4124287917Sdes 4125287917Sdes2 June 2015: Wouter 4126287917Sdes - Fix #674: Do not free pointers given by getenv. 4127287917Sdes 4128287917Sdes29 May 2015: Wouter 4129287917Sdes - Fix that unparseable error responses are ratelimited. 4130287917Sdes - SOA negative TTL is capped at minimumttl in its rdata section. 4131287917Sdes - cache-max-negative-ttl config option, default 3600. 4132287917Sdes 4133287917Sdes26 May 2015: Wouter 4134287917Sdes - Document that ratelimit works with unbound-control set_option. 4135287917Sdes 4136287917Sdes21 May 2015: Wouter 4137287917Sdes - iana portlist update. 4138287917Sdes - documentation proposes ratelimit of 1000 (closer to what upstream 4139287917Sdes servers expect from us). 4140287917Sdes 4141287917Sdes20 May 2015: Wouter 4142287917Sdes - DLV is going to be decommissioned. Advice to stop using it, and 4143287917Sdes put text in the example configuration and man page to that effect. 4144287917Sdes 4145287917Sdes10 May 2015: Wouter 4146287917Sdes - Change syntax of particular validator error to be easier for 4147287917Sdes machine parse, swap rrset and ip adres info so it looks like: 4148287917Sdes validation failure <www.example.nl. TXT IN>: signature crypto 4149287917Sdes failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN> 4150287917Sdes 4151287917Sdes1 May 2015: Wouter 4152287917Sdes - caps-whitelist in unbound.conf allows whitelist of loadbalancers 4153287917Sdes that cannot work with caps-for-id or its fallback. 4154287917Sdes 4155287917Sdes30 April 2015: Wouter 4156287917Sdes - Unit test for type ANY synthesis. 4157287917Sdes 4158287917Sdes22 April 2015: Wouter 4159287917Sdes - Removed contrib/unbound_unixsock.diff, because it has been 4160287917Sdes integrated, use control-interface: /path in unbound.conf. 4161287917Sdes - iana portlist update. 4162287917Sdes 4163287917Sdes17 April 2015: Wouter 4164287917Sdes - Synthesize ANY responses from cache. Does not search exhaustively, 4165287917Sdes but MX,A,AAAA,SOA,NS also CNAME. 4166287917Sdes - Fix leaked dns64prefix configuration string. 4167287917Sdes 4168287917Sdes16 April 2015: Wouter 4169287917Sdes - Add local-zone type inform_deny, that logs query and drops answer. 4170287917Sdes - Ratelimit does not apply to prefetched queries, and ratelimit-factor 4171287917Sdes is default 10. Repeated normal queries get resolved and with 4172287917Sdes prefetch stay in the cache. 4173287917Sdes - Fix bug#664: libunbound python3 related fixes (from Tomas Hozza) 4174287917Sdes Use print_function also for Python2. 4175287917Sdes libunbound examples: produce sorted output. 4176287917Sdes libunbound-Python: libldns is not used anymore. 4177287917Sdes Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns. 4178287917Sdes 4179287917Sdes10 April 2015: Wouter 4180287917Sdes - unbound-control ratelimit_list lists high rate domains. 4181287917Sdes - ratelimit feature, ratelimit: 100, or some sensible qps, can be 4182287917Sdes used to turn it on. It ratelimits recursion effort per zone. 4183287917Sdes For particular names you can configure exceptions in unbound.conf. 4184287917Sdes - Fix that get_option for cache-sizes does not print double newline. 4185287917Sdes - Fix#663: ssl handshake fails when using unix socket because dh size 4186287917Sdes is too small. 4187287917Sdes 4188287917Sdes8 April 2015: Wouter 4189287917Sdes - Fix crash in dnstap: Do not try to log TCP responses after timeout. 4190287917Sdes 4191287917Sdes7 April 2015: Wouter 4192287917Sdes - Libunbound skips dos-line-endings from etc/hosts. 4193287917Sdes - Unbound exits with a fatal error when the auto-trust-anchor-file 4194287917Sdes fails to be writable. This is seconds after startup. You can 4195287917Sdes load a readonly auto-trust-anchor-file with trust-anchor-file. 4196287917Sdes The file has to be writable to notice the trust anchor change, 4197287917Sdes without it, a trust anchor change will be unnoticed and the system 4198287917Sdes will then become inoperable. 4199287917Sdes - unbound-control list_insecure command shows the negative trust 4200287917Sdes anchors currently configured, patch from Jelte Jansen. 4201287917Sdes 4202287917Sdes2 April 2015: Wouter 4203287917Sdes - Fix #660: Fix interface-automatic broken in the presence of 4204287917Sdes asymmetric routing. 4205287917Sdes 4206287917Sdes26 March 2015: Wouter 4207287917Sdes - remote.c probedelay line is easier to read. 4208287917Sdes - rename ldns subdirectory to sldns to avoid name collision. 4209287917Sdes 4210287917Sdes25 March 2015: Wouter 4211287917Sdes - Fix #657: libunbound(3) recommends deprecated 4212287917Sdes CRYPTO_set_id_callback. 4213287917Sdes - If unknown trust anchor algorithm, and libressl is used, error 4214287917Sdes message encourages upgrade of the libressl package. 4215287917Sdes 4216282089Sdes23 March 2015: Wouter 4217282089Sdes - Fix segfault on user not found at startup (from Maciej Soltysiak). 4218282089Sdes 4219287917Sdes20 March 2015: Wouter 4220287917Sdes - Fixed to add integer overflow checks on allocation (defense in depth). 4221287917Sdes 4222287917Sdes19 March 2015: Wouter 4223287917Sdes - Add ip-transparent config option for bind to non-local addresses. 4224287917Sdes 4225287917Sdes17 March 2015: Wouter 4226287917Sdes - Use reallocarray for integer overflow protection, patch submitted 4227287917Sdes by Loganaden Velvindron. 4228287917Sdes 4229287917Sdes16 March 2015: Wouter 4230287917Sdes - Fixup compile on cygwin, more portable openssl thread id. 4231287917Sdes 4232287917Sdes12 March 2015: Wouter 4233287917Sdes - Updated default keylength in unbound-control-setup to 3k. 4234287917Sdes 4235287917Sdes10 March 2015: Wouter 4236287917Sdes - Fix lintian warning in unbound-checkconf man page (from Andreas 4237287917Sdes Schulze). 4238287917Sdes - print svnroot when building windows dist. 4239287917Sdes - iana portlist update. 4240287917Sdes - Fix warning on sign compare in getentropy_linux. 4241287917Sdes 4242287917Sdes9 March 2015: Wouter 4243287917Sdes - Fix #644: harden-algo-downgrade option, if turned off, fixes the 4244287917Sdes reported excessive validation failure when multiple algorithms 4245287917Sdes are present. It allows the weakest algorithm to validate the zone. 4246287917Sdes - iana portlist update. 4247287917Sdes 4248287917Sdes5 March 2015: Wouter 4249287917Sdes - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal 4250287917Sdes scripts. Contributed by Yuri Voinov. 4251287917Sdes - Document that incoming-num-tcp increase is good for large servers. 4252287917Sdes - stats reports tcp usage, of incoming-num-tcp buffers. 4253287917Sdes 4254287917Sdes4 March 2015: Wouter 4255287917Sdes - Patch from Brad Smith that syncs compat/getentropy_linux with 4256287917Sdes OpenBSD's version (2015-03-04). 4257287917Sdes - 0x20 fallback improved: servfail responses do not count as missing 4258287917Sdes comparisons (except if all responses are errors), 4259287917Sdes inability to find nameservers does not fail equality comparisons, 4260287917Sdes many nameservers does not try to compare more than max-sent-count, 4261287917Sdes parse failures start 0x20 fallback procedure. 4262287917Sdes - store caps_response with best response in case downgrade response 4263287917Sdes happens to be the last one. 4264287917Sdes - Document windows 8 tests. 4265287917Sdes 4266287917Sdes3 March 2015: Wouter 4267287917Sdes - tag 1.5.3rc1 4268287917Sdes [ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ] 4269287917Sdes 4270282089Sdes2 March 2015: Wouter 4271282089Sdes - iana portlist update. 4272282089Sdes 4273282089Sdes20 February 2015: Wouter 4274282089Sdes - Use the getrandom syscall introduced in Linux 3.17 (from Heiner 4275282089Sdes Kallweit). 4276282089Sdes - Fix #645 Portability to Solaris 10, use AF_LOCAL. 4277282089Sdes - Fix #646 Portability to Solaris, -lrt for getentropy_solaris. 4278282089Sdes - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after 4279282089Sdes reload. 4280282089Sdes 4281282089Sdes19 February 2015: Wouter 4282282089Sdes - 1.5.2 release tag. 4283282089Sdes - svn trunk contains 1.5.3 under development. 4284282089Sdes 4285282089Sdes13 February 2015: Wouter 4286282089Sdes - Fix #643: doc/example.conf.in: unnecessary whitespace. 4287282089Sdes 4288282089Sdes12 February 2015: Wouter 4289282089Sdes - tag 1.5.2rc1 4290282089Sdes 4291282089Sdes11 February 2015: Wouter 4292282089Sdes - iana portlist update. 4293282089Sdes 4294282089Sdes10 February 2015: Wouter 4295282089Sdes - Fix scrubber with harden-glue turned off to reject NS (and other 4296282089Sdes not-address) records. 4297282089Sdes 4298282089Sdes9 February 2015: Wouter 4299282089Sdes - Fix validation failure in case upstream forwarder (ISC BIND) does 4300282089Sdes not have the same trust anchors and decides to insert unsigned NS 4301282089Sdes record in authority section. 4302282089Sdes 4303282089Sdes2 February 2015: Wouter 4304282089Sdes - infra-cache-min-rtt patch from Florian Riehm, for expected long 4305282089Sdes uplink roundtrip times. 4306282089Sdes 4307282089Sdes30 January 2015: Wouter 4308282089Sdes - Fix 0x20 capsforid fallback to omit gratuitous NS and additional 4309282089Sdes section changes. 4310282089Sdes - Portability fix for Solaris ('sun' is not usable for a variable). 4311282089Sdes 4312282089Sdes29 January 2015: Wouter 4313282089Sdes - Fix pyunbound byte string representation for python3. 4314282089Sdes 4315282089Sdes26 January 2015: Wouter 4316282089Sdes - Fix unintended use of gcc extension for incomplete enum types, 4317282089Sdes compile with pedantic c99 compliance (from Daniel Dickman). 4318282089Sdes 4319282089Sdes23 January 2015: Wouter 4320282089Sdes - windows port fixes, no AF_LOCAL, no chown, no chmod(grp). 4321282089Sdes 4322282089Sdes16 January 2015: Wouter 4323282089Sdes - unit test for local unix connection. Documentation and log_addr 4324282089Sdes does not inspect port for AF_LOCAL. 4325282089Sdes - unbound-checkconf -f prints chroot with pidfile path. 4326282089Sdes 4327282089Sdes13 January 2015: Wouter 4328282089Sdes - iana portlist update. 4329282089Sdes 4330282089Sdes12 January 2015: Wouter 4331282089Sdes - Cast sun_len sizeof to socklen_t. 4332282089Sdes - Fix pyunbound ord call, portable for python 2 and 3. 4333282089Sdes 4334282089Sdes7 January 2015: Wouter 4335282089Sdes - Fix warnings in pythonmod changes. 4336282089Sdes 4337282089Sdes6 January 2015: Wouter 4338282089Sdes - iana portlist update. 4339277057Sdes - patch for remote control over local sockets, from Dag-Erling 4340277057Sdes Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and 4341277057Sdes control-use-cert: no. 4342277057Sdes - Fixup that patch and uid lookup (only for daemon). 4343277057Sdes - coded the default of control-use-cert, to yes. 4344276605Sdes 4345282089Sdes5 January 2015: Wouter 4346282089Sdes - getauxval test for ppc64 linux compatibility. 4347282089Sdes - make strip works for unbound-host and unbound-anchor. 4348282089Sdes - patch from Stephane Lapie that adds to the python API, that 4349282089Sdes exposes struct delegpt, and adds the find_delegation function. 4350282089Sdes - print query name when max target count is exceeded. 4351282089Sdes - patch from Stuart Henderson that fixes DESTDIR in 4352282089Sdes unbound-control-setup for installs where config is not in 4353282089Sdes the prefix location. 4354282089Sdes - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing 4355282089Sdes IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne). 4356282089Sdes - Updated contrib warmup.cmd/sh to support two modes - load 4357282089Sdes from pre-defined list of domains or (with filename as argument) 4358282089Sdes load from user-specified list of domains, and updated contrib 4359282089Sdes unbound_cache.sh/cmd to support loading/save/reload cache to/from 4360282089Sdes default path or (with secondary argument) arbitrary path/filename, 4361282089Sdes from Yuri Voinov. 4362282089Sdes - Patch from Philip Paeps to contrib/unbound_munin_ that uses 4363282089Sdes type ABSOLUTE. Allows munin.conf: [idleserver.example.net] 4364282089Sdes unbound_munin_hits.graph_period minute 4365282089Sdes 4366282089Sdes9 December 2014: Wouter 4367282089Sdes - svn trunk has 1.5.2 in development. 4368282089Sdes - config.guess and config.sub update from libtoolize. 4369282089Sdes - local-zone: example.com inform makes unbound log a message with 4370282089Sdes client IP for queries in that zone. Eg. for finding infected hosts. 4371282089Sdes 4372282089Sdes8 December 2014: Wouter 4373282089Sdes - Fix CVE-2014-8602: denial of service by making resolver chase 4374282089Sdes endless series of delegations. 4375282089Sdes 4376276605Sdes1 December 2014: Wouter 4377276605Sdes - Fix bug#632: unbound fails to build on AArch64, protects 4378276605Sdes getentropy compat code from calling sysctl if it is has been removed. 4379276605Sdes 4380276605Sdes29 November 2014: Wouter 4381276605Sdes - Add include to getentropy_linux.c, hopefully fixing debian build. 4382276605Sdes 4383276605Sdes28 November 2014: Wouter 4384276605Sdes - Fix makefile for build from noexec source tree. 4385276605Sdes 4386276605Sdes26 November 2014: Wouter 4387276605Sdes - Fix libunbound undefined symbol errors for main. 4388276605Sdes Referencing main does not seem to be possible for libunbound. 4389276605Sdes 4390276605Sdes24 November 2014: Wouter 4391276605Sdes - Fix log at high verbosity and memory allocation failure. 4392276605Sdes - iana portlist update. 4393276605Sdes 4394276605Sdes21 November 2014: Wouter 4395276605Sdes - Fix crash on multiple thread random usage on systems without 4396276605Sdes arc4random. 4397276605Sdes 4398276605Sdes20 November 2014: Wouter 4399276605Sdes - fix compat/getentropy_win.c check if CryptGenRandom works and no 4400276605Sdes immediate exit on windows. 4401276605Sdes 4402276605Sdes19 November 2014: Wouter 4403276605Sdes - Fix cdflag dns64 processing. 4404276605Sdes 4405276605Sdes18 November 2014: Wouter 4406276605Sdes - Fix that CD flag disables DNS64 processing, returning the DNSSEC 4407276605Sdes signed AAAA denial. 4408276605Sdes - iana portlist update. 4409276605Sdes 4410276605Sdes17 November 2014: Wouter 4411276605Sdes - Fix #627: SSL_CTX_load_verify_locations return code not properly 4412276605Sdes checked. 4413276605Sdes 4414276605Sdes14 November 2014: Wouter 4415276605Sdes - parser with bison 2.7 4416276605Sdes 4417276605Sdes13 November 2014: Wouter 4418276605Sdes - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, 4419276605Sdes added to contrib/aaaa-filter-iterator.patch. 4420276605Sdes 4421276605Sdes12 November 2014: Wouter 4422276605Sdes - trunk has 1.5.1 in development. 4423276605Sdes - Patch from Robert Edmonds to build pyunbound python module 4424276605Sdes differently. No versioninfo, with -shared and without $(LIBS). 4425276605Sdes - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page. 4426276605Sdes - Removed 'increased limit open files' log message that is written 4427276605Sdes to console. It is only written on verbosity 4 and higher. 4428276605Sdes This keeps system bootup console cleaner. 4429276605Sdes - Patch from James Raftery, always print stats for rcodes 0..5. 4430276605Sdes 4431276605Sdes11 November 2014: Wouter 4432276605Sdes - iana portlist update. 4433276605Sdes - Fix bug where forward or stub addresses with same address but 4434276605Sdes different port number were not tried. 4435276605Sdes - version number in svn trunk is 1.5.0 4436276605Sdes - tag 1.5.0rc1 4437276605Sdes - review fix from Ralph. 4438276605Sdes 4439276605Sdes7 November 2014: Wouter 4440276605Sdes - dnstap fixes by Robert Edmonds: 4441276605Sdes dnstap/dnstap.m4: cosmetic fixes 4442276605Sdes dnstap/: Remove compiled protoc-c output files 4443276605Sdes dnstap/dnstap.m4: Error out if required libraries are not found 4444276605Sdes dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of 4445276605Sdes protobuf-c 1.0.0 4446276605Sdes dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0) 4447276605Sdes 4448276605Sdes4 November 2014: Wouter 4449276605Sdes - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically 4450276605Sdes tracked trust anchor to libunbound. 4451276605Sdes - Redefine internal minievent symbols to unique symbols that helps 4452276605Sdes linking on platforms where the linker leaks names across modules. 4453276605Sdes 4454276605Sdes27 October 2014: Wouter 4455276605Sdes - Disabled use of SSLv3 in remote-control and ssl-upstream. 4456276605Sdes - iana portlist update. 4457276605Sdes 4458276605Sdes16 October 2014: Wouter 4459276605Sdes - Documented dns64 configuration in unbound.conf man page. 4460276605Sdes 4461276605Sdes13 October 2014: Wouter 4462276605Sdes - Fix #617: in ldns in unbound, lowercase WKS services. 4463276605Sdes - Fix ctype invocation casts. 4464276605Sdes 4465276605Sdes10 October 2014: Wouter 4466276605Sdes - Fix unbound-checkconf check for module config with dns64 module. 4467276605Sdes - Fix unbound capsforid fallback, it ignores TTLs in comparison. 4468276605Sdes 4469276605Sdes6 October 2014: Wouter 4470276605Sdes - Fix #614: man page variable substitution bug. 4471276605Sdes6 October 2014: Willem 4472276605Sdes - Whitespaces after $ORIGIN are not part of the origin dname (ldns). 4473276605Sdes - $TTL's value starts at position 5 (ldns). 4474276605Sdes 4475276605Sdes1 October 2014: Wouter 4476276605Sdes - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire). 4477276605Sdes 4478276605Sdes29 September 2014: Wouter 4479276605Sdes - Fix #612: create service with service.conf in present directory and 4480276605Sdes auto load it. 4481276605Sdes - Fix for mingw compile openssl ranlib. 4482276605Sdes 4483276605Sdes25 September 2014: Wouter 4484276605Sdes - updated configure and aclocal with newer autoconf 1.13. 4485276605Sdes 4486276605Sdes22 September 2014: Wouter 4487276605Sdes - Fix swig and python examples for Python 3.x. 4488276605Sdes - Fix for mingw compile with openssl-1.0.1i. 4489276605Sdes 4490276605Sdes19 September 2014: Wouter 4491276605Sdes - improve python configuration detection to build on Fedora 22. 4492276605Sdes 4493276605Sdes18 September 2014: Wouter 4494276605Sdes - patches to also build with Python 3.x (from Pavel Simerda). 4495276605Sdes 4496276605Sdes16 September 2014: Wouter 4497276605Sdes - Fix tcp timer waiting list removal code. 4498276605Sdes - iana portlist update. 4499276605Sdes - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue 4500276605Sdes is longer and more tcp connections can be handled. 4501276605Sdes 4502276605Sdes15 September 2014: Wouter 4503276605Sdes - Fix unit test for CDS typecode. 4504276605Sdes 4505276605Sdes5 September 2014: Wouter 4506276605Sdes - type CDS and CDNSKEY types in sldns. 4507276605Sdes 4508276605Sdes25 August 2014: Wouter 4509276605Sdes - Fixup checklock code for log lock and its mutual initialization 4510276605Sdes dependency. 4511276605Sdes - iana portlist update. 4512276605Sdes - Removed necessity for pkg-config from the dnstap.m4, new are 4513276605Sdes the --with-libfstrm and --with-protobuf-c configure options. 4514276605Sdes 4515276605Sdes19 August 2014: Wouter 4516276605Sdes - Update unbound manpage with more explanation (from Florian Obser). 4517276605Sdes 4518276605Sdes18 August 2014: Wouter 4519276605Sdes - Fix #603: unbound-checkconf -o <option> should skip verification 4520276605Sdes checks. 4521276605Sdes - iana portlist update. 4522276605Sdes - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings. 4523276605Sdes 4524276605Sdes5 August 2014: Wouter 4525276605Sdes - dnstap support, with a patch from Farsight Security, written by 4526276605Sdes Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c. 4527276605Sdes It is BSD licensed (see dnstap/dnstap.c). 4528276605Sdes Building with --enable-dnstap needs pkg-config with this patch. 4529276605Sdes - Noted dnstap in doc/README and doc/CREDITS. 4530276605Sdes - Changes to the dnstap patch. 4531276605Sdes - lint fixes. 4532276605Sdes - dnstap/dnstap_config.h should not have been added to the repo, 4533276605Sdes because is it generated. 4534276605Sdes 4535276605Sdes1 August 2014: Wouter 4536276605Sdes - Patch add msg, rrset, infra and key cache sizes to stats command 4537276605Sdes from Maciej Soltysiak. 4538276605Sdes - iana portlist update. 4539276605Sdes 4540276605Sdes31 July 2014: Wouter 4541276605Sdes - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault. 4542276605Sdes Initial commit of the patch from the FreeBSD base (with its fixes). 4543276605Sdes This adds a module (for module-config in unbound.conf) dns64 that 4544276605Sdes performs DNS64 processing, see README.DNS64. 4545276605Sdes - Changes from DNS64: 4546276605Sdes strcpy changed to memmove. 4547276605Sdes arraybound check fixed from prefix_net/8/4 to prefix_net/8+4. 4548276605Sdes allocation of result consistently in the correct region. 4549276605Sdes time_t is now used for ttl in unbound (since the patch's version). 4550276605Sdes - testdata/dns64_lookup.rpl for unit test for dns64 functionality. 4551276605Sdes 4552276605Sdes29 July 2014: Wouter 4553276605Sdes - Patch from Dag-Erling Smorgrav that implements feature, unbound -dd 4554276605Sdes does not fork in the background and also logs to stderr. 4555276605Sdes 4556276605Sdes21 July 2014: Wouter 4557276605Sdes - Fix endian.h include for OpenBSD. 4558276605Sdes 4559276605Sdes16 July 2014: Wouter 4560276605Sdes - And Fix#596: Bail out of unbound-control dump_infra when ssl 4561276605Sdes write fails. 4562276605Sdes 4563276605Sdes15 July 2014: Wouter 4564276605Sdes - Fix #596: Bail out of unbound-control list_local_zones when ssl 4565276605Sdes write fails. 4566276605Sdes - iana portlist update. 4567276605Sdes 4568276605Sdes13 July 2014: Wouter 4569276605Sdes - Configure tests if main can be linked to from getentropy compat. 4570276605Sdes 4571276605Sdes12 July 2014: Wouter 4572276605Sdes - Fix getentropy compat code, function refs were not portable. 4573276605Sdes - Fix to check openssl version number only for OpenSSL. 4574276605Sdes - LibreSSL provides compat items, check for that in configure. 4575276605Sdes - Fix bug in fix for log locks that caused deadlock in signal handler. 4576276605Sdes - update compat/getentropy and arc4random to the most recent ones from OpenBSD. 4577276605Sdes 4578276605Sdes11 July 2014: Matthijs 4579276605Sdes - fake-rfc2553 patch (thanks Benjamin Baier). 4580276605Sdes 4581276605Sdes11 July 2014: Wouter 4582276605Sdes - arc4random in compat/ and getentropy, explicit_bzero, chacha for 4583276605Sdes dependencies, from OpenBSD. arc4_lock and sha512 in compat. 4584276605Sdes This makes arc4random available on all platforms, except when 4585276605Sdes compiled with LIBNSS (it uses libNSS crypto random). 4586276605Sdes - fix strptime implicit declaration error on OpenBSD. 4587276605Sdes - arc4random, getentropy and explicit_bzero compat for Windows. 4588276605Sdes 4589276605Sdes4 July 2014: Wouter 4590276605Sdes - Fix #593: segfault or crash upon rotating logfile. 4591276605Sdes 4592276605Sdes3 July 2014: Wouter 4593276605Sdes - DLV tests added. 4594276605Sdes - signit tool fixup for compile with libldns library. 4595276605Sdes - iana portlist updated. 4596276605Sdes 4597276605Sdes27 June 2014: Wouter 4598276605Sdes - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X. 4599276605Sdes 4600276605Sdes26 June 2014: Wouter 4601276605Sdes - unbound-control status reports if so-reuseport was successful. 4602276605Sdes - iana portlist updated. 4603276605Sdes 4604276605Sdes24 June 2014: Wouter 4605276605Sdes - Fix caps-for-id fallback, and added fallback attempt when servers 4606276605Sdes drop 0x20 perturbed queries. 4607276605Sdes - Fixup testsetup for VM tests (run testcode/run_vm.sh). 4608276605Sdes 4609276605Sdes17 June 2014: Wouter 4610276605Sdes - iana portlist updated. 4611276605Sdes 4612276605Sdes3 June 2014: Wouter 4613276605Sdes - Add AAAA for B root server to default root hints. 4614276605Sdes 4615276605Sdes2 June 2014: Wouter 4616276605Sdes - Remove unused define from iterator.h 4617276605Sdes 4618276605Sdes30 May 2014: Wouter 4619276605Sdes - Fixup sldns_enum_edns_option typedef definition. 4620276605Sdes 4621276605Sdes28 May 2014: Wouter 4622276605Sdes - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue 4623276605Sdes fixes from FreeBSD's copy of Unbound, he notes: 4624276605Sdes Generate unbound-control-setup.sh at build time so it respects 4625276605Sdes prefix and sysconfdir from the configure script. Also fix the 4626276605Sdes umask to match the comment, and the comment to match the umask. 4627276605Sdes Add const and static where needed. Use unions instead of 4628276605Sdes playing pointer poker. Move declarations that are needed in 4629276605Sdes multiple source files into a shared header. Move sldns_bgetc() 4630276605Sdes from parse.c to buffer.c where it belongs. Introduce a new 4631276605Sdes header file, worker.h, which declares the callbacks that 4632276605Sdes all workers must define. Remove those declarations from 4633276605Sdes libworker.h. Include the correct headers in the correct places. 4634276605Sdes Fix a few dummy callbacks that don't match their prototype. 4635276605Sdes Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. 4636276605Sdes Remove a useless printf which breaks reproducible builds. 4637276605Sdes Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're 4638276605Sdes no longer used. Add unbound-control-setup.sh to the list of 4639276605Sdes generated files. The prototype for libworker_event_done_cb() 4640276605Sdes needs to be moved from libunbound/libworker.h to 4641276605Sdes libunbound/worker.h. 4642276605Sdes - Fixup out-of-directory compile with unbound-control-setup.sh.in. 4643276605Sdes - make depend. 4644276605Sdes 4645276605Sdes23 May 2014: Wouter 4646276605Sdes - unbound-host -D enabled dnssec and reads root trust anchor from 4647276605Sdes the default root key file that was compiled in. 4648276605Sdes 4649276605Sdes20 May 2014: Wouter 4650276605Sdes - Feature, unblock-lan-zones: yesno that you can use to make unbound 4651276605Sdes perform 10.0.0.0/8 and other reverse lookups normally, for use if 4652276605Sdes unbound is running service for localhost on localhost. 4653276605Sdes 4654276605Sdes16 May 2014: Wouter 4655276605Sdes - Updated create_unbound_ad_servers and unbound_cache scripts from 4656276605Sdes Yuri Voinov in the source/contrib directory. Added 4657276605Sdes warmup.cmd (and .sh): warm up the DNS cache with your MRU domains. 4658276605Sdes 4659276605Sdes9 May 2014: Wouter 4660276605Sdes - Implement draft-ietf-dnsop-rfc6598-rfc6303-01. 4661276605Sdes - iana portlist updated. 4662276605Sdes 4663276605Sdes8 May 2014: Wouter 4664276605Sdes - Contrib windows scripts from Yuri Voinov added to src/contrib: 4665276605Sdes create_unbound_ad_servers.cmd: enters anti-ad server lists. 4666276605Sdes unbound_cache.cmd: saves and loads the cache. 4667276605Sdes - Added unbound-control-setup.cmd from Yuri Voinov to the windows 4668276605Sdes unbound distribution set. It requires openssl installed in %PATH%. 4669276605Sdes 4670276605Sdes6 May 2014: Wouter 4671276605Sdes - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier. 4672276605Sdes 4673276605Sdes5 May 2014: Wouter 4674276605Sdes - More #567: remove : from output of stub and forward lists, this is 4675276605Sdes easier to parse. 4676276605Sdes 4677276605Sdes29 April 2014: Wouter 4678276605Sdes - iana portlist updated. 4679276605Sdes - Add unbound-control flush_negative that flushed nxdomains, nodata, 4680276605Sdes and errors from the cache. For dnssec-trigger and NetworkManager, 4681276605Sdes fixes cases where network changes have localdata that was already 4682276605Sdes negatively cached from the previous network. 4683276605Sdes 4684276605Sdes23 April 2014: Wouter 4685276605Sdes - Patch from Jeremie Courreges-Anglas to use arc4random_uniform 4686276605Sdes if available on the OS, it gets entropy from the OS. 4687276605Sdes 4688276605Sdes15 April 2014: Wouter 4689276605Sdes - Fix compile with libevent2 on FreeBSD. 4690276605Sdes 4691276605Sdes11 April 2014: Wouter 4692276605Sdes - Fix #502: explain that do-ip6 disable does not stop AAAA lookups, 4693276605Sdes but it stops the use of the ipv6 transport layer for DNS traffic. 4694276605Sdes - iana portlist updated. 4695276605Sdes 4696276605Sdes10 April 2014: Wouter 4697276605Sdes - iana portlist updated. 4698276605Sdes - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation 4699276605Sdes option for DNS fragmentation defense. 4700276605Sdes - Document that dump_requestlist only prints queries from thread 0. 4701276605Sdes - unbound-control stats prints num.query.tcpout with number of TCP 4702276605Sdes outgoing queries made in the previous statistics interval. 4703276605Sdes - Fix #567: unbound lists if forward zone is secure or insecure with 4704276605Sdes +i annotation in output of list_forwards, also for list_stubs 4705276605Sdes (for NetworkManager integration.) 4706276605Sdes - Fix #554: use unsigned long to print 64bit statistics counters on 4707276605Sdes 64bit systems. 4708276605Sdes - Fix #558: failed prefetch lookup does not remove cached response 4709276605Sdes but delays next prefetch (in lieu of caching a SERVFAIL). 4710276605Sdes - Fix #545: improved logging, the ip address of the error is printed 4711276605Sdes on the same log-line as the error. 4712276605Sdes 4713276605Sdes8 April 2014: Wouter 4714276605Sdes - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control 4715276605Sdes in testbound scripts. 4716276605Sdes - iana portlist updated. 4717276605Sdes 4718276605Sdes7 April 2014: Wouter 4719276605Sdes - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root 4720276605Sdes hints (patch from Anand Buddhdev). 4721276605Sdes - Fix #572: Fix unit test failure for systems with different 4722276605Sdes /etc/services. 4723276605Sdes 4724276605Sdes28 March 2014: Wouter 4725276605Sdes - Fix #569: do_tcp is do-tcp in unbound.conf man page. 4726276605Sdes 4727276605Sdes25 March 2014: Wouter 4728276605Sdes - Patch from Stuart Henderson to build unbound-host man from .1.in. 4729276605Sdes 4730276605Sdes24 March 2014: Wouter 4731276605Sdes - Fix print filename of encompassing config file on read failure. 4732276605Sdes 4733266114Sdes12 March 2014: Wouter 4734266114Sdes - tag 1.4.22 4735276605Sdes - trunk has 1.4.23 in development. 4736266114Sdes 4737266114Sdes10 March 2014: Wouter 4738266114Sdes - Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes 4739266114Sdes because of spelling. Patch from Chris Coates. 4740266114Sdes 4741266114Sdes27 February 2014: Wouter 4742266114Sdes - tag 1.4.22rc1 4743266114Sdes 4744266114Sdes21 February 2014: Wouter 4745266114Sdes - iana portlist updated. 4746266114Sdes 4747266114Sdes20 February 2014: Matthijs 4748266114Sdes - Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is 4749266114Sdes received. This is okay according 4035, but not after revising 4750266114Sdes existence in 4592. NSEC empty non-terminals exist and thus the 4751266114Sdes RCODE should have been NOERROR. If this occurs, and the RRsets 4752266114Sdes are secure, we set the RCODE to NOERROR and the security status 4753292206Sdes of the response is also considered secure. 4754266114Sdes 4755266114Sdes14 February 2014: Wouter 4756266114Sdes - Works on Minix (3.2.1). 4757266114Sdes 4758266114Sdes11 February 2014: Wouter 4759266114Sdes - Fix parse of #553(NSD) string in sldns, quotes without spaces. 4760266114Sdes 4761266114Sdes7 February 2014: Wouter 4762266114Sdes - iana portlist updated. 4763266114Sdes - add body to ifstatement if locks disabled. 4764266114Sdes - add TXT string"string" test case to unit test. 4765266114Sdes - Fix #551: License change "Regents" to "Copyright holder", matching 4766266114Sdes the BSD license on opensource.org. 4767266114Sdes 4768266114Sdes6 February 2014: Wouter 4769266114Sdes - sldns has type HIP. 4770266114Sdes - code documentation on the module interface. 4771266114Sdes 4772266114Sdes5 February 2014: Wouter 4773266114Sdes - Fix sldns parse tests on osx. 4774266114Sdes 4775266114Sdes3 February 2014: Wouter 4776266114Sdes - Detect libevent2 install automatically by configure. 4777266114Sdes - Fixup link with lib/event2 subdir. 4778266114Sdes - Fix parse in sldns of quoted parenthesized text strings. 4779266114Sdes 4780266114Sdes31 January 2014: Wouter 4781266114Sdes - unit test for ldns wire to str and back with zones, root, nlnetlabs 4782266114Sdes and types.sidnlabs. 4783266114Sdes - Fix for hex to string in unknown, atma and nsap. 4784266114Sdes - fixup nss compile (no ldns in it). 4785266114Sdes - fixup warning in unitldns 4786266114Sdes - fixup WKS and rdata type service to print unsigned because strings 4787266114Sdes are not portable; they cannot be read (for sure) on other computers. 4788266114Sdes - fixup type EUI48 and EUI64, type APL and type IPSECKEY in string 4789266114Sdes parse sldns. 4790266114Sdes 4791266114Sdes30 January 2014: Wouter 4792266114Sdes - delay-close does not act if there are udp-wait queries, so that 4793266114Sdes it does not make a socketdrain DoS easier. 4794266114Sdes 4795266114Sdes28 January 2014: Wouter 4796266114Sdes - iana portlist updated. 4797266114Sdes - iana portlist test updated so it does not touch the source 4798266114Sdes if there are no changes. 4799266114Sdes - delay-close: msec option that delays closing ports for which 4800266114Sdes the UDP reply has timed out. Keeps the port open, only accepts 4801266114Sdes the correct reply. This correct reply is not used, but the port 4802266114Sdes is open so that no port-denied ICMPs are generated. 4803266114Sdes 4804266114Sdes27 January 2014: Wouter 4805266114Sdes - reuseport is attempted, then fallback to without on failure. 4806266114Sdes 4807266114Sdes24 January 2014: Wouter 4808266114Sdes - Change unbound-event.h to use void* buffer, length idiom. 4809266114Sdes - iana portlist updated. 4810266114Sdes - unbound-event.h is installed if you configure --enable-event-api. 4811266114Sdes - speed up unbound (reports say it could be up to 10%), by reducing 4812266114Sdes lock contention on localzones.lock. It is changed to an rwlock. 4813266114Sdes - so-reuseport: yesno option to distribute queries evenly over 4814266114Sdes threads on Linux (Thanks Robert Edmonds). 4815266114Sdes - made lint clean. 4816266114Sdes 4817266114Sdes21 January 2014: Wouter 4818266114Sdes - Fix #547: no trustanchor written if filesystem full, fclose checked. 4819266114Sdes 4820266114Sdes17 January 2014: Wouter 4821266114Sdes - Fix isprint() portability in sldns, uses unsigned int. 4822266114Sdes - iana portlist updated. 4823266114Sdes 4824266114Sdes16 January 2014: Wouter 4825266114Sdes - fix #544: Fixed +i causes segfault when running with module conf 4826266114Sdes "iterator". 4827266114Sdes - Windows port, adjust %lld to %I64d, and warning in win_event.c. 4828266114Sdes 4829266114Sdes14 January 2014: Wouter 4830266114Sdes - iana portlist updated. 4831266114Sdes 4832266114Sdes5 Dec 2013: Wouter 4833266114Sdes - Fix bug in cachedump that uses sldns. 4834266114Sdes - update pythonmod for ldns_ to sldns_ name change. 4835266114Sdes 4836266114Sdes3 Dec 2013: Wouter 4837266114Sdes - Fix sldns to use sldns_ prefix for all ldns_ variables. 4838266114Sdes - Fix windows compile to compile with sldns. 4839266114Sdes 4840266114Sdes30 Nov 2013: Wouter 4841266114Sdes - Fix sldns to make globals use sldns_ prefix. This fixes 4842266114Sdes linking with libldns that uses global variables ldns_ . 4843266114Sdes 4844266114Sdes13 Nov 2013: Wouter 4845266114Sdes - Fix bug#537: compile python plugin without ldns library. 4846266114Sdes 4847266114Sdes12 Nov 2013: Wouter 4848266114Sdes - Fix bug#536: acl_deny_non_local and refuse_non_local added. 4849266114Sdes 4850266114Sdes5 Nov 2013: Wouter 4851266114Sdes - Patch from Neel Goyal to fix async id assignment if callback 4852266114Sdes is called by libunbound in the mesh attach. 4853266114Sdes - Accept ip-address: as an alternative for interface: for 4854266114Sdes consistency with nsd.conf syntax. 4855266114Sdes 4856266114Sdes4 Nov 2013: Wouter 4857266114Sdes - Patch from Neel Goyal to fix callback in libunbound. 4858266114Sdes 4859266114Sdes3 Nov 2013: Wouter 4860266114Sdes - if configured --with-libunbound-only fix make install. 4861266114Sdes 4862266114Sdes31 Oct 2013: Wouter 4863266114Sdes - Fix #531: Set SO_REUSEADDR so that the wildcard interface and a 4864266114Sdes more specific interface port 53 can be used at the same time, and 4865266114Sdes one of the daemons is unbound. 4866266114Sdes - iana portlist update. 4867266114Sdes - separate ldns into core ldns inside ldns/ subdirectory. No more 4868266114Sdes --with-ldns is needed and unbound does not rely on libldns. 4869266114Sdes - portability fixes for new USE_SLDNS ldns subdir codebase. 4870266114Sdes 4871266114Sdes22 Oct 2013: Wouter 4872266114Sdes - Patch from Neel Goyal: Add an API call to set an event base on an 4873266114Sdes existing ub_ctx. This basically just destroys the current worker and 4874266114Sdes sets the event base to the current. And fix a deadlock in 4875266114Sdes ub_resolve_event ��� the cfglock is held when libworker_create is 4876266114Sdes called. This ends up trying to acquire the lock again in 4877266114Sdes context_obtain_alloc in the call chain. 4878266114Sdes - Fix #528: if very high logging (4 or more) segfault on allow_snoop. 4879266114Sdes 4880266114Sdes26 Sep 2013: Wouter 4881266114Sdes - unbound-event.h is installed if configured --with-libevent. It 4882266114Sdes contains low-level library calls, that use libevent's event_base 4883266114Sdes and an ldns_buffer for the wire return packet to perform async 4884266114Sdes resolution in the client's eventloop. 4885266114Sdes 4886266114Sdes19 Sep 2013: Wouter 4887266114Sdes - 1.4.21 tag created. 4888266114Sdes - trunk has 1.4.22 number inside it. 4889266114Sdes - iana portlist updated. 4890266114Sdes - acx_nlnetlabs.m4 to 26; improve FLTO help text. 4891266114Sdes 4892266114Sdes16 Sep 2013: Wouter 4893266114Sdes - Fix#524: max-udp-size not effective to non-EDNS0 queries, from 4894266114Sdes Daisuke HIGASHI. 4895266114Sdes 4896266114Sdes10 Sep 2013: Wouter 4897266114Sdes - MIN_TTL and MAX_TTL also in time_t. 4898266114Sdes - tag 1.4.21rc1 made again. 4899266114Sdes 4900266114Sdes26 Aug 2013: Wouter 4901266114Sdes - More fixes for bug#519: for the threaded case test if the bg 4902266114Sdes thread has been killed, on ub_ctx_delete, to avoid hangs. 4903266114Sdes 4904266114Sdes22 Aug 2013: Wouter 4905266114Sdes - more fixes that I overlooked. 4906266114Sdes - review fixes from Willem. 4907266114Sdes 4908266114Sdes21 Aug 2013: Wouter 4909266114Sdes - Fix#520: Errors found by static analysis from Tomas Hozza(redhat). 4910266114Sdes 4911266114Sdes20 Aug 2013: Wouter 4912266114Sdes - Fix for 2038, with time_t instead of uint32_t. 4913266114Sdes 4914266114Sdes19 Aug 2013: Wouter 4915266114Sdes - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound). 4916266114Sdes 4917266114Sdes14 Aug 2013: Wouter 4918266114Sdes - Fix uninit variable in fix#516. 4919266114Sdes 4920266114Sdes8 Aug 2013: Wouter 4921266114Sdes - Fix#516 dnssec lameness detection for answers that are improper. 4922266114Sdes 4923266114Sdes30 Jun 2013: Wouter 4924266114Sdes - tag 1.4.21rc1 4925266114Sdes 4926266114Sdes29 Jun 2013: Wouter 4927266114Sdes - Fix#512 memleak in testcode for testbound (if it fails). 4928266114Sdes - Fix#512 NSS returned arrays out of setup function to be statics. 4929266114Sdes 4930266114Sdes26 Jun 2013: Wouter 4931266114Sdes - max include of 100.000 files (depth and globbed at one time). 4932266114Sdes This is to preserve system memory in bug cases, or endless cases. 4933266114Sdes - iana portlist updated. 4934266114Sdes 4935266114Sdes19 Jun 2013: Wouter 4936266114Sdes - streamtcp man page, contributed by Tomas Hozza. 4937266114Sdes - iana portlist updated. 4938266114Sdes - libunbound documentation on how to avoid openssl race conditions. 4939266114Sdes 4940266114Sdes25 Jun 2013: Wouter 4941266114Sdes - Squelch sendto-permission denied errors when the network is 4942266114Sdes not connected, to avoid spamming syslog. 4943266114Sdes - configure --disable-flto option (from Robert Edmonds). 4944266114Sdes 4945266114Sdes18 Jun 2013: Wouter 4946266114Sdes - Fix for const string literals in C++ for libunbound, from Karel 4947266114Sdes Slany. 4948266114Sdes - iana portlist updated. 4949266114Sdes 4950266114Sdes17 Jun 2013: Wouter 4951266114Sdes - Fixup manpage syntax. 4952266114Sdes 4953266114Sdes14 Jun 2013: Wouter 4954266114Sdes - get_option and set_option support for log-time-ascii, python-script 4955266114Sdes val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect 4956266114Sdes immediately. The others are mostly useful for libunbound users. 4957266114Sdes 4958266114Sdes13 Jun 2013: Wouter 4959266114Sdes - get_option, set_option, unbound-checkconf -o and libunbound 4960266114Sdes getoption and setoption support cache-min-ttl and cache-max-ttl. 4961266114Sdes 4962266114Sdes10 Jun 2013: Wouter 4963266114Sdes - Fix#501: forward-first does not recurse, when forward name is ".". 4964266114Sdes - iana portlist update. 4965266114Sdes - Max include depth is unlimited. 4966266114Sdes 4967266114Sdes27 May 2013: Wouter 4968266114Sdes - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply 4969266114Sdes patch to it to not fail when -Werror is also specified, from the 4970266114Sdes autoconf-archives. 4971266114Sdes - iana portlist update. 4972266114Sdes 4973266114Sdes21 May 2013: Wouter 4974266114Sdes - Explain bogus and secure flags in libunbound more. 4975266114Sdes 4976266114Sdes16 May 2013: Wouter 4977266114Sdes - Fix#499 use-after-free in out-of-memory handling code (thanks Jake 4978266114Sdes Montgomery). 4979266114Sdes - Fix#500 use on non-initialised values on socket bind failures. 4980266114Sdes 4981266114Sdes15 May 2013: Wouter 4982266114Sdes - Fix round-robin doesn't work with some Windows clients (from Ilya 4983266114Sdes Bakulin). 4984266114Sdes 4985266114Sdes3 May 2013: Wouter 4986266114Sdes - update acx_nlnetlabs.m4 to v23, sleep w32 fix. 4987266114Sdes 4988266114Sdes26 April 2013: Wouter 4989266114Sdes - add unbound-control insecure_add and insecure_remove for the 4990266114Sdes administration of negative trust anchors. 4991266114Sdes 4992266114Sdes25 April 2013: Wouter 4993266114Sdes - Implement max-udp-size config option, default 4096 (thanks 4994266114Sdes Daisuke Higashi). 4995266114Sdes - Robust checks on dname validity from rdata for dname compare. 4996266114Sdes - updated iana portlist. 4997266114Sdes 4998266114Sdes19 April 2013: Wouter 4999266114Sdes - Fixup snprintf return value usage, fixed libunbound_get_option. 5000266114Sdes 5001266114Sdes18 April 2013: Wouter 5002266114Sdes - fix bug #491: pick program name (0th argument) as syslog identity. 5003266114Sdes - own implementation of compat/snprintf.c. 5004266114Sdes 5005266114Sdes15 April 2013: Wouter 5006266114Sdes - Fix so that for a configuration line of include: "*.conf" it is not 5007266114Sdes an error if there are no files matching the glob pattern. 5008266114Sdes - unbound-anchor review: BIO_write can return 0 successfully if it 5009266114Sdes has successfully appended a zero length string. 5010266114Sdes 5011266114Sdes11 April 2013: Wouter 5012266114Sdes - Fix queries leaking up for stubs and forwards, if the configured 5013266114Sdes nameservers all fail to answer. 5014266114Sdes 5015266114Sdes10 April 2013: Wouter 5016266114Sdes - code improve for minimal responses, small speed increase. 5017266114Sdes 5018266114Sdes9 April 2013: Wouter 5019266114Sdes - updated iana portlist. 5020266114Sdes - Fix crash in previous private address fixup of 22 March. 5021266114Sdes 5022266114Sdes28 March 2013: Wouter 5023266114Sdes - Make reverse zones easier by documenting the nodefault statements 5024266114Sdes commented-out in the example config file. 5025266114Sdes 5026266114Sdes26 March 2013: Wouter 5027266114Sdes - more fixes to lookup3.c endianness detection. 5028266114Sdes 5029266114Sdes25 March 2013: Wouter 5030266114Sdes - #492: Fix endianness detection, revert to older lookup3.c detection 5031266114Sdes and put new detect lines after previous tests, to avoid regressions 5032266114Sdes but allow new detections to succeed. 5033266114Sdes And add detection for machine/endian.h to it. 5034266114Sdes 5035266114Sdes22 March 2013: Wouter 5036266114Sdes - Fix resolve of names that use a mix of public and private addresses. 5037266114Sdes - iana portlist update. 5038266114Sdes - Fix makedist for new svn for -d option. 5039266114Sdes - unbound.h header file has UNBOUND_VERSION_MAJOR define. 5040266114Sdes - Fix windows RSRC version for long version numbers. 5041266114Sdes 5042249141Sdes21 March 2013: Wouter 5043249141Sdes - release 1.4.20 5044266114Sdes - trunk has 1.4.21 5045266114Sdes - committed libunbound version 4:1:2 for binary API updated in 1.4.20 5046266114Sdes - install copy of unbound-control.8 man page for unbound-control-setup 5047249141Sdes 5048249141Sdes14 March 2013: Wouter 5049249141Sdes - iana portlist update. 5050249141Sdes - tag 1.4.20rc1 5051249141Sdes 5052249141Sdes12 March 2013: Wouter 5053249141Sdes - Fixup makedist.sh for windows compile. 5054249141Sdes 5055249141Sdes11 March 2013: Wouter 5056249141Sdes - iana portlist update. 5057249141Sdes - testcode/ldns-testpkts.c check for makedist is informational. 5058249141Sdes 5059249141Sdes15 February 2013: Wouter 5060249141Sdes - fix defines in lookup3 for bigendian bsd alpha 5061249141Sdes 5062249141Sdes11 February 2013: Wouter 5063249141Sdes - Fixup openssl_thread init code to only run if compiled with SSL. 5064249141Sdes 5065249141Sdes7 February 2013: Wouter 5066249141Sdes - detect endianness in lookup3 on BSD. 5067249141Sdes - add libunbound.ttl at end of result structure, version bump for 5068249141Sdes libunbound and binary backwards compatible, but 1.4.19 is not 5069249141Sdes forward compatible with 1.4.20. 5070249141Sdes - update iana port list. 5071249141Sdes 5072249141Sdes30 January 2013: Wouter 5073249141Sdes - includes and have_ssl fixes for nss. 5074249141Sdes 5075249141Sdes29 January 2013: Wouter 5076249141Sdes - printout name of zone with duplicate fwd and hint errors. 5077249141Sdes 5078249141Sdes28 January 2013: Wouter 5079249141Sdes - updated fwd_zero for newer nc. Updated common.sh for newer netstat. 5080249141Sdes 5081249141Sdes17 January 2013: Wouter 5082249141Sdes - unbound-anchors checks the emailAddress of the signer of the 5083249141Sdes root.xml file, default is dnssec@iana.org. It also checks that 5084249141Sdes the signer has the correct key usage for a digital signature. 5085249141Sdes - update iana port list. 5086249141Sdes 5087249141Sdes3 January 2013: Wouter 5088249141Sdes - Test that unbound-control checks client credentials. 5089249141Sdes - Test that unbound can handle a CNAME at an intermediate node in 5090249141Sdes the chain of trust (where it seeks a DS record). 5091249141Sdes - Check the commonName of the signer of the root.xml file in 5092249141Sdes unbound-anchor, default is dnssec@iana.org. 5093249141Sdes 5094249141Sdes2 January 2013: Wouter 5095249141Sdes - Fix openssl lock free on exit (reported by Robert Fleischman). 5096249141Sdes - iana portlist updated. 5097249141Sdes - Tested that unbound implements the RFC5155 Technical Errata id 3441. 5098249141Sdes Unbound already implements insecure classification of an empty 5099249141Sdes nonterminal in NSEC3 optout zone. 5100249141Sdes 5101249141Sdes20 December 2012: Wouter 5102249141Sdes - Fix unbound-anchor xml parse of entity declarations for safety. 5103249141Sdes 5104249141Sdes19 December 2012: Wouter 5105249141Sdes - iana portlist updated. 5106249141Sdes 5107249141Sdes18 December 2012: Wouter 5108249141Sdes - iana portlist updated. 5109249141Sdes 5110249141Sdes14 December 2012: Wouter 5111249141Sdes - Change of D.ROOT-SERVERS.NET A address in default root hints. 5112249141Sdes 5113249141Sdes12 December 2012: Wouter 5114249141Sdes - 1.4.19 release. 5115249141Sdes - trunk has 1.4.20 under development. 5116249141Sdes 5117249141Sdes5 December 2012: Wouter 5118249141Sdes - note support for AAAA RR type RFC. 5119249141Sdes 5120249141Sdes4 December 2012: Wouter 5121249141Sdes - 1.4.19rc1 tag. 5122249141Sdes 5123249141Sdes30 November 2012: Wouter 5124249141Sdes - bug 481: fix python example0. 5125249141Sdes - iana portlist updated. 5126249141Sdes 5127249141Sdes27 November 2012: Wouter 5128249141Sdes - iana portlist updated. 5129249141Sdes 5130249141Sdes9 November 2012: Wouter 5131249141Sdes - Fix unbound-control forward disables configured stubs below it. 5132249141Sdes 5133249141Sdes7 November 2012: Wouter 5134249141Sdes - Fixup ldns-testpkts, identical to ldns/examples. 5135249141Sdes - iana portlist updated. 5136249141Sdes 5137249141Sdes30 October 2012: Wouter 5138249141Sdes - Fix bug #477: unbound-anchor segfaults if EDNS is blocked. 5139249141Sdes 5140249141Sdes29 October 2012: Matthijs 5141249141Sdes - Fix validation for responses with both CNAME and wildcard 5142249141Sdes expanded CNAME records in answer section. 5143249141Sdes 5144249141Sdes8 October 2012: Wouter 5145249141Sdes - update ldns-testpkts.c to ldns 1.6.14 version. 5146249141Sdes - fix build of pythonmod in objdir, for unbound.py. 5147249141Sdes - make clean and makerealclean remove generated python and docs. 5148249141Sdes 5149249141Sdes5 October 2012: Wouter 5150249141Sdes - fix build of pythonmod in objdir (thanks Jakob Schlyter). 5151249141Sdes 5152249141Sdes3 October 2012: Wouter 5153249141Sdes - fix text in unbound-anchor man page. 5154249141Sdes 5155249141Sdes1 October 2012: Wouter 5156249141Sdes - ignore trusted-keys globs that have no files (from Paul Wouters). 5157249141Sdes 5158249141Sdes27 September 2012: Wouter 5159249141Sdes - include: directive in config file accepts wildcards. Patch from 5160249141Sdes Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*" 5161249141Sdes - unbound-control -q option is quiet, patch from Mariano Absatz. 5162249141Sdes - iana portlist updated. 5163249141Sdes - updated contrib/unbound.spec, patch from Valentin Bud. 5164249141Sdes 5165249141Sdes21 September 2012: Wouter 5166249141Sdes - chdir to / after chroot call (suggested by Camiel Dobbelaar). 5167249141Sdes 5168249141Sdes17 September 2012: Wouter 5169249141Sdes - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation 5170249141Sdes otherwise it is treated as insecure. The RSAMD5 algorithm is 5171249141Sdes deprecated (RFC6725). The MD5 hash is considered weak for some 5172249141Sdes purposes, if you want to sign your zone, then RSASHA256 is an 5173249141Sdes uncontested hash. 5174249141Sdes 5175249141Sdes30 August 2012: Wouter 5176249141Sdes - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled. 5177249141Sdes - iana portlist updated. 5178249141Sdes 5179249141Sdes29 August 2012: Wouter 5180249141Sdes - Nicer comments outgoing-port-avoid, thanks Stu (bug #465). 5181249141Sdes 5182249141Sdes22 August 2012: Wouter 5183249141Sdes - Fallback to 1472 and 1232, one fragment size without headers. 5184249141Sdes 5185249141Sdes21 August 2012: Wouter 5186249141Sdes - Fix timeouts so that when a server has been offline for a while 5187249141Sdes and is probed to see it works, it becomes fully available for 5188249141Sdes server selection again. 5189249141Sdes 5190249141Sdes17 August 2012: Wouter 5191249141Sdes - Add documentation to libunbound for default nonuse of resolv.conf. 5192249141Sdes 5193249141Sdes2 August 2012: Wouter 5194249141Sdes - trunk has 1.4.19 under development (fixes from 1 aug and 31 july 5195249141Sdes are for 1.4.19). 5196249141Sdes - iana portlist updated. 5197249141Sdes 5198249141Sdes1 August 2012: Wouter 5199249141Sdes - Fix openssl race condition, initializes openssl locks, reported 5200249141Sdes by Einar Lonn and Patrik Wallstrom. 5201249141Sdes 5202249141Sdes31 July 2012: Wouter 5203249141Sdes - Improved forward-first and stub-first documentation. 5204249141Sdes - Fix that enables modules to register twice for the same 5205249141Sdes serviced_query, without race conditions or administration issues. 5206249141Sdes This should not happen with the current codebase, but it is robust. 5207249141Sdes - Fix forward-first option where it sets the RD flag wrongly. 5208249141Sdes - added manpage links for libunbound calls (Thanks Paul Wouters). 5209249141Sdes 5210249141Sdes30 July 2012: Wouter 5211249141Sdes - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012). 5212249141Sdes 5213249141Sdes27 July 2012: Wouter 5214249141Sdes - unbound-host works with libNSS 5215249141Sdes - fix bogus nodata cname chain not reported as bogus by validator, 5216249141Sdes (Thanks Peter van Dijk). 5217249141Sdes 5218249141Sdes26 July 2012: Wouter 5219249141Sdes - iana portlist updated. 5220249141Sdes - tag 1.4.18rc1. 5221249141Sdes 5222249141Sdes25 July 2012: Wouter 5223249141Sdes - review fix for libnss, check hash prefix allocation size. 5224249141Sdes 5225249141Sdes23 July 2012: Wouter 5226249141Sdes - fix missing break for GOST DS hash function. 5227249141Sdes - implemented forward_first for the root. 5228249141Sdes 5229249141Sdes20 July 2012: Wouter 5230249141Sdes - Fix bug#452 and another assertion failure in mesh.c, makes 5231249141Sdes assertions in mesh.c resist duplicates. Fixes DS NS search to 5232249141Sdes not generate duplicate sub queries. 5233249141Sdes 5234249141Sdes19 July 2012: Willem 5235249141Sdes - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac, 5236249141Sdes if CFLAGS is specified at configure time then '-g -O2' is not 5237249141Sdes appended to CFLAGS, so that the user can override them. 5238249141Sdes 5239249141Sdes18 July 2012: Willem 5240249141Sdes - Fix libunbound report of errors when in background mode. 5241249141Sdes 5242249141Sdes11 July 2012: Willem 5243249141Sdes - updated iana ports list. 5244249141Sdes 5245249141Sdes9 July 2012: Willem 5246249141Sdes - Add flush_bogus option for unbound-control 5247249141Sdes 5248249141Sdes6 July 2012: Wouter 5249249141Sdes - Fix validation of qtype DS queries that result in no data for 5250249141Sdes non-optout NSEC3 zones. 5251249141Sdes 5252249141Sdes4 July 2012: Wouter 5253249141Sdes - compile libunbound with libnss on Suse, passes regression tests. 5254249141Sdes 5255249141Sdes3 July 2012: Wouter 5256249141Sdes - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes. 5257249141Sdes 5258249141Sdes2 July 2012: Wouter 5259249141Sdes - updated iana ports list. 5260249141Sdes 5261249141Sdes29 June 2012: Wouter 5262249141Sdes - patch for unbound_munin_ script to handle arbitrary thread count by 5263249141Sdes Sven Ulland. 5264249141Sdes 5265249141Sdes28 June 2012: Wouter 5266249141Sdes - detect if openssl has FIPS_mode. 5267249141Sdes - code review: return value of cache_store can be ignored for better 5268249141Sdes performance in out of memory conditions. 5269249141Sdes - fix edns-buffer-size and msg-buffer-size manpage documentation. 5270249141Sdes - updated iana ports list. 5271249141Sdes 5272249141Sdes25 June 2012: Wouter 5273249141Sdes - disable RSAMD5 if in FIPS mode (for openssl and for libnss). 5274249141Sdes 5275249141Sdes22 June 2012: Wouter 5276249141Sdes - implement DS records, NSEC3 and ECDSA for compile with libnss. 5277249141Sdes 5278249141Sdes21 June 2012: Wouter 5279249141Sdes - fix error handling of alloc failure during rrsig verification. 5280249141Sdes - nss check for verification failure. 5281249141Sdes - nss crypto works for RSA and DSA. 5282249141Sdes 5283249141Sdes20 June 2012: Wouter 5284249141Sdes - work on --with-nss build option (for now, --with-libunbound-only). 5285249141Sdes 5286249141Sdes19 June 2012: Wouter 5287249141Sdes - --with-libunbound-only build option, only builds the library and 5288249141Sdes not the daemon and other tools. 5289249141Sdes 5290249141Sdes18 June 2012: Wouter 5291249141Sdes - code review. 5292249141Sdes 5293249141Sdes15 June 2012: Wouter 5294249141Sdes - implement log-time-ascii on windows. 5295249141Sdes - The key-cache bad key ttl is now 60 seconds. 5296249141Sdes - updated iana ports list. 5297249141Sdes - code review. 5298249141Sdes 5299249141Sdes11 June 2012: Wouter 5300249141Sdes - bug #452: fix crash on assert in mesh_state_attachment. 5301249141Sdes 5302249141Sdes30 May 2012: Wouter 5303249141Sdes - silence warning from swig-generated code (md set but not used in 5304249141Sdes swig initmodule, due to ifdefs in swig-generated code). 5305249141Sdes 5306249141Sdes27 May 2012: Wouter 5307249141Sdes - Fix debian-bugs-658021: Please enable hardened build flags. 5308249141Sdes 5309249141Sdes25 May 2012: Wouter 5310249141Sdes - updated iana ports list. 5311249141Sdes 5312238106Sdes24 May 2012: Wouter 5313238106Sdes - tag for 1.4.17 release. 5314249141Sdes - trunk is 1.4.18 in development. 5315238106Sdes 5316238106Sdes18 May 2012: Wouter 5317238106Sdes - Review comments, removed duplicate memset to zero in delegpt. 5318238106Sdes 5319238106Sdes16 May 2012: Wouter 5320238106Sdes - Updated doc/FEATURES with RFCs that are implemented but not listed. 5321238106Sdes - Protect if statements in val_anchor for compile without locks. 5322238106Sdes - tag for 1.4.17rc1. 5323238106Sdes 5324238106Sdes15 May 2012: Wouter 5325238106Sdes - fix configure ECDSA support in ldns detection for windows compile. 5326238106Sdes - fix possible uninitialised variable in windows pipe implementation. 5327238106Sdes 5328238106Sdes9 May 2012: Wouter 5329238106Sdes - Fix alignment problem in util/random on sparc64/freebsd. 5330238106Sdes 5331238106Sdes8 May 2012: Wouter 5332238106Sdes - Fix for accept spinning reported by OpenBSD. 5333238106Sdes - iana portlist updated. 5334238106Sdes 5335238106Sdes2 May 2012: Wouter 5336238106Sdes - Fix validation of nodata for DS query in NSEC zones, reported by 5337238106Sdes Ondrej Mikle. 5338238106Sdes 5339238106Sdes13 April 2012: Wouter 5340238106Sdes - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older 5341238106Sdes openssl. 5342238106Sdes 5343238106Sdes10 April 2012: Wouter 5344238106Sdes - Applied patch from Daisuke HIGASHI for rrset-roundrobin and 5345238106Sdes minimal-responses features. 5346238106Sdes - iana portlist updated. 5347238106Sdes 5348238106Sdes5 April 2012: Wouter 5349238106Sdes - fix bug #443: --with-chroot-dir not honoured by configure. 5350238106Sdes - fix bug #444: setusercontext was called too late (thanks Bjorn 5351238106Sdes Ketelaars). 5352238106Sdes 5353238106Sdes27 March 2012: Wouter 5354238106Sdes - fix bug #442: Fix that Makefile depends on pythonmod headers 5355238106Sdes even using --without-pythonmodule. 5356238106Sdes 5357238106Sdes22 March 2012: Wouter 5358238106Sdes - contrib/validation-reporter follows rotated log file (patch from 5359238106Sdes Augie Schwer). 5360238106Sdes 5361238106Sdes21 March 2012: Wouter 5362238106Sdes - new approach to NS fetches for DS lookup that works with 5363238106Sdes cornercases, and is more robust and considers forwarders. 5364238106Sdes 5365238106Sdes19 March 2012: Wouter 5366238106Sdes - iana portlist updated. 5367238106Sdes - fix to locate nameservers for DS lookup with NS fetches. 5368238106Sdes 5369238106Sdes16 March 2012: Wouter 5370238106Sdes - Patch for access to full DNS packet data in unbound python module 5371238106Sdes from Ondrej Mikle. 5372238106Sdes 5373238106Sdes9 March 2012: Wouter 5374238106Sdes - Applied line-buffer patch from Augie Schwer to validation.reporter.sh. 5375238106Sdes 5376238106Sdes2 March 2012: Wouter 5377238106Sdes - flush_infra cleans timeouted servers from the cache too. 5378238106Sdes - removed warning from --enable-ecdsa. 5379238106Sdes 5380238106Sdes1 March 2012: Wouter 5381238106Sdes - forward-first option. Tries without forward if a query fails. 5382238106Sdes Also stub-first option that is similar. 5383238106Sdes 5384238106Sdes28 February 2012: Wouter 5385238106Sdes - Fix from code review, if EINPROGRESS not defined chain if statement 5386238106Sdes differently. 5387238106Sdes 5388238106Sdes27 February 2012: Wouter 5389238106Sdes - Fix bug#434: on windows check registry for config file location 5390238106Sdes for unbound-control.exe, and unbound-checkconf.exe. 5391238106Sdes 5392238106Sdes23 February 2012: Wouter 5393238106Sdes - Fix to squelch 'network unreachable' errors from tcp connect in 5394238106Sdes logs, high verbosity will show them. 5395238106Sdes 5396238106Sdes16 February 2012: Wouter 5397238106Sdes - iter_hints is now thread-owned in module env, and thus threadsafe. 5398238106Sdes - Fix prefetch and sticky NS, now the prefetch works. It picks 5399238106Sdes nameservers that 'would be valid in the future', and if this makes 5400238106Sdes the NS timeout, it updates that NS by asking delegation from the 5401238106Sdes parent again. If child NS has longer TTL, that TTL does not get 5402238106Sdes refreshed from the lookup to the child nameserver. 5403238106Sdes 5404238106Sdes15 February 2012: Wouter 5405238106Sdes - Fix forward-zone memory, uses malloc and frees original root dp. 5406238106Sdes - iter hints (stubs) uses malloc inside for more dynamicity. 5407238106Sdes - unbound-control forward_add, forward_remove, stub_add, stub_remove 5408238106Sdes can modify stubs and forwards for running unbound (on mobile computer) 5409238106Sdes they can also add and remove domain-insecure for the zone. 5410238106Sdes 5411238106Sdes14 February 2012: Wouter 5412238106Sdes - Fix sticky NS (ghost domain problem) if prefetch is yes. 5413238106Sdes - iter forwards uses malloc inside for more dynamicity. 5414238106Sdes 5415238106Sdes13 February 2012: Wouter 5416238106Sdes - RT#2955. Fix for cygwin compilation. 5417238106Sdes - iana portlist updated. 5418238106Sdes 5419238106Sdes10 February 2012: Wouter 5420238106Sdes - Slightly smaller critical region in one case in infra cache. 5421238106Sdes - Fix timeouts to keep track of query type, A, AAAA and other, if 5422238106Sdes another has caused timeout blacklist, different type can still probe. 5423238106Sdes - unit test fix for nomem_cnametopos.rpl race condition. 5424238106Sdes 5425238106Sdes9 February 2012: Wouter 5426238106Sdes - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h. 5427238106Sdes 5428238106Sdes8 February 2012: Wouter 5429238106Sdes - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This 5430238106Sdes implementation is experimental at this time and not recommended 5431238106Sdes for use on the public internet (the protocol numbers have not 5432238106Sdes been assigned). Needs recent ldns with --enable-ecdsa. 5433238106Sdes - fix memory leak in errorcase for DSA signatures. 5434238106Sdes - iana portlist updated. 5435238106Sdes - workaround for openssl 0.9.8 ecdsa sha2 and evp problem. 5436238106Sdes 5437238106Sdes3 February 2012: Wouter 5438238106Sdes - fix for windows, rename() is not posix compliant on windows. 5439238106Sdes 5440238106Sdes2 February 2012: Wouter 5441238106Sdes - 1.4.16 release tag. 5442238106Sdes - svn trunk is 1.4.17 in development. 5443238106Sdes - iana portlist updated. 5444238106Sdes 5445238106Sdes1 February 2012: Wouter 5446238106Sdes - Fix validation failures (like: validation failure xx: no NSEC3 5447238106Sdes closest encloser from yy for DS zz. while building chain of trust, 5448238106Sdes because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata 5449238106Sdes for an NSEC3. Now it does not change rdata, and fixes TTL. 5450238106Sdes 5451238106Sdes30 January 2012: Wouter 5452238106Sdes - Fix version-number in libtool to be version-info so it produces 5453238106Sdes libunbound.so.2 like it should. 5454238106Sdes 5455238106Sdes26 January 2012: Wouter 5456238106Sdes - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release. 5457238106Sdes - trunk 1.4.16; includes changes memset testcode, #424 openindiana, 5458238106Sdes and keyfile write fixup. 5459238106Sdes - applied patch to support outgoing-interface with ub_ctx_set_option. 5460238106Sdes 5461238106Sdes23 January 2012: Wouter 5462238106Sdes - Fix memset in test code. 5463238106Sdes 5464238106Sdes20 January 2012: Wouter 5465238106Sdes - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2. 5466238106Sdes 5467238106Sdes19 January 2012: Wouter 5468238106Sdes - Fix to write key files completely to a temporary file, and if that 5469238106Sdes succeeds, replace the real key file. So failures leave a useful file. 5470238106Sdes 5471238106Sdes18 January 2012: Wouter 5472238106Sdes - tag 1.4.15rc1 created 5473238106Sdes - updated libunbound/ubsyms.def and remade tag 1.4.15rc1. 5474238106Sdes 5475238106Sdes17 January 2012: Wouter 5476238106Sdes - Fix bug where canonical_compare of RRSIG did not downcase the 5477238106Sdes signer-name. This is mostly harmless because RRSIGs do not have 5478238106Sdes to be sorted in canonical order, usually. 5479238106Sdes 5480238106Sdes12 January 2012: Wouter 5481238106Sdes - bug#428: add ub_version() call to libunbound. API version increase, 5482238106Sdes with (binary) backwards compatibility for the previous version. 5483238106Sdes 5484238106Sdes10 January 2012: Wouter 5485238106Sdes - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL 5486238106Sdes that would be permissible by the RFCs but it is not the TTL in the 5487238106Sdes cache. 5488238106Sdes - iana portlist updated. 5489238106Sdes - uninitialised variable in reprobe for rtt blocked domains fixed. 5490238106Sdes - lintfix and new flex output. 5491238106Sdes 5492238106Sdes2 January 2012: Wouter 5493238106Sdes - Fix to randomize hash function, based on 28c3 congress, reported 5494238106Sdes by Peter van Dijk. 5495238106Sdes 5496238106Sdes24 December 2011: Wouter 5497238106Sdes - Fix for memory leak (about 20 bytes when a tcp or udp send operation 5498238106Sdes towards authority servers failed, takes about 50.000 such failures to 5499238106Sdes leak one Mb, such failures are also usually logged), reported by 5500238106Sdes Robert Fleischmann. 5501238106Sdes - iana portlist updated. 5502238106Sdes 5503238106Sdes19 December 2011: Wouter 5504238106Sdes - Fix for VU#209659 CVE-2011-4528: Unbound denial of service 5505238106Sdes vulnerabilities from nonstandard redirection and denial of existence 5506238106Sdes http://www.unbound.net/downloads/CVE-2011-4528.txt 5507238106Sdes - robust checks for next-closer NSEC3s. 5508238106Sdes - tag 1.4.14 created. 5509238106Sdes - trunk has 1.4.15 in development. 5510238106Sdes 5511238106Sdes15 December 2011: Wouter 5512238106Sdes - remove uninit warning from cachedump code. 5513238106Sdes - Fix parse error on negative SOA RRSIGs if badly ordered in the packet. 5514238106Sdes 5515238106Sdes13 December 2011: Wouter 5516238106Sdes - iana portlist updated. 5517238106Sdes - svn tag 1.4.14rc1 5518238106Sdes - fix infra cache comparison. 5519238106Sdes - Fix to constrain signer_name to be a parent of the lookupname. 5520238106Sdes 5521238106Sdes5 December 2011: Wouter 5522238106Sdes - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc. 5523238106Sdes - Fix warnings with gcc 4.6 in compat/inet_ntop.c. 5524238106Sdes - Fix warning unused in compat/strptime.c. 5525292206Sdes - Fix malloc detection and double definition. 5526238106Sdes 5527238106Sdes2 December 2011: Wouter 5528238106Sdes - configure generated with autoconf 2.68. 5529238106Sdes 5530238106Sdes30 November 2011: Wouter 5531238106Sdes - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes 5532238106Sdes SERVFAILs. Also fixed for UDP (but less likely). 5533238106Sdes 5534238106Sdes28 November 2011: Wouter 5535238106Sdes - Fix quartile time estimate, it was too low, (thanks Jan Komissar). 5536238106Sdes - iana ports updated. 5537238106Sdes 5538238106Sdes11 November 2011: Wouter 5539238106Sdes - Makefile compat with SunOS make, BSD make and GNU make. 5540238106Sdes - iana ports updated. 5541238106Sdes 5542238106Sdes10 November 2011: Wouter 5543238106Sdes - Makefile changed for BSD make compatibility. 5544238106Sdes 5545238106Sdes9 November 2011: Wouter 5546238106Sdes - added unit test for SSL service and SSL-upstream. 5547238106Sdes 5548238106Sdes8 November 2011: Wouter 5549238106Sdes - can configure ssl service to one port number, and not on others. 5550238106Sdes - fixup windows compile with ssl support. 5551238106Sdes - Fix double free in unbound-host, reported by Steve Grubb. 5552238106Sdes - iana portlist updated. 5553238106Sdes 5554238106Sdes1 November 2011: Wouter 5555238106Sdes - dns over ssl support as a client, ssl-upstream yes turns it on. 5556238106Sdes It performs an SSL transaction for every DNS query (250 msec). 5557238106Sdes - documentation for new options: ssl-upstream, ssl-service-key and 5558238106Sdes ssl-service.pem. 5559238106Sdes - iana portlist updated. 5560238106Sdes - fix -flto detection on Lion for llvm-gcc. 5561238106Sdes 5562238106Sdes31 October 2011: Wouter 5563238106Sdes - dns over ssl support, ssl-service-pem and ssl-service-key files 5564238106Sdes can be given and then TCP queries are serviced wrapped in SSL. 5565238106Sdes 5566238106Sdes27 October 2011: Wouter 5567238106Sdes - lame-ttl and lame-size options no longer exist, it is integrated 5568238106Sdes with the host info. They are ignored (with verbose warning) if 5569238106Sdes encountered to keep the config file backwards compatible. 5570238106Sdes - fix iana-update for changing gzip compression of results. 5571238106Sdes - fix export-all-symbols on OSX. 5572238106Sdes 5573238106Sdes26 October 2011: Wouter 5574238106Sdes - iana portlist updated. 5575238106Sdes - Infra cache stores information about ping and lameness per IP, zone. 5576238106Sdes This fixes bug #416. 5577238106Sdes - fix iana_update target for gzipped file on iana site. 5578238106Sdes 5579238106Sdes24 October 2011: Wouter 5580238106Sdes - Fix resolve of partners.extranet.microsoft.com with a fix for the 5581238106Sdes server selection for choosing out of a (particular) list of bad 5582238106Sdes choices. (bug#415) 5583238106Sdes - Fix make_new_space function so that the incoming query is not 5584238106Sdes overwritten if a jostled out query causes a waiting query to be 5585238106Sdes resumed that then fails and sends an error message. (Thanks to 5586238106Sdes Matthew Lee). 5587238106Sdes 5588238106Sdes21 October 2011: Wouter 5589238106Sdes - fix --enable-allsymbols, fptr wlist is disabled on windows with this 5590238106Sdes option enabled because of memory layout exe vs dll. 5591238106Sdes 5592238106Sdes19 October 2011: Wouter 5593238106Sdes - fix unbound-anchor for broken strptime on OSX lion, detected 5594238106Sdes in configure. 5595238106Sdes - Detect if GOST really works, openssl1.0 on OSX fails. 5596238106Sdes - Implement ipv6%interface notation for scope_id usage. 5597238106Sdes 5598238106Sdes17 October 2011: Wouter 5599238106Sdes - better documentation for inform_super (Thanks Yang Zhe). 5600238106Sdes 5601238106Sdes14 October 2011: Wouter 5602238106Sdes - Fix for out-of-memory condition in libunbound (thanks 5603238106Sdes Robert Fleischman). 5604238106Sdes 5605238106Sdes13 October 2011: Wouter 5606238106Sdes - Fix --enable-allsymbols, it depended on link specifics of the 5607238106Sdes target platform, or fptr_wlist assertion failures could occur. 5608238106Sdes 5609238106Sdes12 October 2011: Wouter 5610238106Sdes - updated contrib/unbound_munin_ to family=auto so that it works with 5611238106Sdes munin-node-configure automatically (if installed as 5612238106Sdes /usr/local/share/munin/plugins/unbound_munin_ ). 5613238106Sdes 5614238106Sdes27 September 2011: Wouter 5615238106Sdes - unbound.exe -w windows option for start and stop service. 5616238106Sdes 5617238106Sdes23 September 2011: Wouter 5618238106Sdes - TCP-upstream calculates tcp-ping so server selection works if there 5619238106Sdes are alternatives. 5620238106Sdes 5621238106Sdes20 September 2011: Wouter 5622238106Sdes - Fix classification of NS set in answer section, where there is a 5623238106Sdes parent-child server, and the answer has the AA flag for dir.slb.com. 5624238106Sdes Thanks to Amanda Constant from Secure64. 5625238106Sdes 5626238106Sdes16 September 2011: Wouter 5627238106Sdes - fix bug #408: accept patch from Steve Snyder that comments out 5628238106Sdes unused functions in lookup3.c. 5629238106Sdes - iana portlist updated. 5630238106Sdes - fix EDNS1480 change memleak and TCP fallback. 5631238106Sdes - fix various compiler warnings (reported by Paul Wouters). 5632238106Sdes - max sent count. EDNS1480 only for rtt < 5000. No promiscuous 5633238106Sdes fetch if sentcount > 3, stop query if sentcount > 16. Count is 5634238106Sdes reset when referral or CNAME happens. This makes unbound better 5635238106Sdes at managing large NS sets, they are explored when there is continued 5636238106Sdes interest (in the form of queries). 5637238106Sdes 5638238106Sdes15 September 2011: Wouter 5639238106Sdes - release 1.4.13. 5640238106Sdes - trunk contains 1.4.14 in development. 5641238106Sdes - Unbound probes at EDNS1480 if there an EDNS0 timeout. 5642238106Sdes 5643238106Sdes12 September 2011: Wouter 5644238106Sdes - Reverted dns EDNS backoff fix, it did not help and needs 5645238106Sdes fragmentation fixes instead. 5646238106Sdes - tag 1.4.13rc2 5647238106Sdes 5648238106Sdes7 September 2011: Wouter 5649238106Sdes - Fix operation in ipv6 only (do-ip4: no) mode. 5650238106Sdes 5651238106Sdes6 September 2011: Wouter 5652238106Sdes - fedora specfile updated. 5653238106Sdes 5654238106Sdes5 September 2011: Wouter 5655238106Sdes - tag 1.4.13rc1 5656238106Sdes 5657238106Sdes2 September 2011: Wouter 5658238106Sdes - iana portlist updated. 5659238106Sdes 5660238106Sdes26 August 2011: Wouter 5661238106Sdes - Fix num-threads 0 does not segfault, reported by Simon Deziel. 5662238106Sdes - Fix validation failures due to EDNS backoff retries, the retry 5663238106Sdes for fetch of data has want_dnssec because the iter_indicate_dnssec 5664238106Sdes function returns true when validation failure retry happens, and 5665238106Sdes then the serviced query code does not fallback to noEDNS, even if 5666238106Sdes the cache says it has this. This helps for DLV deployment when 5667238106Sdes the DNSSEC status is not known for sure before the lookup concludes. 5668238106Sdes 5669238106Sdes24 August 2011: Wouter 5670238106Sdes - Applied patch from Karel Slany that fixes a memory leak in the 5671238106Sdes unbound python module, in string conversions. 5672238106Sdes 5673238106Sdes22 August 2011: Wouter 5674238106Sdes - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy 5675238106Sdes Zhang and Luo Ce). Unbound responds with the RR types that are 5676238106Sdes available at the name for qtype ANY and validates those RR types. 5677238106Sdes It does not test for completeness (i.e. with NSEC or NSEC3 query), 5678238106Sdes and it does not follow the CNAME or DNAME to another name (with 5679238106Sdes even more data for the already large response). 5680238106Sdes - Fix that internally, CNAMEs with NXDOMAIN have that as rcode. 5681238106Sdes - Documented the options that work with control set_option command. 5682238106Sdes - tcp-upstream yes/no option (works with set_option) for tunnels. 5683238106Sdes 5684238106Sdes18 August 2011: Wouter 5685238106Sdes - fix autoconf call in makedist crosscompile to RC or snapshot. 5686238106Sdes 5687238106Sdes17 August 2011: Wouter 5688238106Sdes - Fix validation of . DS query. 5689238106Sdes - new xml format at IANA, new awk for iana_update. 5690238106Sdes - iana portlist updated. 5691238106Sdes 5692238106Sdes10 August 2011: Wouter 5693238106Sdes - Fix python site-packages path to /usr/lib64. 5694238106Sdes - updated patch from Tom. 5695238106Sdes - fix memory and fd leak after out-of-memory condition. 5696238106Sdes 5697238106Sdes9 August 2011: Wouter 5698238106Sdes - patch from Tom Hendrikx fixes load of python modules. 5699238106Sdes 5700238106Sdes8 August 2011: Wouter 5701238106Sdes - make clean had ldns-src reference, removed. 5702238106Sdes 5703238106Sdes1 August 2011: Wouter 5704238106Sdes - Fix autoconf 2.68 warnings 5705238106Sdes 5706238106Sdes14 July 2011: Wouter 5707238106Sdes - Unbound implements RFC6303 (since version 1.4.7). 5708238106Sdes - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the 5709238106Sdes meantime, those are for 1.4.13). 5710238106Sdes - iana portlist updated. 5711238106Sdes 5712238106Sdes13 July 2011: Wouter 5713238106Sdes - Quick fix for contrib/unbound.spec example, no ldns-builtin any more. 5714238106Sdes 5715238106Sdes11 July 2011: Wouter 5716238106Sdes - Fix wildcard expansion no-data reply under an optout NSEC3 zone is 5717238106Sdes validated as insecure, reported by Jia Li (lijia@cnnic.cn). 5718238106Sdes 5719238106Sdes4 July 2011: Wouter 5720238106Sdes - 1.4.12rc1 tag created. 5721238106Sdes 5722238106Sdes1 July 2011: Wouter 5723238106Sdes - version number in example config file. 5724238106Sdes - fix that --enable-static-exe does not complain about it unknown. 5725238106Sdes 5726238106Sdes30 June 2011: Wouter 5727238106Sdes - tag relase 1.4.11, trunk is 1.4.12 development. 5728238106Sdes - iana portlist updated. 5729238106Sdes - fix bug#395: id bits of other query may leak out under conditions 5730238106Sdes - fix replyaddr count wrong after jostled queries, which leads to 5731238106Sdes eventual starvation where the daemon has no replyaddrs left to use. 5732238106Sdes - fix comment about rndc port, that referred to the old port number. 5733238106Sdes - fix that the listening socket is not closed when too many remote 5734238106Sdes control connections are made at the same time. 5735238106Sdes - removed ldns-src tarball inside the unbound tarball. 5736238106Sdes 5737238106Sdes23 June 2011: Wouter 5738238106Sdes - Changed -flto check to support clang compiler. 5739238106Sdes - tag 1.4.11rc3 created. 5740238106Sdes 5741238106Sdes17 June 2011: Wouter 5742238106Sdes - tag 1.4.11rc1 created. 5743238106Sdes - remove warning about signed/unsigned from flex (other flex version). 5744238106Sdes - updated aclocal.m4 and libtool to match. 5745238106Sdes - tag 1.4.11rc2 created. 5746238106Sdes 5747238106Sdes16 June 2011: Wouter 5748238106Sdes - log-queries: yesno option, default is no, prints querylog. 5749238106Sdes - version is 1.4.11. 5750238106Sdes 5751238106Sdes14 June 2011: Wouter 5752238106Sdes - Use -flto compiler flag for link time optimization, if supported. 5753238106Sdes - iana portlist updated. 5754238106Sdes 5755238106Sdes12 June 2011: Wouter 5756238106Sdes - IPv6 service address for d.root-servers.net (2001:500:2D::D). 5757238106Sdes 5758238106Sdes10 June 2011: Wouter 5759238106Sdes - unbound-control has version number in the header, 5760238106Sdes UBCT[version]_space_ is the header sent by the client now. 5761238106Sdes - Unbound control port number is registered with IANA: 5762238106Sdes ub-dns-control 8953/tcp unbound dns nameserver control 5763238106Sdes This is the new default for the control-port config setting. 5764238106Sdes - statistics-interval prints the number of jostled queries to log. 5765238106Sdes 5766238106Sdes30 May 2011: Wouter 5767238106Sdes - Fix Makefile for U in environment, since wrong U is more common than 5768238106Sdes deansification necessity. 5769238106Sdes - iana portlist updated. 5770238106Sdes - updated ldns tarball to 1.6.10rc2 snapshot of today. 5771238106Sdes 5772238106Sdes25 May 2011: Wouter 5773238106Sdes - Fix assertion failure when unbound generates an empty error reply 5774238106Sdes in response to a query, CVE-2011-1922 VU#531342. 5775238106Sdes - This fix is in tag 1.4.10. 5776238106Sdes - defense in depth against the above bug, an error is printed to log 5777238106Sdes instead of an assertion failure. 5778238106Sdes 5779238106Sdes10 May 2011: Wouter 5780238106Sdes - bug#386: --enable-allsymbols option links all binaries to libunbound 5781238106Sdes and reduces install size significantly. 5782238106Sdes - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers. 5783238106Sdes - iana portlist updated. 5784238106Sdes - Fix TTL of SOA so negative TTL is separately cached from normal TTL. 5785238106Sdes 5786238106Sdes14 April 2011: Wouter 5787238106Sdes - configure created with newer autoconf 2.66. 5788238106Sdes 5789238106Sdes12 April 2011: Wouter 5790238106Sdes - bug#378: Fix that configure checks for ldns_get_random presence. 5791238106Sdes 5792238106Sdes8 April 2011: Wouter 5793238106Sdes - iana portlist updated. 5794238106Sdes - queries with CD flag set cause DNSSEC validation, but the answer is 5795238106Sdes not withheld if it is bogus. Thus, unbound will retry if it is bad 5796238106Sdes and curb the TTL if it is bad, thus protecting the cache for use by 5797238106Sdes downstream validators. 5798238106Sdes - val-override-date: -1 ignores dates entirely, for NTP usage. 5799238106Sdes 5800238106Sdes29 March 2011: Wouter 5801238106Sdes - harden-below-nxdomain: changed so that it activates when the 5802238106Sdes cached nxdomain is dnssec secure. This avoids backwards 5803238106Sdes incompatibility because those old servers do not have dnssec. 5804238106Sdes 5805238106Sdes24 March 2011: Wouter 5806238106Sdes - iana portlist updated. 5807238106Sdes - release 1.4.9. 5808238106Sdes - trunk is 1.5.0 5809238106Sdes 5810238106Sdes17 March 2011: Wouter 5811238106Sdes - bug#370: new unbound.spec for CentOS 5.x from Harold Jones. 5812238106Sdes Applied but did not do the --disable-gost. 5813238106Sdes 5814238106Sdes10 March 2011: Wouter 5815238106Sdes - tag 1.4.9 release candidate 1 created. 5816238106Sdes 5817238106Sdes3 March 2011: Wouter 5818238106Sdes - updated ldns to today. 5819238106Sdes 5820238106Sdes1 March 2011: Wouter 5821238106Sdes - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout. 5822238106Sdes - give config parse error for multiple names on a stub or forward zone. 5823238106Sdes - updated ldns tarball to 1.6.9(todays snapshot). 5824238106Sdes 5825238106Sdes24 February 2011: Wouter 5826238106Sdes - bug #361: Fix, time.elapsed variable not reset with stats_noreset. 5827238106Sdes 5828238106Sdes23 February 2011: Wouter 5829238106Sdes - iana portlist updated. 5830238106Sdes - common.sh to version 3. 5831238106Sdes 5832238106Sdes18 February 2011: Wouter 5833238106Sdes - common.sh in testdata updated to version 2. 5834238106Sdes 5835238106Sdes15 February 2011: Wouter 5836238106Sdes - Added explicit note on unbound-anchor usage: 5837238106Sdes Please note usage of unbound-anchor root anchor is at your own risk 5838238106Sdes and under the terms of our LICENSE (see that file in the source). 5839238106Sdes 5840238106Sdes11 February 2011: Wouter 5841238106Sdes - iana portlist updated. 5842238106Sdes - tpkg updated with common.sh for common functionality. 5843238106Sdes 5844238106Sdes7 February 2011: Wouter 5845238106Sdes - Added regression test for addition of a .net DS to the root, and 5846238106Sdes cache effects with different TTL for glue and DNSKEY. 5847238106Sdes - iana portlist updated. 5848238106Sdes 5849238106Sdes28 January 2011: Wouter 5850238106Sdes - Fix remove private address does not throw away entire response. 5851238106Sdes 5852238106Sdes24 January 2011: Wouter 5853238106Sdes - release 1.4.8 5854238106Sdes 5855238106Sdes19 January 2011: Wouter 5856238106Sdes - fix bug#349: no -L/usr for ldns. 5857238106Sdes 5858238106Sdes18 January 2011: Wouter 5859238106Sdes - ldns 1.6.8 tarball included. 5860238106Sdes - release 1.4.8rc1. 5861238106Sdes 5862238106Sdes17 January 2011: Wouter 5863238106Sdes - add get and set option for harden-below-nxdomain feature. 5864238106Sdes - iana portlist updated. 5865238106Sdes 5866238106Sdes14 January 2011: Wouter 5867238106Sdes - Fix so a changed NS RRset does not get moved name stuck on old 5868238106Sdes server, for type NS the TTL is not increased. 5869238106Sdes 5870238106Sdes13 January 2011: Wouter 5871238106Sdes - Fix prefetch so it does not get stuck on old server for moved names. 5872238106Sdes 5873238106Sdes12 January 2011: Wouter 5874238106Sdes - iana portlist updated. 5875238106Sdes 5876238106Sdes11 January 2011: Wouter 5877238106Sdes - Fix insecure CNAME sequence marked as secure, reported by Bert 5878238106Sdes Hubert. 5879238106Sdes 5880238106Sdes10 January 2011: Wouter 5881238106Sdes - faster lruhash get_mem routine. 5882238106Sdes 5883238106Sdes4 January 2011: Wouter 5884238106Sdes - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root. 5885238106Sdes - iana portlist updated. 5886238106Sdes 5887238106Sdes23 December 2010: Wouter 5888238106Sdes - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept. 5889238106Sdes 5890238106Sdes21 December 2010: Wouter 5891238106Sdes - algorithm compromise protection using the algorithms signalled in 5892238106Sdes the DS record. Also, trust anchors, DLV, and RFC5011 receive this, 5893238106Sdes and thus, if you have multiple algorithms in your trust-anchor-file 5894238106Sdes then it will now behave different than before. Also, 5011 rollover 5895238106Sdes for algorithms needs to be double-signature until the old algorithm 5896238106Sdes is revoked. 5897238106Sdes It is not an option, because I see no use to turn the security off. 5898238106Sdes - iana portlist updated. 5899238106Sdes 5900238106Sdes17 December 2010: Wouter 5901238106Sdes - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them). 5902238106Sdes - fix validation in this case: CNAME to nodata for co-hosted opt-in 5903238106Sdes NSEC3 insecure delegation, was bogus, fixed to be insecure. 5904238106Sdes 5905238106Sdes16 December 2010: Wouter 5906238106Sdes - Fix our 'BDS' license (typo reported by Xavier Belanger). 5907238106Sdes 5908238106Sdes10 December 2010: Wouter 5909238106Sdes - iana portlist updated. 5910238106Sdes - review changes for unbound-anchor. 5911238106Sdes 5912238106Sdes2 December 2010: Wouter 5913238106Sdes - feature typetransparent localzone, does not block other RR types. 5914238106Sdes 5915238106Sdes1 December 2010: Wouter 5916238106Sdes - Fix bug#338: print address when socket creation fails. 5917238106Sdes 5918238106Sdes30 November 2010: Wouter 5919238106Sdes - Fix storage of EDNS failures in the infra cache. 5920238106Sdes - iana portlist updated. 5921238106Sdes 5922238106Sdes18 November 2010: Wouter 5923238106Sdes - harden-below-nxdomain option, default off (because very old 5924238106Sdes software may be incompatible). We could enable it by default in 5925238106Sdes the future. 5926238106Sdes 5927238106Sdes17 November 2010: Wouter 5928238106Sdes - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN. 5929238106Sdes - make test output nicer. 5930238106Sdes 5931238106Sdes15 November 2010: Wouter 5932238106Sdes - silence 'tcp connect: broken pipe' and 'net down' at low verbosity. 5933238106Sdes - iana portlist updated. 5934238106Sdes - so-sndbuf option for very busy servers, a bit like so-rcvbuf. 5935238106Sdes 5936238106Sdes9 November 2010: Wouter 5937238106Sdes - unbound-anchor compiles with openssl 0.9.7. 5938238106Sdes 5939238106Sdes8 November 2010: Wouter 5940238106Sdes - release tag 1.4.7. 5941238106Sdes - trunk is version 1.4.8. 5942238106Sdes - Be lenient and accept imgw.pl malformed packet (like BIND). 5943238106Sdes 5944238106Sdes5 November 2010: Wouter 5945238106Sdes - do not synthesize a CNAME message from cache for qtype DS. 5946238106Sdes 5947238106Sdes4 November 2010: Wouter 5948238106Sdes - Use central entropy to seed threads. 5949238106Sdes 5950238106Sdes3 November 2010: Wouter 5951238106Sdes - Change the rtt used to probe EDNS-timeout hosts to 1000 msec. 5952238106Sdes 5953238106Sdes2 November 2010: Wouter 5954238106Sdes - tag 1.4.7rc1. 5955238106Sdes - code review. 5956238106Sdes 5957238106Sdes1 November 2010: Wouter 5958238106Sdes - GOST code enabled by default (RFC 5933). 5959238106Sdes 5960238106Sdes27 October 2010: Wouter 5961238106Sdes - Fix uninit value in dump_infra print. 5962238106Sdes - Fix validation failure for parent and child on same server with an 5963238106Sdes insecure childzone and a CNAME from parent to child. 5964238106Sdes - Configure detects libev-4.00. 5965238106Sdes 5966238106Sdes26 October 2010: Wouter 5967238106Sdes - dump_infra and flush_infra commands for unbound-control. 5968238106Sdes - no timeout backoff if meanwhile a query succeeded. 5969238106Sdes - Change of timeout code. No more lost and backoff in blockage. 5970238106Sdes At 12sec timeout (and at least 2x lost before) one probe per IP 5971238106Sdes is allowed only. At 120sec, the IP is blocked. After 15min, a 5972238106Sdes 120sec entry has a single retry packet. 5973238106Sdes 5974238106Sdes25 October 2010: Wouter 5975238106Sdes - Configure errors if ldns is not found. 5976238106Sdes 5977238106Sdes22 October 2010: Wouter 5978238106Sdes - Windows 7 fix for the installer. 5979238106Sdes 5980238106Sdes21 October 2010: Wouter 5981238106Sdes - Fix bug where fallback_tcp causes wrong roundtrip and edns 5982238106Sdes observation to be noted in cache. Fix bug where EDNSprobe halted 5983238106Sdes exponential backoff if EDNS status unknown. 5984238106Sdes - new unresponsive host method, exponentially increasing block backoff. 5985238106Sdes - iana portlist updated. 5986238106Sdes 5987238106Sdes20 October 2010: Wouter 5988238106Sdes - interface automatic works for some people with ip6 disabled. 5989238106Sdes Therefore the error check is removed, so they can use the option. 5990238106Sdes 5991238106Sdes19 October 2010: Wouter 5992238106Sdes - Fix for request list growth, if a server has long timeout but the 5993238106Sdes lost counter is low, then its effective rtt is the one without 5994238106Sdes exponential backoff applied. Because the backoff is not working. 5995238106Sdes The lost counter can then increase and the server is blacklisted, 5996238106Sdes or the lost counter does not increase and the server is working 5997238106Sdes for some queries. 5998238106Sdes 5999238106Sdes18 October 2010: Wouter 6000238106Sdes - iana portlist updated. 6001238106Sdes 6002238106Sdes13 October 2010: Wouter 6003238106Sdes - Fix TCP so it uses a random outgoing-interface. 6004238106Sdes - unbound-anchor handles ADDPEND keystate. 6005238106Sdes 6006238106Sdes11 October 2010: Wouter 6007238106Sdes - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where 6008238106Sdes the zone has a secure delegation hosted on the same server did not 6009238106Sdes verify as secure (it was insecure by mistake). 6010238106Sdes - iana portlist updated. 6011238106Sdes - ldns tarball updated (for reading cachedumps with bad RR data). 6012238106Sdes 6013238106Sdes1 October 2010: Wouter 6014238106Sdes - test for unbound-anchor. fix for reading certs. 6015238106Sdes - Fix alloc_reg_release for longer uptime in out of memory conditions. 6016238106Sdes 6017238106Sdes28 September 2010: Wouter 6018238106Sdes - unbound-anchor working, it creates or updates a root.key file. 6019238106Sdes Use it before you start the validator (e.g. at system boot time). 6020238106Sdes 6021238106Sdes27 September 2010: Wouter 6022238106Sdes - iana portlist updated. 6023238106Sdes 6024238106Sdes24 September 2010: Wouter 6025238106Sdes - bug#329: in example.conf show correct ipv4 link-local 169.254/16. 6026238106Sdes 6027238106Sdes23 September 2010: Wouter 6028238106Sdes - unbound-anchor app, unbound requires libexpat (xml parser library). 6029238106Sdes 6030238106Sdes22 September 2010: Wouter 6031238106Sdes - compliance with draft-ietf-dnsop-default-local-zones-14, removed 6032238106Sdes reverse ipv6 orchid prefix from builtin list. 6033238106Sdes - iana portlist updated. 6034238106Sdes 6035238106Sdes17 September 2010: Wouter 6036238106Sdes - DLV has downgrade protection again, because the RFC says so. 6037238106Sdes - iana portlist updated. 6038238106Sdes 6039238106Sdes16 September 2010: Wouter 6040238106Sdes - Algorithm rollover operational reality intrudes, for trust-anchor, 6041238106Sdes 5011-store, and DLV-anchor if one key matches it's good enough. 6042238106Sdes - iana portlist updated. 6043238106Sdes - Fix reported validation error in out of memory condition. 6044238106Sdes 6045238106Sdes15 September 2010: Wouter 6046238106Sdes - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout. 6047238106Sdes 6048238106Sdes14 September 2010: Wouter 6049238106Sdes - increased mesh-max-activation from 1000 to 3000 for crazy domains 6050238106Sdes like _tcp.slb.com with 262 servers. 6051238106Sdes - iana portlist updated. 6052238106Sdes 6053238106Sdes13 September 2010: Wouter 6054238106Sdes - bug#327: Fix for cannot access stub zones until the root is primed. 6055238106Sdes 6056238106Sdes9 September 2010: Wouter 6057238106Sdes - unresponsive servers are not completely blacklisted (because of 6058238106Sdes firewalls), but also not probed all the time (because of the request 6059238106Sdes list size it generates). The probe rate is 1%. 6060238106Sdes - iana portlist updated. 6061238106Sdes 6062238106Sdes20 August 2010: Wouter 6063238106Sdes - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled. 6064238106Sdes iterator get_mem includes priv_get_mem. delegpt nodup removed. 6065238106Sdes listen_pushback, query_info_allocqname, write_socket, send_packet, 6066238106Sdes comm_point_set_cb_arg and listen_resume removed. 6067238106Sdes 6068238106Sdes19 August 2010: Wouter 6069238106Sdes - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20. 6070238106Sdes Delegpt structures checked for duplicates always. 6071238106Sdes No more nameserver lookups generated when depth is full anyway. 6072238106Sdes - example.conf notes how to do DNSSEC validation and track the root. 6073238106Sdes - iana portlist updated. 6074238106Sdes 6075238106Sdes18 August 2010: Wouter 6076238106Sdes - Fix bug#322: configure does not respect CFLAGS on Solaris. 6077238106Sdes Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line 6078238106Sdes if use sun-cc, but some systems need different flags. 6079238106Sdes 6080238106Sdes16 August 2010: Wouter 6081238106Sdes - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP 6082238106Sdes changes, uses m4_bpatsubst now. 6083238106Sdes - make test (or make check) should be more portable and run the unit 6084238106Sdes test and testbound scripts. (make longtest has special requirements). 6085238106Sdes 6086238106Sdes13 August 2010: Wouter 6087238106Sdes - More pleasant remote control command parsing. 6088238106Sdes - documentation added for return values reported by doxygen 1.7.1. 6089238106Sdes - iana portlist updated. 6090238106Sdes 6091238106Sdes9 August 2010: Wouter 6092238106Sdes - Fix name of rrset printed that failed validation. 6093238106Sdes 6094238106Sdes5 August 2010: Wouter 6095238106Sdes - Return NXDOMAIN after chain of CNAMEs ends at name-not-found. 6096238106Sdes 6097238106Sdes4 August 2010: Wouter 6098238106Sdes - Fix validation in case a trust anchor enters into a zone with 6099238106Sdes unsupported algorithms. 6100238106Sdes 6101238106Sdes3 August 2010: Wouter 6102238106Sdes - updated ldns tarball with bugfixes. 6103238106Sdes - release tag 1.4.6. 6104238106Sdes - trunk becomes 1.4.7 develop. 6105238106Sdes - iana portlist updated. 6106238106Sdes 6107238106Sdes22 July 2010: Wouter 6108238106Sdes - more error details on failed remote control connection. 6109238106Sdes 6110238106Sdes15 July 2010: Wouter 6111238106Sdes - rlimit adjustments for select and ulimit can happen at the same time. 6112238106Sdes 6113238106Sdes14 July 2010: Wouter 6114238106Sdes - Donation text added to README. 6115238106Sdes - Fix integer underflow in prefetch ttl creation from cache. This 6116238106Sdes fixes a potential negative prefetch ttl. 6117238106Sdes 6118238106Sdes12 July 2010: Wouter 6119238106Sdes - Changed the defaults for num-queries-per-thread/outgoing-range. 6120238106Sdes For builtin-select: 512/960, for libevent 1024/4096 and for 6121238106Sdes windows 24/48 (because of win api). This makes the ratio this way 6122238106Sdes to improve resilience under heavy load. For high performance, use 6123238106Sdes libevent and possibly higher numbers. 6124238106Sdes 6125238106Sdes10 July 2010: Wouter 6126238106Sdes - GOST enabled if SSL is recent and ldns has GOST enabled too. 6127238106Sdes - ldns tarball updated. 6128238106Sdes 6129238106Sdes9 July 2010: Wouter 6130238106Sdes - iana portlist updated. 6131238106Sdes - Fix validation of qtype DNSKEY when a key-cache entry exists but 6132238106Sdes no rr-cache entry is used (it expired or prefetch), it then goes 6133238106Sdes back up to the DS or trust-anchor to validate the DNSKEY. 6134238106Sdes 6135238106Sdes7 July 2010: Wouter 6136238106Sdes - Neat function prototypes, unshadowed local declarations. 6137238106Sdes 6138238106Sdes6 July 2010: Wouter 6139238106Sdes - failure to chown the pidfile is not fatal any more. 6140238106Sdes - testbound uses UTC timezone. 6141238106Sdes - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add 6142238106Sdes /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake. 6143238106Sdes 6144238106Sdes5 July 2010: Wouter 6145238106Sdes - log if a server is skipped because it is on the donotquery list, 6146238106Sdes at verbosity 4, to enable diagnosis why no queries to 127.0.0.1. 6147238106Sdes - added feature to print configure date, target and options with -h. 6148238106Sdes - added feature to print event backend system details with -h. 6149238106Sdes - wdiff is not actually required by make test, updated requirements. 6150238106Sdes 6151238106Sdes1 July 2010: Wouter 6152238106Sdes - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex 6153238106Sdes must be signed with all algorithms from the DS rrset at the parent. 6154238106Sdes This is now checked and becomes bogus if not. 6155238106Sdes 6156238106Sdes28 June 2010: Wouter 6157238106Sdes - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps 6158238106Sdes in overload situations to be about 5 qps for the class of shortly 6159238106Sdes serviced queries. 6160238106Sdes The capacity of the resolver is then about (numqueriesperthread / 2) 6161238106Sdes / (average time for such long queries) qps for long queries. 6162238106Sdes And about (numqueriesperthread / 2)/(jostletimeout in whole seconds) 6163238106Sdes qps for short queries, per thread. 6164238106Sdes - Fix the max number of reply-address count to be applied for duplicate 6165238106Sdes queries, and not for new query list entries. This raises the memory 6166238106Sdes usage to a max of (16+1)*numqueriesperthread reply addresses. 6167238106Sdes 6168238106Sdes25 June 2010: Wouter 6169238106Sdes - Fix handling of corner case reply from lame server, follows rfc2308. 6170238106Sdes It could lead to a nodata reply getting into the cache if the search 6171238106Sdes for a non-lame server turned up other misconfigured servers. 6172238106Sdes - unbound.h has extern "C" statement for easier include in c++. 6173238106Sdes 6174238106Sdes23 June 2010: Wouter 6175238106Sdes - iana portlist updated. 6176238106Sdes - makedist upgraded cross compile openssl option, like this: 6177238106Sdes ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost 6178238106Sdes 6179238106Sdes22 June 2010: Wouter 6180238106Sdes - Unbound reports libev or libevent correctly in logs in verbose mode. 6181238106Sdes - Fix to unload gost dynamic library module for leak testing. 6182238106Sdes 6183238106Sdes18 June 2010: Wouter 6184238106Sdes - iana portlist updated. 6185238106Sdes 6186238106Sdes17 June 2010: Wouter 6187238106Sdes - Add AAAA to root hints for I.ROOT-SERVERS.NET. 6188238106Sdes 6189238106Sdes16 June 2010: Wouter 6190238106Sdes - Fix assertion failure reported by Kai Storbeck from XS4ALL, the 6191238106Sdes assertion was wrong. 6192238106Sdes - updated ldns tarball. 6193238106Sdes 6194238106Sdes15 June 2010: Wouter 6195238106Sdes - tag 1.4.5 created. 6196238106Sdes - trunk contains 1.4.6 in development. 6197238106Sdes - Fix TCPreply on systems with no writev, if just 1 byte could be sent. 6198238106Sdes - Fix to use one pointer less for iterator query state store_parent_NS. 6199238106Sdes - makedist crosscompile to windows uses builtin ldns not host ldns. 6200238106Sdes - Max referral count from 30 to 130, because 128 one character domains 6201238106Sdes is valid DNS. 6202238106Sdes - added documentation for the histogram printout to syslog. 6203238106Sdes 6204238106Sdes11 June 2010: Wouter 6205238106Sdes - When retry to parent the retrycount is not wiped, so failed 6206238106Sdes nameservers are not tried again. 6207238106Sdes - iana portlist updated. 6208238106Sdes 6209238106Sdes10 June 2010: Wouter 6210238106Sdes - Fix bug where a long loop could be entered, now cycle detection 6211238106Sdes has a loop-counter and maximum search amount. 6212238106Sdes 6213238106Sdes4 June 2010: Wouter 6214238106Sdes - iana portlist updated. 6215238106Sdes - 1.4.5rc1 tag created. 6216238106Sdes 6217238106Sdes3 June 2010: Wouter 6218238106Sdes - ldns tarball updated, 1.6.5. 6219238106Sdes - review comments, split dependency cycle tracking for parentside 6220238106Sdes last resort lookups for A and AAAA so there are more lookup options. 6221238106Sdes 6222238106Sdes2 June 2010: Wouter 6223238106Sdes - Fix compile warning if compiled without threads. 6224238106Sdes - updated ldns-tarball with current ldns svn (pre 1.6.5). 6225238106Sdes - GOST disabled-by-default, the algorithm number is allocated but the 6226238106Sdes RFC is still has to pass AUTH48 at the IETF. 6227238106Sdes 6228238106Sdes1 June 2010: Wouter 6229238106Sdes - Ignore Z flag in incoming messages too. 6230238106Sdes - Fix storage of negative parent glue if that last resort fails. 6231238106Sdes - libtoolize 2.2.6b, autoconf 2.65 applied to configure. 6232238106Sdes - new splint flags for newer splint install. 6233238106Sdes 6234238106Sdes31 May 2010: Wouter 6235238106Sdes - Fix AD flag handling, it could in some cases mistakenly copy the AD 6236238106Sdes flag from upstream servers. 6237238106Sdes - alloc_special_obtain out of memory is not a fatal error any more, 6238238106Sdes enabling unbound to continue longer in out of memory conditions. 6239238106Sdes - parentside names are dispreferred but not said to be dnssec-lame. 6240238106Sdes - parentside check for cached newname glue. 6241238106Sdes - fix parentside and querytargets modulestate, for dump_requestlist. 6242238106Sdes - unbound-control-setup makes keys -rw-r--- so not all users permitted. 6243238106Sdes - fix parentside from cache to be marked dispreferred for bad names. 6244238106Sdes 6245238106Sdes28 May 2010: Wouter 6246238106Sdes - iana portlist updated. 6247238106Sdes - parent-child disagreement approach altered. Older fixes are 6248238106Sdes removed in place of a more exhaustive search for misconfigured data 6249238106Sdes available via the parent of a delegation. 6250238106Sdes This is designed to be throttled by cache entries, with TTL from the 6251238106Sdes parent if possible. Additionally the loop-counter is used. 6252238106Sdes It also tests for NS RRset differences between parent and child. 6253238106Sdes The fetch of misconfigured data should be more reliable and thorough. 6254238106Sdes It should work reliably even with no or only partial data in cache. 6255238106Sdes Data received from the child (as always) is deemed more 6256238106Sdes authoritative than information received from the delegation parent. 6257238106Sdes The search for misconfigured data is not performed normally. 6258238106Sdes 6259238106Sdes26 May 2010: Wouter 6260238106Sdes - Contribution from Migiel de Vos (Surfnet): nagios patch for 6261238106Sdes unbound-host, in contrib/ (in the source tarball). Makes 6262238106Sdes unbound-host suitable for monitoring dnssec(-chain) status. 6263238106Sdes 6264238106Sdes21 May 2010: Wouter 6265238106Sdes - EDNS timeout code will not fire if EDNS status already known. 6266238106Sdes - EDNS failure not stored if EDNS status known to work. 6267238106Sdes 6268238106Sdes19 May 2010: Wouter 6269238106Sdes - Fix resolution for domains like safesvc.com.cn. If the iterator 6270238106Sdes can not recurse further and it finds the delegation in a state 6271238106Sdes where it would otherwise have rejected it outhand if so received 6272238106Sdes from a cache lookup, then it can try to ask higherup (with loop 6273238106Sdes protection). 6274238106Sdes - Fix comments in iter_utils:dp_is_useless. 6275238106Sdes 6276238106Sdes18 May 2010: Wouter 6277238106Sdes - Fix various compiler warnings from the clang llvm compiler. 6278238106Sdes - iana portlist updated. 6279238106Sdes 6280238106Sdes6 May 2010: Wouter 6281238106Sdes - Fix bug#308: spelling error in variable name in parser and lexer. 6282238106Sdes 6283238106Sdes4 May 2010: Wouter 6284238106Sdes - Fix dnssec-missing detection that was turned off by server selection. 6285238106Sdes - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default 6286238106Sdes reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa, 6287238106Sdes 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa. 6288238106Sdes 6289238106Sdes29 April 2010: Wouter 6290238106Sdes - Fix for dnssec lameness detection to use the key cache. 6291238106Sdes - infra cache entries that are expired are wiped clean. Previously 6292238106Sdes it was possible to not expire host data (if accessed often). 6293238106Sdes 6294238106Sdes28 April 2010: Wouter 6295238106Sdes - ldns tarball updated and GOST support is detected and then enabled. 6296238106Sdes - iana portlist updated. 6297238106Sdes - Fix detection of gost support in ldns (reported by Chris Smith). 6298238106Sdes 6299238106Sdes27 April 2010: Wouter 6300238106Sdes - unbound-control get_option domain-insecure shows config file items. 6301238106Sdes - fix retry sequence if prime hints are recursion-lame. 6302238106Sdes - autotrust anchor file can be initialized with a ZSK key as well. 6303238106Sdes - harden-referral-path does not result in failures due to max-depth. 6304238106Sdes You can increase the max-depth by adding numbers (' 0') after the 6305238106Sdes target-fetch-policy, this increases the depth to which is checked. 6306238106Sdes 6307238106Sdes26 April 2010: Wouter 6308238106Sdes - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use 6309238106Sdes CPPFLAGS during configure process. 6310238106Sdes - if libev is installed on the base system (not libevent), detect 6311238106Sdes it from the event.h header file and link with -lev. 6312238106Sdes - configlexer.lex gets config.h, and configyyrename.h added by make, 6313238106Sdes no more double include. 6314238106Sdes - More strict scrubber (Thanks to George Barwood for the idea): 6315238106Sdes NS set must be pertinent to the query (qname subdomain nsname). 6316238106Sdes - Fix bug#307: In 0x20 backoff fix fallback so the number of 6317238106Sdes outstanding queries does not become -1 and block the request. 6318238106Sdes Fixed handling of recursion-lame in combination with 0x20 fallback. 6319238106Sdes Fix so RRsets are compared canonicalized and sorted if the immediate 6320238106Sdes comparison fails, this makes it work around round-robin sites. 6321238106Sdes 6322238106Sdes23 April 2010: Wouter 6323238106Sdes - Squelch log message: sendto failed permission denied for 6324238106Sdes 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2). 6325238106Sdes - Fix to fetch data as last resort more tenaciously. When cycle 6326238106Sdes targets cause the server selection to believe there are more options 6327238106Sdes when they really are not there, the server selection is reinitiated. 6328238106Sdes - Fix fetch from blacklisted dnssec lame servers as last resort. The 6329238106Sdes server's IP address is then given in validator errors as well. 6330238106Sdes - Fix local-zone type redirect that did not use the query name for 6331238106Sdes the answer rrset. 6332238106Sdes 6333238106Sdes22 April 2010: Wouter 6334238106Sdes - tag 1.4.4. 6335238106Sdes - trunk contains 1.4.5 in development. 6336238106Sdes - Fix validation failure for qtype ANY caused by a RRSIG parse failure. 6337238106Sdes The validator error message was 'no signatures from ...'. 6338238106Sdes 6339238106Sdes16 April 2010: Wouter 6340238106Sdes - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN. 6341238106Sdes - tag 1.4.4rc1. 6342238106Sdes 6343238106Sdes15 April 2010: Wouter 6344238106Sdes - ECC-GOST algorithm number 12 that is assigned by IANA. New test 6345238106Sdes example key and signatures for GOST. GOST requires openssl-1.0.0. 6346238106Sdes GOST is still disabled by default. 6347238106Sdes 6348238106Sdes9 April 2010: Wouter 6349238106Sdes - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or 6350238106Sdes get into an endless loop, if 0x20 was enabled, and buffers are small 6351238106Sdes or particular broken packets are received. 6352238106Sdes - Fix chain of trust with CNAME at an intermediate step, for the DS 6353238106Sdes processing proof. 6354238106Sdes 6355238106Sdes8 April 2010: Wouter 6356238106Sdes - Fix validation of queries with wildcard names (*.example). 6357238106Sdes 6358238106Sdes6 April 2010: Wouter 6359238106Sdes - Fix EDNS probe for .de DNSSEC testbed failure, where the infra 6360238106Sdes cache timeout coincided with a server update, the current EDNS 6361238106Sdes backoff is less sensitive, and does not cache the backoff unless 6362238106Sdes the backoff actually works and the domain is not expecting DNSSEC. 6363238106Sdes - GOST support with correct algorithm numbers. 6364238106Sdes 6365238106Sdes1 April 2010: Wouter 6366238106Sdes - iana portlist updated. 6367238106Sdes 6368238106Sdes24 March 2010: Wouter 6369238106Sdes - unbound control flushed items are not counted when flushed again. 6370238106Sdes 6371238106Sdes23 March 2010: Wouter 6372238106Sdes - iana portlist updated. 6373238106Sdes 6374238106Sdes22 March 2010: Wouter 6375238106Sdes - unbound-host disables use-syslog from config file so that the 6376238106Sdes config file for the main server can be used more easily. 6377238106Sdes - fix bug#301: unbound-checkconf could not parse interface 6378238106Sdes '0.0.0.0@5353', even though unbound itself worked fine. 6379238106Sdes 6380238106Sdes19 March 2010: Wouter 6381238106Sdes - fix fwd_ancil test to pass if the socket options are not supported. 6382238106Sdes 6383238106Sdes18 March 2010: Wouter 6384238106Sdes - Fixed random numbers for port, interface and server selection. 6385238106Sdes Removed very small bias. 6386238106Sdes - Refer to the listing in unbound-control man page in the extended 6387238106Sdes statistics entry in the unbound.conf man page. 6388238106Sdes 6389238106Sdes16 March 2010: Wouter 6390238106Sdes - Fix interface-automatic for OpenBSD: msg.controllen was too small, 6391238106Sdes also assertions on ancillary data buffer. 6392238106Sdes - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO. 6393238106Sdes - for NSEC3 check if signatures are cached. 6394238106Sdes 6395238106Sdes15 March 2010: Wouter 6396238106Sdes - unit test for util/regional.c. 6397238106Sdes 6398238106Sdes12 March 2010: Wouter 6399238106Sdes - Reordered configure checks so fork and -lnsl -lsocket checks are 6400238106Sdes earlier, and thus later checks benefit from and do not hinder them. 6401238106Sdes - iana portlist updated. 6402238106Sdes - ldns tarball updated. 6403238106Sdes - Fix python use when multithreaded. 6404238106Sdes - Fix solaris python compile. 6405238106Sdes - Include less in config.h and include per code file for ldns, ssl. 6406238106Sdes 6407238106Sdes11 March 2010: Wouter 6408238106Sdes - another memory allocation option: --enable-alloc-nonregional. 6409238106Sdes exposes the regional allocations to other memory purifiers. 6410238106Sdes - fix for memory alignment in struct sock_list allocation. 6411238106Sdes - Fix for MacPorts ldns without ssl default, unbound checks if ldns 6412238106Sdes has dnssec functionality and uses the builtin if not. 6413238106Sdes - Fix daemonize on Solaris 10, it did not detach from terminal. 6414238106Sdes - tag 1.4.3 created. 6415238106Sdes - trunk is 1.4.4 in development. 6416238106Sdes - spelling fix in validation error involving cnames. 6417238106Sdes 6418238106Sdes10 March 2010: Wouter 6419238106Sdes - --enable-alloc-lite works with test set. 6420238106Sdes - portability in the testset: printf format conversions, prototypes. 6421238106Sdes 6422238106Sdes9 March 2010: Wouter 6423238106Sdes - tag 1.4.2 created. 6424238106Sdes - trunk is 1.4.3 in development. 6425238106Sdes - --enable-alloc-lite debug option. 6426238106Sdes 6427238106Sdes8 March 2010: Wouter 6428238106Sdes - iana portlist updated. 6429238106Sdes 6430238106Sdes4 March 2010: Wouter 6431238106Sdes - Fix crash in control channel code. 6432238106Sdes 6433238106Sdes3 March 2010: Wouter 6434238106Sdes - better casts in pipe code, brackets placed wrongly. 6435238106Sdes - iana portlist updated. 6436238106Sdes 6437238106Sdes1 March 2010: Wouter 6438238106Sdes - make install depends on make all. 6439238106Sdes - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs. 6440238106Sdes - --enable-checking: enables assertions but does not look nonproduction. 6441238106Sdes - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with 6442238106Sdes nxdomain and nodata distinguished. 6443238106Sdes - ldns tarball updated. 6444238106Sdes - --disable-rpath fixed for libtool not found errors. 6445238106Sdes - new fedora specfile from Fedora13 in contrib from Paul Wouters. 6446238106Sdes 6447238106Sdes26 February 2010: Wouter 6448238106Sdes - Fixup prototype for lexer cleanup in daemon code. 6449238106Sdes - unbound-control list_stubs, list_forwards, list_local_zones and 6450238106Sdes list_local_data. 6451238106Sdes 6452238106Sdes24 February 2010: Wouter 6453238106Sdes - Fix scrubber bug that potentially let NS records through. Reported 6454238106Sdes by Amanda Constant. 6455238106Sdes - Also delete potential poison references from additional. 6456238106Sdes - Fix: no classification of a forwarder as lame, throw away instead. 6457238106Sdes 6458238106Sdes23 February 2010: Wouter 6459238106Sdes - libunbound ub_ctx_get_option() added. 6460238106Sdes - unbound-control set_option and get_option commands. 6461238106Sdes - iana portlist updated. 6462238106Sdes 6463238106Sdes18 February 2010: Wouter 6464238106Sdes - A little more strict DS scrubbing. 6465238106Sdes - No more blacklisting of unresponsive servers, a 2 minute timeout 6466238106Sdes is backed off to. 6467238106Sdes - RD flag not enabled for dnssec-blacklisted tries, unless necessary. 6468238106Sdes - pickup ldns compile fix, libdl for libcrypto. 6469238106Sdes - log 'tcp connect: connection timed out' only in high verbosity. 6470238106Sdes - unbound-control log_reopen command. 6471238106Sdes - moved get_option code from unbound-checkconf to util/config_file.c 6472238106Sdes 6473238106Sdes17 February 2010: Wouter 6474238106Sdes - Disregard DNSKEY from authority section for chain of trust. 6475238106Sdes DS records that are irrelevant to a referral scrubbed. Anti-poison. 6476238106Sdes - iana portlist updated. 6477238106Sdes 6478238106Sdes16 February 2010: Wouter 6479238106Sdes - Check for 'no space left on device' (or other errors) when 6480238106Sdes writing updated autotrust anchors and print errno to log. 6481238106Sdes 6482238106Sdes15 February 2010: Wouter 6483238106Sdes - Fixed the requery protection, the TTL was 0, it is now 900 seconds, 6484238106Sdes hardcoded. We made the choice to send out more conservatively, 6485238106Sdes protecting against an aggregate effect more than protecting a 6486238106Sdes single user (from their own folly, perhaps in case of misconfig). 6487238106Sdes 6488238106Sdes12 February 2010: Wouter 6489238106Sdes - Re-query pattern changed on validation failure. To protect troubled 6490238106Sdes authority servers, unbound caches a failure for the DNSKEY or DS 6491238106Sdes records for the entire zone, and only retries that 900 seconds later. 6492238106Sdes This implies that only a handful of packets are sent extra to the 6493238106Sdes authority if the zone fails. 6494238106Sdes 6495238106Sdes11 February 2010: Wouter 6496238106Sdes - ldns tarball update for long label length syntax error fix. 6497238106Sdes - iana portlist updated. 6498238106Sdes 6499238106Sdes9 February 2010: Wouter 6500238106Sdes - Fixup in compat snprintf routine, %f 1.02 and %g support. 6501238106Sdes - include math.h for testbound test compile portability. 6502238106Sdes 6503238106Sdes2 February 2010: Wouter 6504238106Sdes - Updated url of IANA itar, interim trust anchor repository, in script. 6505238106Sdes 6506238106Sdes1 February 2010: Wouter 6507238106Sdes - iana portlist updated. 6508238106Sdes - configure test for memcmp portability. 6509238106Sdes 6510238106Sdes27 January 2010: Wouter 6511238106Sdes - removed warning on format string in validator error log statement. 6512238106Sdes - iana portlist updated. 6513238106Sdes 6514238106Sdes22 January 2010: Wouter 6515238106Sdes - libtool finish the install of unbound python dynamic library. 6516238106Sdes 6517238106Sdes21 January 2010: Wouter 6518238106Sdes - acx_nlnetlabs.m4 synchronised with nsd's version. 6519238106Sdes 6520238106Sdes20 January 2010: Wouter 6521238106Sdes - Fixup lookup trouble for parent-child domains on the first query. 6522238106Sdes 6523238106Sdes14 January 2010: Wouter 6524238106Sdes - Fixup ldns detection to also check for header files. 6525238106Sdes 6526238106Sdes13 January 2010: Wouter 6527238106Sdes - prefetch-key option that performs DNSKEY queries earlier in the 6528238106Sdes validation process, and that could halve the latency on DNSSEC 6529238106Sdes queries. It takes some extra processing (CPU, a cache is needed). 6530238106Sdes 6531238106Sdes12 January 2010: Wouter 6532238106Sdes - Fix unbound-checkconf for auto-trust-anchor-file present checks. 6533238106Sdes 6534238106Sdes8 January 2010: Wouter 6535238106Sdes - Fix for parent-child disagreement code which could have trouble 6536238106Sdes when (a) ipv6 was disabled and (b) the TTL for parent and child 6537238106Sdes were different. There were two bugs, the parent-side information 6538238106Sdes is fixed to no longer block lookup of child side information and 6539238106Sdes the iterator is fixed to no longer attempt to get ipv6 when it is 6540238106Sdes not enabled and then give up in failure. 6541238106Sdes - test and fixes to make prefetch actually store the answer in the 6542238106Sdes cache. Considers some rrsets 'already expired' but does not allow 6543238106Sdes overwriting of rrsets considered more secure. 6544238106Sdes 6545238106Sdes7 January 2010: Wouter 6546238106Sdes - Fixup python documentation (thanks Leo Vandewoestijne). 6547238106Sdes - Work on cache prefetch feature. 6548238106Sdes - Stats for prefetch, in log print stats, unbound-control stats 6549238106Sdes and in unbound_munin plugin. 6550238106Sdes 6551238106Sdes6 January 2010: Wouter 6552238106Sdes - iana portlist updated. 6553238106Sdes - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length. 6554238106Sdes - verbose output includes parent-side-address notion for lameness. 6555238106Sdes - documented val-log-level: 2 setting in example.conf and man page. 6556238106Sdes - change unbound-control-setup from 1024(sha1) to 1536(sha256). 6557238106Sdes 6558238106Sdes1 January 2010: Wouter 6559238106Sdes - iana portlist updated. 6560238106Sdes 6561238106Sdes22 December 2009: Wouter 6562238106Sdes - configure with newer libtool 2.2.6b. 6563238106Sdes 6564238106Sdes17 December 2009: Wouter 6565238106Sdes - review comments. 6566238106Sdes - tag 1.4.1. 6567238106Sdes - trunk to version 1.4.2. 6568238106Sdes 6569238106Sdes15 December 2009: Wouter 6570238106Sdes - Answer to qclass=ANY queries, with class IN contents. 6571238106Sdes Test that validation also works. 6572238106Sdes - updated ldns snapshot tarball with latest fixes (parsing records). 6573238106Sdes 6574238106Sdes11 December 2009: Wouter 6575238106Sdes - on IPv4 UDP turn off DF flag. 6576238106Sdes 6577238106Sdes10 December 2009: Wouter 6578238106Sdes - requirements.txt updated with design choice explanations. 6579238106Sdes - Reading fixes: fix to set unlame when child confirms parent glue, 6580238106Sdes and fix to avoid duplicate addresses in delegation point. 6581238106Sdes - verify_rrsig routine checks expiration last. 6582238106Sdes 6583238106Sdes9 December 2009: Wouter 6584238106Sdes - Fix Bug#287(reopened): update of ldns tarball with fix for parse 6585238106Sdes errors generated for domain names like '.example.com'. 6586238106Sdes - Fix SOA excluded from negative DS responses. Reported by Hauke 6587238106Sdes Lampe. The negative cache did not include proper SOA records for 6588238106Sdes negative qtype DS responses which makes BIND barf on it, such 6589238106Sdes responses are now only used internally. 6590238106Sdes - Fix negative cache lookup of closestencloser check of DS type bit. 6591238106Sdes 6592238106Sdes8 December 2009: Wouter 6593238106Sdes - Fix for lookup of parent-child disagreement domains, where the 6594238106Sdes parent-side glue works but it does not provide proper NS, A or AAAA 6595238106Sdes for itself, fixing domains such as motorcaravanners.eu. 6596238106Sdes - Feature: you can specify a port number in the interface: line, so 6597238106Sdes you can bind the same interface multiple times at different ports. 6598238106Sdes 6599238106Sdes7 December 2009: Wouter 6600238106Sdes - Bug#287: Fix segfault when unbound-control remove nonexistent local 6601238106Sdes data. Added check to tests. 6602238106Sdes 6603238106Sdes1 December 2009: Wouter 6604238106Sdes - Fix crash with module-config "iterator". 6605238106Sdes - Added unit test that has "iterator" module-config. 6606238106Sdes 6607238106Sdes30 November 2009: Wouter 6608238106Sdes - bug#284: fix parse of # without end-of-line at end-of-file. 6609238106Sdes 6610238106Sdes26 November 2009: Wouter 6611238106Sdes - updated ldns with release candidate for version 1.6.3. 6612238106Sdes - tag for 1.4.0 release. 6613238106Sdes - 1.4.1 version in trunk. 6614238106Sdes - Fixup major libtool version to 2 because of why_bogus change. 6615238106Sdes It was 1:5:0 but should have been 2:0:0. 6616238106Sdes 6617238106Sdes23 November 2009: Wouter 6618238106Sdes - Patch from David Hubbard for libunbound manual page. 6619238106Sdes - Fixup endless spinning in unbound-control stats reported by 6620238106Sdes Attila Nagy. Probably caused by clock reversal. 6621238106Sdes 6622238106Sdes20 November 2009: Wouter 6623238106Sdes - contrib/split-itar.sh contributed by Tom Hendrikx. 6624238106Sdes 6625238106Sdes19 November 2009: Wouter 6626238106Sdes - better argument help for unbound-control. 6627238106Sdes - iana portlist updated. 6628238106Sdes 6629238106Sdes17 November 2009: Wouter 6630238106Sdes - noted multiple entries for multiple domain names in example.conf. 6631238106Sdes - iana portlist updated. 6632238106Sdes 6633238106Sdes16 November 2009: Wouter 6634238106Sdes - Fixed signer detection of CNAME responses without signatures. 6635238106Sdes - Fix#282 libunbound memleak on error condition by Eric Sesterhenn. 6636238106Sdes - Tests for CNAMEs to deeper trust anchors, secure and bogus. 6637238106Sdes - svn tag 1.4.0rc1 made. 6638238106Sdes 6639238106Sdes13 November 2009: Wouter 6640238106Sdes - Fixed validation failure for CNAME to optout NSEC3 nodata answer. 6641238106Sdes - unbound-host does not fail on type ANY. 6642238106Sdes - Fixed wireparse failure to put RRSIGs together with data in some 6643238106Sdes long ANY mix cases, which fixes validation failures. 6644238106Sdes 6645238106Sdes12 November 2009: Wouter 6646238106Sdes - iana portlist updated. 6647238106Sdes - fix manpage errors reported by debian lintian. 6648238106Sdes - review comments. 6649238106Sdes - fixup very long vallog2 level error strings. 6650238106Sdes 6651238106Sdes11 November 2009: Wouter 6652238106Sdes - ldns tarball updated (to 1.6.2). 6653238106Sdes - review comments. 6654238106Sdes 6655238106Sdes10 November 2009: Wouter 6656238106Sdes - Thanks to Surfnet found bug in new dnssec-retry code that failed 6657238106Sdes to combine well when combined with DLV and a particular failure. 6658238106Sdes - Fixed unbound-control -h output about argument optionality. 6659238106Sdes - review comments. 6660238106Sdes 6661238106Sdes5 November 2009: Wouter 6662238106Sdes - lint fixes and portability tests. 6663238106Sdes - better error text for multiple domain keys in one autotrust file. 6664238106Sdes 6665238106Sdes2 November 2009: Wouter 6666238106Sdes - Fix bug where autotrust does not work when started with a DS. 6667238106Sdes - Updated GOST unit tests for unofficial algorithm number 249 6668238106Sdes and DNSKEY-format changes in draft version -01. 6669238106Sdes 6670238106Sdes29 October 2009: Wouter 6671238106Sdes - iana portlist updated. 6672238106Sdes - edns-buffer-size option, default 4096. 6673238106Sdes - fixed do-udp: no. 6674238106Sdes 6675238106Sdes28 October 2009: Wouter 6676238106Sdes - removed abort on prealloc failure, error still printed but softfail. 6677238106Sdes - iana portlist updated. 6678238106Sdes - RFC 5702: RSASHA256 and RSASHA512 support enabled by default. 6679238106Sdes - ldns tarball updated (which also enables rsasha256 support). 6680238106Sdes 6681238106Sdes27 October 2009: Wouter 6682238106Sdes - iana portlist updated. 6683238106Sdes 6684238106Sdes8 October 2009: Wouter 6685238106Sdes - please doxygen 6686238106Sdes - add val-log-level print to corner case (nameserver.epost.bg). 6687238106Sdes - more detail to errors from insecure delegation checks. 6688238106Sdes - Fix double time subtraction in negative cache reported by 6689238106Sdes Amanda Constant and Hugh Mahon. 6690238106Sdes - Made new validator error string available from libunbound for 6691238106Sdes applications. It is in result->why_bogus, a zero-terminated string. 6692238106Sdes unbound-host prints it by default if a result is bogus. 6693238106Sdes Also the errinf is public in module_qstate (for other modules). 6694238106Sdes 6695238106Sdes7 October 2009: Wouter 6696238106Sdes - retry for validation failure in DS and prime results. Less mem use. 6697238106Sdes unit test. Provisioning in other tests for requeries. 6698238106Sdes - retry for validation failure in DNSKEY in middle of chain of trust. 6699238106Sdes unit test. 6700238106Sdes - retry for empty non terminals in chain of trust and unit test. 6701238106Sdes - Fixed security bug where the signatures for NSEC3 records were not 6702238106Sdes checked when checking for absence of DS records. This could have 6703238106Sdes enabled the substitution of an insecure delegation. 6704238106Sdes - moved version number to 1.4.0 because of 1.3.4 release with only 6705238106Sdes the NSEC3 patch from the entry above. 6706238106Sdes - val-log-level: 2 shows extended error information for validation 6707238106Sdes failures, but still one (longish) line per failure. For example: 6708238106Sdes validation failure <example.com. DNSKEY IN>: signature expired from 6709238106Sdes 192.0.2.4 for trust anchor example.com. while building chain of trust 6710238106Sdes validation failure <www.example.com. A IN>: no signatures from 6711238106Sdes 192.0.2.6 for key example.com. while building chain of trust 6712238106Sdes 6713238106Sdes6 October 2009: Wouter 6714238106Sdes - Test set updated to provide additional ns lookup result. 6715238106Sdes The retry would attempt to fetch the data from other nameservers 6716238106Sdes for bogus data, and this needed to be provisioned in the tests. 6717238106Sdes 6718238106Sdes5 October 2009: Wouter 6719238106Sdes - first validation failure retry code. Retries for data failures. 6720238106Sdes And unit test. 6721238106Sdes 6722238106Sdes2 October 2009: Wouter 6723238106Sdes - improve 5011 modularization. 6724238106Sdes - fix unbound-host so -d can be given before -C. 6725238106Sdes - iana portlist updated. 6726238106Sdes 6727238106Sdes28 September 2009: Wouter 6728238106Sdes - autotrust-anchor-file can read multiline input and $ORIGIN. 6729238106Sdes - prevent integer overflow in holddown calculation. review fixes. 6730238106Sdes - fixed race condition in trust point revocation. review fix. 6731238106Sdes - review fixes to comments, removed unused code. 6732238106Sdes 6733238106Sdes25 September 2009: Wouter 6734238106Sdes - so-rcvbuf: 4m option added. Set this on large busy servers to not 6735238106Sdes drop the occasional packet in spikes due to full socket buffers. 6736238106Sdes netstat -su keeps a counter of UDP dropped due to full buffers. 6737238106Sdes - review of validator/autotrust.c, small fixes and comments. 6738238106Sdes 6739238106Sdes23 September 2009: Wouter 6740238106Sdes - 5011 query failed counts verification failures, not lookup failures. 6741238106Sdes - 5011 probe failure handling fixup. 6742238106Sdes - test unbound reading of original autotrust data. 6743238106Sdes The metadata per-key, such as key state (PENDING, MISSING, VALID) is 6744238106Sdes picked up, otherwise performs initial probe like usual. 6745238106Sdes 6746238106Sdes22 September 2009: Wouter 6747238106Sdes - autotrust test with algorithm rollover, new ordering of checks 6748238106Sdes assists in orderly rollover. 6749238106Sdes - autotrust test with algorithm rollover to unknown algorithm. 6750238106Sdes checks if new keys are supported before adding them. 6751238106Sdes - autotrust test with trust point revocation, becomes unsigned. 6752238106Sdes - fix DNSSEC-missing-signature detection for minimal responses 6753238106Sdes for qtype DNSKEY (assumes DNSKEY occurs at zone apex). 6754238106Sdes 6755238106Sdes18 September 2009: Wouter 6756238106Sdes - autotrust tests, fix trustpoint timer deletion code. 6757238106Sdes fix count of valid anchors during missing remove. 6758238106Sdes - autotrust: pick up REVOKE even if not signed with known other keys. 6759238106Sdes 6760238106Sdes17 September 2009: Wouter 6761238106Sdes - fix compile of unbound-host when --enable-alloc-checks. 6762238106Sdes - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis. 6763238106Sdes - Manual page fixes reported by Tony Finch. 6764238106Sdes 6765238106Sdes16 September 2009: Wouter 6766238106Sdes - Fix memory leak reported by Tao Ma. 6767238106Sdes - Fix memstats test tool for log-time-ascii log format. 6768238106Sdes 6769238106Sdes15 September 2009: Wouter 6770238106Sdes - iana portlist updated. 6771238106Sdes 6772238106Sdes10 September 2009: Wouter 6773238106Sdes - increased MAXSYSLOGLEN so .bg key can be printed in debug output. 6774238106Sdes - use linebuffering for log-file: output, this can be significantly 6775238106Sdes faster than the previous fflush method and enable some class of 6776238106Sdes resolvers to use high verbosity (for short periods). 6777238106Sdes Not on windows, because line buffering does not work there. 6778238106Sdes 6779238106Sdes9 September 2009: Wouter 6780238106Sdes - Fix bug where DNSSEC-bogus messages were marked with too high TTL. 6781238106Sdes The RRsets would still expire at the normal time, but this would 6782238106Sdes keep messages bogus in the cache for too long. 6783238106Sdes - regression test for that bug. 6784238106Sdes - documented that load_cache is meant for debugging. 6785238106Sdes 6786238106Sdes8 September 2009: Wouter 6787238106Sdes - fixup printing errors when load_cache, they were printed to the 6788238106Sdes SSL connection which broke, now to the log. 6789238106Sdes - new ldns - with fixed parse of large SOA values. 6790238106Sdes 6791238106Sdes7 September 2009: Wouter 6792238106Sdes - autotrust testbound scenarios. 6793238106Sdes - autotrust fix that failure count is written to file. 6794238106Sdes - autotrust fix that keys may become valid after add holddown time 6795238106Sdes alone, before the probe returns. 6796238106Sdes 6797238106Sdes4 September 2009: Wouter 6798238106Sdes - Changes to make unbound work with libevent-2.0.3 alpha. (in 6799238106Sdes configure detection due to new ssl dependency in libevent) 6800238106Sdes - do not call sphinx for documentation when python is disabled. 6801238106Sdes - remove EV_PERSIST from libevent timeout code to make the code 6802238106Sdes compatible with the libevent-2.0. Works with older libevent too. 6803238106Sdes - fix memory leak in python code. 6804238106Sdes 6805238106Sdes3 September 2009: Wouter 6806238106Sdes - Got a patch from Luca Bruno for libunbound support on windows to 6807238106Sdes pick up the system resolvconf nameservers and hosts there. 6808238106Sdes - included ldns updated (enum warning fixed). 6809238106Sdes - makefile fix for parallel makes. 6810238106Sdes - Patch from Zdenek Vasicek and Attila Nagy for using the source IP 6811238106Sdes from python scripts. See pythonmod/examples/resip.py. 6812238106Sdes - doxygen comment fixes. 6813238106Sdes 6814238106Sdes2 September 2009: Wouter 6815238106Sdes - TRAFFIC keyword for testbound. Simplifies test generation. 6816238106Sdes ${range lower val upper} to check probe timeout values. 6817238106Sdes - test with 5011-prepublish rollover and revocation. 6818238106Sdes - fix revocation of RR for autotrust, stray exclamation mark. 6819238106Sdes 6820238106Sdes1 September 2009: Wouter 6821238106Sdes - testbound variable arithmetic. 6822238106Sdes - autotrust probe time is randomised. 6823238106Sdes - autotrust: the probe is active and does not fetch from cache. 6824238106Sdes 6825238106Sdes31 August 2009: Wouter 6826238106Sdes - testbound variable processing. 6827238106Sdes 6828238106Sdes28 August 2009: Wouter 6829238106Sdes - fixup unbound-control lookup to print forward and stub servers. 6830238106Sdes 6831238106Sdes27 August 2009: Wouter 6832238106Sdes - autotrust: mesh answer callback is empty. 6833238106Sdes 6834238106Sdes26 August 2009: Wouter 6835238106Sdes - autotrust probing. 6836238106Sdes - iana portlist updated. 6837238106Sdes 6838238106Sdes25 August 2009: Wouter 6839238106Sdes - fixup memleak in trust anchor unsupported algorithm check. 6840238106Sdes - iana portlist updated. 6841238106Sdes - autotrust options: add-holddown, del-holddown, keep-missing. 6842238106Sdes - autotrust store revoked status of trust points. 6843238106Sdes - ctime_r compat definition. 6844238106Sdes - detect yylex_destroy() in configure. 6845238106Sdes - detect SSL_get_compression_methods declaration in configure. 6846238106Sdes - fixup DS lookup at anchor point with unsigned parent. 6847238106Sdes - fixup DLV lookup for DS queries to unsigned domains. 6848238106Sdes 6849238106Sdes24 August 2009: Wouter 6850238106Sdes - cleaner memory allocation on exit. autotrust test routines. 6851238106Sdes - free all memory on program exit, fix for ssl and flex. 6852238106Sdes 6853238106Sdes21 August 2009: Wouter 6854238106Sdes - autotrust: debug routines. Read,write and conversions work. 6855238106Sdes 6856238106Sdes20 August 2009: Wouter 6857238106Sdes - autotrust: save and read trustpoint variables. 6858238106Sdes 6859238106Sdes19 August 2009: Wouter 6860238106Sdes - autotrust: state table updates. 6861238106Sdes - iana portlist updated. 6862238106Sdes 6863238106Sdes17 August 2009: Wouter 6864238106Sdes - autotrust: process events. 6865238106Sdes 6866238106Sdes17 August 2009: Wouter 6867238106Sdes - Fix so that servers are only blacklisted if they fail to reply 6868238106Sdes to 16 queries in a row and the timeout gets above 2 minutes. 6869238106Sdes - autotrust work, split up DS verification of DNSKEYs. 6870238106Sdes 6871238106Sdes14 August 2009: Wouter 6872238106Sdes - unbound-control lookup prints out infra cache information, like RTT. 6873238106Sdes - Fix bug in DLV lookup reported by Amanda from Secure64. 6874238106Sdes It could sometimes wrongly classify a domain as unsigned, which 6875238106Sdes does not give the AD bit on replies. 6876238106Sdes 6877238106Sdes13 August 2009: Wouter 6878238106Sdes - autotrust read anchor files. locked trust anchors. 6879238106Sdes 6880238106Sdes12 August 2009: Wouter 6881238106Sdes - autotrust import work. 6882238106Sdes 6883238106Sdes11 August 2009: Wouter 6884238106Sdes - Check for openssl compatible with gost if enabled. 6885238106Sdes - updated unit test for GOST=211 code. 6886238106Sdes Nicer naming of test files. 6887238106Sdes - iana portlist updated. 6888238106Sdes 6889238106Sdes7 August 2009: Wouter 6890238106Sdes - call OPENSSL_config() in unbound and unit test so that the 6891238106Sdes operator can use openssl.cnf for configuration options. 6892238106Sdes - removed small memory leak from config file reader. 6893238106Sdes 6894238106Sdes6 August 2009: Wouter 6895238106Sdes - configure --enable-gost for GOST support, experimental 6896238106Sdes implementation of draft-dolmatov-dnsext-dnssec-gost-01. 6897238106Sdes - iana portlist updated. 6898238106Sdes - ldns tarball updated (with GOST support). 6899238106Sdes 6900238106Sdes5 August 2009: Wouter 6901238106Sdes - trunk moved to 1.3.4. 6902238106Sdes 6903238106Sdes4 August 2009: Wouter 6904238106Sdes - Added test that the examples from draft rsasha256-14 verify. 6905238106Sdes - iana portlist updated. 6906238106Sdes - tagged 1.3.3 6907238106Sdes 6908238106Sdes3 August 2009: Wouter 6909238106Sdes - nicer warning when algorithm not supported, tells you to upgrade. 6910238106Sdes - iana portlist updated. 6911238106Sdes 6912238106Sdes27 July 2009: Wouter 6913238106Sdes - Updated unbound-cacti contribution from Dmitriy Demidov, with 6914238106Sdes the queue statistics displayed in its own graph. 6915238106Sdes - iana portlist updated. 6916238106Sdes 6917238106Sdes22 July 2009: Wouter 6918238106Sdes - Fix bug found by Michael Tokarev where unbound would try to 6919238106Sdes prime the root servers even though forwarders are configured for 6920238106Sdes the root. 6921238106Sdes - tagged 1.3.3rc1 6922238106Sdes 6923238106Sdes21 July 2009: Wouter 6924238106Sdes - Fix server selection, so that it waits for open target queries when 6925238106Sdes faced with lameness. 6926238106Sdes 6927238106Sdes20 July 2009: Wouter 6928238106Sdes - Ignore transient sendto errors, no route to host, and host, net down. 6929238106Sdes - contrib/update-anchor.sh has -r option for root-hints. 6930238106Sdes - feature val-log-level: 1 prints validation failures so you can 6931238106Sdes keep track of them during dnssec deployment. 6932238106Sdes 6933238106Sdes16 July 2009: Wouter 6934238106Sdes - fix replacement malloc code. Used in crosscompile. 6935238106Sdes - makedist -w creates crosscompiled setup.exe on fedora11. 6936238106Sdes 6937238106Sdes15 July 2009: Wouter 6938238106Sdes - dependencies for compat items, for crosscompile. 6939238106Sdes - mingw32 crosscompile changes, dependencies and zipfile creation. 6940238106Sdes and with System.dll from the windows NSIS you can make setup.exe. 6941238106Sdes - package libgcc_s_sjlj exception handler for NSISdl.dll. 6942238106Sdes 6943238106Sdes14 July 2009: Wouter 6944238106Sdes - updated ldns tarball for solaris x64 compile assistance. 6945238106Sdes - no need to define RAND_MAX from config.h. 6946238106Sdes - iana portlist updated. 6947238106Sdes - configure changes and ldns update for mingw32 crosscompile. 6948238106Sdes 6949238106Sdes13 July 2009: Wouter 6950238106Sdes - Fix for crash at start on windows. 6951238106Sdes - tag for release 1.3.2. 6952238106Sdes - trunk has version 1.3.3. 6953238106Sdes - Fix for ID bits on windows to use all 16. RAND_MAX was not 6954238106Sdes defined like you'd expect on mingw. Reported by Mees de Roo. 6955238106Sdes 6956238106Sdes9 July 2009: Wouter 6957238106Sdes - tag for release 1.3.1. 6958238106Sdes - trunk has version 1.3.2. 6959238106Sdes 6960238106Sdes7 July 2009: Wouter 6961238106Sdes - iana portlist updated. 6962238106Sdes 6963238106Sdes6 July 2009: Wouter 6964238106Sdes - prettier error handling in SSL setup. 6965238106Sdes - makedist.sh uname fix (same as ldns). 6966238106Sdes - updated fedora spec file. 6967238106Sdes 6968238106Sdes3 July 2009: Wouter 6969238106Sdes - fixup linking when ldnsdir is "". 6970238106Sdes 6971238106Sdes30 June 2009: Wouter 6972238106Sdes - more lenient truncation checks. 6973238106Sdes 6974238106Sdes29 June 2009: Wouter 6975238106Sdes - ldns trunk r2959 imported as tarball, because of solaris cc compile 6976238106Sdes support for c99. r2960 for better configure. 6977238106Sdes - better wrongly_truncated check. 6978238106Sdes - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to 6979238106Sdes avoid dropped packets at routers. 6980238106Sdes 6981238106Sdes26 June 2009: Wouter 6982238106Sdes - Fix EDNS fallback when EDNS works for short answers but long answers 6983238106Sdes are dropped. 6984238106Sdes 6985238106Sdes22 June 2009: Wouter 6986238106Sdes - fixup iter priv strict aliasing while preserving size of sockaddr. 6987238106Sdes - iana portlist updated. (one less port allocated, one more fraction 6988238106Sdes of a bit for security!) 6989238106Sdes - updated fedora specfile in contrib from Paul Wouters. 6990238106Sdes 6991238106Sdes19 June 2009: Wouter 6992238106Sdes - Fixup strict aliasing warning in iter priv code. 6993238106Sdes and config_file code. 6994238106Sdes - iana portlist updated. 6995238106Sdes - harden-referral-path: handle cases where NS is in answer section. 6996238106Sdes 6997238106Sdes18 June 2009: Wouter 6998238106Sdes - Fix of message parse bug where (specifically) an NSEC and RRSIG 6999238106Sdes in the wrong order would be parsed, but put wrongly into internal 7000238106Sdes structures so that later validation would fail. 7001238106Sdes - Extreme lenience for wrongly truncated replies where a positive 7002238106Sdes reply has an NS in the authority but no signatures. They are 7003238106Sdes turned into minimal responses with only the (secure) answer. 7004238106Sdes - autoconf 2.63 for configure. 7005238106Sdes - python warnings suppress. Keep python API away from header files. 7006238106Sdes 7007238106Sdes17 June 2009: Wouter 7008238106Sdes - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was 7009238106Sdes used for the python code in unbound. (http://www.nic.cz/vip/ in cz). 7010238106Sdes 7011238106Sdes16 June 2009: Wouter 7012238106Sdes - Fixup opportunistic target query generation to it does not 7013238106Sdes generate queries that are known to fail. 7014238106Sdes - Touchup on munin total memory report. 7015238106Sdes - messages picked out of the cache by the iterator are checked 7016238106Sdes if their cname chain is still correct and if validation status 7017238106Sdes has to be reexamined. 7018238106Sdes 7019238106Sdes15 June 2009: Wouter 7020238106Sdes - iana portlist updated. 7021238106Sdes 7022238106Sdes14 June 2009: Wouter 7023238106Sdes - Fixed bug where cached responses would lose their security 7024238106Sdes status on second validation, which especially impacted dlv 7025238106Sdes lookups. Reported by Hauke Lampe. 7026238106Sdes 7027238106Sdes13 June 2009: Wouter 7028238106Sdes - bug #254. removed random whitespace from example.conf. 7029238106Sdes 7030238106Sdes12 June 2009: Wouter 7031238106Sdes - Fixup potential wrong NSEC picked out of the cache. 7032238106Sdes - If unfulfilled callbacks are deleted they are called with an error. 7033238106Sdes - fptr wlist checks for mesh callbacks. 7034238106Sdes - fwd above stub in configuration works. 7035238106Sdes 7036238106Sdes11 June 2009: Wouter 7037238106Sdes - Fix queries for type DS when forward or stub zones are there. 7038238106Sdes They are performed to higherup domains, and thus treated as if 7039238106Sdes going to higher zones when looking up the right forward or stub 7040238106Sdes server. This makes a stub pointing to a local server that has 7041238106Sdes a local view of example.com signed with the same keys as are 7042238106Sdes publicly used work. Reported by Johan Ihren. 7043238106Sdes - Added build-unbound-localzone-from-hosts.pl to contrib, from 7044238106Sdes Dennis DeDonatis. It converts /etc/hosts into config statements. 7045238106Sdes - same thing fixed for forward-zone and DS, chain of trust from 7046238106Sdes public internet into the forward-zone works now. Added unit test. 7047238106Sdes 7048238106Sdes9 June 2009: Wouter 7049238106Sdes - openssl key files are opened apache-style, when user is root and 7050238106Sdes before chrooting. This makes permissions on remote-control key 7051238106Sdes files easier to set up. Fixes bug #251. 7052238106Sdes - flush_type and flush_name remove msg cache entries. 7053238106Sdes - codereview - dp copy bogus setting fix. 7054238106Sdes 7055238106Sdes8 June 2009: Wouter 7056238106Sdes - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause 7057238106Sdes inadvertant behaviour. 7058238106Sdes - 1.3.0 tarball for release created. 7059238106Sdes - 1.3.1 development in svn trunk. 7060238106Sdes - iana portlist updated. 7061238106Sdes - fix lint from complaining on ldns/sha.h. 7062238106Sdes - help compiler figure out aliasing in priv_rrset_bad() routine. 7063238106Sdes - fail to configure with python if swig is not found. 7064238106Sdes - unbound_munin_ in contrib uses ps to show rss if sbrk does not work. 7065238106Sdes 7066238106Sdes3 June 2009: Wouter 7067238106Sdes - fixup bad free() when wrongly encoded DSA signature is seen. 7068238106Sdes Reported by Paul Wouters. 7069238106Sdes - review comments from Matthijs. 7070238106Sdes 7071238106Sdes2 June 2009: Wouter 7072238106Sdes - --enable-sha2 option. The draft rsasha256 changed its algorithm 7073238106Sdes numbers too often. Therefore it is more prudent to disable the 7074238106Sdes RSASHA256 and RSASHA512 support by default. 7075238106Sdes - ldns trunk included as new tarball. 7076238106Sdes - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point. 7077238106Sdes 7078238106Sdes29 May 2009: Wouter 7079238106Sdes - fixup doc bug in README reported by Matthew Dempsky. 7080238106Sdes 7081238106Sdes28 May 2009: Wouter 7082238106Sdes - update iana port list 7083238106Sdes - update ldns lib tarball 7084238106Sdes 7085238106Sdes27 May 2009: Wouter 7086238106Sdes - detect lack of IPv6 support on XP (with a different error code). 7087238106Sdes - Fixup a crash-on-exit which was triggered by a very long queue. 7088238106Sdes Unbound would try to re-use ports that came free, but this is 7089238106Sdes of course not really possible because everything is deleted. 7090238106Sdes Most easily triggered on XP (not Vista), maybe because of the 7091238106Sdes network stack encouraging large messages backlogs. 7092238106Sdes - change in debug statements. 7093238106Sdes - Fixed bug that could cause a crash if root prime failed when there 7094238106Sdes were message backlogs. 7095238106Sdes 7096238106Sdes26 May 2009: Wouter 7097238106Sdes - Thanks again to Brett Carr, found an assertion that was not true. 7098238106Sdes Assertion checked if recursion parent query still existed. 7099238106Sdes 7100238106Sdes29 April 2009: Wouter 7101238106Sdes - Thanks to Brett Carr, caught windows resource leak, use 7102238106Sdes closesocket() and not close() on sockets or else the network stack 7103238106Sdes starts to leak handles. 7104238106Sdes - Removed usage of windows Mutex because windows cannot handle enough 7105238106Sdes mutexes open. Provide own mutex implementation using primitives. 7106238106Sdes 7107238106Sdes28 April 2009: Wouter 7108238106Sdes - created svn tag for 1.3.0. 7109238106Sdes 7110238106Sdes27 April 2009: Wouter 7111238106Sdes - optimised cname from cache. 7112238106Sdes - ifdef windows functions in testbound. 7113238106Sdes 7114238106Sdes23 April 2009: Wouter 7115238106Sdes - fix for threadsafety in solaris thr_key_create() in tests. 7116238106Sdes - iana portlist updated. 7117238106Sdes - fix pylib test for Darwin. 7118238106Sdes - fix pymod test for Darwin and a python threading bug in pymod init. 7119238106Sdes - check python >= 2.4 in configure. 7120238106Sdes - -ldl check for libcrypto 1.0.0beta. 7121238106Sdes 7122238106Sdes21 April 2009: Wouter 7123238106Sdes - fix for build outside sourcedir. 7124238106Sdes - fix for configure script swig detection. 7125238106Sdes 7126238106Sdes17 April 2009: Wouter 7127238106Sdes - Fix reentrant in minievent handler for unix. Could have resulted 7128238106Sdes in spurious event callbacks. 7129238106Sdes - timers do not take up a fd slot for winsock handler. 7130238106Sdes - faster fix for winsock reentrant check. 7131238106Sdes - fix rsasha512 unit test for new (interim) algorithm number. 7132238106Sdes - fix test:ldns doesn't like DOS line endings in keyfiles on unix. 7133238106Sdes - fix compile warning on ubuntu (configlexer fwrite return value). 7134238106Sdes - move python include directives into CPPFLAGS instead of CFLAGS. 7135238106Sdes 7136238106Sdes16 April 2009: Wouter 7137238106Sdes - winsock event handler exit very quickly on signal, even if 7138238106Sdes under heavy load. 7139238106Sdes - iana portlist updated. 7140238106Sdes - fixup windows winsock handler reentrant problem. 7141238106Sdes 7142238106Sdes14 April 2009: Wouter 7143238106Sdes - bug #245: fix munin plugin, perform cleanup of stale lockfiles. 7144238106Sdes - makedist.sh; better help text. 7145238106Sdes - cache-min-ttl option and tests. 7146238106Sdes - mingw detect error condition on TCP sockets (NOTCONN). 7147238106Sdes 7148238106Sdes9 April 2009: Wouter 7149238106Sdes - Fix for removal of RSASHA256_NSEC3 protonumber from ldns. 7150238106Sdes - ldns tarball updated. 7151238106Sdes - iana portlist update. 7152238106Sdes - detect GOST support in openssl-1.0.0-beta1, and fix compile problem 7153238106Sdes because that openssl defines the name STRING for itself. 7154238106Sdes 7155238106Sdes6 April 2009: Wouter 7156238106Sdes - windows compile fix. 7157238106Sdes - Detect FreeBSD jail without ipv6 addresses assigned. 7158238106Sdes - python libunbound wrapper unit test. 7159238106Sdes - installs the following files. Default is to not build them. 7160238106Sdes from configure --with-pythonmodule: 7161238106Sdes /usr/lib/python2.x/site-packages/unboundmodule.py 7162238106Sdes from configure --with-pyunbound: 7163238106Sdes /usr/lib/python2.x/site-packages/unbound.py 7164238106Sdes /usr/lib/python2.x/site-packages/_unbound.so* 7165238106Sdes The example python scripts (pythonmod/examples and 7166238106Sdes libunbound/python/examples) are not installed. 7167238106Sdes - python invalidate routine respects packed rrset ids and locks. 7168238106Sdes - clock skew checks in unbound, config statements. 7169238106Sdes - nxdomain ttl considerations in requirements.txt 7170238106Sdes 7171238106Sdes3 April 2009: Wouter 7172238106Sdes - Fixed a bug that caused messages to be stored in the cache too 7173238106Sdes long. Hard to trigger, but NXDOMAINs for nameservers or CNAME 7174238106Sdes targets have been more vulnerable to the TTL miscalculation bug. 7175238106Sdes - documentation test fixed for python addition. 7176238106Sdes 7177238106Sdes2 April 2009: Wouter 7178238106Sdes - pyunbound (libunbound python plugin) compiles using libtool. 7179238106Sdes - documentation for pythonmod and pyunbound is generated in doc/html. 7180238106Sdes - iana portlist updated. 7181238106Sdes - fixed bug in unbound-control flush_zone where it would not flush 7182238106Sdes every message in the target domain. This especially impacted 7183238106Sdes NXDOMAIN messages which could remain in the cache regardless. 7184238106Sdes - python module test package. 7185238106Sdes 7186238106Sdes1 April 2009: Wouter 7187238106Sdes - suppress errors when trying to contact authority servers that gave 7188238106Sdes ipv6 AAAA records for their nameservers with ipv4 mapped contents. 7189238106Sdes Still tries to do so, could work when deployed in intranet. 7190238106Sdes Higher verbosity shows the error. 7191238106Sdes - new libunbound calls documented. 7192238106Sdes - pyunbound in libunbound/python. Removed compile warnings. 7193238106Sdes Makefile to make it. 7194238106Sdes 7195238106Sdes30 March 2009: Wouter 7196238106Sdes - Fixup LDFLAGS from libevent sourcedir compile configure restore. 7197238106Sdes - Fixup so no non-absolute rpaths are added. 7198238106Sdes - Fixup validation of RRSIG queries, they are let through. 7199238106Sdes - read /dev/random before chroot 7200238106Sdes - checkconf fix no python checks when no python module enabled. 7201238106Sdes - fix configure, pthread first, so other libs do not change outcome. 7202238106Sdes 7203238106Sdes27 March 2009: Wouter 7204238106Sdes - nicer -h output. report linked libraries and modules. 7205238106Sdes - prints modules in intuitive order (config file friendly). 7206238106Sdes - python compiles easily on BSD. 7207238106Sdes 7208238106Sdes26 March 2009: Wouter 7209238106Sdes - ignore swig varargs warnings with gcc. 7210238106Sdes - remove duplicate example.conf text from python example configs. 7211238106Sdes - outofdir compile fix for python. 7212238106Sdes - pyunbound works. 7213238106Sdes - print modules compiled in on -h. manpage. 7214238106Sdes 7215238106Sdes25 March 2009: Wouter 7216238106Sdes - initial import of the python contribution from Zdenek Vasicek and 7217238106Sdes Marek Vavrusa. 7218238106Sdes - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0. 7219238106Sdes 7220238106Sdes24 March 2009: Wouter 7221238106Sdes - more neat configure.ac. Removed duplicate config.h includes. 7222238106Sdes - neater config.h.in. 7223238106Sdes - iana portlist updated. 7224238106Sdes - fix util/configlexer.c and solaris -std=c99 flag. 7225238106Sdes - fix postcommit aclocal errors. 7226238106Sdes - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R. 7227238106Sdes - swap order of host detect and libtool generation. 7228238106Sdes 7229238106Sdes23 March 2009: Wouter 7230238106Sdes - added launchd plist example file for MacOSX to contrib. 7231238106Sdes - deprecation test for daemon(3). 7232238106Sdes - moved common configure actions to m4 include, prettier Makefile. 7233238106Sdes 7234238106Sdes20 March 2009: Wouter 7235238106Sdes - bug #239: module-config entries order is important. Documented. 7236238106Sdes - build fix for test asynclook. 7237238106Sdes 7238238106Sdes19 March 2009: Wouter 7239238106Sdes - winrc/README.txt dos-format text file. 7240238106Sdes - iana portlist updated. 7241238106Sdes - use _beginthreadex() when available (performs stack alignment). 7242238106Sdes - defaults for windows baked into configure.ac (used if on mingw). 7243238106Sdes 7244238106Sdes18 March 2009: Wouter 7245238106Sdes - Added tests, unknown algorithms become insecure. fallback works. 7246238106Sdes - Fix for and test for unknown algorithms in a trust anchor 7247238106Sdes definition. Trust anchors with no supported algos are ignored. 7248238106Sdes This means a (higher)DS or DLV entry for them could succeed, and 7249238106Sdes otherwise they are treated as insecure. 7250238106Sdes - domain-insecure: "example.com" statement added. Sets domain 7251238106Sdes insecure regardless of chain of trust DSs or DLVs. The inverse 7252238106Sdes of a trust-anchor. 7253238106Sdes 7254238106Sdes17 March 2009: Wouter 7255238106Sdes - unit test for unsupported algorithm in anchor warning. 7256238106Sdes - fixed so queries do not fail on opportunistic target queries. 7257238106Sdes 7258238106Sdes16 March 2009: Wouter 7259238106Sdes - fixup diff error printout in contrib/update-itar.sh. 7260238106Sdes - added contrib/unbound_cacti for statistics support in cacti, 7261238106Sdes contributed by Dmitriy Demidov. 7262238106Sdes 7263238106Sdes13 March 2009: Wouter 7264238106Sdes - doxygen and lex/yacc on linux. 7265238106Sdes - strip update-anchor on makedist -w. 7266238106Sdes - fix testbound on windows. 7267238106Sdes - default log to syslog for windows. 7268238106Sdes - uninstaller can stop unbound - changed text on it to reflect that. 7269238106Sdes - remove debugging from windows 'cron' actions. 7270238106Sdes 7271238106Sdes12 March 2009: Wouter 7272238106Sdes - log to App.logs on windows prints executable identity. 7273238106Sdes - fixup tests. 7274238106Sdes - munin plugin fix benign locking error printout. 7275238106Sdes - anchor-update for windows, called every 24 hours; unbound reloads. 7276238106Sdes 7277238106Sdes11 March 2009: Wouter 7278238106Sdes - winsock event handler resets WSAevents after signalled. 7279238106Sdes - winsock event handler tests if signals are really signalled. 7280238106Sdes - install and service with log to file works on XP and Vista on 7281238106Sdes default install location. 7282238106Sdes - on windows logging to the Application logbook works (as a service). 7283238106Sdes - fix RUN_DIR on windows compile setting in makedist. 7284238106Sdes - windows registry has Software\Unbound\ConfigFile element. 7285238106Sdes If does not exist, the default is used. The -c switch overrides it. 7286238106Sdes - fix makedist version cleanup function. 7287238106Sdes 7288238106Sdes10 March 2009: Wouter 7289238106Sdes - makedist -w strips out old rc.. and snapshot info from version. 7290238106Sdes - setup.exe starts and stops unbound after install, before uninstall. 7291238106Sdes - unbound-checkconf recognizes absolute pathnames on windows (C:...). 7292238106Sdes 7293238106Sdes9 March 2009: Wouter 7294238106Sdes - Nullsoft NSIS installer creation script. 7295238106Sdes 7296238106Sdes5 March 2009: Wouter 7297238106Sdes - fixup memory leak introduced on 18feb in mesh reentrant fix. 7298238106Sdes 7299238106Sdes3 March 2009: Wouter 7300238106Sdes - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8). 7301238106Sdes - service works on xp/vista, no config necessary (using defaults). 7302238106Sdes - windows registry settings. 7303238106Sdes 7304238106Sdes2 March 2009: Wouter 7305238106Sdes - fixup --export-symbols to be -export-symbls for libtool. 7306238106Sdes This should fix extraneous symbols exported from libunbound. 7307238106Sdes Thanks to Ondrej Sury and Robert Edmonds for finding it. 7308238106Sdes - iana portlist updated. 7309238106Sdes - document FAQ entry on stub/forward zones and default blocking. 7310238106Sdes - fix asynclook test app for libunbound not exporting symbols. 7311238106Sdes - service install and remove utils that work with vista UAC. 7312238106Sdes 7313238106Sdes27 February 2009: Wouter 7314238106Sdes - Fixup lexer, to not give warnings about fwrite. Appeared in 7315238106Sdes new lexer features. 7316238106Sdes - makedistro functionality for mingw. Has RC support. 7317238106Sdes - support spaces and backslashes in configured defaults paths. 7318238106Sdes - register, deregister in service control manager. 7319238106Sdes 7320238106Sdes25 February 2009: Wouter 7321238106Sdes - windres usage for application resources. 7322238106Sdes 7323238106Sdes24 February 2009: Wouter 7324238106Sdes - isc moved their dlv key download location. 7325238106Sdes - fixup warning on vista/mingw. 7326238106Sdes - makedist -w for window zip distribution first version. 7327238106Sdes 7328238106Sdes20 February 2009: Wouter 7329238106Sdes - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped. 7330238106Sdes Nicer script layout. Added url to site in -h output. 7331238106Sdes 7332238106Sdes19 February 2009: Wouter 7333238106Sdes - unbound-checkconf and unbound print warnings when trust anchors 7334238106Sdes have unsupported algorithms. 7335238106Sdes - added contrib/update-itar.sh This script is similar to 7336238106Sdes update-anchor.sh, and updates from the IANA ITAR repository. 7337238106Sdes You can provide your own PGP key and trust repo, or can use the 7338238106Sdes builtin. The program uses wget and gpg to work. 7339238106Sdes - iana portlist updated. 7340238106Sdes - update-itar.sh: using ftp:// urls because https godaddy certificate 7341238106Sdes is not available everywhere and then gives fatal errors. The 7342238106Sdes security is provided by pgp signature. 7343238106Sdes 7344238106Sdes18 February 2009: Wouter 7345238106Sdes - more cycle detection. Also for target queries. 7346238106Sdes - fixup bug where during deletion of the mesh queries the callbacks 7347238106Sdes that were reentrant caused assertion failures. Keep the mesh in 7348238106Sdes a reentrant safe state. Affects libunbound, reload of server, 7349238106Sdes on quit and flush_requestlist. 7350238106Sdes - iana portlist updated. 7351238106Sdes 7352238106Sdes13 February 2009: Wouter 7353238106Sdes - forwarder information now per-thread duplicated. 7354238106Sdes This keeps it read only for speed, with no locking necessary. 7355238106Sdes - forward command for unbound control to change forwarders to use 7356238106Sdes on the fly. 7357238106Sdes - document that unbound-host reads no config file by default. 7358238106Sdes - updated iana portlist. 7359238106Sdes 7360238106Sdes12 February 2009: Wouter 7361238106Sdes - call setusercontext if available (on BSD). 7362238106Sdes - small refactor of stats clearing. 7363238106Sdes - #227: flush_stats feature for unbound-control. 7364238106Sdes - stats_noreset feature for unbound-control. 7365238106Sdes - flush_requestlist feature for unbound-control. 7366238106Sdes - libunbound version upped API (was changed 5 feb). 7367238106Sdes - unbound-control status shows if root forwarding is in use. 7368238106Sdes - slightly nicer memory management in iter-fwd code. 7369238106Sdes 7370238106Sdes10 February 2009: Wouter 7371238106Sdes - keys with rfc5011 REVOKE flag are skipped and not considered when 7372238106Sdes validating data. 7373238106Sdes - iana portlist updated 7374238106Sdes - #226: dump_requestlist feature for unbound-control. 7375238106Sdes 7376238106Sdes6 February 2009: Wouter 7377238106Sdes - contrib contains specfile for fedora 1.2.1 (from Paul Wouters). 7378238106Sdes - iana portlist updated. 7379238106Sdes - fixup EOL in include directive (reported by Paul Wouters). 7380238106Sdes You can no longer specify newlines in the names of included files. 7381238106Sdes - config parser changed. Gives some syntax errors closer to where they 7382238106Sdes occurred. Does not enforce a space after keyword anymore. 7383238106Sdes Does not allow literal newlines inside quoted strings anymore. 7384238106Sdes - verbosity level 5 logs customer IP for new requestlist entries. 7385238106Sdes - test fix, lexer and cancel test. 7386238106Sdes - new option log-time-ascii: yes if you enable it prints timestamps 7387238106Sdes in the log file as Feb 06 13:45:26 (like syslog does). 7388238106Sdes - detect event_base_new in libevent-1.4.1 and later and use it. 7389238106Sdes - #231 unbound-checkconf -o option prints that value from config file. 7390238106Sdes Useful for scripting in management scripts and the like. 7391238106Sdes 7392238106Sdes5 February 2009: Wouter 7393238106Sdes - ldns 1.5.0 rc as tarball included. 7394238106Sdes - 1.3.0 development continues: 7395238106Sdes change in libunbound API: ub_cancel can return an error, that 7396238106Sdes the async_id did not exist, or that it was already delivered. 7397238106Sdes The result could have been delivered just before the cancel 7398238106Sdes routine managed to acquire the lock, so a caller may get the 7399238106Sdes result at the same time they call cancel. For this case, 7400238106Sdes ub_cancel tries to return an error code. 7401238106Sdes Fixes race condition in ub_cancel() libunbound function. 7402238106Sdes - MacOSX Leopard cleaner text output from configure. 7403238106Sdes - initgroups(3) is called to drop secondary group permissions, if 7404238106Sdes applicable. 7405238106Sdes - configure option --with-ldns-builtin forces the use of the 7406238106Sdes inluded ldns package with the unbound source. The -I include 7407238106Sdes is put before the others, so it avoids bad include files from 7408238106Sdes an older ldns install. 7409238106Sdes - daemon(3) posix call is used when available. 7410238106Sdes - testbound test for older fix added. 7411238106Sdes 7412238106Sdes4 February 2009: Wouter 7413238106Sdes - tag for release 1.2.1. 7414238106Sdes - trunk setup for 1.3.0 development. 7415238106Sdes 7416238106Sdes3 February 2009: Wouter 7417238106Sdes - noted feature requests in doc/TODO. 7418238106Sdes - printout more detailed errors on ssl certificate loading failures. 7419238106Sdes - updated IANA portlist. 7420238106Sdes 7421238106Sdes16 January 2009: Wouter 7422238106Sdes - more quiet about ipv6 network failures, i.e. when ipv6 is not 7423238106Sdes available (network unreachable). Debug still printed on high 7424238106Sdes verbosity. 7425238106Sdes - unbound-host -4 and -6 options. Stops annoying ipv6 errors when 7426238106Sdes debugging with unbound-host -4 -d ... 7427238106Sdes - more cycle detection for NS-check, addr-check, root-prime and 7428238106Sdes stub-prime queries in the iterator. Avoids possible deadlock 7429238106Sdes when priming fails. 7430238106Sdes 7431238106Sdes15 January 2009: Wouter 7432238106Sdes - bug #229: fixup configure checks for compilation with Solaris 7433238106Sdes Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc 7434238106Sdes - fixup suncc warnings. 7435238106Sdes - fix bug where unbound could crash using libevent 1.3 and older. 7436238106Sdes - update testset for recent retry change. 7437238106Sdes 7438238106Sdes14 January 2009: Wouter 7439238106Sdes - 1.2.1 feature: negative caching for failed queries. 7440238106Sdes Queries that failed are cached for 5 seconds (NORR_TTL). 7441238106Sdes If the failure is local, like out of memory, it is not cached. 7442238106Sdes - the TTL comparison for the cache used different comparisons, 7443238106Sdes causing many cache responses that used the iterator and validator 7444238106Sdes state machines unnecessarily. 7445238106Sdes - retry from 4 to 5 so that EDNS drop retry is part of the first 7446238106Sdes query resolve attempt, and cached error does not stop EDNS fallback. 7447238106Sdes - remove debug prints that protect against bad referrals. 7448238106Sdes - honor QUIET=no on make commandline (or QUIET=yes ). 7449238106Sdes 7450238106Sdes13 January 2009: Wouter 7451238106Sdes - fixed bug in lameness marking, removed printouts. 7452238106Sdes - find NS rrset more cleanly for qtype NS. 7453238106Sdes - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for 7454238106Sdes reporting and logs. 7455238106Sdes - 1.2.1 feature: stops resolving AAAAs promiscuously when they 7456238106Sdes are in the negative cache. 7457238106Sdes 7458238106Sdes12 January 2009: Wouter 7459238106Sdes - fixed bug in infrastructure lameness cache, did not lowercase 7460238106Sdes name of zone to hash when setting lame. 7461238106Sdes - lameness debugging printouts. 7462238106Sdes 7463238106Sdes9 January 2009: Wouter 7464238106Sdes - created svn tag for 1.2.0 release. 7465238106Sdes - svn trunk contains 1.2.1 version number. 7466238106Sdes - iana portlist updated for todays list. 7467238106Sdes - removed debug print. 7468238106Sdes 7469238106Sdes8 January 2009: Wouter 7470238106Sdes - new version of ldns-trunk (today) included as tarball, fixed 7471238106Sdes bug #224, building with -j race condition. 7472238106Sdes - remove possible race condition in the test for race conditions. 7473238106Sdes 7474238106Sdes7 January 2009: Wouter 7475238106Sdes - version 1.2.0 in preparation. 7476238106Sdes - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file 7477238106Sdes statements. (Adapted from patch by Paul Wouters). 7478238106Sdes - typo fix and iana portlist updated. 7479238106Sdes - porting testsuite; unused var warning, and type fixup. 7480238106Sdes 7481238106Sdes6 January 2009: Wouter 7482238106Sdes - fixup packet-of-death when compiled with --enable-debug. 7483238106Sdes A malformed packet could cause an internal assertion failure. 7484238106Sdes - added test for HINFO canonicalisation behaviour. 7485238106Sdes - fixup reported problem with transparent local-zone data where 7486238106Sdes queries with different type could get nxdomain. Now queries 7487238106Sdes with a different name get resolved normally, with different type 7488238106Sdes get a correct NOERROR/NODATA answer. 7489238106Sdes - HINFO no longer downcased for validation, making unbound compatible 7490238106Sdes with bind and ldns. 7491238106Sdes - fix reading included config files when chrooted. 7492238106Sdes Give full path names for include files. 7493238106Sdes Relative path names work if the start dir equals the working dir. 7494238106Sdes - fix libunbound message transport when no packet buffer is available. 7495238106Sdes 7496238106Sdes5 January 2009: Wouter 7497238106Sdes - fixup getaddrinfo failure handling for remote control port. 7498238106Sdes - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints. 7499238106Sdes - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/ 7500238106Sdes - comm_timer_set performs base_set operation after event_add. 7501238106Sdes 7502238106Sdes18 December 2008: Wouter 7503238106Sdes - fixed bug reported by Duane Wessels: error in DLV lookup, would make 7504238106Sdes some zones that had correct DLV keys as insecure. 7505238106Sdes - follows -rc makedist from ldns changes (no _rc). 7506238106Sdes - ldns tarball updated with 1.4.1rc for DLV unit test. 7507238106Sdes - verbose prints about recursion lame detection and server selection. 7508238106Sdes - fixup BSD port for infra host storage. It hashed wrongly. 7509238106Sdes - fixup makedist snapshot name generation. 7510238106Sdes - do not reopen syslog to avoid dev/log dependency. 7511238106Sdes 7512238106Sdes17 December 2008: Wouter 7513238106Sdes - follows ldns makedist.sh. -rc option. autom4te dir removed. 7514238106Sdes - unbound-control status command. 7515238106Sdes - extended statistics has a number of ipv6 queries counter. 7516238106Sdes contrib/unbound_munin_ was updated to draw ipv6 in the hits graph. 7517238106Sdes 7518238106Sdes16 December 2008: Wouter 7519238106Sdes - follow makedist improvements from ldns, for maintainers prereleases. 7520238106Sdes - snapshot version uses _ not - to help rpm distinguish the 7521238106Sdes version number. 7522238106Sdes 7523238106Sdes11 December 2008: Wouter 7524238106Sdes - better fix for bug #219: use LOG_NDELAY with openlog() call. 7525238106Sdes Thanks to Tamas Tevesz. 7526238106Sdes 7527238106Sdes9 December 2008: Wouter 7528238106Sdes - bug #221 fixed: unbound checkconf checks if key files exist if 7529238106Sdes remote control is enabled. Also fixed NULL printf when not chrooted. 7530238106Sdes - iana portlist updated. 7531238106Sdes 7532238106Sdes3 December 2008: Wouter 7533238106Sdes - Fix problem reported by Jaco Engelbrecht where unbound-control stats 7534238106Sdes freezes up unbound if this was compiled without threading, and 7535238106Sdes was using multiple processes. 7536238106Sdes - iana portlist updated. 7537238106Sdes - test for remote control with interprocess communication. 7538238106Sdes - created command distribution mechanism so that remote control 7539238106Sdes commands other than 'stats' work on all processes in a nonthreaded 7540238106Sdes compiled version. dump/load cache work, on the first process. 7541238106Sdes - fixup remote control local_data addition memory corruption bug. 7542238106Sdes 7543238106Sdes1 December 2008: Wouter 7544238106Sdes - SElinux policy files in contrib/selinux for the unbound daemon, 7545238106Sdes by Paul Wouters and Adam Tkac. 7546238106Sdes 7547238106Sdes25 November 2008: Wouter 7548238106Sdes - configure complains when --without-ssl is given (bug #220). 7549238106Sdes - skip unsupported feature tests on vista/mingw. 7550238106Sdes - fixup testcode/streamtcp to work on vista/mingw. 7551238106Sdes - root-hints test checks version of dig required. 7552238106Sdes - blacklisted servers are polled at a low rate (1%) to see if they 7553238106Sdes come back up. But not if there is some other working server. 7554238106Sdes 7555238106Sdes24 November 2008: Wouter 7556238106Sdes - document that the user of the server daemon needs read privileges 7557238106Sdes on the keys and certificates generated by unbound-control-setup. 7558238106Sdes This is different per system or distribution, usually, running the 7559238106Sdes script under the same username as the server uses suffices. 7560238106Sdes i.e. sudo -u unbound unbound-control-setup 7561238106Sdes - testset port to vista/mingw. 7562238106Sdes - tcp_sigpipe to freebsd port. 7563238106Sdes 7564238106Sdes21 November 2008: Wouter 7565238106Sdes - fixed tcp accept, errors were printed when they should not. 7566238106Sdes - unbound-control-setup.sh removes read/write permissions other 7567238106Sdes from the keys it creates (as suggested by Dmitriy Demidov). 7568238106Sdes 7569238106Sdes20 November 2008: Wouter 7570238106Sdes - fixup fatal error due to faulty error checking after tcp accept. 7571238106Sdes - add check in rlimit to avoid integer underflow. 7572238106Sdes - rlimit check with new formula; better estimate for number interfaces 7573238106Sdes - nicer comments in rlimit check. 7574238106Sdes - tag 1.1.1 created in svn. 7575238106Sdes - trunk label is 1.1.2 7576238106Sdes 7577238106Sdes19 November 2008: Wouter 7578238106Sdes - bug #219: fixed so that syslog which delays opening until the first 7579238106Sdes log line is written, gets a log line while not chroot'ed yet. 7580238106Sdes 7581238106Sdes18 November 2008: Wouter 7582238106Sdes - iana portlist updated. 7583238106Sdes - removed cast in unit test debug print that was not 64bit safe. 7584238106Sdes - trunk back to 1.1.0; copied to tags 1.1.0 release. 7585238106Sdes - trunk to has version number 1.1.1 again. 7586238106Sdes - in 1.1.1; make clean nicer. grammar in manpage. 7587238106Sdes 7588238106Sdes17 November 2008: Wouter 7589238106Sdes - theoretical fix for problems reported on mailing list. 7590238106Sdes If a delegation point has no A but only AAAA and do-ip6 is no, 7591238106Sdes resolution would fail. Fixed to ask for the A and AAAA records. 7592238106Sdes It has to ask for both always, so that it can fail quietly, from 7593238106Sdes TLD perspective, when a zone is only reachable on one transport. 7594238106Sdes - test for above, only AAAA and doip6 is no. Fix causes A record 7595238106Sdes for nameserver to be fetched. 7596238106Sdes - fixup address duplication on cache fillup for delegation points. 7597238106Sdes - testset updated for new query answer requirements. 7598238106Sdes 7599238106Sdes14 November 2008: Wouter 7600238106Sdes - created 1.1.0 release tag in svn. 7601238106Sdes - trunk moved to 1.1.1 7602238106Sdes - fixup unittest-neg for locking. 7603238106Sdes 7604238106Sdes13 November 2008: Wouter 7605238106Sdes - added fedora init and specfile to contrib (by Paul Wouters). 7606238106Sdes - added configure check for ldns 1.4.0 (using its compat funcs). 7607238106Sdes - neater comments in worker.h. 7608238106Sdes - removed doc/plan and updated doc/TODO. 7609238106Sdes - silenced EHOSTDOWN (verbosity 2 or higher to see it). 7610238106Sdes - review comments from Jelte, Matthijs. Neater code. 7611238106Sdes 7612238106Sdes12 November 2008: Wouter 7613238106Sdes - add unbound-control manpage to makedist replace list. 7614238106Sdes 7615238106Sdes11 November 2008: Wouter 7616238106Sdes - unit test for negative cache, stress tests the refcounting. 7617238106Sdes - fix for refcounting error that could cause fptr_wlist fatal exit 7618238106Sdes in the negative cache rbtree (upcoming 1.1 feature). (Thanks to 7619238106Sdes Attila Nagy for testing). 7620238106Sdes - nicer comments in cachedump about failed RR to string conversion. 7621238106Sdes - fix 32bit wrap around when printing large (4G and more) mem usage 7622238106Sdes for extended statistics. 7623238106Sdes 7624238106Sdes10 November 2008: Wouter 7625238106Sdes - fixup the getaddrinfo compat code rename. 7626238106Sdes 7627238106Sdes8 November 2008: Wouter 7628238106Sdes - added configure check for eee build warning. 7629238106Sdes 7630238106Sdes7 November 2008: Wouter 7631238106Sdes - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4. 7632238106Sdes - detect nonblocking problems in network stack in configure script. 7633238106Sdes 7634238106Sdes6 November 2008: Wouter 7635238106Sdes - dname_priv must decompress the name before comparison. 7636238106Sdes - iana portlist updated. 7637238106Sdes 7638238106Sdes5 November 2008: Wouter 7639238106Sdes - fixed possible memory leak in key_entry_key deletion. 7640238106Sdes Would leak a couple bytes when trust anchors were replaced. 7641238106Sdes - if query and reply qname overlap, the bytes are skipped not copied. 7642238106Sdes - fixed file descriptor leak when messages were jostled out that 7643238106Sdes had outstanding (TCP) replies. 7644238106Sdes - DNAMEs used from cache have their synthesized CNAMEs initialized 7645238106Sdes properly. 7646238106Sdes - fixed file descriptor leak for localzone type deny (for TCP). 7647238106Sdes - fixed memleak at exit for nsec3 negative cached zones. 7648238106Sdes - fixed memleak for the keyword 'nodefault' when reading config. 7649238106Sdes - made verbosity of 'edns incapable peer' warning higher, so you 7650238106Sdes do not get spammed by it. 7651238106Sdes - caught elusive Bad file descriptor error bug, that would print the 7652238106Sdes error while unnecessarily try to listen to a closed fd. Fixed. 7653238106Sdes 7654238106Sdes4 November 2008: Wouter 7655238106Sdes - fixed -Wwrite-strings warnings that result in better code. 7656238106Sdes 7657238106Sdes3 November 2008: Wouter 7658238106Sdes - fixup build process for Mac OSX linker, use ldns b32 compat funcs. 7659238106Sdes - generated configure with autoconf-2.61. 7660238106Sdes - iana portlist updated. 7661238106Sdes - detect if libssl needs libdl. For static linking with libssl. 7662238106Sdes - changed to use new algorithm identifiers for sha256/sha512 7663238106Sdes from ldns 1.4.0 (need very latest version). 7664238106Sdes - updated the included ldns tarball. 7665238106Sdes - proper detection of SHA256 and SHA512 functions (not just sizes). 7666238106Sdes 7667238106Sdes23 October 2008: Wouter 7668238106Sdes - a little more debug info for failure on signer names. prints names. 7669238106Sdes 7670238106Sdes22 October 2008: Wouter 7671238106Sdes - CFLAGS are picked up by configure from the environment. 7672238106Sdes - iana portlist updated. 7673238106Sdes - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too. 7674238106Sdes - new stub-prime: yesno option. Default is off, so it does not prime. 7675238106Sdes can be turned on to get same behaviour as previous unbound release. 7676238106Sdes - made automated test that checks if builtin root hints are uptodate. 7677238106Sdes - finished draft-wijngaards-dnsext-resolver-side-mitigation 7678238106Sdes implementation. The unwanted-reply-threshold can be set. 7679238106Sdes - fixup so fptr_whitelist test in alloc.c works. 7680238106Sdes 7681238106Sdes21 October 2008: Wouter 7682238106Sdes - fix update-anchors.sh, so it does not report different RR order 7683238106Sdes as an update. Sorts the keys in the file. Updated copyright. 7684238106Sdes - fixup testbound on windows, the command control pipe doesn't exist. 7685238106Sdes - skip 08hostlib test on windows, no fork() available. 7686238106Sdes - made unbound-remote work on windows. 7687238106Sdes 7688238106Sdes20 October 2008: Wouter 7689238106Sdes - quench a log message that is debug only. 7690238106Sdes - iana portlist updated. 7691238106Sdes - do not query bogus nameservers. It is like nameservers that have 7692238106Sdes the NS or A or AAAA record bogus are listed as donotquery. 7693238106Sdes - if server selection is faced with only bad choices, it will 7694238106Sdes attempt to get more options to be fetched. 7695238106Sdes - changed bogus-ttl default value from 900 to 60 seconds. 7696238106Sdes In anticipation that operator caused failures are more likely than 7697238106Sdes actual attacks at this time. And thus repeated validation helps 7698238106Sdes the operators get the problem fixed sooner. It makes validation 7699238106Sdes failures go away sooner (60 seconds after the zone is fixed). 7700238106Sdes Also it is likely to try different nameserver targets every minute, 7701238106Sdes so that if a zone is bad on one server but not another, it is 7702238106Sdes likely to pick up the 'correct' one after a couple minutes, 7703238106Sdes and if the TTL is big enough that solves validation for the zone. 7704238106Sdes - fixup unbound-control compilation on windows. 7705238106Sdes 7706238106Sdes17 October 2008: Wouter 7707238106Sdes - port Leopard/G5: fixup type conversion size_t/uint32. 7708238106Sdes please ranlib, stop file without symbols warning. 7709238106Sdes - harden referral path now also validates the root after priming. 7710238106Sdes It looks up the root NS authoritatively as well as the root servers 7711238106Sdes and attemps to validate the entries. 7712238106Sdes 7713238106Sdes16 October 2008: Wouter 7714238106Sdes - Fixup negative TTL values appearing (reported by Attila Nagy). 7715238106Sdes 7716238106Sdes15 October 2008: Wouter 7717238106Sdes - better documentation for 0x20; remove fallback TODO, it is done. 7718238106Sdes - harden-referral-path feature includes A, AAAA queries for glue, 7719238106Sdes as well as very careful NS caching (only when doing NS query). 7720238106Sdes A, AAAA use the delegation from the NS-query. 7721238106Sdes 7722238106Sdes14 October 2008: Wouter 7723238106Sdes - fwd_three.tpkg test was flaky. If the three requests hit the 7724238106Sdes wrong threads by chance (or bad OS) then the test would fail. 7725238106Sdes Made less flaky by increasing number of retries. 7726238106Sdes - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs. 7727238106Sdes - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014). 7728238106Sdes Which includes the ldns_dname_absolute fix. 7729238106Sdes - fwd_three test remains flaky now that unbound does not stop 7730238106Sdes listening when full. Thus, removed timeout problem. 7731238106Sdes It may be serviced by three threads, or maybe by one. 7732238106Sdes Mostly only useful for lock-check testing now. 7733238106Sdes 7734238106Sdes13 October 2008: Wouter 7735238106Sdes - fixed recursion servers deployed as authoritative detection, so 7736238106Sdes that as a last resort, a +RD query is sent there to get the 7737238106Sdes correct answer. 7738238106Sdes - iana port list update. 7739238106Sdes - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013). 7740238106Sdes 7741238106Sdes10 October 2008: Wouter 7742238106Sdes - fixup tests - the negative cache contained the correct NSEC3s for 7743238106Sdes two tests that are supposed to fail to validate. 7744238106Sdes 7745238106Sdes9 October 2008: Wouter 7746238106Sdes - negative cache caps max iterations of NSEC3 done. 7747238106Sdes - NSEC3 negative cache for qtype DS works. 7748238106Sdes 7749238106Sdes8 October 2008: Wouter 7750238106Sdes - NSEC negative cache for DS. 7751238106Sdes 7752238106Sdes6 October 2008: Wouter 7753238106Sdes - jostle-timeout option, so you can config for slow links. 7754238106Sdes - 0x20 fallback code. Tries 3xnumber of nameserver addresses 7755238106Sdes queries that must all be the same. Sent to random nameservers. 7756238106Sdes - documented choices for DoS, EDNS, 0x20. 7757238106Sdes 7758238106Sdes2 October 2008: Wouter 7759238106Sdes - fixup unlink of pidfile. 7760238106Sdes - fixup SHA256 algorithm collation code. 7761238106Sdes - contrib/update-anchor.sh does not overwrite anchors if not needed. 7762238106Sdes exits 0 when a restart is needed, other values if not. 7763238106Sdes so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart 7764238106Sdes can restart unbound exactly when needed. 7765238106Sdes 7766238106Sdes30 September 2008: Wouter 7767238106Sdes - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1. 7768238106Sdes - tests for sha256 support and downgrade resistance. 7769238106Sdes - RSASHA256 and RSASHA512 support (using the draft in dnsext), 7770238106Sdes using the drafted protocol numbers. 7771238106Sdes - when using stub on localhost (127.0.0.1@10053) unbound works. 7772238106Sdes Like when running NSD to host a local zone, on the same machine. 7773238106Sdes The noprime feature. manpages more explanation. Added a test for it. 7774238106Sdes - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com" 7775238106Sdes 7776238106Sdes29 September 2008: Wouter 7777238106Sdes - EDNS lameness detection, if EDNS packets are dropped this is 7778238106Sdes detected, eventually. 7779238106Sdes - multiple query timeout rtt backoff does not backoff too much. 7780238106Sdes 7781238106Sdes26 September 2008: Wouter 7782238106Sdes - tests for remote-control. 7783238106Sdes - small memory leak in exception during remote control fixed. 7784238106Sdes - fixup for lock checking but not unchecking in remote control. 7785238106Sdes - iana portlist updated. 7786238106Sdes 7787238106Sdes23 September 2008: Wouter 7788238106Sdes - Msg cache is loaded. A cache load enables cache responses. 7789238106Sdes - unbound-control flush [name], flush_type and flush_zone. 7790238106Sdes 7791238106Sdes22 September 2008: Wouter 7792238106Sdes - dump_cache and load_cache statements in unbound-control. 7793238106Sdes RRsets are dumped and loaded correctly. 7794238106Sdes Msg cache is dumped. 7795238106Sdes 7796238106Sdes19 September 2008: Wouter 7797238106Sdes - locking on the localdata structure. 7798238106Sdes - add and remove local zone and data with unbound-control. 7799238106Sdes - ldns trunk snapshot updated, make tests work again. 7800238106Sdes 7801238106Sdes18 September 2008: Wouter 7802238106Sdes - fixup error in time calculation. 7803238106Sdes - munin plugin improvements. 7804238106Sdes - nicer abbreviations for high query types values (ixfr, axfr, any...) 7805238106Sdes - documented the statistics output in unbound-control man page. 7806238106Sdes - extended statistics prints out histogram, over unbound-control. 7807238106Sdes 7808238106Sdes17 September 2008: Wouter 7809238106Sdes - locking for threadsafe bogus rrset counter. 7810238106Sdes - ldns trunk no longer exports b32 functions, provide compat. 7811238106Sdes - ldns tarball updated. 7812238106Sdes - testcode/ldns-testpkts.c const fixups. 7813238106Sdes - fixed rcode stat printout. 7814238106Sdes - munin plugin in contrib. 7815238106Sdes - stats always printout uptime, because stats plugins need it. 7816238106Sdes 7817238106Sdes16 September 2008: Wouter 7818238106Sdes - extended-statistics: yesno config option. 7819238106Sdes - unwanted replies spoof nearmiss detector. 7820238106Sdes - iana portlist updated. 7821238106Sdes 7822238106Sdes15 September 2008: Wouter 7823238106Sdes - working start, stop, reload commands for unbound-control. 7824238106Sdes - test for unbound-control working; better exit value for control. 7825238106Sdes - verbosity control via unbound-control. 7826238106Sdes - unbound-control stats. 7827238106Sdes 7828238106Sdes12 September 2008: Wouter 7829238106Sdes - removed browser control mentions. Proto speccy. 7830238106Sdes 7831238106Sdes11 September 2008: Wouter 7832238106Sdes - set nonblocking on new TCP streams, because linux does not inherit 7833238106Sdes the socket options to the accepted socket. 7834238106Sdes - fix TCP timeouts. 7835238106Sdes - SSL protected connection between server and unbound-control. 7836238106Sdes 7837238106Sdes10 September 2008: Wouter 7838238106Sdes - remove memleak in privacy addresses on reloads and quits. 7839238106Sdes - remote control work. 7840238106Sdes 7841238106Sdes9 September 2008: Wouter 7842238106Sdes - smallapp/unbound-control-setup.sh script to set up certificates. 7843238106Sdes 7844238106Sdes4 September 2008: Wouter 7845238106Sdes - scrubber scrubs away private addresses. 7846238106Sdes - test for private addresses. man page entry. 7847238106Sdes - code refactored for name and address tree lookups. 7848238106Sdes 7849238106Sdes3 September 2008: Wouter 7850238106Sdes - options for 'DNS Rebinding' protection: private-address and 7851238106Sdes private-domain. 7852238106Sdes - dnstree for reuse of routines that help with domain, addr lookups. 7853238106Sdes - private-address and private-domain config option read, stored. 7854238106Sdes 7855238106Sdes2 September 2008: Wouter 7856238106Sdes - DoS protection features. Queries are jostled out to make room. 7857238106Sdes - testbound can pass time, increasing the internal timer. 7858238106Sdes - do not mark unsigned additionals bogus, leave unchecked, which 7859238106Sdes is removed too. 7860238106Sdes 7861238106Sdes1 September 2008: Wouter 7862238106Sdes - disallow nonrecursive queries for cache snooping by default. 7863238106Sdes You can allow is using access-control: <subnet> allow_snoop. 7864238106Sdes The defaults do allow access no authoritative data without RD bit. 7865238106Sdes - two tests for it and fixups of tests for nonrec refused. 7866238106Sdes 7867238106Sdes29 August 2008: Wouter 7868238106Sdes - version 1.1 number in trunk. 7869238106Sdes - harden-referral-path option for query for NS records. 7870238106Sdes Default turns off expensive, experimental option. 7871238106Sdes 7872238106Sdes28 August 2008: Wouter 7873238106Sdes - fixup logfile handling; it is created with correct permissions 7874238106Sdes again. (from bugfix#199). 7875238106Sdes Some errors are not written to logfile (pidfile writing, forking), 7876238106Sdes and these are only visible by using the -d commandline flag. 7877238106Sdes 7878238106Sdes27 August 2008: Wouter 7879238106Sdes - daemon(3) is causing problems for people. Reverting the patch. 7880238106Sdes bug#200, and 199 and 203 contain sideline discussion on it. 7881238106Sdes - bug#199 fixed: pidfile can be outside chroot. openlog is done before 7882238106Sdes chroot and drop permissions. 7883238106Sdes - config option to set size of aggressive negative cache, 7884238106Sdes neg-cache-size. 7885238106Sdes - bug#203 fixed: dlv has been implemented. 7886238106Sdes 7887238106Sdes26 August 2008: Wouter 7888238106Sdes - test for insecure zone when DLV is in use, also does negative cache. 7889238106Sdes - test for trustanchor when DLV is in use (the anchor works). 7890238106Sdes - test for DLV used for a zone below a trustanchor. 7891238106Sdes - added scrub filter for overreaching NSEC records and unit test. 7892238106Sdes - iana portlist update 7893238106Sdes - use of setresuid or setreuid when available. 7894238106Sdes - use daemon(3) if available. 7895238106Sdes 7896238106Sdes25 August 2008: Wouter 7897238106Sdes - realclean patch from Robert Edmonds. 7898238106Sdes 7899238106Sdes22 August 2008: Wouter 7900238106Sdes - nicer debuglogging of DLV. 7901238106Sdes - test with secure delegation inside the DLV repository. 7902238106Sdes 7903238106Sdes21 August 2008: Wouter 7904238106Sdes - negative cache code linked into validator, for DLV use. 7905238106Sdes negative cache works for DLV. 7906238106Sdes - iana portlist update. 7907238106Sdes - dlv-anchor option for unit tests. 7908238106Sdes - fixup NSEC_AT_APEX classification for short typemaps. 7909238106Sdes - ldns-testns has subdomain checks, for unit tests. 7910238106Sdes 7911238106Sdes20 August 2008: Wouter 7912238106Sdes - negative cache code, reviewed. 7913238106Sdes 7914238106Sdes18 August 2008: Wouter 7915238106Sdes - changes info: in logfile to notice: info: or debug: depending on 7916238106Sdes the verbosity of the statements. Better logfile message 7917238106Sdes classification. 7918238106Sdes - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd. 7919238106Sdes 7920238106Sdes15 August 2008: Wouter 7921238106Sdes - DLV nsec code fixed for better detection of closest existing 7922238106Sdes enclosers from NSEC responses. 7923238106Sdes - DLV works, straight to the dlv repository, so not for production. 7924238106Sdes - Iana port update. 7925238106Sdes 7926238106Sdes14 August 2008: Wouter 7927238106Sdes - synthesize DLV messages from the rrset cache, like done for DS. 7928238106Sdes 7929238106Sdes13 August 2008: Wouter 7930238106Sdes - bug #203: nicer do-auto log message when user sets incompatible 7931238106Sdes options. 7932238106Sdes - bug #204: variable name ameliorated in log.c. 7933238106Sdes - bug #206: in iana_update, no egrep, but awk use. 7934238106Sdes - ldns snapshot r2699 taken (includes DLV type). 7935238106Sdes - DLV work, config file element, trust anchor read in. 7936238106Sdes 7937238106Sdes12 August 2008: Wouter 7938238106Sdes - finished adjusting testset to provide qtype NS answers. 7939238106Sdes 7940238106Sdes11 August 2008: Wouter 7941238106Sdes - Fixup rrset security updates overwriting 2181 trust status. 7942238106Sdes This makes validated to be insecure data just as worthless as 7943238106Sdes nonvalidated data, and 2181 rules prevent cache overwrites to them. 7944238106Sdes - Fix assertion fail on bogus key handling. 7945238106Sdes - dnssec lameness detection works on first query at trust apex. 7946238106Sdes - NS queries get proper cache and dnssec lameness treatment. 7947238106Sdes - fixup compilation without pthreads on linux. 7948238106Sdes 7949238106Sdes8 August 2008: Wouter 7950238106Sdes - NS queries are done after every referral. 7951238106Sdes validator is used on those NS records (if anchors enabled). 7952238106Sdes 7953238106Sdes7 August 2008: Wouter 7954238106Sdes - Scrubber more strict. CNAME chains, DNAMEs from cache, other 7955238106Sdes irrelevant rrsets removed. 7956238106Sdes - 1.0.2 released from 1.0 support branch. 7957238106Sdes - fixup update-anchor.sh to work both in BSD shell and bash. 7958238106Sdes 7959238106Sdes5 August 2008: Wouter 7960238106Sdes - fixup DS test so apex nodata works again. 7961238106Sdes 7962238106Sdes4 August 2008: Wouter 7963238106Sdes - iana port update. 7964238106Sdes - TODO update. 7965238106Sdes - fix bug 201: null ptr deref on cleanup while udp pkts wait for port. 7966238106Sdes - added explanatory text for outgoing-port-permit in manpage. 7967238106Sdes 7968238106Sdes30 July 2008: Wouter 7969238106Sdes - fixup bug qtype DS for unsigned zone and signed parent validation. 7970238106Sdes 7971238106Sdes25 July 2008: Wouter 7972238106Sdes - added original copyright statement of OpenBSD arc4random code. 7973238106Sdes - created tube signaling solution on windows, as a pipe replacement. 7974238106Sdes this makes background asynchronous resolution work on windows. 7975238106Sdes - removed very insecure socketpair compat code. It also did not 7976238106Sdes work with event_waiting. Solved by pipe replacement. 7977238106Sdes - unbound -h prints openssl version number as well. 7978238106Sdes 7979238106Sdes22 July 2008: Wouter 7980238106Sdes - moved pipe actions to util/tube.c. easier porting and shared code. 7981238106Sdes - check _raw() commpoint callbacks with fptr_wlist. 7982238106Sdes - iana port update. 7983238106Sdes 7984238106Sdes21 July 2008: Wouter 7985238106Sdes - #198: nicer entropy warning message. manpage OS hints. 7986238106Sdes 7987238106Sdes19 July 2008: Wouter 7988238106Sdes - #198: fixup man page to suggest chroot entropy fix. 7989238106Sdes 7990238106Sdes18 July 2008: Wouter 7991238106Sdes - branch for 1.0 support. 7992238106Sdes - trunk work on tube.c. 7993238106Sdes 7994238106Sdes17 July 2008: Wouter 7995238106Sdes - fix bug #196, compile outside source tree. 7996238106Sdes - fix bug #195, add --with-username=user configure option. 7997238106Sdes - print error and exit if started with config that requires more 7998238106Sdes fds than the builtin minievent can handle. 7999238106Sdes 8000238106Sdes16 July 2008: Wouter 8001238106Sdes - made svn tag 1.0.1, trunk now 1.0.2 8002238106Sdes - sha256 checksums enabled in makedist.sh 8003238106Sdes 8004238106Sdes15 July 2008: Wouter 8005238106Sdes - Follow draft-ietf-dnsop-default-local-zones-06 added reverse 8006238106Sdes IPv6 example prefix to AS112 default blocklist. 8007238106Sdes - fixup lookup of DS records by client with trustanchor for same. 8008238106Sdes - libunbound ub_resolve, fix handling of error condition during setup. 8009238106Sdes - lowered log_hex blocksize to fit through BSD syslog linesize. 8010238106Sdes - no useless initialisation if getpwnam not available. 8011238106Sdes - iana, ldns snapshot updated. 8012238106Sdes 8013238106Sdes3 July 2008: Wouter 8014238106Sdes - Matthijs fixed memory leaks in root hints file reading. 8015238106Sdes 8016238106Sdes26 June 2008: Wouter 8017238106Sdes - fixup streamtcp bounds setting for udp mode, in the test framework. 8018238106Sdes - contrib item for updating trust anchors. 8019238106Sdes 8020238106Sdes25 June 2008: Wouter 8021238106Sdes - fixup fwd_ancil test typos. 8022238106Sdes - Fix for newegg lameness : ok for qtype=A, but lame for others. 8023238106Sdes - fixup unit test for infra cache, test lame merging. 8024238106Sdes - porting to mingw, bind, listen, getsockopt and setsockopt error 8025238106Sdes handling. 8026238106Sdes 8027238106Sdes24 June 2008: Wouter 8028238106Sdes - removed testcode/checklocks from production code compilation path. 8029238106Sdes - streamtcp can use UDP mode (connected UDP socket), for testing IPv6 8030238106Sdes on windows. 8031238106Sdes - fwd_ancil test fails if platform support is lacking. 8032238106Sdes 8033238106Sdes23 June 2008: Wouter 8034238106Sdes - fixup minitpkg to cleanup on windows with its file locking troubles. 8035238106Sdes - minitpkg shows skipped tests in report. 8036238106Sdes - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not 8037238106Sdes ipv6 connectivity). 8038238106Sdes - winsock event handler keeps track of sticky TCP events, that have 8039238106Sdes not been fully handled yet. when interest in the event(s) resumes, 8040238106Sdes they are sent again. When WOULDBLOCK is returned events are cleared. 8041238106Sdes - skip tests that need signals when testing on mingw. 8042238106Sdes 8043238106Sdes18 June 2008: Wouter 8044238106Sdes - open testbound replay files in binary mode, because fseek/ftell 8045238106Sdes do not work in ascii-mode on windows. The b does nothing on unix. 8046238106Sdes unittest and testbound tests work on windows (xp too). 8047238106Sdes - ioctlsocket prints nicer error message. 8048238106Sdes - fixed up some TCP porting for winsock. 8049238106Sdes - lack of IPv6 gives a warning, no fatal error. 8050238106Sdes - use WSAGetLastError() on windows instead of errno for some errors. 8051238106Sdes 8052238106Sdes17 June 2008: Wouter 8053238106Sdes - outgoing num fds 32 by default on windows ; it supports less 8054238106Sdes fds for waiting on than unixes. 8055238106Sdes - winsock_event minievent handler for windows. (you could also 8056238106Sdes attempt to link with libevent/libev ports for windows). 8057238106Sdes - neater crypto check and gdi32 detection. 8058238106Sdes - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista. 8059238106Sdes 8060238106Sdes16 June 2008: Wouter 8061238106Sdes - on windows, use windows threads, mutex and thread-local-storage(Tls). 8062238106Sdes - detect if openssl needs gdi32. 8063238106Sdes - if no threading, THREADS_DISABLED is defined for use in the code. 8064238106Sdes - sets USE_WINSOCK if using ws2_32 on windows. 8065238106Sdes - wsa_strerror() function for more readable errors. 8066238106Sdes - WSA Startup and Cleanup called in unbound.exe. 8067238106Sdes 8068238106Sdes13 June 2008: Wouter 8069238106Sdes - port mingw32, more signal ifdefs, detect sleep, usleep, 8070238106Sdes random, srandom (used inside the tests). 8071238106Sdes - signed or unsigned FD_SET is cast. 8072238106Sdes 8073238106Sdes10 June 2008: Wouter 8074238106Sdes - fixup warnings compiling on eeepc xandros linux. 8075238106Sdes 8076238106Sdes9 June 2008: Wouter 8077238106Sdes - in iteration response type code 8078238106Sdes * first check for SOA record (negative answer) before NS record 8079238106Sdes and lameness. 8080238106Sdes * check if no AA bit for non-forwarder, and thus lame zone. 8081238106Sdes In response to error report by Richard Doty for mail.opusnet.com. 8082238106Sdes - fixup unput warning from lexer on freeBSD. 8083238106Sdes - bug#183. pidfile, rundir, and chroot configure options. Also the 8084238106Sdes example.conf and manual pages get the configured defaults. 8085238106Sdes You can use: (or accept the defaults to /usr/local/etc/unbound/) 8086238106Sdes --with-conf-file=filename 8087238106Sdes --with-pidfile=filename 8088238106Sdes --with-run-dir=path 8089238106Sdes --with-chroot-dir=path 8090238106Sdes 8091238106Sdes8 June 2008: Wouter 8092238106Sdes - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug. 8093238106Sdes Reported by Robert Edmonds. 8094238106Sdes - iana port updated. 8095238106Sdes 8096238106Sdes4 June 2008: Wouter 8097238106Sdes - updated libtool files with newer version. 8098238106Sdes - iana portlist updated. 8099238106Sdes 8100238106Sdes3 June 2008: Wouter 8101238106Sdes - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the 8102238106Sdes trailing dot is not used during comparison. 8103238106Sdes 8104238106Sdes2 June 2008: Wouter 8105238106Sdes - Jelte fixed bugs in my absence 8106238106Sdes - bug 178: fixed unportable shell usage in configure (relied on 8107238106Sdes bash shell). 8108238106Sdes - bug 180: fixed buffer overflow in unbound-checkconf use of strncat. 8109238106Sdes - bug 181: fixed buffer overflow in ldns (called by unbound to parse 8110238106Sdes config file parts). 8111238106Sdes - fixes by Wouter 8112238106Sdes - bug 177: fixed compilation failure on opensuse, the 8113238106Sdes --disable-static configure flag caused problems. (Patch from 8114238106Sdes Klaus Singvogel) 8115238106Sdes - bug 179: same fix as 177. 8116238106Sdes - bug 185: --disable-shared not passed along to ldns included with 8117238106Sdes unbound. Fixed so that configure parameters are passed to the 8118238106Sdes subdir configure script. 8119238106Sdes fixed that ./libtool is used always, you can still override 8120238106Sdes manually with ./configure libtool=mylibtool or set $libtool in 8121238106Sdes the environment. 8122238106Sdes - update of the ldns tarball to current ldns svn version (fix 181). 8123238106Sdes - bug 184: -r option for unbound-host, read resolv.conf for 8124238106Sdes forwarder. (Note that forwarder must support DNSSEC for validation 8125238106Sdes to succeed). 8126238106Sdes 8127238106Sdes23 May 2008: Wouter 8128238106Sdes - mingw32 porting. 8129238106Sdes - test for sys/wait.h 8130238106Sdes - WSAEWOULDBLOCK test after nonblocking TCP connect. 8131238106Sdes - write_iov_buffer removed: unused and no struct iov on windows. 8132238106Sdes - signed/unsigned warning fixup mini_event. 8133238106Sdes - use ioctlsocket to set nonblocking I/O if fnctl is unavailable. 8134238106Sdes - skip signals that are not defined 8135238106Sdes - detect pwd.h. 8136238106Sdes - detect getpwnam, getrlimit, setsid, sbrk, chroot. 8137238106Sdes - default config has no chroot if chroot() unavailable. 8138238106Sdes - if no kill() then no pidfile is read or written. 8139238106Sdes - gmtime_r is replaced by nonthreadsafe alternative if unavail. 8140238106Sdes used in rrsig time validation errors. 8141238106Sdes 8142238106Sdes22 May 2008: Wouter 8143238106Sdes - contrib unbound.spec from Patrick Vande Walle. 8144238106Sdes - fixup bug#175: call tzset before chroot to have correct timestamps 8145238106Sdes in system log. 8146238106Sdes - do not generate lex input and lex unput functions. 8147238106Sdes - mingw port. replacement functions labelled _unbound. 8148238106Sdes - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed. 8149238106Sdes 8150238106Sdes19 May 2008: Wouter 8151238106Sdes - fedora 9, check in6_pktinfo define in configure. 8152238106Sdes - CREDITS fixup of history. 8153238106Sdes - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative. 8154238106Sdes 8155238106Sdes16 May 2008: Wouter 8156238106Sdes - fixup for MacOSX hosts file reading (reported by John Dickinson). 8157238106Sdes - created 1.0.0 svn tag. 8158238106Sdes - trunk version 1.0.1. 8159238106Sdes 8160238106Sdes14 May 2008: Wouter 8161238106Sdes - accepted patch from Ondrej Sury for library version libtool option. 8162238106Sdes - configure --disable-rpath fixes up libtool for rpath trouble. 8163238106Sdes Adapted from debian package patch file. 8164238106Sdes 8165238106Sdes13 May 2008: Wouter 8166238106Sdes - Added root ipv6 addresses to builtin root hints. 8167238106Sdes - TODO modified for post 1.0 plans. 8168238106Sdes - trunk version set to 1.0.0. 8169238106Sdes - no unnecessary linking with librt (only when libevent/libev used). 8170238106Sdes 8171238106Sdes7 May 2008: Wouter 8172238106Sdes - fixup no-ip4 problem with error callback in outside network. 8173238106Sdes 8174238106Sdes25 April 2008: Wouter 8175238106Sdes - DESTDIR is honored by the Makefile for rpms. 8176238106Sdes - contrib files unbound.spec and unbound.init, builds working RPM 8177238106Sdes on FC7 Linux, a chrooted caching resolver, and libunbound. 8178238106Sdes - iana ports update. 8179238106Sdes 8180238106Sdes24 April 2008: Wouter 8181238106Sdes - chroot checks improved. working directory relative to chroot. 8182238106Sdes checks if config file path is inside chroot. Documentation on it. 8183238106Sdes - nicer example.conf text. 8184238106Sdes - created 0.11 tag. 8185238106Sdes 8186238106Sdes23 April 2008: Wouter 8187238106Sdes - parseunbound.pl contrib update from Kai Storbeck for threads. 8188238106Sdes - iana ports update 8189238106Sdes 8190238106Sdes22 April 2008: Wouter 8191238106Sdes - ignore SIGPIPE. 8192238106Sdes - unit test for SIGPIPE ignore. 8193238106Sdes 8194238106Sdes21 April 2008: Wouter 8195238106Sdes - FEATURES document. 8196238106Sdes - fixup reread of config file if it was given as a full path 8197238106Sdes and chroot was used. 8198238106Sdes 8199238106Sdes16 April 2008: Wouter 8200238106Sdes - requirements doc, updated clean query returns. 8201238106Sdes - parseunbound.pl update from Kai Storbeck. 8202238106Sdes - sunos4 porting changes. 8203238106Sdes 8204238106Sdes15 April 2008: Wouter 8205238106Sdes - fixup default rc.d pidfile location to /usr/local/etc. 8206238106Sdes - iana ports updated. 8207238106Sdes - copyright updated in ldns-testpkts to keep same as in ldns. 8208238106Sdes - fixup checkconf chroot tests a bit more, chdir must be inside 8209238106Sdes chroot dir. 8210238106Sdes - documented 'gcc: unrecognized -KPIC option' errors on Solaris. 8211238106Sdes - example.conf values changed to /usr/local/etc/unbound 8212238106Sdes - DSA test work. 8213238106Sdes - DSA signatures: unbound is compatible with both encodings found. 8214238106Sdes It will detect and convert when necessary. 8215238106Sdes 8216238106Sdes14 April 2008: Wouter 8217238106Sdes - got update for parseunbound.pl statistics script from Kai Storbeck. 8218238106Sdes - tpkg tests for udp wait list. 8219238106Sdes - documented 0x20 status. 8220238106Sdes - fixup chroot and checkconf, it is much smarter now. 8221238106Sdes - fixup DSA EVP signature decoding. Solution that Jelte found copied. 8222238106Sdes - and check first sig byte for the encoding type. 8223238106Sdes 8224238106Sdes11 April 2008: Wouter 8225238106Sdes - random port selection out of the configged ports. 8226238106Sdes - fixup threadsafety for libevent-1.4.3+ (event_base_get_method). 8227238106Sdes - removed base_port. 8228238106Sdes - created 256-port ephemeral space for the OS, 59802 available. 8229238106Sdes - fixup consistency of port_if out array during heavy use. 8230238106Sdes 8231238106Sdes10 April 2008: Wouter 8232238106Sdes - --with-libevent works with latest libevent 1.4.99-trunk. 8233238106Sdes - added log file statistics perl script to contrib. 8234238106Sdes - automatic iana ports update from makefile. 60058 available. 8235238106Sdes 8236238106Sdes9 April 2008: Wouter 8237238106Sdes - configure can detect libev(from its build directory) when passed 8238238106Sdes --with-libevent=/home/wouter/libev-3.2 8239238106Sdes libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%). 8240238106Sdes - unused commpoints not listed in epoll list. 8241238106Sdes - statistics-cumulative option so that the values are not reset. 8242238106Sdes - config creates array of available ports, 61841 available, 8243238106Sdes it excludes <1024 and iana assigned numbers. 8244238106Sdes config statements to modify the available port numbers. 8245238106Sdes 8246238106Sdes8 April 2008: Wouter 8247238106Sdes - unbound tries to set the ulimit fds when started as server. 8248238106Sdes if that does not work, it will scale back its requirements. 8249238106Sdes 8250238106Sdes27 March 2008: Wouter 8251238106Sdes - documented /dev/random symlink from chrootdir as FAQ entry. 8252238106Sdes 8253238106Sdes26 March 2008: Wouter 8254238106Sdes - implemented AD bit signaling. If a query sets AD bit (but not DO) 8255238106Sdes then the AD bit is set in the reply if the answer validated. 8256238106Sdes Without including DNSSEC signatures. Useful if you have a trusted 8257238106Sdes path from the client to the resolver. Follows dnssec-updates draft. 8258238106Sdes 8259238106Sdes25 March 2008: Wouter 8260238106Sdes - implemented check that for NXDOMAIN and NOERROR answers a query 8261238106Sdes section must be present in the reply (by the scrubber). And it must 8262238106Sdes be equal to the question sent, at least lowercase folded. 8263238106Sdes Previously this feature happened because the cache code refused 8264238106Sdes to store such messages. However blocking by the scrubber makes 8265238106Sdes sure nothing gets into the RRset cache. Also, this looks like a 8266238106Sdes timeout (instead of an allocation failure) and this retries are 8267238106Sdes done (which is useful in a spoofing situation). 8268238106Sdes - RTT banding. Band size 400 msec, this makes band around zero (fast) 8269238106Sdes include unknown servers. This makes unbound explore unknown servers. 8270238106Sdes 8271238106Sdes7 March 2008: Wouter 8272238106Sdes - -C config feature for harvest program. 8273238106Sdes - harvest handles CNAMEs too. 8274238106Sdes 8275238106Sdes5 March 2008: Wouter 8276238106Sdes - patch from Hugo Koji Kobayashi for iterator logs spelling. 8277238106Sdes 8278238106Sdes4 March 2008: Wouter 8279238106Sdes - From report by Jinmei Tatuya, rfc2181 trust value for remainder 8280238106Sdes of a cname trust chain is lower; not full answer_AA. 8281238106Sdes - test for this fix. 8282238106Sdes - default config file location is /usr/local/etc/unbound. 8283238106Sdes Thus prefix is used to determine the location. This is also the 8284238106Sdes chroot and pidfile default location. 8285238106Sdes 8286238106Sdes3 March 2008: Wouter 8287238106Sdes - Create 0.10 svn tag. 8288238106Sdes - 0.11 version in trunk. 8289238106Sdes - indentation nicer. 8290238106Sdes 8291238106Sdes29 February 2008: Wouter 8292238106Sdes - documentation update. 8293238106Sdes - fixup port to Solaris of perf test tool. 8294238106Sdes - updated ldns-tarball with decl-after-statement fixes. 8295238106Sdes 8296238106Sdes28 February 2008: Wouter 8297238106Sdes - fixed memory leaks in libunbound (during cancellation and wait). 8298238106Sdes - libunbound returns the answer packet in full. 8299238106Sdes - snprintf compat update. 8300238106Sdes - harvest performs lookup. 8301238106Sdes - ldns-tarball update with fix for ldns_dname_label. 8302238106Sdes - installs to sbin by default. 8303238106Sdes - install all manual pages (unbound-host and libunbound too). 8304238106Sdes 8305238106Sdes27 February 2008: Wouter 8306238106Sdes - option to use caps for id randomness. 8307238106Sdes - config file option use-caps-for-id: yes 8308238106Sdes - harvest debug tool 8309238106Sdes 8310238106Sdes26 February 2008: Wouter 8311238106Sdes - delay utility delays TCP as well. If the server that is forwarded 8312238106Sdes to has a TCP error, the delay utility closes the connection. 8313238106Sdes - delay does REUSE_ADDR, and can handle a server that closes its end. 8314238106Sdes - answers use casing from query. 8315238106Sdes 8316238106Sdes25 February 2008: Wouter 8317238106Sdes - delay utility works. Gets decent thoughput too (>20000). 8318238106Sdes 8319238106Sdes22 February 2008: Wouter 8320238106Sdes - +2% for recursions, if identical queries (except for destination 8321238106Sdes and query ID) in the reply list, avoid re-encoding the answer. 8322238106Sdes - removed TODO items for optimizations that do not show up in 8323238106Sdes profile reports. 8324238106Sdes - default is now minievent - not libevent. As its faster and 8325238106Sdes not needed for regular installs, only for very large port ranges. 8326238106Sdes - loop check different speedup pkt-dname-reading, 1% faster for 8327238106Sdes nocache-recursion check. 8328238106Sdes - less hashing during msg parse, 4% for recursion. 8329238106Sdes - small speed fix for dname_count_size_labels, +1 or +2% recursion. 8330238106Sdes - some speed results noted: 8331238106Sdes optimization resulted in +40% for recursion (cache miss) and 8332238106Sdes +70 to +80 for cache hits, and +96% for version.bind. 8333238106Sdes zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4 8334238106Sdes www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3 8335238106Sdes www with DO bit set : BIND 8269.31 Ub 28735.6 qps. 8336238106Sdes So, unbound can be about equal qps to NSD in cache hits. 8337238106Sdes And about 3.4x faster than BIND in cache performance. 8338238106Sdes - delay utility for testing. 8339238106Sdes 8340238106Sdes21 February 2008: Wouter 8341238106Sdes - speedup of root-delegation message encoding by 15%. 8342238106Sdes - minor speedup of compress tree_lookup, maybe 1%. 8343238106Sdes - speedup of dname_lab_cmp and memlowercmp - the top functions in 8344238106Sdes profiler output, maybe a couple percent when it matters. 8345238106Sdes 8346238106Sdes20 February 2008: Wouter 8347238106Sdes - setup speec_cache for need-ldns-testns in dotests. 8348238106Sdes - check number of queued replies on incoming queries to avoid overload 8349238106Sdes on that account. 8350238106Sdes - fptr whitelist checks are not disabled in optimize mode. 8351238106Sdes - do-daemonize config file option. 8352238106Sdes - minievent time share initializes time at start. 8353238106Sdes - updated testdata for nsec3 new algorithm numbers (6, 7). 8354238106Sdes - small performance test of packet encoding (root delegation). 8355238106Sdes 8356238106Sdes19 February 2008: Wouter 8357238106Sdes - applied patch to unbound-host man page from Jan-Piet Mens. 8358238106Sdes - fix donotquery-localhost: yes default (it erroneously was switched 8359238106Sdes to default 'no'). 8360238106Sdes - time is only gotten once and the value is shared across unbound. 8361238106Sdes - unittest cleans up crypto, so that it has no memory leaks. 8362238106Sdes - mini_event shares the time value with unbound this results in 8363238106Sdes +3% speed for cache responses and +9% for recursions. 8364238106Sdes - ldns tarball update with new NSEC3 sign code numbers. 8365238106Sdes - perform several reads per UDP operation. This improves performance 8366238106Sdes in DoS conditions, and costs very little in normal conditions. 8367238106Sdes improves cache response +50%, and recursions +10%. 8368238106Sdes - modified asynclook test. because the callback from async is not 8369238106Sdes in any sort of lock (and thus can use all library functions freely), 8370238106Sdes this causes a tiny race condition window when the last lock is 8371238106Sdes released for a callback and a new cancel() for that callback. 8372238106Sdes The only way to remove this is by putting callbacks into some 8373238106Sdes lock window. I'd rather have the small possibility of a callback 8374238106Sdes for a cancelled function then no use of library functions in 8375238106Sdes callbacks. Could be possible to only outlaw process(), wait(), 8376238106Sdes cancel() from callbacks, by adding another lock, but I'd rather not. 8377238106Sdes 8378238106Sdes18 February 2008: Wouter 8379238106Sdes - patch to unbound-host from Jan-Piet Mens. 8380238106Sdes - unbound host prints errors if fails to configure context. 8381238106Sdes - fixup perf to resend faster, so that long waiting requests do 8382238106Sdes not hold up the queue, they become lost packets or SERVFAILs, 8383238106Sdes or can be sent a little while later (i.e. processing time may 8384238106Sdes take long, but throughput has to be high). 8385238106Sdes - fixup iterator operating in no cache conditions (RD flag unset 8386238106Sdes after a CNAME). 8387238106Sdes - streamlined code for RD flag setting. 8388238106Sdes - profiled code and changed dname compares to be faster. 8389238106Sdes The speedup is about +3% to +8% (depending on the test). 8390238106Sdes - minievent tests for eintr and eagain. 8391238106Sdes 8392238106Sdes15 February 2008: Wouter 8393238106Sdes - added FreeBSD rc.d script to contrib. 8394238106Sdes - --prefix option for configure also changes directory: pidfile: 8395238106Sdes and chroot: defaults in config file. 8396238106Sdes - added cache speed test, for cache size OK and cache too small. 8397238106Sdes 8398238106Sdes14 February 2008: Wouter 8399238106Sdes - start without a config file (will complain, but start with 8400238106Sdes defaults). 8401238106Sdes - perf test program works. 8402238106Sdes 8403238106Sdes13 February 2008: Wouter 8404238106Sdes - 0.9 released. 8405238106Sdes - 1.0 development. Printout ldns version on unbound -h. 8406238106Sdes - start of perf tool. 8407238106Sdes - bugfix to read empty lines from /etc/hosts. 8408238106Sdes 8409238106Sdes12 February 2008: Wouter 8410238106Sdes - fixup problem with configure calling itself if ldns-src tarball 8411238106Sdes is not present. 8412238106Sdes 8413238106Sdes11 February 2008: Wouter 8414238106Sdes - changed library to use ub_ instead of ub_val_ as prefix. 8415238106Sdes - statistics output text nice. 8416238106Sdes - etc/hosts handling. 8417238106Sdes - library function to put logging to a stream. 8418238106Sdes - set any option interface. 8419238106Sdes 8420238106Sdes8 February 2008: Wouter 8421238106Sdes - test program for multiple queries over a TCP channel. 8422238106Sdes - tpkg test for stream tcp queries. 8423238106Sdes - unbound replies to multiple TCP queries on a TCP channel. 8424238106Sdes - fixup misclassification of root referral with NS in answer 8425238106Sdes when validating a nonrec query. 8426238106Sdes - tag 0.9 8427238106Sdes - layout of manpages, spelling fix in header, manpages process by 8428238106Sdes makedist, list asynclook and tcpstream tests as ldns-testns 8429238106Sdes required. 8430238106Sdes 8431238106Sdes7 February 2008: Wouter 8432238106Sdes - moved up all current level 2 to be level 3. And 3 to 4. 8433238106Sdes to make room for new debug level 2 for detailed information 8434238106Sdes for operators. 8435238106Sdes - verbosity level 2. Describes recursion and validation. 8436238106Sdes - cleaner configure script and fixes for libevent solaris. 8437238106Sdes - signedness for log output memory sizes in high verbosity. 8438238106Sdes 8439238106Sdes6 February 2008: Wouter 8440238106Sdes - clearer explanation of threading configure options. 8441238106Sdes - fixup asynclook test for nothreading (it creates only one process 8442238106Sdes to do the extended test). 8443238106Sdes - changed name of ub_val_result_free to ub_val_resolve_free. 8444238106Sdes - removes warning message during library linking, renamed 8445238106Sdes libunbound/unbound.c -> libunbound.c and worker to libworker. 8446238106Sdes - fallback without EDNS if result is NOTIMPL as well as on FORMERR. 8447238106Sdes 8448238106Sdes5 February 2008: Wouter 8449238106Sdes - statistics-interval: seconds option added. 8450238106Sdes - test for statistics option 8451238106Sdes - ignore errors making directories, these can occur in parallel builds 8452238106Sdes - fixup Makefile strip command and libunbound docs typo. 8453238106Sdes 8454238106Sdes31 January 2008: Wouter 8455238106Sdes - bg thread/process reads and writes the pipe nonblocking all the time 8456238106Sdes so that even if the pipe is buffered or so, the bg thread does not 8457238106Sdes block, and services both pipes and queries. 8458238106Sdes 8459238106Sdes30 January 2008: Wouter 8460238106Sdes - check trailing / on chrootdir in checkconf. 8461238106Sdes - check if root hints and anchor files are in chrootdir. 8462238106Sdes - no route to host tcp error is verbosity level 2. 8463238106Sdes - removed unused send_reply_iov. and its configure check. 8464238106Sdes - added prints of 'remote address is 1.2.3.4 port 53' to errors 8465238106Sdes from netevent; the basic socket errors. 8466238106Sdes 8467238106Sdes28 January 2008: Wouter 8468238106Sdes - fixup uninit use of buffer by libunbound (query id, flags) for 8469238106Sdes local_zone answers. 8470238106Sdes - fixup uninit warning from random.c; also seems to fix sporadic 8471238106Sdes sigFPE coming out of openssl. 8472238106Sdes - made openssl entropy warning more silent for library use. Needs 8473238106Sdes verbosity 1 now. 8474238106Sdes - fixup forgotten locks for rbtree_searches on ctx->query tree. 8475238106Sdes - random generator cleanup - RND_STATE_SIZE removed, and instead 8476238106Sdes a super-rnd can be passed at init to chain init random states. 8477238106Sdes - test also does lock checks if available. 8478238106Sdes - protect config access in libworker_setup(). 8479238106Sdes - libevent doesn't like comm_base_exit outside of runloop. 8480238106Sdes - close fds after removing commpoints only (for epoll, kqueue). 8481238106Sdes 8482238106Sdes25 January 2008: Wouter 8483238106Sdes - added tpkg for asynclook and library use. 8484238106Sdes - allows localhost to be queried when as a library. 8485238106Sdes - fixup race condition between cancel and answer (in case of 8486238106Sdes really fast answers that beat the cancel). 8487238106Sdes - please doxygen, put doxygen comment in one place. 8488238106Sdes - asynclook -b blocking mode and test. 8489238106Sdes - refactor asynclook, nicer code. 8490238106Sdes - fixup race problems from opensll in rand init from library, with 8491238106Sdes a mutex around the rand init. 8492238106Sdes - fix pass async_id=NULL to _async resolve(). 8493238106Sdes - rewrote _wait() routine, so that it is threadsafe. 8494238106Sdes - cancelation is threadsafe. 8495238106Sdes - asynclook extended test in tpkg. 8496238106Sdes - fixed two races where forked bg process waits for (somehow shared?) 8497238106Sdes locks, so does not service the query pipe on the bg side. 8498238106Sdes Now those locks are only held for fg_threads and for bg_as_a_thread. 8499238106Sdes 8500238106Sdes24 January 2008: Wouter 8501238106Sdes - tested the cancel() function. 8502238106Sdes - asynclook -c (cancel) feature. 8503238106Sdes - fix fail to allocate context actions. 8504238106Sdes - make pipe nonblocking at start. 8505238106Sdes - update plane for retry mode with caution to limit bandwidth. 8506238106Sdes - fix Makefile for concurrent make of unbound-host. 8507238106Sdes - renamed ub_val_ctx_wait/poll/process/fd to ub_val*. 8508238106Sdes - new calls to set forwarding added to header and docs. 8509238106Sdes 8510238106Sdes23 January 2008: Wouter 8511238106Sdes - removed debug prints from if-auto, verb-algo enables some. 8512238106Sdes - libunbound QUIT setup, remove memory leaks, when using threads 8513238106Sdes will share memory for passing results instead of writing it over 8514238106Sdes the pipe, only writes ID number over the pipe (towards the handler 8515238106Sdes thread that does process() ). 8516238106Sdes 8517238106Sdes22 January 2008: Wouter 8518238106Sdes - library code for async in libunbound/unbound.c. 8519238106Sdes - fix link testbound. 8520238106Sdes - fixup exit bug in mini_event. 8521238106Sdes - background worker query enter and result functions. 8522238106Sdes - bg query test application asynclook, it looks up multiple 8523238106Sdes hostaddresses (A records) at the same time. 8524238106Sdes 8525238106Sdes21 January 2008: Wouter 8526238106Sdes - libworker work, netevent raw commpoints, write_msg, serialize. 8527238106Sdes 8528238106Sdes18 January 2008: Wouter 8529238106Sdes - touch up of manpage for libunbound. 8530238106Sdes - support for IP_RECVDSTADDR (for *BSD ip4). 8531238106Sdes - fix for BSD, do not use ip4to6 mapping, make two sockets, once 8532238106Sdes ip6 and once ip4, uses socket options. 8533238106Sdes - goodbye ip4to6 mapping. 8534238106Sdes - update ldns-testpkts with latest version from ldns-trunk. 8535238106Sdes - updated makedist for relative ldns pathnames. 8536238106Sdes - library API with more information inside the result structure. 8537238106Sdes - work on background resolves. 8538238106Sdes 8539238106Sdes17 January 2008: Wouter 8540238106Sdes - fixup configure in case -lldns is installed. 8541238106Sdes - fixup a couple of doxygen warnings, about enum variables. 8542238106Sdes - interface-automatic now copies the interface address from the 8543238106Sdes PKT_INFO structure as well. 8544238106Sdes - manual page with library API, all on one page 'man libunbound'. 8545238106Sdes - rewrite of PKTINFO structure, it also captures IP4 PKTINFO. 8546238106Sdes 8547238106Sdes16 January 2008: Wouter 8548238106Sdes - incoming queries to the server with TC bit on are replied FORMERR. 8549238106Sdes - interface-automatic replied the wrong source address on localhost 8550238106Sdes queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying 8551238106Sdes to use ifnum=-1 to mean 'no interface, use kernel route'. 8552238106Sdes 8553238106Sdes15 January 2008: Wouter 8554238106Sdes - interface-automatic feature. experimental. Nice for anycast. 8555238106Sdes - tpkg test for ip6 ancillary data. 8556238106Sdes - removed debug prints. 8557238106Sdes - porting experience, define for Solaris, test refined for BSD 8558238106Sdes compatibility. The feature probably will not work on OpenBSD. 8559238106Sdes - makedist fixup for ldns-src in build-dir. 8560238106Sdes 8561238106Sdes14 January 2008: Wouter 8562238106Sdes - in no debug sets NDEBUG to remove asserts. 8563238106Sdes - configure --enable-debug is needed for dependency generation 8564238106Sdes for assertions and for compiler warnings. 8565238106Sdes - ldns.tgz updated with ldns-trunk (where buffer.h is updated). 8566238106Sdes - fix lint, unit test in optimize mode. 8567238106Sdes - default access control allows ::ffff:127.0.0.1 v6mapped localhost. 8568238106Sdes 8569238106Sdes11 January 2008: Wouter 8570238106Sdes - man page, warning removed. 8571238106Sdes - added text describing the use of stub zones for private zones. 8572238106Sdes - checkconf tests for bad hostnames (IP address), and for doubled 8573238106Sdes interface lines. 8574238106Sdes - memory sizes can be given with 'k', 'Kb', or M or G appended. 8575238106Sdes 8576238106Sdes10 January 2008: Wouter 8577238106Sdes - typo in example.conf. 8578238106Sdes - made using ldns-src that is included the package more portable 8579238106Sdes by linking with .lo instead of .o files in the ldns package. 8580238106Sdes - nicer do-ip6: yes/no documentation. 8581238106Sdes - nicer linking of libevent .o files. 8582238106Sdes - man pages render correctly on solaris. 8583238106Sdes 8584238106Sdes9 January 2008: Wouter 8585238106Sdes - fixup openssl RAND problem, when the system is not configured to 8586238106Sdes give entropy, and the rng needs to be seeded. 8587238106Sdes 8588238106Sdes8 January 2008: Wouter 8589238106Sdes - print median and quartiles with extensive logging. 8590238106Sdes 8591238106Sdes4 January 2008: Wouter 8592238106Sdes - document misconfiguration in private network. 8593238106Sdes 8594238106Sdes2 January 2008: Wouter 8595238106Sdes - fixup typo in requirements. 8596238106Sdes - document that 'refused' is a better choice than 'drop' for 8597238106Sdes the access control list, as refused will stop retries. 8598238106Sdes 8599238106Sdes7 December 2007: Wouter 8600238106Sdes - unbound-host has a -d option to show what happens. This can help 8601238106Sdes with debugging (why do I get this answer). 8602238106Sdes - fixup CNAME handling, on nodata, sets and display canonname. 8603238106Sdes - dot removed from CNAME display. 8604238106Sdes - respect -v for NXDOMAINs. 8605238106Sdes - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes). 8606238106Sdes - size_t to int for portability of the header file. 8607238106Sdes - fixup bogus handling. 8608238106Sdes - dependencies and lint for unbound-host. 8609238106Sdes 8610238106Sdes6 December 2007: Wouter 8611238106Sdes - library resolution works in foreground mode, unbound-host app 8612238106Sdes receives data. 8613238106Sdes - unbound-host prints rdata using ldns. 8614238106Sdes - unbound-host accepts trust anchors, and prints validation 8615238106Sdes information when you give -v. 8616238106Sdes 8617238106Sdes5 December 2007: Wouter 8618238106Sdes - locking in context_new() inside the function. 8619238106Sdes - setup of libworker. 8620238106Sdes 8621238106Sdes4 December 2007: Wouter 8622238106Sdes - minor Makefile fixup. 8623238106Sdes - moved module-stack code out of daemon/daemon into services/modstack, 8624238106Sdes preparing for code-reuse. 8625238106Sdes - move context into own header file. 8626238106Sdes - context query structure. 8627238106Sdes - removed unused variable pwd from checkconf. 8628238106Sdes - removed unused assignment from outside netw. 8629238106Sdes - check timeval length of string. 8630238106Sdes - fixup error in val_utils getsigner. 8631238106Sdes - fixup same (*var) error in netblocktostr. 8632238106Sdes - fixup memleak on parse error in localzone. 8633238106Sdes - fixup memleak on packet parse error. 8634238106Sdes - put ; after union in parser.y. 8635238106Sdes - small hardening in iter_operate against iq==NULL. 8636238106Sdes - hardening, if error reply with rcode=0 (noerror) send servfail. 8637238106Sdes - fixup same (*var) error in find_rrset in msgparse, was harmless. 8638238106Sdes - check return value of evtimer_add(). 8639238106Sdes - fixup lockorder in lruhash_reclaim(), building up a list of locked 8640238106Sdes entries one at a time. Instead they are removed and unlocked. 8641238106Sdes - fptr_wlist for markdelfunc. 8642238106Sdes - removed is_locked param from lruhash delkeyfunc. 8643238106Sdes - moved bin_unlock during bin_split purely to please. 8644238106Sdes 8645238106Sdes3 December 2007: Wouter 8646238106Sdes - changed checkconf/ to smallapp/ to make room for more support tools. 8647238106Sdes (such as unbound-host). 8648238106Sdes - install dirs created with -m 755 because they need to be accessible. 8649238106Sdes - library extensive featurelist added to TODO. 8650238106Sdes - please doxygen, lint. 8651238106Sdes - library test application, with basic functionality. 8652238106Sdes - fix for building in a subdirectory. 8653238106Sdes - link lib fix for Leopard. 8654238106Sdes 8655238106Sdes30 November 2007: Wouter 8656238106Sdes - makefile that creates libunbound.la, basic file or libunbound.a 8657238106Sdes when creating static executables (no libtool). 8658238106Sdes - more API setup. 8659238106Sdes 8660238106Sdes29 November 2007: Wouter 8661238106Sdes - 0.9 public API start. 8662238106Sdes 8663238106Sdes28 November 2007: Wouter 8664238106Sdes - Changeup plan for 0.8 - no complication needed, a simple solution 8665238106Sdes has been chosen for authoritative features. 8666238106Sdes - you can use single quotes in the config file, so it is possible 8667238106Sdes to specify TXT records in local data. 8668238106Sdes - fixup small memory problem in implicit transparent zone creation. 8669238106Sdes - test for implicit zone creation and multiple RR RRsets local data. 8670238106Sdes - local-zone nodefault test. 8671238106Sdes - show testbound testlist on commit. 8672238106Sdes - iterator normalizer changes CNAME chains ending in NXDOMAIN where 8673238106Sdes the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial 8674238106Sdes domain exists). 8675238106Sdes - nicer verbosity: 0 and 1 levels. 8676238106Sdes - lower nonRDquery chance of eliciting wrongly typed validation 8677238106Sdes requiring message from the cache. 8678238106Sdes - fix for nonRDquery validation typing; nodata is detected when 8679238106Sdes SOA record in auth section (all validation-requiring nodata messages 8680238106Sdes have a SOA record in authority, so this is OK for the validator), 8681238106Sdes and NS record is needed to be a referral. 8682238106Sdes - duplicate checking when adding NSECs for a CNAME, and test. 8683238106Sdes - created svn tag 0.8, after completing testbed tests. 8684238106Sdes 8685238106Sdes27 November 2007: Wouter 8686238106Sdes - per suggestion in rfc2308, replaced default max-ttl value with 1 day. 8687238106Sdes - set size of msgparse lookup table to 32, from 1024, so that its size 8688238106Sdes is below the 2048 regional large size threshold, and does not cause 8689238106Sdes a call to malloc when a message is parsed. 8690238106Sdes - update of memstats tool to print number of allocation calls. 8691238106Sdes This is what is taking time (not space) and indicates the avg size 8692238106Sdes of the allocations as well. region_alloc stat is removed. 8693238106Sdes 8694238106Sdes22 November 2007: Wouter 8695238106Sdes - noted EDNS in-the-middle dropping trouble as a TODO. 8696238106Sdes At this point theoretical, no user trouble has been reported. 8697238106Sdes - added all default AS112 zones. 8698238106Sdes - answers from local zone content. 8699238106Sdes * positive answer, the rrset in question 8700238106Sdes * nodata answer (exist, but not that type). 8701238106Sdes * nxdomain answer (domain does not exist). 8702238106Sdes * empty-nonterminal answer. 8703238106Sdes * But not: wildcard, nsec, referral, rrsig, cname/dname, 8704238106Sdes or additional section processing, NS put in auth. 8705238106Sdes - test for correct working of static and transparent and couple 8706238106Sdes of important defaults (localhost, as112, reverses). 8707238106Sdes Also checks deny and refuse settings. 8708238106Sdes - fixup implicit zone generation and AA bit for NXDOMAIN on localdata. 8709238106Sdes 8710238106Sdes21 November 2007: Wouter 8711238106Sdes - local zone internal data setup. 8712238106Sdes 8713238106Sdes20 November 2007: Wouter 8714238106Sdes - 0.8 - str2list config support for double string config options. 8715238106Sdes - local-zone and local-data options, config storage and documentation. 8716238106Sdes 8717238106Sdes19 November 2007: Wouter 8718238106Sdes - do not downcase NSEC and RRSIG for verification. Follows 8719238106Sdes draft-ietf-dnsext-dnssec-bis-updates-06.txt. 8720238106Sdes - fixup leaking unbound daemons at end of tests. 8721238106Sdes - README file updated. 8722238106Sdes - nice libevent not found error. 8723238106Sdes - README talks about gnu make. 8724238106Sdes - 0.8: unit test for addr_mask and fixups for it. 8725238106Sdes and unit test for addr_in_common(). 8726238106Sdes - 0.8: access-control config file element. 8727238106Sdes and unit test rpl replay file. 8728238106Sdes - 0.8: fixup address reporting from netevent. 8729238106Sdes 8730238106Sdes16 November 2007: Wouter 8731238106Sdes - privilege separation is not needed in unbound at this time. 8732238106Sdes TODO item marked as such. 8733238106Sdes - created beta-0.7 branch for support. 8734238106Sdes - tagged 0.7 for beta release. 8735238106Sdes - moved trunk to 0.8 for 0.8(auth features) development. 8736238106Sdes - 0.8: access control list setup. 8737238106Sdes 8738238106Sdes15 November 2007: Wouter 8739238106Sdes - review fixups from Jelte. 8740238106Sdes 8741238106Sdes14 November 2007: Wouter 8742238106Sdes - testbed script does not recreate configure, since its in svn now. 8743238106Sdes - fixup checkconf test so that it does not test 8744238106Sdes /etc/unbound/unbound.conf. 8745238106Sdes - tag 0.6. 8746238106Sdes 8747238106Sdes13 November 2007: Wouter 8748238106Sdes - remove debug print. 8749238106Sdes - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists. 8750238106Sdes 8751238106Sdes12 November 2007: Wouter 8752238106Sdes - fixup signal handling where SIGTERM could be ignored if a SIGHUP 8753238106Sdes arrives later on. 8754238106Sdes - bugreports to unbound-bugs@nlnetlabs.nl 8755238106Sdes - fixup testbound so it exits cleanly. 8756238106Sdes - cleanup the caches on a reload, so that rrsetID numbers won't clash. 8757238106Sdes 8758238106Sdes9 November 2007: Wouter 8759238106Sdes - took ldns snapshot in repo. 8760238106Sdes - default config file is /etc/unbound/unbound.conf. 8761238106Sdes If it doesn't exist, it is installed with the doc/example.conf file. 8762238106Sdes The file is not deleted on uninstall. 8763238106Sdes - default listening is not all, but localhost interfaces. 8764238106Sdes 8765238106Sdes8 November 2007: Wouter 8766238106Sdes - Fixup chroot and drop user privileges. 8767238106Sdes - new L root ip address in default hints. 8768238106Sdes 8769238106Sdes1 November 2007: Wouter 8770238106Sdes - Fixup of crash on reload, due to anchors in env not NULLed after 8771238106Sdes dealloc during deinit. 8772238106Sdes - Fixup of chroot call. Happens after privileges are dropped, so 8773238106Sdes that checking the passwd entry still works. 8774238106Sdes - minor touch up of clear() hashtable function. 8775238106Sdes - VERB_DETAIL prints out what chdir, username, chroot is being done. 8776238106Sdes - when id numbers run out, caches are cleared, as in design notes. 8777238106Sdes Tested with a mock setup with very few bits in id, it worked. 8778238106Sdes - harden-dnssec-stripped: yes is now default. It insists on dnssec 8779238106Sdes data for trust anchors. Included tests for the feature. 8780238106Sdes 8781238106Sdes31 October 2007: Wouter 8782238106Sdes - cache-max-ttl config option. 8783238106Sdes - building outside sourcedir works again. 8784238106Sdes - defaults more secure: 8785238106Sdes username: "unbound" 8786238106Sdes chroot: "/etc/unbound" 8787238106Sdes The operator can override them to be less secure ("") if necessary. 8788238106Sdes - fix horrible oversight in sorting rrset references in a message, 8789238106Sdes sort per reference key pointer, not on referencepointer itself. 8790238106Sdes - pidfile: "/etc/unbound/unbound.pid" is now the default. 8791238106Sdes - tests changed to reflect the updated default. 8792238106Sdes - created hashtable clear() function that respects locks. 8793238106Sdes 8794238106Sdes30 October 2007: Wouter 8795238106Sdes - fixup assertion failure that relied on compressed names to be 8796238106Sdes smaller than uncompressed names. A packet from comrite.com was seen 8797238106Sdes to be compressed to a larger size. Added it as unit test. 8798238106Sdes - quieter logging at low verbosity level for common tcp messages. 8799238106Sdes - no greedy TTL update. 8800238106Sdes 8801238106Sdes23 October 2007: Wouter 8802238106Sdes - fixup (grand-)parent problem for dnssec-lameness detection. 8803238106Sdes - fixup tests to do additional section processing for lame replies, 8804238106Sdes since the detection needs that. 8805238106Sdes - no longer trust in query section in reply during dnssec lame detect. 8806238106Sdes - dnssec lameness does not make the server never ever queried, but 8807238106Sdes non-preferred. If no other servers exist or answer, the dnssec lame 8808238106Sdes server is used; the fastest dnssec lame server is chosen. 8809238106Sdes - added test then when trust anchor cannot be primed (nodata), the 8810238106Sdes insecure mode from unbound works. 8811238106Sdes - Fixup max queries per thread, any more are dropped. 8812238106Sdes 8813238106Sdes22 October 2007: Wouter 8814238106Sdes - added donotquerylocalhost config option. Can be turned off for 8815238106Sdes out test cases. 8816238106Sdes - ISO C compat changes. 8817238106Sdes - detect RA-no-AA lameness, as LAME. 8818238106Sdes - DNSSEC-lameness detection, as LAME. 8819238106Sdes See notes in requirements.txt for choices made. 8820238106Sdes - tests for lameness detection. 8821238106Sdes - added all to make test target; need unbound for fwd tests. 8822238106Sdes - testbound does not pollute /etc/unbound. 8823238106Sdes 8824238106Sdes19 October 2007: Wouter 8825238106Sdes - added configure (and its files) to svn, so that the trunk is easier 8826238106Sdes to use. ./configure, config.guess, config.sub, ltmain.sh, 8827238106Sdes and config.h.in. 8828238106Sdes - added yacc/lex generated files, util/configlexer.c, 8829238106Sdes util/configparser.c util/configparser.h, to svn. 8830238106Sdes - without lex no attempt to use it. 8831238106Sdes - unsecure response validation collated into one block. 8832238106Sdes - remove warning about const cast of cfgfile name. 8833238106Sdes - outgoing-interfaces can be different from service interfaces. 8834238106Sdes - ldns-src configure is done during unbound configure and 8835238106Sdes ldns-src make is done during unbound make, and so inherits the 8836238106Sdes make arguments from the unbound make invocation. 8837238106Sdes - nicer error when libevent problem causes instant exit on signal. 8838238106Sdes - read root hints from a root hint file (like BIND does). 8839238106Sdes 8840238106Sdes18 October 2007: Wouter 8841238106Sdes - addresses are logged with errors. 8842238106Sdes - fixup testcode fake event to remove pending before callback 8843238106Sdes since the callback may create new pending items. 8844238106Sdes - tests updated because retries are now in iterator module. 8845238106Sdes - ldns-testpkts code is checked for differences between unbound 8846238106Sdes and ldns by makedist.sh. 8847238106Sdes - ldns trunk from today added in svn repo for fallback in case 8848238106Sdes no ldns is installed on the system. 8849238106Sdes make download_ldns refreshes the tarball with ldns svn trunk. 8850238106Sdes - ldns-src.tar.gz is used if no ldns is found on the system, and 8851238106Sdes statically linked into unbound. 8852238106Sdes - start of regional allocator code. 8853238106Sdes - regional uses less memory and variables, simplified code. 8854238106Sdes - remove of region-allocator. 8855238106Sdes - alloc cache keeps a cache of recently released regional blocks, 8856238106Sdes up to a maximum. 8857238106Sdes - make unit test cleanly free memory. 8858238106Sdes 8859238106Sdes17 October 2007: Wouter 8860238106Sdes - fixup another cycle detect and ns-addr timeout resolution bug. 8861238106Sdes This time by refusing delegations from the cache without addresses 8862238106Sdes when resolving a mandatory-glue nameserver-address for that zone. 8863238106Sdes We're going to have to ask a TLD server anyway; might as well be 8864238106Sdes the TLD server for this name. And this resolves a lot of cases where 8865238106Sdes the other nameserver names lead to cycles or are not available. 8866238106Sdes - changed random generator from random(3) clone to arc4random wrapped 8867238106Sdes for thread safety. The random generator is initialised with 8868238106Sdes entropy from the system. 8869238106Sdes - fix crash where failure to prime DNSKEY tried to print null pointer 8870238106Sdes in the log message. 8871238106Sdes - removed some debug prints, only verb_algo (4) enables them. 8872238106Sdes - fixup test; new random generator took new paths; such as one 8873238106Sdes where no scripted answer was available. 8874238106Sdes - mark insecure RRs as insecure. 8875238106Sdes - fixup removal of nonsecure items from the additional. 8876238106Sdes - reduced timeout values to more realistic, 376 msec (262 msec has 8877238106Sdes 90% of roundtrip times, 512 msec has 99% of roundtrip times.) 8878238106Sdes - server selection failover to next server after timeout (376 msec). 8879238106Sdes 8880238106Sdes16 October 2007: Wouter 8881238106Sdes - no malloc in log_hex. 8882238106Sdes - assertions around system calls. 8883238106Sdes - protect against gethostname without ending zero. 8884238106Sdes - ntop output is null terminated by unbound. 8885238106Sdes - pidfile content null termination 8886238106Sdes - various snprintf use sizeof(stringbuf) instead of fixed constant. 8887238106Sdes - changed loopdetect % 8 with & 0x7 since % can become negative for 8888238106Sdes weird negative input and particular interpretation of integer math. 8889238106Sdes - dname_pkt_copy checks length of result, to protect result buffers. 8890238106Sdes prints an error, this should not happen. Bad strings should have 8891238106Sdes been rejected earlier in the program. 8892238106Sdes - remove a size_t underflow from msgreply size func. 8893238106Sdes 8894238106Sdes15 October 2007: Wouter 8895238106Sdes - nicer warning. 8896238106Sdes - fix IP6 TCP, wrong definition check. With test package. 8897238106Sdes - fixup the fact that the query section was not compressed to, 8898238106Sdes the code was there but was called by value instead of by reference. 8899238106Sdes And test for the case, uses xxd and nc. 8900238106Sdes - more portable ip6 check for sockaddr types. 8901238106Sdes 8902238106Sdes8 October 2007: Wouter 8903238106Sdes - --disable-rpath option in configure for 64bit systems with 8904238106Sdes several dynamic lib dirs. 8905238106Sdes 8906238106Sdes7 October 2007: Wouter 8907238106Sdes - fixup tests for no AD bit in non-DO queries. 8908238106Sdes - test that makes sure AD bit is not set on non-DO query. 8909238106Sdes 8910238106Sdes6 October 2007: Wouter 8911238106Sdes - removed logfile open early. It did not have the proper permissions; 8912238106Sdes it was opened as root instead of the user. And we cannot change user 8913238106Sdes id yet, since chroot and bind ports need to be done. 8914238106Sdes - callback checks for event callbacks done from mini_event. Because 8915238106Sdes of deletions cannot do this from netevent. This means when using 8916238106Sdes libevent the protection does not work on event-callbacks. 8917238106Sdes - fixup too small reply (did not zero counts). 8918238106Sdes - fixup reply no longer AD bit when query without DO bit. 8919238106Sdes 8920238106Sdes5 October 2007: Wouter 8921238106Sdes - function pointer whitelist. 8922238106Sdes 8923238106Sdes4 October 2007: Wouter 8924238106Sdes - overwrite sensitive random seed value after use. 8925238106Sdes - switch to logfile very soon if not -d (console attached). 8926238106Sdes - error messages do not reveal the trustanchor contents. 8927238106Sdes - start work on function pointer whitelists. 8928238106Sdes 8929238106Sdes3 October 2007: Wouter 8930238106Sdes - fix for multiple empty nonterminals, after multiple DSes in the 8931238106Sdes chain of trust. 8932238106Sdes - mesh checks if modules are looping, and stops them. 8933238106Sdes - refetch with CNAMEd nameserver address regression test added. 8934238106Sdes - fixup line count bug in testcode, so testbound prints correct line 8935238106Sdes number with parse errors. 8936238106Sdes - unit test for multiple ENT case. 8937238106Sdes - fix for cname out of validated unsec zone. 8938238106Sdes - fixup nasty id=0 reuse. Also added assertions to detect its 8939238106Sdes return (the assertion catches in the existing test cases). 8940238106Sdes 8941238106Sdes1 October 2007: Wouter 8942238106Sdes - skip F77, CXX, objC tests in configure step. 8943238106Sdes - fixup crash in refetch glue after a CNAME. 8944238106Sdes and protection against similar failures (with error print). 8945238106Sdes 8946238106Sdes28 September 2007: Wouter 8947238106Sdes - test case for unbound-checkconf, fixed so it also checks the 8948238106Sdes interface: statements. 8949238106Sdes 8950238106Sdes26 September 2007: Wouter 8951238106Sdes - SIGHUP will reopen the log file. 8952238106Sdes - Option to log to syslog. 8953238106Sdes - please lint, fixup tests (that went to syslog on open, oops). 8954238106Sdes - config check program. 8955238106Sdes 8956238106Sdes25 September 2007: Wouter 8957238106Sdes - tests for NSEC3. Fixup bitmap checks for NSEC3. 8958238106Sdes - positive ANY response needs to check if wildcard expansion, and 8959238106Sdes check that original data did not exist. 8960238106Sdes - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure 8961238106Sdes delegation, for abuse of child zone apex nsec3. 8962238106Sdes - create 0.5 release tag. 8963238106Sdes 8964238106Sdes24 September 2007: Wouter 8965238106Sdes - do not make test programs by default. 8966238106Sdes - But 'make test' will perform all of the tests. 8967238106Sdes - Advertise builtin select libevent alternative when no libevent 8968238106Sdes is found. 8969238106Sdes - signit can generate NSEC3 hashes, for generating tests. 8970292206Sdes - multiple nsec3 parameters in message test. 8971238106Sdes - too high nsec3 iterations becomes insecure test. 8972238106Sdes 8973238106Sdes21 September 2007: Wouter 8974238106Sdes - fixup empty_DS_name allocated in wrong region (port DEC Alpha). 8975238106Sdes - fixup testcode lock safety (port FreeBSD). 8976238106Sdes - removes subscript has type char warnings (port Solaris 9). 8977238106Sdes - fixup of field with format type to int (port MacOS/X intel). 8978238106Sdes - added test for infinite loop case in nonRD answer validation. 8979238106Sdes It was a more general problem, but hard to reproduce. When an 8980238106Sdes unsigned rrset is being validated and the key fetched, the DS 8981238106Sdes sequence is followed, but if the final name has no DS, then no 8982238106Sdes proof is possible - the signature has been stripped off. 8983238106Sdes 8984238106Sdes20 September 2007: Wouter 8985238106Sdes - fixup and test for NSEC wildcard with empty nonterminals. 8986238106Sdes - makedist.sh fixup for svn info. 8987238106Sdes - acl features request in plan. 8988238106Sdes - improved DS empty nonterminal handling. 8989238106Sdes - compat with ANS nxdomain for empty nonterminals. Attempts the nodata 8990238106Sdes proof anyway, which succeeds in ANS failure case. 8991238106Sdes - striplab protection in case it becomes -1. 8992238106Sdes - plans for static and blacklist config. 8993238106Sdes 8994238106Sdes19 September 2007: Wouter 8995238106Sdes - comments about non-packed usage. 8996238106Sdes - plan for overload support in 0.6. 8997238106Sdes - added testbound tests for a failed resolution from the logs 8998238106Sdes and for failed prime when missing glue. 8999238106Sdes - fixup so useless delegation points are not returned from the 9000238106Sdes cache. Also the safety belt is used if priming fails to complete. 9001238106Sdes - fixup NSEC rdata not to be lowercased, bind compat. 9002238106Sdes 9003238106Sdes18 September 2007: Wouter 9004238106Sdes - wildcard nsec3 testcases, and fixup to get correct wildcard name. 9005238106Sdes - validator prints subtype classification for debug. 9006238106Sdes 9007238106Sdes17 September 2007: Wouter 9008238106Sdes - NSEC3 hash cache unit test. 9009238106Sdes - validator nsec3 nameerror test. 9010238106Sdes 9011238106Sdes14 September 2007: Wouter 9012238106Sdes - nsec3 nodata proof, nods proof, wildcard proof. 9013238106Sdes - nsec3 support for cname chain ending in noerror or nodata. 9014238106Sdes - validator calls nsec3 proof routines if no NSECs prove anything. 9015238106Sdes - fixup iterator bug where it stored the answer to a cname under 9016238106Sdes the wrong qname into the cache. When prepending the cnames, the 9017238106Sdes qname has to be reset to the original qname. 9018238106Sdes 9019238106Sdes13 September 2007: Wouter 9020238106Sdes - nsec3 find matching and covering, ce proof, prove namerror msg. 9021238106Sdes 9022238106Sdes12 September 2007: Wouter 9023238106Sdes - fixup of manual page warnings, like for NSD bugreport. 9024238106Sdes - nsec3 work, config, max iterations, filter, and hash cache. 9025238106Sdes 9026238106Sdes6 September 2007: Wouter 9027238106Sdes - fixup to find libevent on mac port install. 9028238106Sdes - fixup size_t vs unsigned portability in validator/sigcrypt. 9029238106Sdes - please compiler on different platforms, for unreachable code. 9030238106Sdes - val_nsec3 file. 9031238106Sdes - pthread_rwlock type is optional, in case of old pthread libs. 9032238106Sdes 9033238106Sdes5 September 2007: Wouter 9034238106Sdes - cname, name error validator tests. 9035238106Sdes - logging of qtype ANY works. 9036238106Sdes - ANY type answers get RRSIG in answer section of replies (but not 9037238106Sdes in other sections, unless DO bit is on). 9038238106Sdes - testbound can replay a TCP query (set MATCH TCP in the QUERY). 9039238106Sdes - DS and noDS referral validation test. 9040238106Sdes - if you configure many trust anchors, parent trust anchors can 9041292206Sdes securely deny existence of child trust anchors, if validated. 9042238106Sdes - not all *.name NSECs are present because a wildcard was matched, 9043238106Sdes and *.name NSECs can prove nodata for empty nonterminals. 9044238106Sdes Also, for wildcard name NSECs, check they are not from the parent 9045238106Sdes zone (for wildcarded zone cuts), and check absence of CNAME bit, 9046238106Sdes for a nodata proof. 9047238106Sdes - configure option for memory allocation debugging. 9048238106Sdes - port configure option for memory allocation to solaris10. 9049238106Sdes 9050238106Sdes4 September 2007: Wouter 9051238106Sdes - fixup of Leakage warning when serviced queries processed multiple 9052238106Sdes callbacks for the same query from the same server. 9053238106Sdes - testbound removes config file from /tmp on failed exit. 9054238106Sdes - fixup for referral cleanup of the additional section. 9055238106Sdes - tests for cname, referral validation. 9056238106Sdes - neater testbound tpkg output. 9057238106Sdes - DNAMEs no longer match their apex when synthesized from the cache. 9058238106Sdes - find correct signer name for DNAME responses. 9059238106Sdes - wildcarded DNAME test and fixup code to detect. 9060238106Sdes - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs. 9061238106Sdes So that wildcarded CNAMEs get their NSEC with them to the answer. 9062238106Sdes - test for a CNAME to a DNAME to a CNAME to an answer, all from 9063238106Sdes different domains, for key fetching and signature checking of 9064238106Sdes CNAME'd messages. 9065238106Sdes 9066238106Sdes3 September 2007: Wouter 9067238106Sdes - Fixed error in iterator that would cause assertion failure in 9068238106Sdes validator. CNAME to a NXDOMAIN response was collated into a response 9069238106Sdes with both a CNAME and the NXDOMAIN rcode. Added a test that the 9070238106Sdes rcode is changed to NOERROR (because of the CNAME). 9071238106Sdes - timeout on tcp does not lead to spurious leakage detect. 9072238106Sdes - account memory for name of lame zones, so that memory leakages does 9073238106Sdes not show lame cache growth as a leakage growth. 9074238106Sdes - config setting for lameness cache expressed in bytes, instead of 9075238106Sdes number of entries. 9076238106Sdes - tool too summarize allocations per code line. 9077238106Sdes 9078238106Sdes31 August 2007: Wouter 9079238106Sdes - can read bind trusted-keys { ... }; files, in a compatibility mode. 9080238106Sdes - iterator should not detach target queries that it still could need. 9081238106Sdes the protection against multiple outstanding queries is moved to a 9082238106Sdes current_query num check. 9083238106Sdes - validator nodata, positive, referral tests. 9084238106Sdes - dname print can print '*' wildcard. 9085238106Sdes 9086238106Sdes30 August 2007: Wouter 9087238106Sdes - fixup override date config option. 9088238106Sdes - config options to control memory usage. 9089238106Sdes - caught bad free of un-alloced data in worker_send error case. 9090238106Sdes - memory accounting for key cache (trust anchors and temporary cache). 9091238106Sdes - memory accounting fixup for outside network tcp pending waits. 9092238106Sdes - memory accounting fixup for outside network tcp callbacks. 9093238106Sdes - memory accounting for iterator fixed storage. 9094238106Sdes - key cache size and slabs config options. 9095238106Sdes - lib crypto cleanups at exit. 9096238106Sdes 9097238106Sdes29 August 2007: Wouter 9098238106Sdes - test tool to sign rrsets for testing validator with. 9099238106Sdes - added RSA and DSA test keys, public and private pairs, 512 bits. 9100238106Sdes - default configuration is with validation enabled. 9101238106Sdes Only a trust-anchor needs to be configured for DNSSEC to work. 9102238106Sdes - do not convert to DER for DSA signature verification. 9103238106Sdes - validator replay test file, for a DS to DNSKEY DSA key prime and 9104238106Sdes positive response. 9105238106Sdes 9106238106Sdes28 August 2007: Wouter 9107238106Sdes - removed double use for udp buffers, that could fail, 9108238106Sdes instead performs a malloc to do the backup. 9109238106Sdes - validator validates referral messages, by validating all the rrsets 9110238106Sdes and stores the rrsets in the cache. Further referral (nonRD queries) 9111238106Sdes replies are made from the rrset cache directly. Unless unchecked 9112238106Sdes rrsets are encountered, there are then validated. 9113238106Sdes - enforce that signing is done by a parent domain (or same domain). 9114238106Sdes - adjust TTL downwards if rrset TTL bigger than signature allows. 9115238106Sdes - permissive mode feature, sets AD bit for secure, but bogus does 9116238106Sdes not give servfail (bogus is changed into indeterminate). 9117238106Sdes - optimization of rrset verification. rr canonical sorting is reused, 9118238106Sdes for the same rrset. canonical rrset image in buffer is reused for 9119238106Sdes the same signature. 9120238106Sdes - if the rrset is too big (64k exactly + large owner name) the 9121238106Sdes canonicalization routine will fail if it does not fit in buffer. 9122238106Sdes - faster verification for large sigsets. 9123238106Sdes - verb_detail mode reports validation failures, but not the entire 9124238106Sdes algorithm for validation. Key prime failures are reported as 9125238106Sdes verb_ops level. 9126238106Sdes 9127238106Sdes27 August 2007: Wouter 9128238106Sdes - do not garble the edns if a cache answer fails. 9129238106Sdes - answer norecursive from cache if possible. 9130238106Sdes - honor clean_additional setting when returning secure non-recursive 9131238106Sdes referrals. 9132238106Sdes - do not store referral in msg cache for nonRD queries. 9133238106Sdes - store verification status in the rrset cache to speed up future 9134238106Sdes verification. 9135238106Sdes - mark rrsets indeterminate and insecure if they are found to be so. 9136238106Sdes and store this in the cache. 9137238106Sdes 9138238106Sdes24 August 2007: Wouter 9139238106Sdes - message is bogus if unsecure authority rrsets are present. 9140238106Sdes - val-clean-additional option, so you can turn it off. 9141238106Sdes - move rrset verification out of the specific proof types into one 9142238106Sdes routine. This makes the proof routines prettier. 9143238106Sdes - fixup cname handling in validator, cname-to-positive and cname-to- 9144238106Sdes nodata work. 9145238106Sdes - Do not synthesize DNSKEY and DS responses from the rrset cache if 9146238106Sdes the rrset is from the additional section. Signatures may have 9147238106Sdes fallen off the packet, and cause validation failure. 9148238106Sdes - more verbose signature date errors (with the date attached). 9149238106Sdes - increased default infrastructure cache size. It is important for 9150238106Sdes performance, and 1000 entries are only 212k (or a 400 k total cache 9151238106Sdes size). To 10000 entries (for 2M entries, 4M cache size). 9152238106Sdes 9153238106Sdes23 August 2007: Wouter 9154238106Sdes - CNAME handling - move needs_validation to before val_new(). 9155238106Sdes val_new() setups the chase-reply to be an edited copy of the msg. 9156238106Sdes new classification, and find signer can find for it. 9157238106Sdes removal of unsigned crap from additional, and query restart for 9158238106Sdes cname. 9159238106Sdes - refuse to follow wildcarded DNAMEs when validating. 9160238106Sdes But you can query for qtype ANY, or qtype DNAME and validate that. 9161238106Sdes 9162238106Sdes22 August 2007: Wouter 9163238106Sdes - bogus TTL. 9164238106Sdes - review - use val_error(). 9165238106Sdes 9166238106Sdes21 August 2007: Wouter 9167238106Sdes - ANY response validation. 9168238106Sdes - store security status in cache. 9169238106Sdes - check cache security status and either send the query to be 9170238106Sdes validated, return the query to client, or send servfail to client. 9171238106Sdes Sets AD bit on validated replies. 9172238106Sdes - do not examine security status on an error reply in mesh_done. 9173238106Sdes - construct DS, DNSKEY messages from rrset cache. 9174238106Sdes - manual page entry for override-date. 9175238106Sdes 9176238106Sdes20 August 2007: Wouter 9177238106Sdes - validate and positive validation, positive wildcard NSEC validation. 9178238106Sdes - nodata validation, nxdomain validation. 9179238106Sdes 9180238106Sdes18 August 2007: Wouter 9181238106Sdes - process DNSKEY response in FINDKEY state. 9182238106Sdes 9183238106Sdes17 August 2007: Wouter 9184238106Sdes - work on DS2KE routine. 9185238106Sdes - val_nsec.c for validator NSEC proofs. 9186238106Sdes - unit test for NSEC bitmap reading. 9187238106Sdes - dname iswild and canonical_compare with unit tests. 9188238106Sdes 9189238106Sdes16 August 2007: Wouter 9190238106Sdes - DS sig unit test. 9191238106Sdes - latest release libevent 1.3c and 1.3d have threading fixed. 9192238106Sdes - key entry fixup data pointer and ttl absolute. 9193238106Sdes - This makes a key-prime succeed in validator, with DS or DNSKEY as 9194238106Sdes trust-anchor. 9195238106Sdes - fixup canonical compare byfield routine, fix bug and also neater. 9196238106Sdes - fixed iterator response type classification for queries of type 9197238106Sdes ANY and NS. 9198238106Sdes dig ANY gives sometimes NS rrset in AN and NS section, and parser 9199238106Sdes removes the NS section duplicate. dig NS gives sometimes the NS 9200238106Sdes in the answer section, as referral. 9201238106Sdes - validator FINDKEY state. 9202238106Sdes 9203238106Sdes15 August 2007: Wouter 9204238106Sdes - crypto calls to verify signatures. 9205238106Sdes - unit test for rrsig verification. 9206238106Sdes 9207238106Sdes14 August 2007: Wouter 9208238106Sdes - default outgoing ports changed to avoid port 2049 by default. 9209238106Sdes This port is widely blocked by firewalls. 9210238106Sdes - count infra lameness cache in memory size. 9211238106Sdes - accounting of memory improved 9212238106Sdes - outbound entries are allocated in the query region they are for. 9213238106Sdes - extensive debugging for memory allocations. 9214238106Sdes - --enable-lock-checks can be used to enable lock checking. 9215238106Sdes - protect undefs in config.h from autoheaders ministrations. 9216238106Sdes - print all received udp packets. log hex will print on multiple 9217238106Sdes lines if needed. 9218238106Sdes - fixed error in parser with backwards rrsig references. 9219238106Sdes - mark cycle targets for iterator did not have CD flag so failed 9220238106Sdes its task. 9221238106Sdes 9222238106Sdes13 August 2007: Wouter 9223238106Sdes - fixup makefile, if lexer is missing give nice error and do not 9224238106Sdes mess up the dependencies. 9225238106Sdes - canonical compare routine updated. 9226238106Sdes - canonical hinfo compare. 9227238106Sdes - printout list of the queries that the mesh is working on. 9228238106Sdes 9229238106Sdes10 August 2007: Wouter 9230238106Sdes - malloc and free overrides that track total allocation and frees. 9231238106Sdes for memory debugging. 9232238106Sdes - work on canonical sort. 9233238106Sdes 9234238106Sdes9 August 2007: Wouter 9235238106Sdes - canonicalization, signature checks 9236238106Sdes - dname signature label count and unit test. 9237238106Sdes - added debug heap size print to memory printout. 9238238106Sdes - typo fixup in worker.c 9239238106Sdes - -R needed on solaris. 9240238106Sdes - validator override option for date check testing. 9241238106Sdes 9242238106Sdes8 August 2007: Wouter 9243238106Sdes - ldns _raw routines created (in ldns trunk). 9244238106Sdes - sigcrypt DS digest routines 9245238106Sdes - val_utils uses sigcrypt to perform signature cryptography. 9246238106Sdes - sigcrypt keyset processing 9247238106Sdes 9248238106Sdes7 August 2007: Wouter 9249238106Sdes - security status type. 9250238106Sdes - security status is copied when rdata is equal for rrsets. 9251238106Sdes - rrset id is updated to invalidate all the message cache entries 9252238106Sdes that refer to NSEC, NSEC3, DNAME rrsets that have changed. 9253238106Sdes - val_util work 9254238106Sdes - val_sigcrypt file for validator signature checks. 9255238106Sdes 9256238106Sdes6 August 2007: Wouter 9257238106Sdes - key cache for validator. 9258238106Sdes - moved isroot and dellabel to own dname routines, with unit test. 9259238106Sdes 9260238106Sdes3 August 2007: Wouter 9261238106Sdes - replanning. 9262238106Sdes - scrubber check section of lame NS set. 9263238106Sdes - trust anchors can be in config file or read from zone file, 9264238106Sdes DS and DNSKEY entries. 9265238106Sdes - unit test trust anchor storage. 9266238106Sdes - trust anchors converted to packed rrsets. 9267238106Sdes - key entry definition. 9268238106Sdes 9269238106Sdes2 August 2007: Wouter 9270238106Sdes - configure change for latest libevent trunk version (needs -lrt). 9271238106Sdes - query_done and walk_supers are moved out of module interface. 9272238106Sdes - fixup delegation point duplicates. 9273238106Sdes - fixup iterator scrubber; lame NS set is let through the scrubber 9274238106Sdes so that the classification is lame. 9275238106Sdes - validator module exists, and does nothing but pass through, 9276238106Sdes with calling of next module and return. 9277238106Sdes - validator work. 9278238106Sdes 9279238106Sdes1 August 2007: Wouter 9280238106Sdes - set version to 0.5 9281238106Sdes - module work for module to module interconnections. 9282238106Sdes - config of modules. 9283238106Sdes - detect cycle takes flags. 9284238106Sdes 9285238106Sdes31 July 2007: Wouter 9286238106Sdes - updated plan 9287238106Sdes - release 0.4 tag. 9288238106Sdes 9289238106Sdes30 July 2007: Wouter 9290238106Sdes - changed random state init, so that sequential process IDs are not 9291238106Sdes cancelled out by sequential thread-ids in the random number seed. 9292238106Sdes - the fwd_three test, which sends three queries to unbound, and 9293238106Sdes unbound is kept waiting by ldns-testns for 3 seconds, failed 9294238106Sdes because the retry timeout for default by unbound is 3 seconds too, 9295238106Sdes it would hit that timeout and fail the test. Changed so that unbound 9296238106Sdes is kept waiting for 2 seconds instead. 9297238106Sdes 9298238106Sdes27 July 2007: Wouter 9299238106Sdes - removed useless -C debug option. It did not work. 9300238106Sdes - text edit of documentation. 9301238106Sdes - added doc/CREDITS file, referred to by the manpages. 9302238106Sdes - updated planning. 9303238106Sdes 9304238106Sdes26 July 2007: Wouter 9305238106Sdes - cycle detection, for query state dependencies. Will attempt to 9306238106Sdes circumvent the cycle, but if no other targets available fails. 9307238106Sdes - unit test for AXFR, IXFR response. 9308238106Sdes - test for cycle detection. 9309238106Sdes 9310238106Sdes25 July 2007: Wouter 9311238106Sdes - testbound read ADDRESS and check it. 9312238106Sdes - test for version.bind and friends. 9313238106Sdes - test for iterator chaining through several referrals. 9314238106Sdes - test and fixup for refetch for glue. Refetch fails if glue 9315238106Sdes is still not provided. 9316238106Sdes 9317238106Sdes24 July 2007: Wouter 9318238106Sdes - Example section in config manual. 9319238106Sdes - Addr stored for range and moment in replay. 9320238106Sdes 9321238106Sdes20 July 2007: Wouter 9322238106Sdes - Check CNAME chain before returning cache entry with CNAMEs. 9323238106Sdes - Option harden-glue, default is on. It will discard out of zone 9324238106Sdes data. If disabled, performance is faster, but spoofing attempts 9325238106Sdes become a possibility. Note that still normalize scrubbing is done, 9326238106Sdes and that the potentially spoofed data is used for infrastructure 9327238106Sdes and not returned to the client. 9328238106Sdes - if glue times out, refetch by asking parent of delegation again. 9329238106Sdes Much like asking for DS at the parent side. 9330238106Sdes - TODO items from forgery-resilience draft. 9331238106Sdes and on memory handling improvements. 9332238106Sdes - renamed module_event_timeout to module_event_noreply. 9333238106Sdes - memory reporting code; reports on memory usage after handling 9334238106Sdes a network packet (not on cache replies). 9335238106Sdes 9336238106Sdes19 July 2007: Wouter 9337238106Sdes - shuffle NS selection when getting nameserver target addresses. 9338238106Sdes - fixup of deadlock warnings, yield cpu in checklock code so that 9339238106Sdes freebsd scheduler selects correct process to run. 9340238106Sdes - added identity and version config options and replies. 9341238106Sdes - store cname messages complete answers. 9342238106Sdes 9343238106Sdes18 July 2007: Wouter 9344238106Sdes - do not query addresses, 127.0.0.1, and ::1 by default. 9345238106Sdes 9346238106Sdes17 July 2007: Wouter 9347238106Sdes - forward zone options in config file. 9348292206Sdes - forward per zone in iterator. takes precedence over stubs. 9349238106Sdes - fixup commithooks. 9350238106Sdes - removed forward-to and forward-to-port features, subsumed by 9351238106Sdes new forward zones. 9352238106Sdes - fix parser to handle absent server: clause. 9353238106Sdes - change untrusted rrset test to account for scrubber that is now 9354238106Sdes applied during the test (which removes the poison, by the way). 9355238106Sdes - feature, addresses can be specified with @portnumber, like nsd.conf. 9356238106Sdes - test config files changed over to new forwarder syntax. 9357238106Sdes 9358238106Sdes27 June 2007: Wouter 9359238106Sdes - delete of mesh does a postorder traverse of the tree. 9360238106Sdes - found and fixed a memory leak. For TTL=0 messages, that would 9361238106Sdes not be cached, instead the msg-replyinfo structure was leaked. 9362238106Sdes - changed server selection so it will filter out hosts that are 9363238106Sdes unresponsive. This is defined as a host with the maximum rto value. 9364238106Sdes This means that unbound tried the host for retries up to 120 secs. 9365238106Sdes The rto value will time out after host-ttl seconds from the cache. 9366238106Sdes This keeps such unresolvable queries from taking up resources. 9367238106Sdes - utility for keeping histogram. 9368238106Sdes 9369238106Sdes26 June 2007: Wouter 9370238106Sdes - mesh is called by worker, and iterator uses it. 9371238106Sdes This removes the hierarchical code. 9372238106Sdes QueryTargets state and Finished state are merged for iterator. 9373238106Sdes - forwarder mode no longer sets AA bit on first reply. 9374238106Sdes - rcode in walk_supers is not needed. 9375238106Sdes 9376238106Sdes25 June 2007: Wouter 9377238106Sdes - more mesh work. 9378238106Sdes - error encode routine for ease. 9379238106Sdes 9380238106Sdes22 June 2007: Wouter 9381238106Sdes - removed unused _node iterator value from rbtree_t. Takes up space. 9382238106Sdes - iterator can handle querytargets state without a delegation point 9383238106Sdes set, so that a priming(stub) subquery error can be handled. 9384238106Sdes - iterator stores if it is priming or not. 9385238106Sdes - log_query_info() neater logging. 9386238106Sdes - changed iterator so that it does not alter module_qstate.qinfo 9387238106Sdes but keeps a chase query info. Also query_flags are not altered, 9388238106Sdes the iterator uses chase_flags. 9389238106Sdes - fixup crash in case no ports for the family exist. 9390238106Sdes 9391238106Sdes21 June 2007: Wouter 9392238106Sdes - Fixup secondary buffer in case of error callback. 9393238106Sdes - cleanup slumber list of runnable states. 9394238106Sdes - module_subreq_depth fails to work in slumber list. 9395238106Sdes - fixup query release for cached results to sub targets. 9396238106Sdes - neater error for tcp connection failure, shows addr in verbose. 9397238106Sdes - rbtree_init so that it can be used with preallocated memory. 9398238106Sdes 9399238106Sdes20 June 2007: Wouter 9400238106Sdes - new -C option to enable coredumps after forking away. 9401238106Sdes - doc update. 9402238106Sdes - fixup CNAME generation by scrubber, and memory allocation of it. 9403238106Sdes - fixup deletion of serviced queries when all callbacks delete too. 9404238106Sdes - set num target queries to 0 when you move them to slumber list. 9405238106Sdes - typo in check caused subquery errors to be ignored, fixed. 9406238106Sdes - make lint happy about rlim_t. 9407238106Sdes - freeup of modules after freeup of module-states. 9408238106Sdes - duplicate replies work, this uses secondary udp buffer in outnet. 9409238106Sdes 9410238106Sdes19 June 2007: Wouter 9411238106Sdes - nicer layout in stats.c, review 0.3 change. 9412238106Sdes - spelling improvement, review 0.3 change. 9413238106Sdes - uncapped timeout for server selection, so that very fast or slow 9414238106Sdes servers will stand out from the rest. 9415238106Sdes - target-fetch-policy: "3 2 1 0 0" config setting. 9416238106Sdes - fixup queries answered without RD bit (for root prime results). 9417238106Sdes - refuse AXFR and IXFR requests. 9418238106Sdes - fixup RD flag in error reply from iterator. fixup RA flag from 9419238106Sdes worker error reply. 9420238106Sdes - fixup encoding of very short edns buffer sizes, now sets TC bit. 9421238106Sdes - config options harden-short-bufsize and harden-large-queries. 9422238106Sdes 9423238106Sdes18 June 2007: Wouter 9424238106Sdes - same, move subqueries to slumber list when first has resolved. 9425238106Sdes - fixup last fix for duplicate callbacks. 9426238106Sdes - another offbyone in targetcounter. Also in Java prototype by the way. 9427238106Sdes 9428238106Sdes15 June 2007: Wouter 9429238106Sdes - if a query asks to be notified of the same serviced query result 9430238106Sdes multiple times, this will succeed. Only one callback will happen; 9431238106Sdes multiple outbound-list entries result (but the double cleanup of it 9432238106Sdes will not matter). 9433238106Sdes - when iterator moves on due to CNAME or referral, it will remove 9434238106Sdes the subqueries (for other targets). These are put on the slumber 9435238106Sdes list. 9436238106Sdes - state module wait subq is OK with no new subqs, an old one may have 9437238106Sdes stopped, with an error, and it is still waiting for other ones. 9438238106Sdes - if a query loops, halt entire query (easy way to clean up properly). 9439238106Sdes 9440238106Sdes14 June 2007: Wouter 9441238106Sdes - num query targets was > 0 , not >= 0 compared, so that fetch 9442238106Sdes policy of 0 did nothing. 9443238106Sdes 9444238106Sdes13 June 2007: Wouter 9445238106Sdes - debug option: configure --enable-static-exe for compile where 9446238106Sdes ldns and libevent are linked statically. Default is off. 9447238106Sdes - make install and make uninstall. Works with static-exe and without. 9448238106Sdes installation of unbound binary and manual pages. 9449292206Sdes - alignment problem fix on solaris 64. 9450238106Sdes - fixup address in case of TCP error. 9451238106Sdes 9452238106Sdes12 June 2007: Wouter 9453238106Sdes - num target queries was set to 0 at a bad time. Default it to 0 and 9454238106Sdes increase as target queries are done. 9455238106Sdes - synthesize CNAME and DNAME responses from the cache. 9456238106Sdes - Updated doxygen config for doxygen 1.5. 9457238106Sdes - aclocal newer version. 9458238106Sdes - doxygen 1.5 fixes for comments (for the strict check on docs). 9459238106Sdes 9460238106Sdes11 June 2007: Wouter 9461238106Sdes - replies on TCP queries have the address field set in replyinfo, 9462238106Sdes for serviced queries, because the initiator does not know that 9463238106Sdes a TCP fallback has occured. 9464238106Sdes - omit DNSSEC types from nonDO replies, except if qtype is ANY or 9465238106Sdes if qtype directly queries for the type (and then only show that 9466238106Sdes 'unknown type' in the answer section). 9467238106Sdes - fixed message parsing where rrsigs on their own would be put 9468238106Sdes in the signature list over the rrsig type. 9469238106Sdes 9470238106Sdes7 June 2007: Wouter 9471238106Sdes - fixup error in double linked list insertion for subqueries and 9472238106Sdes for outbound list of serviced queries for iterator module. 9473238106Sdes - nicer printout of outgoing port selection. 9474238106Sdes - fixup cname target readout. 9475238106Sdes - nicer debug output. 9476238106Sdes - fixup rrset counts when prepending CNAMEs to the answer. 9477238106Sdes - fixup rrset TTL for prepended CNAMEs. 9478238106Sdes - process better check for looping modules, and which submodule to 9479238106Sdes run next. 9480238106Sdes - subreq insertion code fixup for slumber list. 9481238106Sdes - VERB_DETAIL, verbosity: 2 level gives short but readable output. 9482238106Sdes VERB_ALGO, verbosity: 3 gives extensive output. 9483238106Sdes - fixup RA bit in cached replies. 9484238106Sdes - fixup CNAME responses from the cache no longer partial response. 9485238106Sdes - error in network send handled without leakage. 9486238106Sdes - enable ip6 from config, and try ip6 addresses if available, 9487238106Sdes if ip6 is not connected, skips to next server. 9488238106Sdes 9489238106Sdes5 June 2007: Wouter 9490238106Sdes - iterator state finished. 9491238106Sdes - subrequests without parent store in cache and stop. 9492238106Sdes - worker slumber list for ongoing promiscuous queries. 9493238106Sdes - subrequest error handling. 9494238106Sdes - priming failure returns SERVFAIL. 9495238106Sdes - priming gives LAME result, returns SERVFAIL. 9496238106Sdes - debug routine to print dns_msg as handled by iterator. 9497238106Sdes - memleak in config file stubs fixup. 9498238106Sdes - more small bugs, in scrubber, query compare no ID for lookup, 9499238106Sdes in dname validation for NS targets. 9500238106Sdes - sets entry.key for new special allocs. 9501238106Sdes - lognametypeclass can display unknown types and classes. 9502238106Sdes 9503238106Sdes4 June 2007: Wouter 9504238106Sdes - random selection of equally preferred nameserver targets. 9505238106Sdes - reply info copy routine. Reuses existing code. 9506238106Sdes - cache lameness in response handling. 9507238106Sdes - do not touch qstate after worker_process_query because it may have 9508238106Sdes been deleted by that routine. 9509238106Sdes - Prime response state. 9510238106Sdes - Process target response state. 9511238106Sdes - some memcmp changed to dname_compare for case preservation. 9512238106Sdes 9513238106Sdes1 June 2007: Wouter 9514238106Sdes - normalize incoming messages. Like unbound-java, with CNAME chain 9515238106Sdes checked, DNAME checked, CNAME's synthesized, glue checked. 9516238106Sdes - sanitize incoming messages. 9517238106Sdes - split msgreply encode functions into own file msgencode.c. 9518238106Sdes - msg_parse to queryinfo/replyinfo conversion more versatile. 9519238106Sdes - process_response, classify response, delegpt_from_message. 9520238106Sdes 9521238106Sdes31 May 2007: Wouter 9522238106Sdes - querytargets state. 9523238106Sdes - dname_subdomain_c() routine. 9524238106Sdes - server selection, based on RTT. ip6 is filtered out if not available, 9525238106Sdes and lameness is checked too. 9526238106Sdes - delegation point copy routine. 9527238106Sdes 9528238106Sdes30 May 2007: Wouter 9529238106Sdes - removed FLAG_CD from message and rrset caches. This was useful for 9530238106Sdes an agnostic forwarder, but not for a sophisticated (trust value per 9531238106Sdes rrset enabled) cache. 9532292206Sdes - iterator response typing. 9533238106Sdes - iterator cname handle. 9534238106Sdes - iterator prime start. 9535238106Sdes - subquery work. 9536238106Sdes - processInitRequest and processInitRequest2. 9537238106Sdes - cache synthesizes referral messages, with DS and NSEC. 9538238106Sdes - processInitRequest3. 9539238106Sdes - if a request creates multiple subrequests these are all activated. 9540238106Sdes 9541238106Sdes29 May 2007: Wouter 9542238106Sdes - routines to lock and unlock array of rrsets moved to cache/rrset. 9543238106Sdes - lookup message from msg cache (and copy to region). 9544238106Sdes - fixed cast error in dns msg lookup. 9545238106Sdes - message with duplicate rrset does not increase its TTLs twice. 9546238106Sdes - 'qnamesize' changed to 'qname_len' for similar naming scheme. 9547238106Sdes 9548238106Sdes25 May 2007: Wouter 9549238106Sdes - Acknowledge use of unbound-java code in iterator. Nicer readme. 9550238106Sdes - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and 9551238106Sdes rrset cache from module environment. 9552292206Sdes - packed rrset key has type and class as easily accessible struct 9553238106Sdes members. They are still kept in network format for fast msg encode. 9554238106Sdes - dns cache find_delegation routine. 9555238106Sdes - iterator main functions setup. 9556238106Sdes - dns cache lookup setup. 9557238106Sdes 9558238106Sdes24 May 2007: Wouter 9559238106Sdes - small changes to prepare for subqueries. 9560238106Sdes - iterator forwarder feature separated out. 9561238106Sdes - iterator hints stub code, config file stub code, so that first 9562238106Sdes testing can proceed locally. 9563238106Sdes - replay tests now have config option to enable forwarding mode. 9564238106Sdes 9565238106Sdes23 May 2007: Wouter 9566238106Sdes - outside network does precise timers for roundtrip estimates for rtt 9567238106Sdes and for setting timeout for UDP. Pending_udp takes milliseconds. 9568238106Sdes - cleaner iterator sockaddr conversion of forwarder address. 9569238106Sdes - iterator/iter_utils and iter_delegpt setup. 9570238106Sdes - root hints. 9571238106Sdes 9572238106Sdes22 May 2007: Wouter 9573238106Sdes - outbound query list for modules and support to callback with the 9574238106Sdes outbound entry to the module. 9575238106Sdes - testbound support for new serviced queries. 9576238106Sdes - test for retry to TCP cannot use testbound any longer. 9577238106Sdes - testns test for EDNS fallback, test for TCP fallback already exists. 9578238106Sdes - fixes for no-locking compile. 9579238106Sdes - mini_event timer precision and fix for change in timeouts during 9580238106Sdes timeout callback. Fix for fwd_three tests, performed nonexit query. 9581238106Sdes 9582238106Sdes21 May 2007: Wouter 9583238106Sdes - small comment on hash table locking. 9584238106Sdes - outside network serviced queries, contain edns and tcp fallback, 9585238106Sdes and udp retries and rtt timing. 9586238106Sdes 9587238106Sdes16 May 2007: Wouter 9588238106Sdes - lruhash_touch() would cause locking order problems. Fixup in 9589238106Sdes lock-verify in case locking cycle is found. 9590238106Sdes - services/cache/rrset.c for rrset cache code. 9591238106Sdes - special rrset_cache LRU updating function that uses the rrset id. 9592238106Sdes - no dependencies calculation when make clean is called. 9593238106Sdes - config settings for infra cache. 9594238106Sdes - daemon code slightly cleaner, only creates caches once. 9595238106Sdes 9596238106Sdes15 May 2007: Wouter 9597238106Sdes - host cache code. 9598238106Sdes - unit test for host cache. 9599238106Sdes 9600238106Sdes14 May 2007: Wouter 9601238106Sdes - Port to OS/X and Dec Alpha. Printf format and alignment fixes. 9602238106Sdes - extensive lock debug report on join timeout. 9603238106Sdes - proper RTT calculation, in utility code. 9604238106Sdes - setup of services/cache/infra, host cache. 9605238106Sdes 9606238106Sdes11 May 2007: Wouter 9607238106Sdes - iterator/iterator.c module. 9608238106Sdes - fixup to pass reply_info in testcode and in netevent. 9609238106Sdes 9610238106Sdes10 May 2007: Wouter 9611238106Sdes - created release-0.3 svn tag. 9612238106Sdes - util/module.h 9613238106Sdes - fixed compression - no longer compresses root name. 9614238106Sdes 9615238106Sdes9 May 2007: Wouter 9616238106Sdes - outside network cleans up waiting tcp queries on exit. 9617238106Sdes - fallback to TCP. 9618238106Sdes - testbound replay with retry in TCP mode. 9619238106Sdes - tpkg test for retry in TCP mode, against ldns-testns server. 9620238106Sdes - daemon checks max number of open files and complains if not enough. 9621238106Sdes - test where data expires in the cache. 9622238106Sdes - compiletests: fixed empty body ifstatements in alloc.c, in case 9623238106Sdes locks are disabled. 9624238106Sdes 9625238106Sdes8 May 2007: Wouter 9626238106Sdes - outgoing network keeps list of available tcp buffers for outgoing 9627238106Sdes tcp queries. 9628238106Sdes - outgoing-num-tcp config option. 9629238106Sdes - outgoing network keeps waiting list of queries waiting for buffer. 9630238106Sdes - netevent supports outgoing tcp commpoints, nonblocking connects. 9631238106Sdes 9632238106Sdes7 May 2007: Wouter 9633238106Sdes - EDNS read from query, used to make reply smaller. 9634238106Sdes - advertised edns value constants. 9635238106Sdes - EDNS BADVERS response, if asked for too high edns version. 9636292206Sdes - EDNS extended error responses once the EDNS record from the query 9637238106Sdes has successfully been parsed. 9638238106Sdes 9639238106Sdes4 May 2007: Wouter 9640238106Sdes - msgreply sizefunc is more accurate. 9641238106Sdes - config settings for rrset cache size and slabs. 9642238106Sdes - hashtable insert takes argument so that a thread can use its own 9643238106Sdes alloc cache to store released keys. 9644238106Sdes - alloc cache special_release() locks if necessary. 9645238106Sdes - rrset trustworthiness type added. 9646238106Sdes - thread keeps a scratchpad region for handling messages. 9647238106Sdes - writev used in netevent to write tcp length and data after another. 9648238106Sdes This saves a roundtrip on tcp replies. 9649238106Sdes - test for one rrset updated in the cache. 9650238106Sdes - test for one rrset which is not updated, as it is not deemed 9651238106Sdes trustworthy enough. 9652238106Sdes - test for TTL refreshed in rrset. 9653238106Sdes 9654238106Sdes3 May 2007: Wouter 9655238106Sdes - fill refs. Use new parse and encode to answer queries. 9656238106Sdes - stores rrsets in cache. 9657238106Sdes - uses new msgreply format in cache. 9658238106Sdes 9659238106Sdes2 May 2007: Wouter 9660238106Sdes - dname unit tests in own file and spread out neatly in functions. 9661238106Sdes - more dname unit tests. 9662238106Sdes - message encoding creates truncated TC flagged messages if they do 9663238106Sdes not fit, and will leave out (whole)rrsets from additional if needed. 9664238106Sdes 9665238106Sdes1 May 2007: Wouter 9666238106Sdes - decompress query section, extremely lenient acceptance. 9667238106Sdes But only for answers from other servers, not for plain queries. 9668238106Sdes - compression and decompression test cases. 9669238106Sdes - some stats added. 9670238106Sdes - example.conf interface: line is changed from 127.0.0.1 which leads 9671238106Sdes to problems if used (restricting communication to the localhost), 9672238106Sdes to a documentation and test address. 9673238106Sdes 9674238106Sdes27 April 2007: Wouter 9675238106Sdes - removed iov usage, it is not good for dns message encoding. 9676238106Sdes - owner name compression more optimal. 9677238106Sdes - rrsig owner name compression. 9678238106Sdes - rdata domain name compression. 9679238106Sdes 9680238106Sdes26 April 2007: Wouter 9681238106Sdes - floating point exception fix in lock-verify. 9682238106Sdes - lint uses make dependency 9683238106Sdes - fixup lint in dname owner domain name compression code. 9684238106Sdes - define for offset range that can be compressed to. 9685238106Sdes 9686238106Sdes25 April 2007: Wouter 9687238106Sdes - prettier code; parse_rrset->type kept in host byte order. 9688238106Sdes - datatype used for hashvalue of converted rrsig structure. 9689238106Sdes - unit test compares edns section data too. 9690238106Sdes 9691238106Sdes24 April 2007: Wouter 9692238106Sdes - ttl per RR, for RRSIG rrsets and others. 9693238106Sdes - dname_print debug function. 9694238106Sdes - if type is not known, size calc will skip DNAME decompression. 9695238106Sdes - RRSIG parsing and storing and putting in messages. 9696238106Sdes - dnssec enabled unit tests (from nlnetlabs.nl and se queries). 9697238106Sdes - EDNS extraction routine. 9698238106Sdes 9699238106Sdes20 April 2007: Wouter 9700238106Sdes - code comes through all of the unit tests now. 9701238106Sdes - disabled warning about spurious extra data. 9702238106Sdes - documented the RRSIG parse plan in msgparse.h. 9703238106Sdes - rrsig reading and outputting. 9704238106Sdes 9705238106Sdes19 April 2007: Wouter 9706238106Sdes - fix unit test to actually to tests. 9707238106Sdes - fix write iov helper, and fakevent code. 9708238106Sdes - extra builtin testcase (small packet). 9709238106Sdes - ttl converted to network format in packets. 9710238106Sdes - flags converted correctly 9711238106Sdes - rdatalen off by 2 error fixup. 9712238106Sdes - uses less iov space for header. 9713238106Sdes 9714238106Sdes18 April 2007: Wouter 9715238106Sdes - review of msgparse code. 9716238106Sdes - smaller test cases. 9717238106Sdes 9718238106Sdes17 April 2007: Wouter 9719238106Sdes - copy and decompress dnames. 9720238106Sdes - store calculated hash value too. 9721238106Sdes - routine to create message out of stored information. 9722238106Sdes - util/data/msgparse.c for message parsing code. 9723238106Sdes - unit test, and first fixes because of test. 9724238106Sdes * forgot rrset_count addition. 9725238106Sdes * did & of ptr on stack for memory position calculation. 9726238106Sdes * dname_pkt_copy forgot to read next label length. 9727238106Sdes - test from file and fixes 9728238106Sdes * double frees fixed in error conditions. 9729238106Sdes * types with less than full rdata allowed by parser. 9730238106Sdes Some dynamic update packets seem to use it. 9731238106Sdes 9732238106Sdes16 April 2007: Wouter 9733238106Sdes - following a small change in LDNS, parsing code calculates the 9734238106Sdes memory size to allocate for rrs. 9735238106Sdes - code to handle ID creation. 9736238106Sdes 9737238106Sdes13 April 2007: Wouter 9738238106Sdes - parse routines. Code that parses rrsets, rrs. 9739238106Sdes 9740238106Sdes12 April 2007: Wouter 9741238106Sdes - dname compare routine that preserves case, with unit tests. 9742238106Sdes 9743238106Sdes11 April 2007: Wouter 9744238106Sdes - parse work - dname packet parse, msgparse, querysection parse, 9745238106Sdes start of sectionparse. 9746238106Sdes 9747238106Sdes10 April 2007: Wouter 9748238106Sdes - Improved alignment of reply_info packet, nice for 32 and 64 bit. 9749238106Sdes - Put RRset counts in reply_info, because the number of RRs can change 9750238106Sdes due to RRset updates. 9751238106Sdes - import of region-allocator code from nsd. 9752238106Sdes - set alloc special type to ub_packed_rrset_key. 9753238106Sdes Uses lruhash entry overflow chain next pointer in alloc cache. 9754238106Sdes - doxygen documentation for region-allocator. 9755238106Sdes - setup for parse scratch data. 9756238106Sdes 9757238106Sdes5 April 2007: Wouter 9758238106Sdes - discussed packed rrset with Jelte. 9759238106Sdes 9760238106Sdes4 April 2007: Wouter 9761238106Sdes - moved to version 0.3. 9762238106Sdes - added util/data/dname.c 9763238106Sdes - layout of memory for rrsets. 9764238106Sdes 9765238106Sdes3 April 2007: Wouter 9766238106Sdes - detect sign of msghdr.msg_iovlen so that the cast to that type 9767238106Sdes in netevent (which is there to please lint) can be correct. 9768238106Sdes The type on several OSes ranges from int, int32, uint32, size_t. 9769238106Sdes Detects unsigned or signed using math trick. 9770238106Sdes - constants for DNS flags. 9771238106Sdes - compilation without locks fixup. 9772238106Sdes - removed include of unportable header from lookup3.c. 9773238106Sdes - more portable use of struct msghdr. 9774238106Sdes - casts for printf warning portability. 9775238106Sdes - tweaks to tests to port them to the testbed. 9776238106Sdes - 0.2 tag created. 9777238106Sdes 9778238106Sdes2 April 2007: Wouter 9779238106Sdes - check sizes of udp received messages, not too short. 9780238106Sdes - review changes. Some memmoves can be memcpys: 4byte aligned. 9781238106Sdes set id correctly on cached answers. 9782238106Sdes - review changes msgreply.c, memleak on error condition. AA flag 9783238106Sdes clear on cached reply. Lowercase queries on hashing. 9784238106Sdes unit test on lowercasing. Test AA bit not set on cached reply. 9785238106Sdes Note that no TTLs are managed. 9786238106Sdes 9787238106Sdes29 March 2007: Wouter 9788238106Sdes - writev or sendmsg used when answering from cache. 9789238106Sdes This avoids a copy of the data. 9790238106Sdes - do not do useless byteswap on query id. Store reply flags in uint16 9791238106Sdes for easier access (and no repeated byteswapping). 9792238106Sdes - reviewed code. 9793238106Sdes - configure detects and config.h includes sys/uio.h for writev decl. 9794238106Sdes 9795238106Sdes28 March 2007: Wouter 9796238106Sdes - new config option: num-queries-per-thread. 9797238106Sdes - added tpkg test for answering three queries at the same time 9798238106Sdes using one thread (from the query service list). 9799238106Sdes 9800238106Sdes27 March 2007: Wouter 9801238106Sdes - added test for cache and not cached answers, in testbound replays. 9802238106Sdes - testbound can give config file and commandline options from the 9803238106Sdes replay file to unbound. 9804238106Sdes - created test that checks if items drop out of the cache. 9805238106Sdes - added word 'partitioned hash table' to documentation on slab hash. 9806238106Sdes A slab hash is a partitioned hash table. 9807238106Sdes - worker can handle multiple queries at a time. 9808238106Sdes 9809238106Sdes26 March 2007: Wouter 9810238106Sdes - config settings for slab hash message cache. 9811238106Sdes - test for cached answer. 9812238106Sdes - Fixup deleting fake answer from testbound list. 9813238106Sdes 9814238106Sdes23 March 2007: Wouter 9815238106Sdes - review of yesterday's commits. 9816238106Sdes - covered up memory leak of the entry locks. 9817238106Sdes - answers from the cache correctly. Copies flags correctly. 9818238106Sdes - sanity check for incoming query replies. 9819238106Sdes - slabbed hash table. Much nicer contention, need dual cpu to see. 9820238106Sdes 9821238106Sdes22 March 2007: Wouter 9822238106Sdes - AIX configure check. 9823238106Sdes - lock-verify can handle references to locks that are created 9824238106Sdes in files it has not yet read in. 9825238106Sdes - threaded hash table test. 9826238106Sdes - unit test runs lock-verify afterwards and checks result. 9827238106Sdes - need writelock to update data on hash_insert. 9828238106Sdes - message cache code, msgreply code. 9829238106Sdes 9830238106Sdes21 March 2007: Wouter 9831238106Sdes - unit test of hash table, fixup locking problem in table_grow(). 9832238106Sdes - fixup accounting of sizes for removing items from hashtable. 9833238106Sdes - unit test for hash table, single threaded test of integrity. 9834238106Sdes - lock-verify reports errors nicely. More quiet in operation. 9835238106Sdes 9836238106Sdes16 March 2007: Wouter 9837238106Sdes - lock-verifier, checks consistent order of locking. 9838238106Sdes 9839238106Sdes14 March 2007: Wouter 9840238106Sdes - hash table insert (and subroutines) and lookup implemented. 9841238106Sdes - hash table remove. 9842238106Sdes - unit tests for hash internal bin, lru functions. 9843238106Sdes 9844238106Sdes13 March 2007: Wouter 9845238106Sdes - lock_unprotect in checklocks. 9846238106Sdes - util/storage/lruhash.h for LRU hash table structure. 9847238106Sdes 9848238106Sdes12 March 2007: Wouter 9849238106Sdes - configure.ac moved to 0.2. 9850238106Sdes - query_info and replymsg util/data structure. 9851238106Sdes 9852238106Sdes9 March 2007: Wouter 9853238106Sdes - added rwlock writelock checking. 9854238106Sdes So it will keep track of the writelock, and readlocks are enforced 9855238106Sdes to not change protected memory areas. 9856238106Sdes - log_hex function to dump hex strings to the logfile. 9857238106Sdes - checklocks zeroes its destroyed lock after checking memory areas. 9858238106Sdes - unit test for alloc. 9859238106Sdes - identifier for union in checklocks to please older compilers. 9860238106Sdes - created 0.1 tag. 9861238106Sdes 9862238106Sdes8 March 2007: Wouter 9863238106Sdes - Reviewed checklock code. 9864238106Sdes 9865238106Sdes7 March 2007: Wouter 9866238106Sdes - created a wrapper around thread calls that performs some basic 9867238106Sdes checking for data race and deadlock, and basic performance 9868238106Sdes contention measurement. 9869238106Sdes 9870238106Sdes6 March 2007: Wouter 9871238106Sdes - Testbed works with threading (different machines, different options). 9872238106Sdes - alloc work, does the special type. 9873238106Sdes 9874238106Sdes2 March 2007: Wouter 9875238106Sdes - do not compile fork funcs unless needed. Otherwise will give 9876238106Sdes type errors as their typedefs have not been enabled. 9877238106Sdes - log shows thread numbers much more nicely (and portably). 9878238106Sdes - even on systems with nonthreadsafe libevent signal handling, 9879238106Sdes unbound will exit if given a signal. 9880238106Sdes Reloads will not work, and exit is not graceful. 9881238106Sdes - start of alloc framework layout. 9882238106Sdes 9883238106Sdes1 March 2007: Wouter 9884238106Sdes - Signals, libevent and threads work well, with libevent patch and 9885238106Sdes changes to code (close after event_del). 9886238106Sdes - set ipc pipes nonblocking. 9887238106Sdes 9888238106Sdes27 February 2007: Wouter 9889238106Sdes - ub_thread_join portable definition. 9890238106Sdes - forking is used if no threading is available. 9891238106Sdes Tested, it works, since pipes work across processes as well. 9892238106Sdes Thread_join is replaced with waitpid. 9893238106Sdes - During reloads the daemon will temporarily handle signals, 9894238106Sdes so that they do not result in problems. 9895238106Sdes - Also randomize the outgoing port range for tests. 9896238106Sdes - If query list is full, will stop selecting listening ports for read. 9897238106Sdes This makes all threads service incoming requests, instead of one. 9898238106Sdes No memory is leaking during reloads, service of queries, etc. 9899238106Sdes - test that uses ldns-testns -f to test threading. Have to answer 9900238106Sdes three queries at the same time. 9901238106Sdes - with verbose=0 operates quietly. 9902238106Sdes 9903238106Sdes26 February 2007: Wouter 9904238106Sdes - ub_random code used to select ID and port. 9905238106Sdes - log code prints thread id. 9906238106Sdes - unbound can thread itself, with reload(HUP) and quit working 9907238106Sdes correctly. 9908238106Sdes - don't open pipes for #0, doesn't need it. 9909238106Sdes - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload). 9910238106Sdes 9911238106Sdes23 February 2007: Wouter 9912238106Sdes - Can do reloads on sigHUP. Everything is stopped, and freed, 9913238106Sdes except the listening ports. Then the config file is reread. 9914238106Sdes And everything is started again (and listening ports if needed). 9915238106Sdes - Ports for queries are shared. 9916238106Sdes - config file added interface:, chroot: and username:. 9917238106Sdes - config file: directory, logfile, pidfile. And they work too. 9918238106Sdes - will daemonize by default now. Use -d to stay in the foreground. 9919238106Sdes - got BSD random[256 state] code, made it threadsafe. util/random. 9920238106Sdes 9921238106Sdes22 February 2007: Wouter 9922238106Sdes - Have a config file. Removed commandline options, moved to config. 9923238106Sdes - tests use config file. 9924238106Sdes 9925238106Sdes21 February 2007: Wouter 9926238106Sdes - put -c option in man page. 9927238106Sdes - minievent fd array capped by FD_SETSIZE. 9928238106Sdes 9929238106Sdes20 February 2007: Wouter 9930238106Sdes - Added locks code and pthread spinlock detection. 9931238106Sdes - can use no locks, or solaris native thread library. 9932238106Sdes - added yacc and lex configure, and config file parsing code. 9933238106Sdes also makedist.sh, and manpage. 9934238106Sdes - put include errno.h in config.h 9935238106Sdes 9936238106Sdes19 February 2007: Wouter 9937238106Sdes - Created 0.0 svn tag. 9938238106Sdes - added acx_pthread.m4 autoconf check for pthreads from 9939238106Sdes the autoconf archive. It is GPL-with-autoconf-exception Licensed. 9940238106Sdes You can specify --with-pthreads, or --without-pthreads to configure. 9941238106Sdes 9942238106Sdes16 February 2007: Wouter 9943238106Sdes - Updated testbed script, works better by using make on remote end. 9944238106Sdes - removed check decls, we can compile without them. 9945238106Sdes - makefile supports LIBOBJ replacements. 9946238106Sdes - docs checks ignore compat code. 9947238106Sdes - added util/mini-event.c and .h, a select based alternative used with 9948238106Sdes ./configure --with-libevent=no 9949238106Sdes It is limited to 1024 file descriptors, and has less features. 9950238106Sdes - will not create ip6 sockets if ip6 not on the machine. 9951238106Sdes 9952238106Sdes15 February 2007: Wouter 9953238106Sdes - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64, 9954238106Sdes Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc. 9955238106Sdes - malloc rndstate, so that it is aligned for access. 9956238106Sdes - fixed rbtree cleanup with postorder traverse. 9957238106Sdes - fixed pending messages are deleted when handled. 9958238106Sdes - You can control verbosity; default is not verbose, every -v 9959238106Sdes adds more verbosity. 9960238106Sdes 9961238106Sdes14 February 2007: Wouter 9962238106Sdes - Included configure.ac changes from ldns. 9963238106Sdes - detect (some) headers before the standards check. 9964238106Sdes - do not use isblank to test c99, since its not available on solaris9. 9965238106Sdes - review of testcode. 9966238106Sdes * entries in a RANGE are no longer reversed. 9967238106Sdes * print name of file with replay entry parse errors. 9968238106Sdes - port to OSX: cast to int for some prints of sizet. 9969238106Sdes - Makefile copies ldnstestpkts.c before doing dependencies on it. 9970238106Sdes 9971238106Sdes13 February 2007: Wouter 9972238106Sdes - work on fake events, first fwd replay works. 9973238106Sdes - events can do timeouts and errors on queries to servers. 9974238106Sdes - test package that runs replay scenarios. 9975238106Sdes 9976238106Sdes12 February 2007: Wouter 9977238106Sdes - work on fake events. 9978238106Sdes 9979238106Sdes9 February 2007: Wouter 9980238106Sdes - replay file reading. 9981238106Sdes - fake event setup, it creates fake structures, and teardowns, 9982238106Sdes added signal callbacks to reply to be able to fake those, 9983238106Sdes and main structure of event replay routines. 9984238106Sdes 9985238106Sdes8 February 2007: Wouter 9986238106Sdes - added tcp test. 9987238106Sdes - replay storage. 9988238106Sdes - testcode/fake_event work. 9989238106Sdes 9990238106Sdes7 February 2007: Wouter 9991238106Sdes - return answer with the same ID as query was sent with. 9992238106Sdes - created udp forwarder test. I've done some effort to make it perform 9993238106Sdes quickly. After servers are created, no big sleep statements but 9994238106Sdes it checks the logfiles to see if servers have come up. Takes 0.14s. 9995238106Sdes - set addrlen value when calling recvfrom. 9996238106Sdes - comparison of addrs more portable. 9997238106Sdes - LIBEVENT option for testbed to set libevent directory. 9998238106Sdes - work on tcp input. 9999238106Sdes 10000238106Sdes6 February 2007: Wouter 10001238106Sdes - reviewed code and improved in places. 10002238106Sdes 10003238106Sdes5 February 2007: Wouter 10004238106Sdes - Picked up stdc99 and other define tests from ldns. Improved 10005238106Sdes POSIX define test to include getaddrinfo. 10006238106Sdes - defined constants for netevent callback error code. 10007238106Sdes - unit test for strisip6. 10008238106Sdes 10009238106Sdes2 February 2007: Wouter 10010238106Sdes - Created udp4 and udp6 port arrays to provide service for both 10011238106Sdes address families. 10012238106Sdes - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets. 10013238106Sdes - listens on both ip4 and ip6 ports to provide correct return address. 10014238106Sdes - worker fwder address filled correctly. 10015238106Sdes - fixup timer code. 10016238106Sdes - forwards udp queries and sends answer. 10017238106Sdes 10018238106Sdes1 February 2007: Wouter 10019238106Sdes - outside network more UDP work. 10020238106Sdes - moved * closer to type. 10021238106Sdes - comm_timer object and events. 10022238106Sdes 10023238106Sdes31 January 2007: Wouter 10024238106Sdes - Added makedist.sh script to make release tarball. 10025238106Sdes - Removed listen callback layer, did not add anything. 10026238106Sdes - Added UDP recv to netevent, worker callback for udp. 10027238106Sdes - netevent communication reply storage structure. 10028238106Sdes - minimal query header sanity checking for worker. 10029238106Sdes - copied over rbtree implementation from NSD (BSD licensed too). 10030238106Sdes - outgoing network query service work. 10031238106Sdes 10032238106Sdes30 January 2007: Wouter 10033238106Sdes - links in example/ldns-testpkts.c and .h for premade packet support. 10034238106Sdes - added callback argument to listen_dnsport and daemon/worker. 10035238106Sdes 10036238106Sdes29 January 2007: Wouter 10037238106Sdes - unbound.8 a short manpage. 10038238106Sdes 10039238106Sdes26 January 2007: Wouter 10040238106Sdes - fixed memleak. 10041238106Sdes - make lint works on BSD and Linux (openssl defines). 10042238106Sdes - make tags works. 10043238106Sdes - testbound program start. 10044238106Sdes 10045238106Sdes25 January 2007: Wouter 10046238106Sdes - fixed lint so it may work on BSD. 10047238106Sdes - put license into header of every file. 10048238106Sdes - created verbosity flag. 10049238106Sdes - fixed libevent configure flag. 10050238106Sdes - detects event_base_free() in new libevent 1.2 version. 10051238106Sdes - getopt in daemon. fatal_exit() and verbose() logging funcs. 10052238106Sdes - created log_assert, that throws assertions to the logfile. 10053238106Sdes - listen_dnsport service. Binds ports. 10054238106Sdes 10055238106Sdes24 January 2007: Wouter 10056238106Sdes - cleaned up configure.ac. 10057238106Sdes 10058238106Sdes23 January 2007: Wouter 10059238106Sdes - added libevent to configure to link with. 10060238106Sdes - util/netevent setup work. 10061238106Sdes - configure searches for libevent. 10062238106Sdes - search for libs at end of configure (when other headers and types 10063238106Sdes have been found). 10064238106Sdes - doxygen works with ATTR_UNUSED(). 10065238106Sdes - util/netevent implementation. 10066238106Sdes 10067238106Sdes22 January 2007: Wouter 10068238106Sdes - Designed header file for network communication. 10069238106Sdes 10070238106Sdes16 January 2007: Wouter 10071238106Sdes - added readme.svn and readme.tests. 10072238106Sdes 10073238106Sdes4 January 2007: Wouter 10074238106Sdes - Testbed script (run on multiple platforms the test set). 10075238106Sdes Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5. 10076238106Sdes - added unit test tpkg. 10077238106Sdes 10078238106Sdes3 January 2007: Wouter 10079238106Sdes - committed first set of files into subversion repository. 10080238106Sdes svn co svn+ssh://unbound.net/svn/unbound 10081238106Sdes You need a ssh login. There is no https access yet. 10082238106Sdes - Added LICENSE, the BSD license. 10083238106Sdes - Added doc/README with compile help. 10084238106Sdes - main program stub and quiet makefile. 10085238106Sdes - minimal logging service (to stderr). 10086238106Sdes - added postcommit hook that serves emails. 10087238106Sdes - added first test 00-lint. postcommit also checks if build succeeds. 10088238106Sdes - 01-doc: doxygen doc target added for html docs. And stringent test 10089238106Sdes on documented files, functions and parameters. 10090238106Sdes 10091238106Sdes15 December 2006: Wouter 10092238106Sdes - Created Makefile.in and configure.ac. 10093