1296415Sdes24 February 2016: Wouter 2296415Sdes - Fix OpenBSD asynclook lock free that gets used later (fix test code). 3296415Sdes - Fix that NSEC3 negative cache is used when there is no salt. 4296415Sdes 5296415Sdes23 February 2016: Wouter 6296415Sdes - ub_ctx_set_stub() function for libunbound to config stub zones. 7296415Sdes - sorted ubsyms.def file with exported libunbound functions. 8296415Sdes 9296415Sdes19 February 2016: Wouter 10296415Sdes - Print understandable debug log when unusable DS record is seen. 11296415Sdes - load gost algorithm if digest is seen before key algorithm. 12296415Sdes - iana portlist update. 13296415Sdes 14296415Sdes17 February 2016: Wouter 15296415Sdes - Fix that "make install" fails due to "text file busy" error. 16296415Sdes 17296415Sdes16 February 2016: Wouter 18296415Sdes - Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error. 19296415Sdes 20296415Sdes15 February 2016: Wouter 21296415Sdes - ip-transparent option for FreeBSD with IP_BINDANY socket option. 22296415Sdes - wait for sendto to drain socket buffers when they are full. 23296415Sdes 24296415Sdes9 February 2016: Wouter 25296415Sdes - Test for type OPENPGPKEY. 26296415Sdes - insecure-lan-zones: yesno config option, patch from Dag-Erling 27296415Sdes Sm��rgrav. 28296415Sdes 29296415Sdes8 February 2016: Wouter 30296415Sdes - Fix patch typo in prevuous commit for 734 from Adi Prasaja. 31296415Sdes - RR Type CSYNC support RFC 7477, in debug printout and config input. 32296415Sdes - RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07). 33296415Sdes 34296415Sdes29 January 2016: Wouter 35296415Sdes - Neater cmdline_verbose increment patch from Edgar Pettijohn. 36296415Sdes 37296415Sdes27 January 2016: Wouter 38296415Sdes - Made netbsd sendmsg test nonfatal, in case of false positives. 39296415Sdes - Fix #741: log message for dnstap socket connection is more clear. 40296415Sdes 41296415Sdes26 January 2016: Wouter 42296415Sdes - Fix #734: chown the pidfile if it resides inside the chroot. 43296415Sdes - Use arc4random instead of random in tests (because it is 44296415Sdes available, possibly as compat, anyway). 45296415Sdes - Fix cmsg alignment for argument to sendmsg on NetBSD. 46296415Sdes - Fix that unbound complains about unimplemented IP_PKTINFO for 47296415Sdes sendmsg on NetBSD (for interface-automatic). 48296415Sdes 49296415Sdes25 January 2016: Wouter 50296415Sdes - Fix #738: Swig should not be invoked with CPPFLAGS. 51296415Sdes 52296415Sdes19 January 2016: Wouter 53296415Sdes - Squelch 'cannot assign requested address' log messages unless 54296415Sdes verbosity is high, it was spammed after network down. 55296415Sdes 56296415Sdes14 January 2016: Wouter 57296415Sdes - Fix to simplify empty string checking from Michael McConville. 58296415Sdes - iana portlist update. 59296415Sdes 60296415Sdes12 January 2016: Wouter 61296415Sdes - Fix #734: Do not log an error when the PID file cannot be chown'ed. 62296415Sdes Patch from Simon Deziel. 63296415Sdes 64296415Sdes11 January 2016: Wouter 65296415Sdes - Fix test if -pthreads unused to use better grep for portability. 66296415Sdes 67296415Sdes06 January 2016: Wouter 68296415Sdes - Fix mingw crosscompile for recent mingw. 69296415Sdes - Update aclocal, autoconf output with new versions (1.15, 2.4.6). 70296415Sdes 71296415Sdes05 January 2016: Wouter 72296415Sdes - #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch 73296415Sdes from Daisuke Higashi. 74296415Sdes - Support RFC7686: handle ".onion" Special-Use Domain. It is blocked 75296415Sdes by default, and can be unblocked with "nodefault" localzone config. 76296415Sdes 77296415Sdes04 January 2016: Wouter 78296415Sdes - Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined, 79296415Sdes for Linux glibc 2.20. 80296415Sdes - Fixup contrib/aaaa-filter-iterator.patch for moved contents in the 81296415Sdes source code, so it applies cleanly again. Removed unused variable 82296415Sdes warnings. 83296415Sdes 84296415Sdes15 December 2015: Ralph 85296415Sdes - Fix #729: omit use of escape sequences in echo since they are not 86296415Sdes portable (unbound-control-setup). 87296415Sdes 88296415Sdes11 December 2015: Wouter 89296415Sdes - remove NULL-checks before free, patch from Michael McConville. 90296415Sdes - updated ax_pthread.m4 to version 21 with clang support, this 91296415Sdes removes a warning from compilation. 92296415Sdes - OSX portability, detect if sbrk is deprecated. 93296415Sdes - OSX clang, stop -pthread unused during link stage warnings. 94296415Sdes - OSX clang new flto check. 95296415Sdes 96296415Sdes10 December 2015: Wouter 97296415Sdes - 1.5.7 release 98296415Sdes - trunk has 1.5.8 in development. 99296415Sdes 100292206Sdes8 December 2015: Wouter 101292206Sdes - Fixup 724 for unbound-control. 102292206Sdes 103292206Sdes7 December 2015: Ralph 104292206Sdes - Do not minimise forwarded requests. 105292206Sdes 106292206Sdes4 December 2015: Wouter 107292206Sdes - Removed unneeded whitespace from example.conf. 108292206Sdes 109292206Sdes3 December 2015: Ralph 110292206Sdes - (after rc1 tag) 111292206Sdes - Committed fix to qname minimisation and unit test case for it. 112292206Sdes 113292206Sdes3 December 2015: Wouter 114292206Sdes - iana portlist update. 115292206Sdes - 1.5.7rc1 prerelease tag. 116292206Sdes 117292206Sdes2 December 2015: Wouter 118292206Sdes - Fixup 724: Fix PCA prompt for unbound-service-install.exe. 119292206Sdes re-enable stdout printout. 120292206Sdes - For 724: Add Changelog to windows binary dist. 121292206Sdes 122292206Sdes1 December 2015: Ralph 123292206Sdes - Qname minimisation review fixes 124292206Sdes 125292206Sdes1 December 2015: Wouter 126292206Sdes - Fixup 724 fix for fname_after_chroot() calls. 127292206Sdes - Remove stdout printout for unbound-service-install.exe 128292206Sdes - .gitignore for git users. 129292206Sdes 130292206Sdes30 November 2015: Ralph 131292206Sdes - Implemented qname minimisation 132292206Sdes 133292206Sdes30 November 2015: Wouter 134292206Sdes - Fix for #724: conf syntax to read files from run dir (on Windows). 135292206Sdes 136292206Sdes25 November 2015: Wouter 137292206Sdes - Fix for #720, fix unbound-control-setup windows batch file. 138292206Sdes 139292206Sdes24 November 2015: Wouter 140292206Sdes - Fix #720: add windows scripts to zip bundle. 141292206Sdes - iana portlist update. 142292206Sdes 143292206Sdes20 November 2015: Wouter 144292206Sdes - Added assert on rrset cache correctness. 145292206Sdes - Fix that malformed EDNS query gets a response without malformed EDNS. 146292206Sdes 147292206Sdes18 November 2015: Wouter 148292206Sdes - newer acx_nlnetlabs.m4. 149292206Sdes - spelling fixes from Igor Sobrado Delgado. 150292206Sdes 151292206Sdes17 November 2015: Wouter 152292206Sdes - Fix #594. libunbound: optionally use libnettle for crypto. 153292206Sdes Contributed by Luca Bruno. Added --with-nettle for use with 154292206Sdes --with-libunbound-only. 155292206Sdes - refactor nsec3 hash implementation to be more library-portable. 156292206Sdes - iana portlist update. 157292206Sdes - Fixup DER encoded DSA signatures for libnettle. 158292206Sdes 159292206Sdes16 November 2015: Wouter 160292206Sdes - Fix for lenient accept of reverse order DNAME and CNAME. 161292206Sdes 162292206Sdes6 November 2015: Wouter 163292206Sdes - Change example.conf: ftp.internic.net to https://www.internic.net 164292206Sdes 165292206Sdes5 November 2015: Wouter 166292206Sdes - ACX_SSL_CHECKS no longer adds -ldl needlessly. 167292206Sdes 168292206Sdes3 November 2015: Wouter 169292206Sdes - Fix #718: Fix unbound-control-setup with support for env 170292206Sdes without HEREDOC bash support. 171292206Sdes 172292206Sdes29 October 2015: Wouter 173292206Sdes - patch from Doug Hogan for SSL_OP_NO_SSLvx options. 174292206Sdes - Fix #716: nodata proof with empty non-terminals and wildcards. 175292206Sdes 176292206Sdes28 October 2015: Wouter 177292206Sdes - Fix checklock testcode for linux threads on exit. 178292206Sdes 179292206Sdes27 October 2015: Wouter 180292206Sdes - isblank() compat implementation. 181292206Sdes - detect libexpat without xml_StopParser function. 182292206Sdes - portability fixes. 183292206Sdes - portability, replace snprintf if return value broken. 184292206Sdes 185292206Sdes23 October 2015: Wouter 186292206Sdes - Fix #714: Document config to block private-address for IPv4 187292206Sdes mapped IPv6 addresses. 188292206Sdes 189292206Sdes22 October 2015: Wouter 190292206Sdes - Fix #712: unbound-anchor appears to not fsync root.key. 191292206Sdes 192292206Sdes20 October 2015: Wouter 193292206Sdes - 1.5.6 release. 194292206Sdes - trunk tracks development of 1.5.7. 195292206Sdes 196292206Sdes15 October 2015: Wouter 197292206Sdes - Fix segfault in the dns64 module in the formaterror error path. 198292206Sdes - Fix sldns_wire2str_rdata_scan for malformed RRs. 199292206Sdes - tag for 1.5.6rc1 release. 200292206Sdes 201292206Sdes14 October 2015: Wouter 202292206Sdes - ANY responses include DNAME records if present, as per Evan Hunt's 203292206Sdes remark in dnsop. 204292206Sdes - Fix manpage to suggest using SIGTERM to terminate the server. 205292206Sdes 206292206Sdes9 October 2015: Wouter 207292206Sdes - Default for ssl-port is port 853, the temporary port assignment 208292206Sdes for secure domain name system traffic. 209292206Sdes If you used to rely on the older default of port 443, you have 210292206Sdes to put a clause in unbound.conf for that. The new value is likely 211292206Sdes going to be the standardised port number for this traffic. 212292206Sdes - iana portlist update. 213292206Sdes 214292206Sdes6 October 2015: Wouter 215292206Sdes - 1.5.5 release. 216292206Sdes - trunk tracks the development of 1.5.6. 217292206Sdes 218289063Sdes28 September 2015: Wouter 219289063Sdes - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution 220289063Sdes failures. 221289063Sdes - tag for 1.5.5rc1 release. 222289063Sdes - makedist.sh: pgp sig echo commands. 223289063Sdes 224289063Sdes25 September 2015: Wouter 225289063Sdes - Fix unbound-control flush that does not succeed in removing data. 226289063Sdes 227289063Sdes22 September 2015: Wouter 228289063Sdes - Fix config globbed include chroot treatment, this fixes reload of 229289063Sdes globs (patch from Dag-Erling Sm��rgrav). 230289063Sdes - iana portlist update. 231289063Sdes - Fix #702: New IPs for for h.root-servers.net. 232289063Sdes - Remove confusion comment from canonical_compare() function. 233289063Sdes - Fix #705: ub_ctx_set_fwd() return value mishandled on windows. 234289063Sdes - testbound selftest also works in non-debug mode. 235289063Sdes - Fix minor error in unbound.conf.5.in 236289063Sdes - Fix unbound.conf(5) access-control description for precedence 237289063Sdes and default. 238289063Sdes 239289063Sdes31 August 2015: Wouter 240289063Sdes - changed windows setup compression to be more transparent. 241289063Sdes 242289063Sdes28 August 2015: Wouter 243289063Sdes - Fix #697: Get PY_MAJOR_VERSION failure at configure for python 244289063Sdes 2.4 to 2.6. 245289063Sdes - Feature #699: --enable-pie option to that builds PIE binary. 246289063Sdes - Feature #700: --enable-relro-now option that enables full read-only 247289063Sdes relocation. 248289063Sdes 249289063Sdes24 August 2015: Wouter 250289063Sdes - Fix deadlock for local data add and zone add when unbound-control 251289063Sdes list_local_data printout is interrupted. 252289063Sdes - iana portlist update. 253289063Sdes - Change default of harden-algo-downgrade to off. This is lenient 254289063Sdes for algorithm rollover. 255289063Sdes 256289063Sdes13 August 2015: Wouter 257289063Sdes - 5011 implementation does not insist on all algorithms, when 258289063Sdes harden-algo-downgrade is turned off. 259289063Sdes - Reap the child process that libunbound spawns. 260289063Sdes 261289063Sdes11 August 2015: Wouter 262289063Sdes - Fix #694: configure script does not detect LibreSSL 2.2.2 263289063Sdes 264289063Sdes4 August 2015: Wouter 265289063Sdes - Document that local-zone nodefault matches exactly and transparent 266289063Sdes can be used to release a subzone. 267289063Sdes 268289063Sdes3 August 2015: Wouter 269289063Sdes - Document in the manual more text about configuring locally served 270289063Sdes zones. 271289063Sdes - Fix 5011 anchor update timer after reload. 272289063Sdes - Fix mktime in unbound-anchor not using UTC. 273289063Sdes 274289063Sdes30 July 2015: Wouter 275289063Sdes - please afl-gcc (llvm) for uninitialised variable warning. 276289063Sdes - Added permit-small-holddown config to debug fast 5011 rollover. 277289063Sdes 278289063Sdes24 July 2015: Wouter 279289063Sdes - Fix #690: Reload fails when so-reuseport is yes after changing 280289063Sdes num-threads. 281289063Sdes - iana portlist update. 282289063Sdes 283289063Sdes21 July 2015: Wouter 284289063Sdes - Fix configure to detect SSL_CTX_set_ecdh_auto. 285289063Sdes - iana portlist update. 286289063Sdes 287289063Sdes20 July 2015: Wouter 288289063Sdes - Enable ECDHE for servers. Where available, use 289289063Sdes SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to 290289063Sdes enable ECDHE. Otherwise, manually offer curve p256. 291289063Sdes Client connections should automatically use ECDHE when available. 292289063Sdes (thanks Daniel Kahn Gillmor) 293289063Sdes 294289063Sdes18 July 2015: Willem 295289063Sdes - Allow certificate chain files to allow for intermediate certificates. 296289063Sdes (thanks Daniel Kahn Gillmor) 297289063Sdes 298289063Sdes13 July 2015: Wouter 299289063Sdes - makedist produces sha1 and sha256 files for created binaries too. 300289063Sdes 301289063Sdes9 July 2015: Wouter 302289063Sdes - 1.5.4 release tag 303289063Sdes - trunk has 1.5.5 in development. 304289063Sdes - Fix #681: Setting forwarders with unbound-control forward 305289063Sdes implicitly turns on forward-first. 306289063Sdes 307287917Sdes29 June 2015: Wouter 308287917Sdes - iana portlist update. 309287917Sdes - Fix alloc with log for allocation size checks. 310287917Sdes 311287917Sdes26 June 2015: Wouter 312287917Sdes - Fix #677 Fix DNAME responses from cache that failed internal chain 313287917Sdes test. 314287917Sdes - iana portlist update. 315287917Sdes 316287917Sdes22 June 2015: Wouter 317287917Sdes - Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly 318287917Sdes and was therefore always synthesized (thanks to Valentin Dietrich). 319287917Sdes 320287917Sdes4 June 2015: Wouter 321287917Sdes - RFC 7553 RR type URI support, is now enabled by default. 322287917Sdes 323287917Sdes2 June 2015: Wouter 324287917Sdes - Fix #674: Do not free pointers given by getenv. 325287917Sdes 326287917Sdes29 May 2015: Wouter 327287917Sdes - Fix that unparseable error responses are ratelimited. 328287917Sdes - SOA negative TTL is capped at minimumttl in its rdata section. 329287917Sdes - cache-max-negative-ttl config option, default 3600. 330287917Sdes 331287917Sdes26 May 2015: Wouter 332287917Sdes - Document that ratelimit works with unbound-control set_option. 333287917Sdes 334287917Sdes21 May 2015: Wouter 335287917Sdes - iana portlist update. 336287917Sdes - documentation proposes ratelimit of 1000 (closer to what upstream 337287917Sdes servers expect from us). 338287917Sdes 339287917Sdes20 May 2015: Wouter 340287917Sdes - DLV is going to be decommissioned. Advice to stop using it, and 341287917Sdes put text in the example configuration and man page to that effect. 342287917Sdes 343287917Sdes10 May 2015: Wouter 344287917Sdes - Change syntax of particular validator error to be easier for 345287917Sdes machine parse, swap rrset and ip adres info so it looks like: 346287917Sdes validation failure <www.example.nl. TXT IN>: signature crypto 347287917Sdes failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN> 348287917Sdes 349287917Sdes1 May 2015: Wouter 350287917Sdes - caps-whitelist in unbound.conf allows whitelist of loadbalancers 351287917Sdes that cannot work with caps-for-id or its fallback. 352287917Sdes 353287917Sdes30 April 2015: Wouter 354287917Sdes - Unit test for type ANY synthesis. 355287917Sdes 356287917Sdes22 April 2015: Wouter 357287917Sdes - Removed contrib/unbound_unixsock.diff, because it has been 358287917Sdes integrated, use control-interface: /path in unbound.conf. 359287917Sdes - iana portlist update. 360287917Sdes 361287917Sdes17 April 2015: Wouter 362287917Sdes - Synthesize ANY responses from cache. Does not search exhaustively, 363287917Sdes but MX,A,AAAA,SOA,NS also CNAME. 364287917Sdes - Fix leaked dns64prefix configuration string. 365287917Sdes 366287917Sdes16 April 2015: Wouter 367287917Sdes - Add local-zone type inform_deny, that logs query and drops answer. 368287917Sdes - Ratelimit does not apply to prefetched queries, and ratelimit-factor 369287917Sdes is default 10. Repeated normal queries get resolved and with 370287917Sdes prefetch stay in the cache. 371287917Sdes - Fix bug#664: libunbound python3 related fixes (from Tomas Hozza) 372287917Sdes Use print_function also for Python2. 373287917Sdes libunbound examples: produce sorted output. 374287917Sdes libunbound-Python: libldns is not used anymore. 375287917Sdes Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns. 376287917Sdes 377287917Sdes10 April 2015: Wouter 378287917Sdes - unbound-control ratelimit_list lists high rate domains. 379287917Sdes - ratelimit feature, ratelimit: 100, or some sensible qps, can be 380287917Sdes used to turn it on. It ratelimits recursion effort per zone. 381287917Sdes For particular names you can configure exceptions in unbound.conf. 382287917Sdes - Fix that get_option for cache-sizes does not print double newline. 383287917Sdes - Fix#663: ssl handshake fails when using unix socket because dh size 384287917Sdes is too small. 385287917Sdes 386287917Sdes8 April 2015: Wouter 387287917Sdes - Fix crash in dnstap: Do not try to log TCP responses after timeout. 388287917Sdes 389287917Sdes7 April 2015: Wouter 390287917Sdes - Libunbound skips dos-line-endings from etc/hosts. 391287917Sdes - Unbound exits with a fatal error when the auto-trust-anchor-file 392287917Sdes fails to be writable. This is seconds after startup. You can 393287917Sdes load a readonly auto-trust-anchor-file with trust-anchor-file. 394287917Sdes The file has to be writable to notice the trust anchor change, 395287917Sdes without it, a trust anchor change will be unnoticed and the system 396287917Sdes will then become inoperable. 397287917Sdes - unbound-control list_insecure command shows the negative trust 398287917Sdes anchors currently configured, patch from Jelte Jansen. 399287917Sdes 400287917Sdes2 April 2015: Wouter 401287917Sdes - Fix #660: Fix interface-automatic broken in the presence of 402287917Sdes asymmetric routing. 403287917Sdes 404287917Sdes26 March 2015: Wouter 405287917Sdes - remote.c probedelay line is easier to read. 406287917Sdes - rename ldns subdirectory to sldns to avoid name collision. 407287917Sdes 408287917Sdes25 March 2015: Wouter 409287917Sdes - Fix #657: libunbound(3) recommends deprecated 410287917Sdes CRYPTO_set_id_callback. 411287917Sdes - If unknown trust anchor algorithm, and libressl is used, error 412287917Sdes message encourages upgrade of the libressl package. 413287917Sdes 414282089Sdes23 March 2015: Wouter 415282089Sdes - Fix segfault on user not found at startup (from Maciej Soltysiak). 416282089Sdes 417287917Sdes20 March 2015: Wouter 418287917Sdes - Fixed to add integer overflow checks on allocation (defense in depth). 419287917Sdes 420287917Sdes19 March 2015: Wouter 421287917Sdes - Add ip-transparent config option for bind to non-local addresses. 422287917Sdes 423287917Sdes17 March 2015: Wouter 424287917Sdes - Use reallocarray for integer overflow protection, patch submitted 425287917Sdes by Loganaden Velvindron. 426287917Sdes 427287917Sdes16 March 2015: Wouter 428287917Sdes - Fixup compile on cygwin, more portable openssl thread id. 429287917Sdes 430287917Sdes12 March 2015: Wouter 431287917Sdes - Updated default keylength in unbound-control-setup to 3k. 432287917Sdes 433287917Sdes10 March 2015: Wouter 434287917Sdes - Fix lintian warning in unbound-checkconf man page (from Andreas 435287917Sdes Schulze). 436287917Sdes - print svnroot when building windows dist. 437287917Sdes - iana portlist update. 438287917Sdes - Fix warning on sign compare in getentropy_linux. 439287917Sdes 440287917Sdes9 March 2015: Wouter 441287917Sdes - Fix #644: harden-algo-downgrade option, if turned off, fixes the 442287917Sdes reported excessive validation failure when multiple algorithms 443287917Sdes are present. It allows the weakest algorithm to validate the zone. 444287917Sdes - iana portlist update. 445287917Sdes 446287917Sdes5 March 2015: Wouter 447287917Sdes - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal 448287917Sdes scripts. Contributed by Yuri Voinov. 449287917Sdes - Document that incoming-num-tcp increase is good for large servers. 450287917Sdes - stats reports tcp usage, of incoming-num-tcp buffers. 451287917Sdes 452287917Sdes4 March 2015: Wouter 453287917Sdes - Patch from Brad Smith that syncs compat/getentropy_linux with 454287917Sdes OpenBSD's version (2015-03-04). 455287917Sdes - 0x20 fallback improved: servfail responses do not count as missing 456287917Sdes comparisons (except if all responses are errors), 457287917Sdes inability to find nameservers does not fail equality comparisons, 458287917Sdes many nameservers does not try to compare more than max-sent-count, 459287917Sdes parse failures start 0x20 fallback procedure. 460287917Sdes - store caps_response with best response in case downgrade response 461287917Sdes happens to be the last one. 462287917Sdes - Document windows 8 tests. 463287917Sdes 464287917Sdes3 March 2015: Wouter 465287917Sdes - tag 1.5.3rc1 466287917Sdes [ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ] 467287917Sdes 468282089Sdes2 March 2015: Wouter 469282089Sdes - iana portlist update. 470282089Sdes 471282089Sdes20 February 2015: Wouter 472282089Sdes - Use the getrandom syscall introduced in Linux 3.17 (from Heiner 473282089Sdes Kallweit). 474282089Sdes - Fix #645 Portability to Solaris 10, use AF_LOCAL. 475282089Sdes - Fix #646 Portability to Solaris, -lrt for getentropy_solaris. 476282089Sdes - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after 477282089Sdes reload. 478282089Sdes 479282089Sdes19 February 2015: Wouter 480282089Sdes - 1.5.2 release tag. 481282089Sdes - svn trunk contains 1.5.3 under development. 482282089Sdes 483282089Sdes13 February 2015: Wouter 484282089Sdes - Fix #643: doc/example.conf.in: unnecessary whitespace. 485282089Sdes 486282089Sdes12 February 2015: Wouter 487282089Sdes - tag 1.5.2rc1 488282089Sdes 489282089Sdes11 February 2015: Wouter 490282089Sdes - iana portlist update. 491282089Sdes 492282089Sdes10 February 2015: Wouter 493282089Sdes - Fix scrubber with harden-glue turned off to reject NS (and other 494282089Sdes not-address) records. 495282089Sdes 496282089Sdes9 February 2015: Wouter 497282089Sdes - Fix validation failure in case upstream forwarder (ISC BIND) does 498282089Sdes not have the same trust anchors and decides to insert unsigned NS 499282089Sdes record in authority section. 500282089Sdes 501282089Sdes2 February 2015: Wouter 502282089Sdes - infra-cache-min-rtt patch from Florian Riehm, for expected long 503282089Sdes uplink roundtrip times. 504282089Sdes 505282089Sdes30 January 2015: Wouter 506282089Sdes - Fix 0x20 capsforid fallback to omit gratuitous NS and additional 507282089Sdes section changes. 508282089Sdes - Portability fix for Solaris ('sun' is not usable for a variable). 509282089Sdes 510282089Sdes29 January 2015: Wouter 511282089Sdes - Fix pyunbound byte string representation for python3. 512282089Sdes 513282089Sdes26 January 2015: Wouter 514282089Sdes - Fix unintended use of gcc extension for incomplete enum types, 515282089Sdes compile with pedantic c99 compliance (from Daniel Dickman). 516282089Sdes 517282089Sdes23 January 2015: Wouter 518282089Sdes - windows port fixes, no AF_LOCAL, no chown, no chmod(grp). 519282089Sdes 520282089Sdes16 January 2015: Wouter 521282089Sdes - unit test for local unix connection. Documentation and log_addr 522282089Sdes does not inspect port for AF_LOCAL. 523282089Sdes - unbound-checkconf -f prints chroot with pidfile path. 524282089Sdes 525282089Sdes13 January 2015: Wouter 526282089Sdes - iana portlist update. 527282089Sdes 528282089Sdes12 January 2015: Wouter 529282089Sdes - Cast sun_len sizeof to socklen_t. 530282089Sdes - Fix pyunbound ord call, portable for python 2 and 3. 531282089Sdes 532282089Sdes7 January 2015: Wouter 533282089Sdes - Fix warnings in pythonmod changes. 534282089Sdes 535282089Sdes6 January 2015: Wouter 536282089Sdes - iana portlist update. 537277057Sdes - patch for remote control over local sockets, from Dag-Erling 538277057Sdes Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and 539277057Sdes control-use-cert: no. 540277057Sdes - Fixup that patch and uid lookup (only for daemon). 541277057Sdes - coded the default of control-use-cert, to yes. 542276605Sdes 543282089Sdes5 January 2015: Wouter 544282089Sdes - getauxval test for ppc64 linux compatibility. 545282089Sdes - make strip works for unbound-host and unbound-anchor. 546282089Sdes - patch from Stephane Lapie that adds to the python API, that 547282089Sdes exposes struct delegpt, and adds the find_delegation function. 548282089Sdes - print query name when max target count is exceeded. 549282089Sdes - patch from Stuart Henderson that fixes DESTDIR in 550282089Sdes unbound-control-setup for installs where config is not in 551282089Sdes the prefix location. 552282089Sdes - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing 553282089Sdes IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne). 554282089Sdes - Updated contrib warmup.cmd/sh to support two modes - load 555282089Sdes from pre-defined list of domains or (with filename as argument) 556282089Sdes load from user-specified list of domains, and updated contrib 557282089Sdes unbound_cache.sh/cmd to support loading/save/reload cache to/from 558282089Sdes default path or (with secondary argument) arbitrary path/filename, 559282089Sdes from Yuri Voinov. 560282089Sdes - Patch from Philip Paeps to contrib/unbound_munin_ that uses 561282089Sdes type ABSOLUTE. Allows munin.conf: [idleserver.example.net] 562282089Sdes unbound_munin_hits.graph_period minute 563282089Sdes 564282089Sdes9 December 2014: Wouter 565282089Sdes - svn trunk has 1.5.2 in development. 566282089Sdes - config.guess and config.sub update from libtoolize. 567282089Sdes - local-zone: example.com inform makes unbound log a message with 568282089Sdes client IP for queries in that zone. Eg. for finding infected hosts. 569282089Sdes 570282089Sdes8 December 2014: Wouter 571282089Sdes - Fix CVE-2014-8602: denial of service by making resolver chase 572282089Sdes endless series of delegations. 573282089Sdes 574276605Sdes1 December 2014: Wouter 575276605Sdes - Fix bug#632: unbound fails to build on AArch64, protects 576276605Sdes getentropy compat code from calling sysctl if it is has been removed. 577276605Sdes 578276605Sdes29 November 2014: Wouter 579276605Sdes - Add include to getentropy_linux.c, hopefully fixing debian build. 580276605Sdes 581276605Sdes28 November 2014: Wouter 582276605Sdes - Fix makefile for build from noexec source tree. 583276605Sdes 584276605Sdes26 November 2014: Wouter 585276605Sdes - Fix libunbound undefined symbol errors for main. 586276605Sdes Referencing main does not seem to be possible for libunbound. 587276605Sdes 588276605Sdes24 November 2014: Wouter 589276605Sdes - Fix log at high verbosity and memory allocation failure. 590276605Sdes - iana portlist update. 591276605Sdes 592276605Sdes21 November 2014: Wouter 593276605Sdes - Fix crash on multiple thread random usage on systems without 594276605Sdes arc4random. 595276605Sdes 596276605Sdes20 November 2014: Wouter 597276605Sdes - fix compat/getentropy_win.c check if CryptGenRandom works and no 598276605Sdes immediate exit on windows. 599276605Sdes 600276605Sdes19 November 2014: Wouter 601276605Sdes - Fix cdflag dns64 processing. 602276605Sdes 603276605Sdes18 November 2014: Wouter 604276605Sdes - Fix that CD flag disables DNS64 processing, returning the DNSSEC 605276605Sdes signed AAAA denial. 606276605Sdes - iana portlist update. 607276605Sdes 608276605Sdes17 November 2014: Wouter 609276605Sdes - Fix #627: SSL_CTX_load_verify_locations return code not properly 610276605Sdes checked. 611276605Sdes 612276605Sdes14 November 2014: Wouter 613276605Sdes - parser with bison 2.7 614276605Sdes 615276605Sdes13 November 2014: Wouter 616276605Sdes - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, 617276605Sdes added to contrib/aaaa-filter-iterator.patch. 618276605Sdes 619276605Sdes12 November 2014: Wouter 620276605Sdes - trunk has 1.5.1 in development. 621276605Sdes - Patch from Robert Edmonds to build pyunbound python module 622276605Sdes differently. No versioninfo, with -shared and without $(LIBS). 623276605Sdes - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page. 624276605Sdes - Removed 'increased limit open files' log message that is written 625276605Sdes to console. It is only written on verbosity 4 and higher. 626276605Sdes This keeps system bootup console cleaner. 627276605Sdes - Patch from James Raftery, always print stats for rcodes 0..5. 628276605Sdes 629276605Sdes11 November 2014: Wouter 630276605Sdes - iana portlist update. 631276605Sdes - Fix bug where forward or stub addresses with same address but 632276605Sdes different port number were not tried. 633276605Sdes - version number in svn trunk is 1.5.0 634276605Sdes - tag 1.5.0rc1 635276605Sdes - review fix from Ralph. 636276605Sdes 637276605Sdes7 November 2014: Wouter 638276605Sdes - dnstap fixes by Robert Edmonds: 639276605Sdes dnstap/dnstap.m4: cosmetic fixes 640276605Sdes dnstap/: Remove compiled protoc-c output files 641276605Sdes dnstap/dnstap.m4: Error out if required libraries are not found 642276605Sdes dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of 643276605Sdes protobuf-c 1.0.0 644276605Sdes dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0) 645276605Sdes 646276605Sdes4 November 2014: Wouter 647276605Sdes - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically 648276605Sdes tracked trust anchor to libunbound. 649276605Sdes - Redefine internal minievent symbols to unique symbols that helps 650276605Sdes linking on platforms where the linker leaks names across modules. 651276605Sdes 652276605Sdes27 October 2014: Wouter 653276605Sdes - Disabled use of SSLv3 in remote-control and ssl-upstream. 654276605Sdes - iana portlist update. 655276605Sdes 656276605Sdes16 October 2014: Wouter 657276605Sdes - Documented dns64 configuration in unbound.conf man page. 658276605Sdes 659276605Sdes13 October 2014: Wouter 660276605Sdes - Fix #617: in ldns in unbound, lowercase WKS services. 661276605Sdes - Fix ctype invocation casts. 662276605Sdes 663276605Sdes10 October 2014: Wouter 664276605Sdes - Fix unbound-checkconf check for module config with dns64 module. 665276605Sdes - Fix unbound capsforid fallback, it ignores TTLs in comparison. 666276605Sdes 667276605Sdes6 October 2014: Wouter 668276605Sdes - Fix #614: man page variable substitution bug. 669276605Sdes6 October 2014: Willem 670276605Sdes - Whitespaces after $ORIGIN are not part of the origin dname (ldns). 671276605Sdes - $TTL's value starts at position 5 (ldns). 672276605Sdes 673276605Sdes1 October 2014: Wouter 674276605Sdes - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire). 675276605Sdes 676276605Sdes29 September 2014: Wouter 677276605Sdes - Fix #612: create service with service.conf in present directory and 678276605Sdes auto load it. 679276605Sdes - Fix for mingw compile openssl ranlib. 680276605Sdes 681276605Sdes25 September 2014: Wouter 682276605Sdes - updated configure and aclocal with newer autoconf 1.13. 683276605Sdes 684276605Sdes22 September 2014: Wouter 685276605Sdes - Fix swig and python examples for Python 3.x. 686276605Sdes - Fix for mingw compile with openssl-1.0.1i. 687276605Sdes 688276605Sdes19 September 2014: Wouter 689276605Sdes - improve python configuration detection to build on Fedora 22. 690276605Sdes 691276605Sdes18 September 2014: Wouter 692276605Sdes - patches to also build with Python 3.x (from Pavel Simerda). 693276605Sdes 694276605Sdes16 September 2014: Wouter 695276605Sdes - Fix tcp timer waiting list removal code. 696276605Sdes - iana portlist update. 697276605Sdes - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue 698276605Sdes is longer and more tcp connections can be handled. 699276605Sdes 700276605Sdes15 September 2014: Wouter 701276605Sdes - Fix unit test for CDS typecode. 702276605Sdes 703276605Sdes5 September 2014: Wouter 704276605Sdes - type CDS and CDNSKEY types in sldns. 705276605Sdes 706276605Sdes25 August 2014: Wouter 707276605Sdes - Fixup checklock code for log lock and its mutual initialization 708276605Sdes dependency. 709276605Sdes - iana portlist update. 710276605Sdes - Removed necessity for pkg-config from the dnstap.m4, new are 711276605Sdes the --with-libfstrm and --with-protobuf-c configure options. 712276605Sdes 713276605Sdes19 August 2014: Wouter 714276605Sdes - Update unbound manpage with more explanation (from Florian Obser). 715276605Sdes 716276605Sdes18 August 2014: Wouter 717276605Sdes - Fix #603: unbound-checkconf -o <option> should skip verification 718276605Sdes checks. 719276605Sdes - iana portlist update. 720276605Sdes - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings. 721276605Sdes 722276605Sdes5 August 2014: Wouter 723276605Sdes - dnstap support, with a patch from Farsight Security, written by 724276605Sdes Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c. 725276605Sdes It is BSD licensed (see dnstap/dnstap.c). 726276605Sdes Building with --enable-dnstap needs pkg-config with this patch. 727276605Sdes - Noted dnstap in doc/README and doc/CREDITS. 728276605Sdes - Changes to the dnstap patch. 729276605Sdes - lint fixes. 730276605Sdes - dnstap/dnstap_config.h should not have been added to the repo, 731276605Sdes because is it generated. 732276605Sdes 733276605Sdes1 August 2014: Wouter 734276605Sdes - Patch add msg, rrset, infra and key cache sizes to stats command 735276605Sdes from Maciej Soltysiak. 736276605Sdes - iana portlist update. 737276605Sdes 738276605Sdes31 July 2014: Wouter 739276605Sdes - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault. 740276605Sdes Initial commit of the patch from the FreeBSD base (with its fixes). 741276605Sdes This adds a module (for module-config in unbound.conf) dns64 that 742276605Sdes performs DNS64 processing, see README.DNS64. 743276605Sdes - Changes from DNS64: 744276605Sdes strcpy changed to memmove. 745276605Sdes arraybound check fixed from prefix_net/8/4 to prefix_net/8+4. 746276605Sdes allocation of result consistently in the correct region. 747276605Sdes time_t is now used for ttl in unbound (since the patch's version). 748276605Sdes - testdata/dns64_lookup.rpl for unit test for dns64 functionality. 749276605Sdes 750276605Sdes29 July 2014: Wouter 751276605Sdes - Patch from Dag-Erling Smorgrav that implements feature, unbound -dd 752276605Sdes does not fork in the background and also logs to stderr. 753276605Sdes 754276605Sdes21 July 2014: Wouter 755276605Sdes - Fix endian.h include for OpenBSD. 756276605Sdes 757276605Sdes16 July 2014: Wouter 758276605Sdes - And Fix#596: Bail out of unbound-control dump_infra when ssl 759276605Sdes write fails. 760276605Sdes 761276605Sdes15 July 2014: Wouter 762276605Sdes - Fix #596: Bail out of unbound-control list_local_zones when ssl 763276605Sdes write fails. 764276605Sdes - iana portlist update. 765276605Sdes 766276605Sdes13 July 2014: Wouter 767276605Sdes - Configure tests if main can be linked to from getentropy compat. 768276605Sdes 769276605Sdes12 July 2014: Wouter 770276605Sdes - Fix getentropy compat code, function refs were not portable. 771276605Sdes - Fix to check openssl version number only for OpenSSL. 772276605Sdes - LibreSSL provides compat items, check for that in configure. 773276605Sdes - Fix bug in fix for log locks that caused deadlock in signal handler. 774276605Sdes - update compat/getentropy and arc4random to the most recent ones from OpenBSD. 775276605Sdes 776276605Sdes11 July 2014: Matthijs 777276605Sdes - fake-rfc2553 patch (thanks Benjamin Baier). 778276605Sdes 779276605Sdes11 July 2014: Wouter 780276605Sdes - arc4random in compat/ and getentropy, explicit_bzero, chacha for 781276605Sdes dependencies, from OpenBSD. arc4_lock and sha512 in compat. 782276605Sdes This makes arc4random available on all platforms, except when 783276605Sdes compiled with LIBNSS (it uses libNSS crypto random). 784276605Sdes - fix strptime implicit declaration error on OpenBSD. 785276605Sdes - arc4random, getentropy and explicit_bzero compat for Windows. 786276605Sdes 787276605Sdes4 July 2014: Wouter 788276605Sdes - Fix #593: segfault or crash upon rotating logfile. 789276605Sdes 790276605Sdes3 July 2014: Wouter 791276605Sdes - DLV tests added. 792276605Sdes - signit tool fixup for compile with libldns library. 793276605Sdes - iana portlist updated. 794276605Sdes 795276605Sdes27 June 2014: Wouter 796276605Sdes - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X. 797276605Sdes 798276605Sdes26 June 2014: Wouter 799276605Sdes - unbound-control status reports if so-reuseport was successful. 800276605Sdes - iana portlist updated. 801276605Sdes 802276605Sdes24 June 2014: Wouter 803276605Sdes - Fix caps-for-id fallback, and added fallback attempt when servers 804276605Sdes drop 0x20 perturbed queries. 805276605Sdes - Fixup testsetup for VM tests (run testcode/run_vm.sh). 806276605Sdes 807276605Sdes17 June 2014: Wouter 808276605Sdes - iana portlist updated. 809276605Sdes 810276605Sdes3 June 2014: Wouter 811276605Sdes - Add AAAA for B root server to default root hints. 812276605Sdes 813276605Sdes2 June 2014: Wouter 814276605Sdes - Remove unused define from iterator.h 815276605Sdes 816276605Sdes30 May 2014: Wouter 817276605Sdes - Fixup sldns_enum_edns_option typedef definition. 818276605Sdes 819276605Sdes28 May 2014: Wouter 820276605Sdes - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue 821276605Sdes fixes from FreeBSD's copy of Unbound, he notes: 822276605Sdes Generate unbound-control-setup.sh at build time so it respects 823276605Sdes prefix and sysconfdir from the configure script. Also fix the 824276605Sdes umask to match the comment, and the comment to match the umask. 825276605Sdes Add const and static where needed. Use unions instead of 826276605Sdes playing pointer poker. Move declarations that are needed in 827276605Sdes multiple source files into a shared header. Move sldns_bgetc() 828276605Sdes from parse.c to buffer.c where it belongs. Introduce a new 829276605Sdes header file, worker.h, which declares the callbacks that 830276605Sdes all workers must define. Remove those declarations from 831276605Sdes libworker.h. Include the correct headers in the correct places. 832276605Sdes Fix a few dummy callbacks that don't match their prototype. 833276605Sdes Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. 834276605Sdes Remove a useless printf which breaks reproducible builds. 835276605Sdes Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're 836276605Sdes no longer used. Add unbound-control-setup.sh to the list of 837276605Sdes generated files. The prototype for libworker_event_done_cb() 838276605Sdes needs to be moved from libunbound/libworker.h to 839276605Sdes libunbound/worker.h. 840276605Sdes - Fixup out-of-directory compile with unbound-control-setup.sh.in. 841276605Sdes - make depend. 842276605Sdes 843276605Sdes23 May 2014: Wouter 844276605Sdes - unbound-host -D enabled dnssec and reads root trust anchor from 845276605Sdes the default root key file that was compiled in. 846276605Sdes 847276605Sdes20 May 2014: Wouter 848276605Sdes - Feature, unblock-lan-zones: yesno that you can use to make unbound 849276605Sdes perform 10.0.0.0/8 and other reverse lookups normally, for use if 850276605Sdes unbound is running service for localhost on localhost. 851276605Sdes 852276605Sdes16 May 2014: Wouter 853276605Sdes - Updated create_unbound_ad_servers and unbound_cache scripts from 854276605Sdes Yuri Voinov in the source/contrib directory. Added 855276605Sdes warmup.cmd (and .sh): warm up the DNS cache with your MRU domains. 856276605Sdes 857276605Sdes9 May 2014: Wouter 858276605Sdes - Implement draft-ietf-dnsop-rfc6598-rfc6303-01. 859276605Sdes - iana portlist updated. 860276605Sdes 861276605Sdes8 May 2014: Wouter 862276605Sdes - Contrib windows scripts from Yuri Voinov added to src/contrib: 863276605Sdes create_unbound_ad_servers.cmd: enters anti-ad server lists. 864276605Sdes unbound_cache.cmd: saves and loads the cache. 865276605Sdes - Added unbound-control-setup.cmd from Yuri Voinov to the windows 866276605Sdes unbound distribution set. It requires openssl installed in %PATH%. 867276605Sdes 868276605Sdes6 May 2014: Wouter 869276605Sdes - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier. 870276605Sdes 871276605Sdes5 May 2014: Wouter 872276605Sdes - More #567: remove : from output of stub and forward lists, this is 873276605Sdes easier to parse. 874276605Sdes 875276605Sdes29 April 2014: Wouter 876276605Sdes - iana portlist updated. 877276605Sdes - Add unbound-control flush_negative that flushed nxdomains, nodata, 878276605Sdes and errors from the cache. For dnssec-trigger and NetworkManager, 879276605Sdes fixes cases where network changes have localdata that was already 880276605Sdes negatively cached from the previous network. 881276605Sdes 882276605Sdes23 April 2014: Wouter 883276605Sdes - Patch from Jeremie Courreges-Anglas to use arc4random_uniform 884276605Sdes if available on the OS, it gets entropy from the OS. 885276605Sdes 886276605Sdes15 April 2014: Wouter 887276605Sdes - Fix compile with libevent2 on FreeBSD. 888276605Sdes 889276605Sdes11 April 2014: Wouter 890276605Sdes - Fix #502: explain that do-ip6 disable does not stop AAAA lookups, 891276605Sdes but it stops the use of the ipv6 transport layer for DNS traffic. 892276605Sdes - iana portlist updated. 893276605Sdes 894276605Sdes10 April 2014: Wouter 895276605Sdes - iana portlist updated. 896276605Sdes - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation 897276605Sdes option for DNS fragmentation defense. 898276605Sdes - Document that dump_requestlist only prints queries from thread 0. 899276605Sdes - unbound-control stats prints num.query.tcpout with number of TCP 900276605Sdes outgoing queries made in the previous statistics interval. 901276605Sdes - Fix #567: unbound lists if forward zone is secure or insecure with 902276605Sdes +i annotation in output of list_forwards, also for list_stubs 903276605Sdes (for NetworkManager integration.) 904276605Sdes - Fix #554: use unsigned long to print 64bit statistics counters on 905276605Sdes 64bit systems. 906276605Sdes - Fix #558: failed prefetch lookup does not remove cached response 907276605Sdes but delays next prefetch (in lieu of caching a SERVFAIL). 908276605Sdes - Fix #545: improved logging, the ip address of the error is printed 909276605Sdes on the same log-line as the error. 910276605Sdes 911276605Sdes8 April 2014: Wouter 912276605Sdes - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control 913276605Sdes in testbound scripts. 914276605Sdes - iana portlist updated. 915276605Sdes 916276605Sdes7 April 2014: Wouter 917276605Sdes - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root 918276605Sdes hints (patch from Anand Buddhdev). 919276605Sdes - Fix #572: Fix unit test failure for systems with different 920276605Sdes /etc/services. 921276605Sdes 922276605Sdes28 March 2014: Wouter 923276605Sdes - Fix #569: do_tcp is do-tcp in unbound.conf man page. 924276605Sdes 925276605Sdes25 March 2014: Wouter 926276605Sdes - Patch from Stuart Henderson to build unbound-host man from .1.in. 927276605Sdes 928276605Sdes24 March 2014: Wouter 929276605Sdes - Fix print filename of encompassing config file on read failure. 930276605Sdes 931266114Sdes12 March 2014: Wouter 932266114Sdes - tag 1.4.22 933276605Sdes - trunk has 1.4.23 in development. 934266114Sdes 935266114Sdes10 March 2014: Wouter 936266114Sdes - Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes 937266114Sdes because of spelling. Patch from Chris Coates. 938266114Sdes 939266114Sdes27 February 2014: Wouter 940266114Sdes - tag 1.4.22rc1 941266114Sdes 942266114Sdes21 February 2014: Wouter 943266114Sdes - iana portlist updated. 944266114Sdes 945266114Sdes20 February 2014: Matthijs 946266114Sdes - Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is 947266114Sdes received. This is okay according 4035, but not after revising 948266114Sdes existence in 4592. NSEC empty non-terminals exist and thus the 949266114Sdes RCODE should have been NOERROR. If this occurs, and the RRsets 950266114Sdes are secure, we set the RCODE to NOERROR and the security status 951292206Sdes of the response is also considered secure. 952266114Sdes 953266114Sdes14 February 2014: Wouter 954266114Sdes - Works on Minix (3.2.1). 955266114Sdes 956266114Sdes11 February 2014: Wouter 957266114Sdes - Fix parse of #553(NSD) string in sldns, quotes without spaces. 958266114Sdes 959266114Sdes7 February 2014: Wouter 960266114Sdes - iana portlist updated. 961266114Sdes - add body to ifstatement if locks disabled. 962266114Sdes - add TXT string"string" test case to unit test. 963266114Sdes - Fix #551: License change "Regents" to "Copyright holder", matching 964266114Sdes the BSD license on opensource.org. 965266114Sdes 966266114Sdes6 February 2014: Wouter 967266114Sdes - sldns has type HIP. 968266114Sdes - code documentation on the module interface. 969266114Sdes 970266114Sdes5 February 2014: Wouter 971266114Sdes - Fix sldns parse tests on osx. 972266114Sdes 973266114Sdes3 February 2014: Wouter 974266114Sdes - Detect libevent2 install automatically by configure. 975266114Sdes - Fixup link with lib/event2 subdir. 976266114Sdes - Fix parse in sldns of quoted parenthesized text strings. 977266114Sdes 978266114Sdes31 January 2014: Wouter 979266114Sdes - unit test for ldns wire to str and back with zones, root, nlnetlabs 980266114Sdes and types.sidnlabs. 981266114Sdes - Fix for hex to string in unknown, atma and nsap. 982266114Sdes - fixup nss compile (no ldns in it). 983266114Sdes - fixup warning in unitldns 984266114Sdes - fixup WKS and rdata type service to print unsigned because strings 985266114Sdes are not portable; they cannot be read (for sure) on other computers. 986266114Sdes - fixup type EUI48 and EUI64, type APL and type IPSECKEY in string 987266114Sdes parse sldns. 988266114Sdes 989266114Sdes30 January 2014: Wouter 990266114Sdes - delay-close does not act if there are udp-wait queries, so that 991266114Sdes it does not make a socketdrain DoS easier. 992266114Sdes 993266114Sdes28 January 2014: Wouter 994266114Sdes - iana portlist updated. 995266114Sdes - iana portlist test updated so it does not touch the source 996266114Sdes if there are no changes. 997266114Sdes - delay-close: msec option that delays closing ports for which 998266114Sdes the UDP reply has timed out. Keeps the port open, only accepts 999266114Sdes the correct reply. This correct reply is not used, but the port 1000266114Sdes is open so that no port-denied ICMPs are generated. 1001266114Sdes 1002266114Sdes27 January 2014: Wouter 1003266114Sdes - reuseport is attempted, then fallback to without on failure. 1004266114Sdes 1005266114Sdes24 January 2014: Wouter 1006266114Sdes - Change unbound-event.h to use void* buffer, length idiom. 1007266114Sdes - iana portlist updated. 1008266114Sdes - unbound-event.h is installed if you configure --enable-event-api. 1009266114Sdes - speed up unbound (reports say it could be up to 10%), by reducing 1010266114Sdes lock contention on localzones.lock. It is changed to an rwlock. 1011266114Sdes - so-reuseport: yesno option to distribute queries evenly over 1012266114Sdes threads on Linux (Thanks Robert Edmonds). 1013266114Sdes - made lint clean. 1014266114Sdes 1015266114Sdes21 January 2014: Wouter 1016266114Sdes - Fix #547: no trustanchor written if filesystem full, fclose checked. 1017266114Sdes 1018266114Sdes17 January 2014: Wouter 1019266114Sdes - Fix isprint() portability in sldns, uses unsigned int. 1020266114Sdes - iana portlist updated. 1021266114Sdes 1022266114Sdes16 January 2014: Wouter 1023266114Sdes - fix #544: Fixed +i causes segfault when running with module conf 1024266114Sdes "iterator". 1025266114Sdes - Windows port, adjust %lld to %I64d, and warning in win_event.c. 1026266114Sdes 1027266114Sdes14 January 2014: Wouter 1028266114Sdes - iana portlist updated. 1029266114Sdes 1030266114Sdes5 Dec 2013: Wouter 1031266114Sdes - Fix bug in cachedump that uses sldns. 1032266114Sdes - update pythonmod for ldns_ to sldns_ name change. 1033266114Sdes 1034266114Sdes3 Dec 2013: Wouter 1035266114Sdes - Fix sldns to use sldns_ prefix for all ldns_ variables. 1036266114Sdes - Fix windows compile to compile with sldns. 1037266114Sdes 1038266114Sdes30 Nov 2013: Wouter 1039266114Sdes - Fix sldns to make globals use sldns_ prefix. This fixes 1040266114Sdes linking with libldns that uses global variables ldns_ . 1041266114Sdes 1042266114Sdes13 Nov 2013: Wouter 1043266114Sdes - Fix bug#537: compile python plugin without ldns library. 1044266114Sdes 1045266114Sdes12 Nov 2013: Wouter 1046266114Sdes - Fix bug#536: acl_deny_non_local and refuse_non_local added. 1047266114Sdes 1048266114Sdes5 Nov 2013: Wouter 1049266114Sdes - Patch from Neel Goyal to fix async id assignment if callback 1050266114Sdes is called by libunbound in the mesh attach. 1051266114Sdes - Accept ip-address: as an alternative for interface: for 1052266114Sdes consistency with nsd.conf syntax. 1053266114Sdes 1054266114Sdes4 Nov 2013: Wouter 1055266114Sdes - Patch from Neel Goyal to fix callback in libunbound. 1056266114Sdes 1057266114Sdes3 Nov 2013: Wouter 1058266114Sdes - if configured --with-libunbound-only fix make install. 1059266114Sdes 1060266114Sdes31 Oct 2013: Wouter 1061266114Sdes - Fix #531: Set SO_REUSEADDR so that the wildcard interface and a 1062266114Sdes more specific interface port 53 can be used at the same time, and 1063266114Sdes one of the daemons is unbound. 1064266114Sdes - iana portlist update. 1065266114Sdes - separate ldns into core ldns inside ldns/ subdirectory. No more 1066266114Sdes --with-ldns is needed and unbound does not rely on libldns. 1067266114Sdes - portability fixes for new USE_SLDNS ldns subdir codebase. 1068266114Sdes 1069266114Sdes22 Oct 2013: Wouter 1070266114Sdes - Patch from Neel Goyal: Add an API call to set an event base on an 1071266114Sdes existing ub_ctx. This basically just destroys the current worker and 1072266114Sdes sets the event base to the current. And fix a deadlock in 1073266114Sdes ub_resolve_event ��� the cfglock is held when libworker_create is 1074266114Sdes called. This ends up trying to acquire the lock again in 1075266114Sdes context_obtain_alloc in the call chain. 1076266114Sdes - Fix #528: if very high logging (4 or more) segfault on allow_snoop. 1077266114Sdes 1078266114Sdes26 Sep 2013: Wouter 1079266114Sdes - unbound-event.h is installed if configured --with-libevent. It 1080266114Sdes contains low-level library calls, that use libevent's event_base 1081266114Sdes and an ldns_buffer for the wire return packet to perform async 1082266114Sdes resolution in the client's eventloop. 1083266114Sdes 1084266114Sdes19 Sep 2013: Wouter 1085266114Sdes - 1.4.21 tag created. 1086266114Sdes - trunk has 1.4.22 number inside it. 1087266114Sdes - iana portlist updated. 1088266114Sdes - acx_nlnetlabs.m4 to 26; improve FLTO help text. 1089266114Sdes 1090266114Sdes16 Sep 2013: Wouter 1091266114Sdes - Fix#524: max-udp-size not effective to non-EDNS0 queries, from 1092266114Sdes Daisuke HIGASHI. 1093266114Sdes 1094266114Sdes10 Sep 2013: Wouter 1095266114Sdes - MIN_TTL and MAX_TTL also in time_t. 1096266114Sdes - tag 1.4.21rc1 made again. 1097266114Sdes 1098266114Sdes26 Aug 2013: Wouter 1099266114Sdes - More fixes for bug#519: for the threaded case test if the bg 1100266114Sdes thread has been killed, on ub_ctx_delete, to avoid hangs. 1101266114Sdes 1102266114Sdes22 Aug 2013: Wouter 1103266114Sdes - more fixes that I overlooked. 1104266114Sdes - review fixes from Willem. 1105266114Sdes 1106266114Sdes21 Aug 2013: Wouter 1107266114Sdes - Fix#520: Errors found by static analysis from Tomas Hozza(redhat). 1108266114Sdes 1109266114Sdes20 Aug 2013: Wouter 1110266114Sdes - Fix for 2038, with time_t instead of uint32_t. 1111266114Sdes 1112266114Sdes19 Aug 2013: Wouter 1113266114Sdes - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound). 1114266114Sdes 1115266114Sdes14 Aug 2013: Wouter 1116266114Sdes - Fix uninit variable in fix#516. 1117266114Sdes 1118266114Sdes8 Aug 2013: Wouter 1119266114Sdes - Fix#516 dnssec lameness detection for answers that are improper. 1120266114Sdes 1121266114Sdes30 Jun 2013: Wouter 1122266114Sdes - tag 1.4.21rc1 1123266114Sdes 1124266114Sdes29 Jun 2013: Wouter 1125266114Sdes - Fix#512 memleak in testcode for testbound (if it fails). 1126266114Sdes - Fix#512 NSS returned arrays out of setup function to be statics. 1127266114Sdes 1128266114Sdes26 Jun 2013: Wouter 1129266114Sdes - max include of 100.000 files (depth and globbed at one time). 1130266114Sdes This is to preserve system memory in bug cases, or endless cases. 1131266114Sdes - iana portlist updated. 1132266114Sdes 1133266114Sdes19 Jun 2013: Wouter 1134266114Sdes - streamtcp man page, contributed by Tomas Hozza. 1135266114Sdes - iana portlist updated. 1136266114Sdes - libunbound documentation on how to avoid openssl race conditions. 1137266114Sdes 1138266114Sdes25 Jun 2013: Wouter 1139266114Sdes - Squelch sendto-permission denied errors when the network is 1140266114Sdes not connected, to avoid spamming syslog. 1141266114Sdes - configure --disable-flto option (from Robert Edmonds). 1142266114Sdes 1143266114Sdes18 Jun 2013: Wouter 1144266114Sdes - Fix for const string literals in C++ for libunbound, from Karel 1145266114Sdes Slany. 1146266114Sdes - iana portlist updated. 1147266114Sdes 1148266114Sdes17 Jun 2013: Wouter 1149266114Sdes - Fixup manpage syntax. 1150266114Sdes 1151266114Sdes14 Jun 2013: Wouter 1152266114Sdes - get_option and set_option support for log-time-ascii, python-script 1153266114Sdes val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect 1154266114Sdes immediately. The others are mostly useful for libunbound users. 1155266114Sdes 1156266114Sdes13 Jun 2013: Wouter 1157266114Sdes - get_option, set_option, unbound-checkconf -o and libunbound 1158266114Sdes getoption and setoption support cache-min-ttl and cache-max-ttl. 1159266114Sdes 1160266114Sdes10 Jun 2013: Wouter 1161266114Sdes - Fix#501: forward-first does not recurse, when forward name is ".". 1162266114Sdes - iana portlist update. 1163266114Sdes - Max include depth is unlimited. 1164266114Sdes 1165266114Sdes27 May 2013: Wouter 1166266114Sdes - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply 1167266114Sdes patch to it to not fail when -Werror is also specified, from the 1168266114Sdes autoconf-archives. 1169266114Sdes - iana portlist update. 1170266114Sdes 1171266114Sdes21 May 2013: Wouter 1172266114Sdes - Explain bogus and secure flags in libunbound more. 1173266114Sdes 1174266114Sdes16 May 2013: Wouter 1175266114Sdes - Fix#499 use-after-free in out-of-memory handling code (thanks Jake 1176266114Sdes Montgomery). 1177266114Sdes - Fix#500 use on non-initialised values on socket bind failures. 1178266114Sdes 1179266114Sdes15 May 2013: Wouter 1180266114Sdes - Fix round-robin doesn't work with some Windows clients (from Ilya 1181266114Sdes Bakulin). 1182266114Sdes 1183266114Sdes3 May 2013: Wouter 1184266114Sdes - update acx_nlnetlabs.m4 to v23, sleep w32 fix. 1185266114Sdes 1186266114Sdes26 April 2013: Wouter 1187266114Sdes - add unbound-control insecure_add and insecure_remove for the 1188266114Sdes administration of negative trust anchors. 1189266114Sdes 1190266114Sdes25 April 2013: Wouter 1191266114Sdes - Implement max-udp-size config option, default 4096 (thanks 1192266114Sdes Daisuke Higashi). 1193266114Sdes - Robust checks on dname validity from rdata for dname compare. 1194266114Sdes - updated iana portlist. 1195266114Sdes 1196266114Sdes19 April 2013: Wouter 1197266114Sdes - Fixup snprintf return value usage, fixed libunbound_get_option. 1198266114Sdes 1199266114Sdes18 April 2013: Wouter 1200266114Sdes - fix bug #491: pick program name (0th argument) as syslog identity. 1201266114Sdes - own implementation of compat/snprintf.c. 1202266114Sdes 1203266114Sdes15 April 2013: Wouter 1204266114Sdes - Fix so that for a configuration line of include: "*.conf" it is not 1205266114Sdes an error if there are no files matching the glob pattern. 1206266114Sdes - unbound-anchor review: BIO_write can return 0 successfully if it 1207266114Sdes has successfully appended a zero length string. 1208266114Sdes 1209266114Sdes11 April 2013: Wouter 1210266114Sdes - Fix queries leaking up for stubs and forwards, if the configured 1211266114Sdes nameservers all fail to answer. 1212266114Sdes 1213266114Sdes10 April 2013: Wouter 1214266114Sdes - code improve for minimal responses, small speed increase. 1215266114Sdes 1216266114Sdes9 April 2013: Wouter 1217266114Sdes - updated iana portlist. 1218266114Sdes - Fix crash in previous private address fixup of 22 March. 1219266114Sdes 1220266114Sdes28 March 2013: Wouter 1221266114Sdes - Make reverse zones easier by documenting the nodefault statements 1222266114Sdes commented-out in the example config file. 1223266114Sdes 1224266114Sdes26 March 2013: Wouter 1225266114Sdes - more fixes to lookup3.c endianness detection. 1226266114Sdes 1227266114Sdes25 March 2013: Wouter 1228266114Sdes - #492: Fix endianness detection, revert to older lookup3.c detection 1229266114Sdes and put new detect lines after previous tests, to avoid regressions 1230266114Sdes but allow new detections to succeed. 1231266114Sdes And add detection for machine/endian.h to it. 1232266114Sdes 1233266114Sdes22 March 2013: Wouter 1234266114Sdes - Fix resolve of names that use a mix of public and private addresses. 1235266114Sdes - iana portlist update. 1236266114Sdes - Fix makedist for new svn for -d option. 1237266114Sdes - unbound.h header file has UNBOUND_VERSION_MAJOR define. 1238266114Sdes - Fix windows RSRC version for long version numbers. 1239266114Sdes 1240249141Sdes21 March 2013: Wouter 1241249141Sdes - release 1.4.20 1242266114Sdes - trunk has 1.4.21 1243266114Sdes - committed libunbound version 4:1:2 for binary API updated in 1.4.20 1244266114Sdes - install copy of unbound-control.8 man page for unbound-control-setup 1245249141Sdes 1246249141Sdes14 March 2013: Wouter 1247249141Sdes - iana portlist update. 1248249141Sdes - tag 1.4.20rc1 1249249141Sdes 1250249141Sdes12 March 2013: Wouter 1251249141Sdes - Fixup makedist.sh for windows compile. 1252249141Sdes 1253249141Sdes11 March 2013: Wouter 1254249141Sdes - iana portlist update. 1255249141Sdes - testcode/ldns-testpkts.c check for makedist is informational. 1256249141Sdes 1257249141Sdes15 February 2013: Wouter 1258249141Sdes - fix defines in lookup3 for bigendian bsd alpha 1259249141Sdes 1260249141Sdes11 February 2013: Wouter 1261249141Sdes - Fixup openssl_thread init code to only run if compiled with SSL. 1262249141Sdes 1263249141Sdes7 February 2013: Wouter 1264249141Sdes - detect endianness in lookup3 on BSD. 1265249141Sdes - add libunbound.ttl at end of result structure, version bump for 1266249141Sdes libunbound and binary backwards compatible, but 1.4.19 is not 1267249141Sdes forward compatible with 1.4.20. 1268249141Sdes - update iana port list. 1269249141Sdes 1270249141Sdes30 January 2013: Wouter 1271249141Sdes - includes and have_ssl fixes for nss. 1272249141Sdes 1273249141Sdes29 January 2013: Wouter 1274249141Sdes - printout name of zone with duplicate fwd and hint errors. 1275249141Sdes 1276249141Sdes28 January 2013: Wouter 1277249141Sdes - updated fwd_zero for newer nc. Updated common.sh for newer netstat. 1278249141Sdes 1279249141Sdes17 January 2013: Wouter 1280249141Sdes - unbound-anchors checks the emailAddress of the signer of the 1281249141Sdes root.xml file, default is dnssec@iana.org. It also checks that 1282249141Sdes the signer has the correct key usage for a digital signature. 1283249141Sdes - update iana port list. 1284249141Sdes 1285249141Sdes3 January 2013: Wouter 1286249141Sdes - Test that unbound-control checks client credentials. 1287249141Sdes - Test that unbound can handle a CNAME at an intermediate node in 1288249141Sdes the chain of trust (where it seeks a DS record). 1289249141Sdes - Check the commonName of the signer of the root.xml file in 1290249141Sdes unbound-anchor, default is dnssec@iana.org. 1291249141Sdes 1292249141Sdes2 January 2013: Wouter 1293249141Sdes - Fix openssl lock free on exit (reported by Robert Fleischman). 1294249141Sdes - iana portlist updated. 1295249141Sdes - Tested that unbound implements the RFC5155 Technical Errata id 3441. 1296249141Sdes Unbound already implements insecure classification of an empty 1297249141Sdes nonterminal in NSEC3 optout zone. 1298249141Sdes 1299249141Sdes20 December 2012: Wouter 1300249141Sdes - Fix unbound-anchor xml parse of entity declarations for safety. 1301249141Sdes 1302249141Sdes19 December 2012: Wouter 1303249141Sdes - iana portlist updated. 1304249141Sdes 1305249141Sdes18 December 2012: Wouter 1306249141Sdes - iana portlist updated. 1307249141Sdes 1308249141Sdes14 December 2012: Wouter 1309249141Sdes - Change of D.ROOT-SERVERS.NET A address in default root hints. 1310249141Sdes 1311249141Sdes12 December 2012: Wouter 1312249141Sdes - 1.4.19 release. 1313249141Sdes - trunk has 1.4.20 under development. 1314249141Sdes 1315249141Sdes5 December 2012: Wouter 1316249141Sdes - note support for AAAA RR type RFC. 1317249141Sdes 1318249141Sdes4 December 2012: Wouter 1319249141Sdes - 1.4.19rc1 tag. 1320249141Sdes 1321249141Sdes30 November 2012: Wouter 1322249141Sdes - bug 481: fix python example0. 1323249141Sdes - iana portlist updated. 1324249141Sdes 1325249141Sdes27 November 2012: Wouter 1326249141Sdes - iana portlist updated. 1327249141Sdes 1328249141Sdes9 November 2012: Wouter 1329249141Sdes - Fix unbound-control forward disables configured stubs below it. 1330249141Sdes 1331249141Sdes7 November 2012: Wouter 1332249141Sdes - Fixup ldns-testpkts, identical to ldns/examples. 1333249141Sdes - iana portlist updated. 1334249141Sdes 1335249141Sdes30 October 2012: Wouter 1336249141Sdes - Fix bug #477: unbound-anchor segfaults if EDNS is blocked. 1337249141Sdes 1338249141Sdes29 October 2012: Matthijs 1339249141Sdes - Fix validation for responses with both CNAME and wildcard 1340249141Sdes expanded CNAME records in answer section. 1341249141Sdes 1342249141Sdes8 October 2012: Wouter 1343249141Sdes - update ldns-testpkts.c to ldns 1.6.14 version. 1344249141Sdes - fix build of pythonmod in objdir, for unbound.py. 1345249141Sdes - make clean and makerealclean remove generated python and docs. 1346249141Sdes 1347249141Sdes5 October 2012: Wouter 1348249141Sdes - fix build of pythonmod in objdir (thanks Jakob Schlyter). 1349249141Sdes 1350249141Sdes3 October 2012: Wouter 1351249141Sdes - fix text in unbound-anchor man page. 1352249141Sdes 1353249141Sdes1 October 2012: Wouter 1354249141Sdes - ignore trusted-keys globs that have no files (from Paul Wouters). 1355249141Sdes 1356249141Sdes27 September 2012: Wouter 1357249141Sdes - include: directive in config file accepts wildcards. Patch from 1358249141Sdes Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*" 1359249141Sdes - unbound-control -q option is quiet, patch from Mariano Absatz. 1360249141Sdes - iana portlist updated. 1361249141Sdes - updated contrib/unbound.spec, patch from Valentin Bud. 1362249141Sdes 1363249141Sdes21 September 2012: Wouter 1364249141Sdes - chdir to / after chroot call (suggested by Camiel Dobbelaar). 1365249141Sdes 1366249141Sdes17 September 2012: Wouter 1367249141Sdes - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation 1368249141Sdes otherwise it is treated as insecure. The RSAMD5 algorithm is 1369249141Sdes deprecated (RFC6725). The MD5 hash is considered weak for some 1370249141Sdes purposes, if you want to sign your zone, then RSASHA256 is an 1371249141Sdes uncontested hash. 1372249141Sdes 1373249141Sdes30 August 2012: Wouter 1374249141Sdes - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled. 1375249141Sdes - iana portlist updated. 1376249141Sdes 1377249141Sdes29 August 2012: Wouter 1378249141Sdes - Nicer comments outgoing-port-avoid, thanks Stu (bug #465). 1379249141Sdes 1380249141Sdes22 August 2012: Wouter 1381249141Sdes - Fallback to 1472 and 1232, one fragment size without headers. 1382249141Sdes 1383249141Sdes21 August 2012: Wouter 1384249141Sdes - Fix timeouts so that when a server has been offline for a while 1385249141Sdes and is probed to see it works, it becomes fully available for 1386249141Sdes server selection again. 1387249141Sdes 1388249141Sdes17 August 2012: Wouter 1389249141Sdes - Add documentation to libunbound for default nonuse of resolv.conf. 1390249141Sdes 1391249141Sdes2 August 2012: Wouter 1392249141Sdes - trunk has 1.4.19 under development (fixes from 1 aug and 31 july 1393249141Sdes are for 1.4.19). 1394249141Sdes - iana portlist updated. 1395249141Sdes 1396249141Sdes1 August 2012: Wouter 1397249141Sdes - Fix openssl race condition, initializes openssl locks, reported 1398249141Sdes by Einar Lonn and Patrik Wallstrom. 1399249141Sdes 1400249141Sdes31 July 2012: Wouter 1401249141Sdes - Improved forward-first and stub-first documentation. 1402249141Sdes - Fix that enables modules to register twice for the same 1403249141Sdes serviced_query, without race conditions or administration issues. 1404249141Sdes This should not happen with the current codebase, but it is robust. 1405249141Sdes - Fix forward-first option where it sets the RD flag wrongly. 1406249141Sdes - added manpage links for libunbound calls (Thanks Paul Wouters). 1407249141Sdes 1408249141Sdes30 July 2012: Wouter 1409249141Sdes - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012). 1410249141Sdes 1411249141Sdes27 July 2012: Wouter 1412249141Sdes - unbound-host works with libNSS 1413249141Sdes - fix bogus nodata cname chain not reported as bogus by validator, 1414249141Sdes (Thanks Peter van Dijk). 1415249141Sdes 1416249141Sdes26 July 2012: Wouter 1417249141Sdes - iana portlist updated. 1418249141Sdes - tag 1.4.18rc1. 1419249141Sdes 1420249141Sdes25 July 2012: Wouter 1421249141Sdes - review fix for libnss, check hash prefix allocation size. 1422249141Sdes 1423249141Sdes23 July 2012: Wouter 1424249141Sdes - fix missing break for GOST DS hash function. 1425249141Sdes - implemented forward_first for the root. 1426249141Sdes 1427249141Sdes20 July 2012: Wouter 1428249141Sdes - Fix bug#452 and another assertion failure in mesh.c, makes 1429249141Sdes assertions in mesh.c resist duplicates. Fixes DS NS search to 1430249141Sdes not generate duplicate sub queries. 1431249141Sdes 1432249141Sdes19 July 2012: Willem 1433249141Sdes - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac, 1434249141Sdes if CFLAGS is specified at configure time then '-g -O2' is not 1435249141Sdes appended to CFLAGS, so that the user can override them. 1436249141Sdes 1437249141Sdes18 July 2012: Willem 1438249141Sdes - Fix libunbound report of errors when in background mode. 1439249141Sdes 1440249141Sdes11 July 2012: Willem 1441249141Sdes - updated iana ports list. 1442249141Sdes 1443249141Sdes9 July 2012: Willem 1444249141Sdes - Add flush_bogus option for unbound-control 1445249141Sdes 1446249141Sdes6 July 2012: Wouter 1447249141Sdes - Fix validation of qtype DS queries that result in no data for 1448249141Sdes non-optout NSEC3 zones. 1449249141Sdes 1450249141Sdes4 July 2012: Wouter 1451249141Sdes - compile libunbound with libnss on Suse, passes regression tests. 1452249141Sdes 1453249141Sdes3 July 2012: Wouter 1454249141Sdes - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes. 1455249141Sdes 1456249141Sdes2 July 2012: Wouter 1457249141Sdes - updated iana ports list. 1458249141Sdes 1459249141Sdes29 June 2012: Wouter 1460249141Sdes - patch for unbound_munin_ script to handle arbitrary thread count by 1461249141Sdes Sven Ulland. 1462249141Sdes 1463249141Sdes28 June 2012: Wouter 1464249141Sdes - detect if openssl has FIPS_mode. 1465249141Sdes - code review: return value of cache_store can be ignored for better 1466249141Sdes performance in out of memory conditions. 1467249141Sdes - fix edns-buffer-size and msg-buffer-size manpage documentation. 1468249141Sdes - updated iana ports list. 1469249141Sdes 1470249141Sdes25 June 2012: Wouter 1471249141Sdes - disable RSAMD5 if in FIPS mode (for openssl and for libnss). 1472249141Sdes 1473249141Sdes22 June 2012: Wouter 1474249141Sdes - implement DS records, NSEC3 and ECDSA for compile with libnss. 1475249141Sdes 1476249141Sdes21 June 2012: Wouter 1477249141Sdes - fix error handling of alloc failure during rrsig verification. 1478249141Sdes - nss check for verification failure. 1479249141Sdes - nss crypto works for RSA and DSA. 1480249141Sdes 1481249141Sdes20 June 2012: Wouter 1482249141Sdes - work on --with-nss build option (for now, --with-libunbound-only). 1483249141Sdes 1484249141Sdes19 June 2012: Wouter 1485249141Sdes - --with-libunbound-only build option, only builds the library and 1486249141Sdes not the daemon and other tools. 1487249141Sdes 1488249141Sdes18 June 2012: Wouter 1489249141Sdes - code review. 1490249141Sdes 1491249141Sdes15 June 2012: Wouter 1492249141Sdes - implement log-time-ascii on windows. 1493249141Sdes - The key-cache bad key ttl is now 60 seconds. 1494249141Sdes - updated iana ports list. 1495249141Sdes - code review. 1496249141Sdes 1497249141Sdes11 June 2012: Wouter 1498249141Sdes - bug #452: fix crash on assert in mesh_state_attachment. 1499249141Sdes 1500249141Sdes30 May 2012: Wouter 1501249141Sdes - silence warning from swig-generated code (md set but not used in 1502249141Sdes swig initmodule, due to ifdefs in swig-generated code). 1503249141Sdes 1504249141Sdes27 May 2012: Wouter 1505249141Sdes - Fix debian-bugs-658021: Please enable hardened build flags. 1506249141Sdes 1507249141Sdes25 May 2012: Wouter 1508249141Sdes - updated iana ports list. 1509249141Sdes 1510238106Sdes24 May 2012: Wouter 1511238106Sdes - tag for 1.4.17 release. 1512249141Sdes - trunk is 1.4.18 in development. 1513238106Sdes 1514238106Sdes18 May 2012: Wouter 1515238106Sdes - Review comments, removed duplicate memset to zero in delegpt. 1516238106Sdes 1517238106Sdes16 May 2012: Wouter 1518238106Sdes - Updated doc/FEATURES with RFCs that are implemented but not listed. 1519238106Sdes - Protect if statements in val_anchor for compile without locks. 1520238106Sdes - tag for 1.4.17rc1. 1521238106Sdes 1522238106Sdes15 May 2012: Wouter 1523238106Sdes - fix configure ECDSA support in ldns detection for windows compile. 1524238106Sdes - fix possible uninitialised variable in windows pipe implementation. 1525238106Sdes 1526238106Sdes9 May 2012: Wouter 1527238106Sdes - Fix alignment problem in util/random on sparc64/freebsd. 1528238106Sdes 1529238106Sdes8 May 2012: Wouter 1530238106Sdes - Fix for accept spinning reported by OpenBSD. 1531238106Sdes - iana portlist updated. 1532238106Sdes 1533238106Sdes2 May 2012: Wouter 1534238106Sdes - Fix validation of nodata for DS query in NSEC zones, reported by 1535238106Sdes Ondrej Mikle. 1536238106Sdes 1537238106Sdes13 April 2012: Wouter 1538238106Sdes - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older 1539238106Sdes openssl. 1540238106Sdes 1541238106Sdes10 April 2012: Wouter 1542238106Sdes - Applied patch from Daisuke HIGASHI for rrset-roundrobin and 1543238106Sdes minimal-responses features. 1544238106Sdes - iana portlist updated. 1545238106Sdes 1546238106Sdes5 April 2012: Wouter 1547238106Sdes - fix bug #443: --with-chroot-dir not honoured by configure. 1548238106Sdes - fix bug #444: setusercontext was called too late (thanks Bjorn 1549238106Sdes Ketelaars). 1550238106Sdes 1551238106Sdes27 March 2012: Wouter 1552238106Sdes - fix bug #442: Fix that Makefile depends on pythonmod headers 1553238106Sdes even using --without-pythonmodule. 1554238106Sdes 1555238106Sdes22 March 2012: Wouter 1556238106Sdes - contrib/validation-reporter follows rotated log file (patch from 1557238106Sdes Augie Schwer). 1558238106Sdes 1559238106Sdes21 March 2012: Wouter 1560238106Sdes - new approach to NS fetches for DS lookup that works with 1561238106Sdes cornercases, and is more robust and considers forwarders. 1562238106Sdes 1563238106Sdes19 March 2012: Wouter 1564238106Sdes - iana portlist updated. 1565238106Sdes - fix to locate nameservers for DS lookup with NS fetches. 1566238106Sdes 1567238106Sdes16 March 2012: Wouter 1568238106Sdes - Patch for access to full DNS packet data in unbound python module 1569238106Sdes from Ondrej Mikle. 1570238106Sdes 1571238106Sdes9 March 2012: Wouter 1572238106Sdes - Applied line-buffer patch from Augie Schwer to validation.reporter.sh. 1573238106Sdes 1574238106Sdes2 March 2012: Wouter 1575238106Sdes - flush_infra cleans timeouted servers from the cache too. 1576238106Sdes - removed warning from --enable-ecdsa. 1577238106Sdes 1578238106Sdes1 March 2012: Wouter 1579238106Sdes - forward-first option. Tries without forward if a query fails. 1580238106Sdes Also stub-first option that is similar. 1581238106Sdes 1582238106Sdes28 February 2012: Wouter 1583238106Sdes - Fix from code review, if EINPROGRESS not defined chain if statement 1584238106Sdes differently. 1585238106Sdes 1586238106Sdes27 February 2012: Wouter 1587238106Sdes - Fix bug#434: on windows check registry for config file location 1588238106Sdes for unbound-control.exe, and unbound-checkconf.exe. 1589238106Sdes 1590238106Sdes23 February 2012: Wouter 1591238106Sdes - Fix to squelch 'network unreachable' errors from tcp connect in 1592238106Sdes logs, high verbosity will show them. 1593238106Sdes 1594238106Sdes16 February 2012: Wouter 1595238106Sdes - iter_hints is now thread-owned in module env, and thus threadsafe. 1596238106Sdes - Fix prefetch and sticky NS, now the prefetch works. It picks 1597238106Sdes nameservers that 'would be valid in the future', and if this makes 1598238106Sdes the NS timeout, it updates that NS by asking delegation from the 1599238106Sdes parent again. If child NS has longer TTL, that TTL does not get 1600238106Sdes refreshed from the lookup to the child nameserver. 1601238106Sdes 1602238106Sdes15 February 2012: Wouter 1603238106Sdes - Fix forward-zone memory, uses malloc and frees original root dp. 1604238106Sdes - iter hints (stubs) uses malloc inside for more dynamicity. 1605238106Sdes - unbound-control forward_add, forward_remove, stub_add, stub_remove 1606238106Sdes can modify stubs and forwards for running unbound (on mobile computer) 1607238106Sdes they can also add and remove domain-insecure for the zone. 1608238106Sdes 1609238106Sdes14 February 2012: Wouter 1610238106Sdes - Fix sticky NS (ghost domain problem) if prefetch is yes. 1611238106Sdes - iter forwards uses malloc inside for more dynamicity. 1612238106Sdes 1613238106Sdes13 February 2012: Wouter 1614238106Sdes - RT#2955. Fix for cygwin compilation. 1615238106Sdes - iana portlist updated. 1616238106Sdes 1617238106Sdes10 February 2012: Wouter 1618238106Sdes - Slightly smaller critical region in one case in infra cache. 1619238106Sdes - Fix timeouts to keep track of query type, A, AAAA and other, if 1620238106Sdes another has caused timeout blacklist, different type can still probe. 1621238106Sdes - unit test fix for nomem_cnametopos.rpl race condition. 1622238106Sdes 1623238106Sdes9 February 2012: Wouter 1624238106Sdes - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h. 1625238106Sdes 1626238106Sdes8 February 2012: Wouter 1627238106Sdes - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This 1628238106Sdes implementation is experimental at this time and not recommended 1629238106Sdes for use on the public internet (the protocol numbers have not 1630238106Sdes been assigned). Needs recent ldns with --enable-ecdsa. 1631238106Sdes - fix memory leak in errorcase for DSA signatures. 1632238106Sdes - iana portlist updated. 1633238106Sdes - workaround for openssl 0.9.8 ecdsa sha2 and evp problem. 1634238106Sdes 1635238106Sdes3 February 2012: Wouter 1636238106Sdes - fix for windows, rename() is not posix compliant on windows. 1637238106Sdes 1638238106Sdes2 February 2012: Wouter 1639238106Sdes - 1.4.16 release tag. 1640238106Sdes - svn trunk is 1.4.17 in development. 1641238106Sdes - iana portlist updated. 1642238106Sdes 1643238106Sdes1 February 2012: Wouter 1644238106Sdes - Fix validation failures (like: validation failure xx: no NSEC3 1645238106Sdes closest encloser from yy for DS zz. while building chain of trust, 1646238106Sdes because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata 1647238106Sdes for an NSEC3. Now it does not change rdata, and fixes TTL. 1648238106Sdes 1649238106Sdes30 January 2012: Wouter 1650238106Sdes - Fix version-number in libtool to be version-info so it produces 1651238106Sdes libunbound.so.2 like it should. 1652238106Sdes 1653238106Sdes26 January 2012: Wouter 1654238106Sdes - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release. 1655238106Sdes - trunk 1.4.16; includes changes memset testcode, #424 openindiana, 1656238106Sdes and keyfile write fixup. 1657238106Sdes - applied patch to support outgoing-interface with ub_ctx_set_option. 1658238106Sdes 1659238106Sdes23 January 2012: Wouter 1660238106Sdes - Fix memset in test code. 1661238106Sdes 1662238106Sdes20 January 2012: Wouter 1663238106Sdes - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2. 1664238106Sdes 1665238106Sdes19 January 2012: Wouter 1666238106Sdes - Fix to write key files completely to a temporary file, and if that 1667238106Sdes succeeds, replace the real key file. So failures leave a useful file. 1668238106Sdes 1669238106Sdes18 January 2012: Wouter 1670238106Sdes - tag 1.4.15rc1 created 1671238106Sdes - updated libunbound/ubsyms.def and remade tag 1.4.15rc1. 1672238106Sdes 1673238106Sdes17 January 2012: Wouter 1674238106Sdes - Fix bug where canonical_compare of RRSIG did not downcase the 1675238106Sdes signer-name. This is mostly harmless because RRSIGs do not have 1676238106Sdes to be sorted in canonical order, usually. 1677238106Sdes 1678238106Sdes12 January 2012: Wouter 1679238106Sdes - bug#428: add ub_version() call to libunbound. API version increase, 1680238106Sdes with (binary) backwards compatibility for the previous version. 1681238106Sdes 1682238106Sdes10 January 2012: Wouter 1683238106Sdes - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL 1684238106Sdes that would be permissible by the RFCs but it is not the TTL in the 1685238106Sdes cache. 1686238106Sdes - iana portlist updated. 1687238106Sdes - uninitialised variable in reprobe for rtt blocked domains fixed. 1688238106Sdes - lintfix and new flex output. 1689238106Sdes 1690238106Sdes2 January 2012: Wouter 1691238106Sdes - Fix to randomize hash function, based on 28c3 congress, reported 1692238106Sdes by Peter van Dijk. 1693238106Sdes 1694238106Sdes24 December 2011: Wouter 1695238106Sdes - Fix for memory leak (about 20 bytes when a tcp or udp send operation 1696238106Sdes towards authority servers failed, takes about 50.000 such failures to 1697238106Sdes leak one Mb, such failures are also usually logged), reported by 1698238106Sdes Robert Fleischmann. 1699238106Sdes - iana portlist updated. 1700238106Sdes 1701238106Sdes19 December 2011: Wouter 1702238106Sdes - Fix for VU#209659 CVE-2011-4528: Unbound denial of service 1703238106Sdes vulnerabilities from nonstandard redirection and denial of existence 1704238106Sdes http://www.unbound.net/downloads/CVE-2011-4528.txt 1705238106Sdes - robust checks for next-closer NSEC3s. 1706238106Sdes - tag 1.4.14 created. 1707238106Sdes - trunk has 1.4.15 in development. 1708238106Sdes 1709238106Sdes15 December 2011: Wouter 1710238106Sdes - remove uninit warning from cachedump code. 1711238106Sdes - Fix parse error on negative SOA RRSIGs if badly ordered in the packet. 1712238106Sdes 1713238106Sdes13 December 2011: Wouter 1714238106Sdes - iana portlist updated. 1715238106Sdes - svn tag 1.4.14rc1 1716238106Sdes - fix infra cache comparison. 1717238106Sdes - Fix to constrain signer_name to be a parent of the lookupname. 1718238106Sdes 1719238106Sdes5 December 2011: Wouter 1720238106Sdes - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc. 1721238106Sdes - Fix warnings with gcc 4.6 in compat/inet_ntop.c. 1722238106Sdes - Fix warning unused in compat/strptime.c. 1723292206Sdes - Fix malloc detection and double definition. 1724238106Sdes 1725238106Sdes2 December 2011: Wouter 1726238106Sdes - configure generated with autoconf 2.68. 1727238106Sdes 1728238106Sdes30 November 2011: Wouter 1729238106Sdes - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes 1730238106Sdes SERVFAILs. Also fixed for UDP (but less likely). 1731238106Sdes 1732238106Sdes28 November 2011: Wouter 1733238106Sdes - Fix quartile time estimate, it was too low, (thanks Jan Komissar). 1734238106Sdes - iana ports updated. 1735238106Sdes 1736238106Sdes11 November 2011: Wouter 1737238106Sdes - Makefile compat with SunOS make, BSD make and GNU make. 1738238106Sdes - iana ports updated. 1739238106Sdes 1740238106Sdes10 November 2011: Wouter 1741238106Sdes - Makefile changed for BSD make compatibility. 1742238106Sdes 1743238106Sdes9 November 2011: Wouter 1744238106Sdes - added unit test for SSL service and SSL-upstream. 1745238106Sdes 1746238106Sdes8 November 2011: Wouter 1747238106Sdes - can configure ssl service to one port number, and not on others. 1748238106Sdes - fixup windows compile with ssl support. 1749238106Sdes - Fix double free in unbound-host, reported by Steve Grubb. 1750238106Sdes - iana portlist updated. 1751238106Sdes 1752238106Sdes1 November 2011: Wouter 1753238106Sdes - dns over ssl support as a client, ssl-upstream yes turns it on. 1754238106Sdes It performs an SSL transaction for every DNS query (250 msec). 1755238106Sdes - documentation for new options: ssl-upstream, ssl-service-key and 1756238106Sdes ssl-service.pem. 1757238106Sdes - iana portlist updated. 1758238106Sdes - fix -flto detection on Lion for llvm-gcc. 1759238106Sdes 1760238106Sdes31 October 2011: Wouter 1761238106Sdes - dns over ssl support, ssl-service-pem and ssl-service-key files 1762238106Sdes can be given and then TCP queries are serviced wrapped in SSL. 1763238106Sdes 1764238106Sdes27 October 2011: Wouter 1765238106Sdes - lame-ttl and lame-size options no longer exist, it is integrated 1766238106Sdes with the host info. They are ignored (with verbose warning) if 1767238106Sdes encountered to keep the config file backwards compatible. 1768238106Sdes - fix iana-update for changing gzip compression of results. 1769238106Sdes - fix export-all-symbols on OSX. 1770238106Sdes 1771238106Sdes26 October 2011: Wouter 1772238106Sdes - iana portlist updated. 1773238106Sdes - Infra cache stores information about ping and lameness per IP, zone. 1774238106Sdes This fixes bug #416. 1775238106Sdes - fix iana_update target for gzipped file on iana site. 1776238106Sdes 1777238106Sdes24 October 2011: Wouter 1778238106Sdes - Fix resolve of partners.extranet.microsoft.com with a fix for the 1779238106Sdes server selection for choosing out of a (particular) list of bad 1780238106Sdes choices. (bug#415) 1781238106Sdes - Fix make_new_space function so that the incoming query is not 1782238106Sdes overwritten if a jostled out query causes a waiting query to be 1783238106Sdes resumed that then fails and sends an error message. (Thanks to 1784238106Sdes Matthew Lee). 1785238106Sdes 1786238106Sdes21 October 2011: Wouter 1787238106Sdes - fix --enable-allsymbols, fptr wlist is disabled on windows with this 1788238106Sdes option enabled because of memory layout exe vs dll. 1789238106Sdes 1790238106Sdes19 October 2011: Wouter 1791238106Sdes - fix unbound-anchor for broken strptime on OSX lion, detected 1792238106Sdes in configure. 1793238106Sdes - Detect if GOST really works, openssl1.0 on OSX fails. 1794238106Sdes - Implement ipv6%interface notation for scope_id usage. 1795238106Sdes 1796238106Sdes17 October 2011: Wouter 1797238106Sdes - better documentation for inform_super (Thanks Yang Zhe). 1798238106Sdes 1799238106Sdes14 October 2011: Wouter 1800238106Sdes - Fix for out-of-memory condition in libunbound (thanks 1801238106Sdes Robert Fleischman). 1802238106Sdes 1803238106Sdes13 October 2011: Wouter 1804238106Sdes - Fix --enable-allsymbols, it depended on link specifics of the 1805238106Sdes target platform, or fptr_wlist assertion failures could occur. 1806238106Sdes 1807238106Sdes12 October 2011: Wouter 1808238106Sdes - updated contrib/unbound_munin_ to family=auto so that it works with 1809238106Sdes munin-node-configure automatically (if installed as 1810238106Sdes /usr/local/share/munin/plugins/unbound_munin_ ). 1811238106Sdes 1812238106Sdes27 September 2011: Wouter 1813238106Sdes - unbound.exe -w windows option for start and stop service. 1814238106Sdes 1815238106Sdes23 September 2011: Wouter 1816238106Sdes - TCP-upstream calculates tcp-ping so server selection works if there 1817238106Sdes are alternatives. 1818238106Sdes 1819238106Sdes20 September 2011: Wouter 1820238106Sdes - Fix classification of NS set in answer section, where there is a 1821238106Sdes parent-child server, and the answer has the AA flag for dir.slb.com. 1822238106Sdes Thanks to Amanda Constant from Secure64. 1823238106Sdes 1824238106Sdes16 September 2011: Wouter 1825238106Sdes - fix bug #408: accept patch from Steve Snyder that comments out 1826238106Sdes unused functions in lookup3.c. 1827238106Sdes - iana portlist updated. 1828238106Sdes - fix EDNS1480 change memleak and TCP fallback. 1829238106Sdes - fix various compiler warnings (reported by Paul Wouters). 1830238106Sdes - max sent count. EDNS1480 only for rtt < 5000. No promiscuous 1831238106Sdes fetch if sentcount > 3, stop query if sentcount > 16. Count is 1832238106Sdes reset when referral or CNAME happens. This makes unbound better 1833238106Sdes at managing large NS sets, they are explored when there is continued 1834238106Sdes interest (in the form of queries). 1835238106Sdes 1836238106Sdes15 September 2011: Wouter 1837238106Sdes - release 1.4.13. 1838238106Sdes - trunk contains 1.4.14 in development. 1839238106Sdes - Unbound probes at EDNS1480 if there an EDNS0 timeout. 1840238106Sdes 1841238106Sdes12 September 2011: Wouter 1842238106Sdes - Reverted dns EDNS backoff fix, it did not help and needs 1843238106Sdes fragmentation fixes instead. 1844238106Sdes - tag 1.4.13rc2 1845238106Sdes 1846238106Sdes7 September 2011: Wouter 1847238106Sdes - Fix operation in ipv6 only (do-ip4: no) mode. 1848238106Sdes 1849238106Sdes6 September 2011: Wouter 1850238106Sdes - fedora specfile updated. 1851238106Sdes 1852238106Sdes5 September 2011: Wouter 1853238106Sdes - tag 1.4.13rc1 1854238106Sdes 1855238106Sdes2 September 2011: Wouter 1856238106Sdes - iana portlist updated. 1857238106Sdes 1858238106Sdes26 August 2011: Wouter 1859238106Sdes - Fix num-threads 0 does not segfault, reported by Simon Deziel. 1860238106Sdes - Fix validation failures due to EDNS backoff retries, the retry 1861238106Sdes for fetch of data has want_dnssec because the iter_indicate_dnssec 1862238106Sdes function returns true when validation failure retry happens, and 1863238106Sdes then the serviced query code does not fallback to noEDNS, even if 1864238106Sdes the cache says it has this. This helps for DLV deployment when 1865238106Sdes the DNSSEC status is not known for sure before the lookup concludes. 1866238106Sdes 1867238106Sdes24 August 2011: Wouter 1868238106Sdes - Applied patch from Karel Slany that fixes a memory leak in the 1869238106Sdes unbound python module, in string conversions. 1870238106Sdes 1871238106Sdes22 August 2011: Wouter 1872238106Sdes - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy 1873238106Sdes Zhang and Luo Ce). Unbound responds with the RR types that are 1874238106Sdes available at the name for qtype ANY and validates those RR types. 1875238106Sdes It does not test for completeness (i.e. with NSEC or NSEC3 query), 1876238106Sdes and it does not follow the CNAME or DNAME to another name (with 1877238106Sdes even more data for the already large response). 1878238106Sdes - Fix that internally, CNAMEs with NXDOMAIN have that as rcode. 1879238106Sdes - Documented the options that work with control set_option command. 1880238106Sdes - tcp-upstream yes/no option (works with set_option) for tunnels. 1881238106Sdes 1882238106Sdes18 August 2011: Wouter 1883238106Sdes - fix autoconf call in makedist crosscompile to RC or snapshot. 1884238106Sdes 1885238106Sdes17 August 2011: Wouter 1886238106Sdes - Fix validation of . DS query. 1887238106Sdes - new xml format at IANA, new awk for iana_update. 1888238106Sdes - iana portlist updated. 1889238106Sdes 1890238106Sdes10 August 2011: Wouter 1891238106Sdes - Fix python site-packages path to /usr/lib64. 1892238106Sdes - updated patch from Tom. 1893238106Sdes - fix memory and fd leak after out-of-memory condition. 1894238106Sdes 1895238106Sdes9 August 2011: Wouter 1896238106Sdes - patch from Tom Hendrikx fixes load of python modules. 1897238106Sdes 1898238106Sdes8 August 2011: Wouter 1899238106Sdes - make clean had ldns-src reference, removed. 1900238106Sdes 1901238106Sdes1 August 2011: Wouter 1902238106Sdes - Fix autoconf 2.68 warnings 1903238106Sdes 1904238106Sdes14 July 2011: Wouter 1905238106Sdes - Unbound implements RFC6303 (since version 1.4.7). 1906238106Sdes - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the 1907238106Sdes meantime, those are for 1.4.13). 1908238106Sdes - iana portlist updated. 1909238106Sdes 1910238106Sdes13 July 2011: Wouter 1911238106Sdes - Quick fix for contrib/unbound.spec example, no ldns-builtin any more. 1912238106Sdes 1913238106Sdes11 July 2011: Wouter 1914238106Sdes - Fix wildcard expansion no-data reply under an optout NSEC3 zone is 1915238106Sdes validated as insecure, reported by Jia Li (lijia@cnnic.cn). 1916238106Sdes 1917238106Sdes4 July 2011: Wouter 1918238106Sdes - 1.4.12rc1 tag created. 1919238106Sdes 1920238106Sdes1 July 2011: Wouter 1921238106Sdes - version number in example config file. 1922238106Sdes - fix that --enable-static-exe does not complain about it unknown. 1923238106Sdes 1924238106Sdes30 June 2011: Wouter 1925238106Sdes - tag relase 1.4.11, trunk is 1.4.12 development. 1926238106Sdes - iana portlist updated. 1927238106Sdes - fix bug#395: id bits of other query may leak out under conditions 1928238106Sdes - fix replyaddr count wrong after jostled queries, which leads to 1929238106Sdes eventual starvation where the daemon has no replyaddrs left to use. 1930238106Sdes - fix comment about rndc port, that referred to the old port number. 1931238106Sdes - fix that the listening socket is not closed when too many remote 1932238106Sdes control connections are made at the same time. 1933238106Sdes - removed ldns-src tarball inside the unbound tarball. 1934238106Sdes 1935238106Sdes23 June 2011: Wouter 1936238106Sdes - Changed -flto check to support clang compiler. 1937238106Sdes - tag 1.4.11rc3 created. 1938238106Sdes 1939238106Sdes17 June 2011: Wouter 1940238106Sdes - tag 1.4.11rc1 created. 1941238106Sdes - remove warning about signed/unsigned from flex (other flex version). 1942238106Sdes - updated aclocal.m4 and libtool to match. 1943238106Sdes - tag 1.4.11rc2 created. 1944238106Sdes 1945238106Sdes16 June 2011: Wouter 1946238106Sdes - log-queries: yesno option, default is no, prints querylog. 1947238106Sdes - version is 1.4.11. 1948238106Sdes 1949238106Sdes14 June 2011: Wouter 1950238106Sdes - Use -flto compiler flag for link time optimization, if supported. 1951238106Sdes - iana portlist updated. 1952238106Sdes 1953238106Sdes12 June 2011: Wouter 1954238106Sdes - IPv6 service address for d.root-servers.net (2001:500:2D::D). 1955238106Sdes 1956238106Sdes10 June 2011: Wouter 1957238106Sdes - unbound-control has version number in the header, 1958238106Sdes UBCT[version]_space_ is the header sent by the client now. 1959238106Sdes - Unbound control port number is registered with IANA: 1960238106Sdes ub-dns-control 8953/tcp unbound dns nameserver control 1961238106Sdes This is the new default for the control-port config setting. 1962238106Sdes - statistics-interval prints the number of jostled queries to log. 1963238106Sdes 1964238106Sdes30 May 2011: Wouter 1965238106Sdes - Fix Makefile for U in environment, since wrong U is more common than 1966238106Sdes deansification necessity. 1967238106Sdes - iana portlist updated. 1968238106Sdes - updated ldns tarball to 1.6.10rc2 snapshot of today. 1969238106Sdes 1970238106Sdes25 May 2011: Wouter 1971238106Sdes - Fix assertion failure when unbound generates an empty error reply 1972238106Sdes in response to a query, CVE-2011-1922 VU#531342. 1973238106Sdes - This fix is in tag 1.4.10. 1974238106Sdes - defense in depth against the above bug, an error is printed to log 1975238106Sdes instead of an assertion failure. 1976238106Sdes 1977238106Sdes10 May 2011: Wouter 1978238106Sdes - bug#386: --enable-allsymbols option links all binaries to libunbound 1979238106Sdes and reduces install size significantly. 1980238106Sdes - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers. 1981238106Sdes - iana portlist updated. 1982238106Sdes - Fix TTL of SOA so negative TTL is separately cached from normal TTL. 1983238106Sdes 1984238106Sdes14 April 2011: Wouter 1985238106Sdes - configure created with newer autoconf 2.66. 1986238106Sdes 1987238106Sdes12 April 2011: Wouter 1988238106Sdes - bug#378: Fix that configure checks for ldns_get_random presence. 1989238106Sdes 1990238106Sdes8 April 2011: Wouter 1991238106Sdes - iana portlist updated. 1992238106Sdes - queries with CD flag set cause DNSSEC validation, but the answer is 1993238106Sdes not withheld if it is bogus. Thus, unbound will retry if it is bad 1994238106Sdes and curb the TTL if it is bad, thus protecting the cache for use by 1995238106Sdes downstream validators. 1996238106Sdes - val-override-date: -1 ignores dates entirely, for NTP usage. 1997238106Sdes 1998238106Sdes29 March 2011: Wouter 1999238106Sdes - harden-below-nxdomain: changed so that it activates when the 2000238106Sdes cached nxdomain is dnssec secure. This avoids backwards 2001238106Sdes incompatibility because those old servers do not have dnssec. 2002238106Sdes 2003238106Sdes24 March 2011: Wouter 2004238106Sdes - iana portlist updated. 2005238106Sdes - release 1.4.9. 2006238106Sdes - trunk is 1.5.0 2007238106Sdes 2008238106Sdes17 March 2011: Wouter 2009238106Sdes - bug#370: new unbound.spec for CentOS 5.x from Harold Jones. 2010238106Sdes Applied but did not do the --disable-gost. 2011238106Sdes 2012238106Sdes10 March 2011: Wouter 2013238106Sdes - tag 1.4.9 release candidate 1 created. 2014238106Sdes 2015238106Sdes3 March 2011: Wouter 2016238106Sdes - updated ldns to today. 2017238106Sdes 2018238106Sdes1 March 2011: Wouter 2019238106Sdes - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout. 2020238106Sdes - give config parse error for multiple names on a stub or forward zone. 2021238106Sdes - updated ldns tarball to 1.6.9(todays snapshot). 2022238106Sdes 2023238106Sdes24 February 2011: Wouter 2024238106Sdes - bug #361: Fix, time.elapsed variable not reset with stats_noreset. 2025238106Sdes 2026238106Sdes23 February 2011: Wouter 2027238106Sdes - iana portlist updated. 2028238106Sdes - common.sh to version 3. 2029238106Sdes 2030238106Sdes18 February 2011: Wouter 2031238106Sdes - common.sh in testdata updated to version 2. 2032238106Sdes 2033238106Sdes15 February 2011: Wouter 2034238106Sdes - Added explicit note on unbound-anchor usage: 2035238106Sdes Please note usage of unbound-anchor root anchor is at your own risk 2036238106Sdes and under the terms of our LICENSE (see that file in the source). 2037238106Sdes 2038238106Sdes11 February 2011: Wouter 2039238106Sdes - iana portlist updated. 2040238106Sdes - tpkg updated with common.sh for common functionality. 2041238106Sdes 2042238106Sdes7 February 2011: Wouter 2043238106Sdes - Added regression test for addition of a .net DS to the root, and 2044238106Sdes cache effects with different TTL for glue and DNSKEY. 2045238106Sdes - iana portlist updated. 2046238106Sdes 2047238106Sdes28 January 2011: Wouter 2048238106Sdes - Fix remove private address does not throw away entire response. 2049238106Sdes 2050238106Sdes24 January 2011: Wouter 2051238106Sdes - release 1.4.8 2052238106Sdes 2053238106Sdes19 January 2011: Wouter 2054238106Sdes - fix bug#349: no -L/usr for ldns. 2055238106Sdes 2056238106Sdes18 January 2011: Wouter 2057238106Sdes - ldns 1.6.8 tarball included. 2058238106Sdes - release 1.4.8rc1. 2059238106Sdes 2060238106Sdes17 January 2011: Wouter 2061238106Sdes - add get and set option for harden-below-nxdomain feature. 2062238106Sdes - iana portlist updated. 2063238106Sdes 2064238106Sdes14 January 2011: Wouter 2065238106Sdes - Fix so a changed NS RRset does not get moved name stuck on old 2066238106Sdes server, for type NS the TTL is not increased. 2067238106Sdes 2068238106Sdes13 January 2011: Wouter 2069238106Sdes - Fix prefetch so it does not get stuck on old server for moved names. 2070238106Sdes 2071238106Sdes12 January 2011: Wouter 2072238106Sdes - iana portlist updated. 2073238106Sdes 2074238106Sdes11 January 2011: Wouter 2075238106Sdes - Fix insecure CNAME sequence marked as secure, reported by Bert 2076238106Sdes Hubert. 2077238106Sdes 2078238106Sdes10 January 2011: Wouter 2079238106Sdes - faster lruhash get_mem routine. 2080238106Sdes 2081238106Sdes4 January 2011: Wouter 2082238106Sdes - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root. 2083238106Sdes - iana portlist updated. 2084238106Sdes 2085238106Sdes23 December 2010: Wouter 2086238106Sdes - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept. 2087238106Sdes 2088238106Sdes21 December 2010: Wouter 2089238106Sdes - algorithm compromise protection using the algorithms signalled in 2090238106Sdes the DS record. Also, trust anchors, DLV, and RFC5011 receive this, 2091238106Sdes and thus, if you have multiple algorithms in your trust-anchor-file 2092238106Sdes then it will now behave different than before. Also, 5011 rollover 2093238106Sdes for algorithms needs to be double-signature until the old algorithm 2094238106Sdes is revoked. 2095238106Sdes It is not an option, because I see no use to turn the security off. 2096238106Sdes - iana portlist updated. 2097238106Sdes 2098238106Sdes17 December 2010: Wouter 2099238106Sdes - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them). 2100238106Sdes - fix validation in this case: CNAME to nodata for co-hosted opt-in 2101238106Sdes NSEC3 insecure delegation, was bogus, fixed to be insecure. 2102238106Sdes 2103238106Sdes16 December 2010: Wouter 2104238106Sdes - Fix our 'BDS' license (typo reported by Xavier Belanger). 2105238106Sdes 2106238106Sdes10 December 2010: Wouter 2107238106Sdes - iana portlist updated. 2108238106Sdes - review changes for unbound-anchor. 2109238106Sdes 2110238106Sdes2 December 2010: Wouter 2111238106Sdes - feature typetransparent localzone, does not block other RR types. 2112238106Sdes 2113238106Sdes1 December 2010: Wouter 2114238106Sdes - Fix bug#338: print address when socket creation fails. 2115238106Sdes 2116238106Sdes30 November 2010: Wouter 2117238106Sdes - Fix storage of EDNS failures in the infra cache. 2118238106Sdes - iana portlist updated. 2119238106Sdes 2120238106Sdes18 November 2010: Wouter 2121238106Sdes - harden-below-nxdomain option, default off (because very old 2122238106Sdes software may be incompatible). We could enable it by default in 2123238106Sdes the future. 2124238106Sdes 2125238106Sdes17 November 2010: Wouter 2126238106Sdes - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN. 2127238106Sdes - make test output nicer. 2128238106Sdes 2129238106Sdes15 November 2010: Wouter 2130238106Sdes - silence 'tcp connect: broken pipe' and 'net down' at low verbosity. 2131238106Sdes - iana portlist updated. 2132238106Sdes - so-sndbuf option for very busy servers, a bit like so-rcvbuf. 2133238106Sdes 2134238106Sdes9 November 2010: Wouter 2135238106Sdes - unbound-anchor compiles with openssl 0.9.7. 2136238106Sdes 2137238106Sdes8 November 2010: Wouter 2138238106Sdes - release tag 1.4.7. 2139238106Sdes - trunk is version 1.4.8. 2140238106Sdes - Be lenient and accept imgw.pl malformed packet (like BIND). 2141238106Sdes 2142238106Sdes5 November 2010: Wouter 2143238106Sdes - do not synthesize a CNAME message from cache for qtype DS. 2144238106Sdes 2145238106Sdes4 November 2010: Wouter 2146238106Sdes - Use central entropy to seed threads. 2147238106Sdes 2148238106Sdes3 November 2010: Wouter 2149238106Sdes - Change the rtt used to probe EDNS-timeout hosts to 1000 msec. 2150238106Sdes 2151238106Sdes2 November 2010: Wouter 2152238106Sdes - tag 1.4.7rc1. 2153238106Sdes - code review. 2154238106Sdes 2155238106Sdes1 November 2010: Wouter 2156238106Sdes - GOST code enabled by default (RFC 5933). 2157238106Sdes 2158238106Sdes27 October 2010: Wouter 2159238106Sdes - Fix uninit value in dump_infra print. 2160238106Sdes - Fix validation failure for parent and child on same server with an 2161238106Sdes insecure childzone and a CNAME from parent to child. 2162238106Sdes - Configure detects libev-4.00. 2163238106Sdes 2164238106Sdes26 October 2010: Wouter 2165238106Sdes - dump_infra and flush_infra commands for unbound-control. 2166238106Sdes - no timeout backoff if meanwhile a query succeeded. 2167238106Sdes - Change of timeout code. No more lost and backoff in blockage. 2168238106Sdes At 12sec timeout (and at least 2x lost before) one probe per IP 2169238106Sdes is allowed only. At 120sec, the IP is blocked. After 15min, a 2170238106Sdes 120sec entry has a single retry packet. 2171238106Sdes 2172238106Sdes25 October 2010: Wouter 2173238106Sdes - Configure errors if ldns is not found. 2174238106Sdes 2175238106Sdes22 October 2010: Wouter 2176238106Sdes - Windows 7 fix for the installer. 2177238106Sdes 2178238106Sdes21 October 2010: Wouter 2179238106Sdes - Fix bug where fallback_tcp causes wrong roundtrip and edns 2180238106Sdes observation to be noted in cache. Fix bug where EDNSprobe halted 2181238106Sdes exponential backoff if EDNS status unknown. 2182238106Sdes - new unresponsive host method, exponentially increasing block backoff. 2183238106Sdes - iana portlist updated. 2184238106Sdes 2185238106Sdes20 October 2010: Wouter 2186238106Sdes - interface automatic works for some people with ip6 disabled. 2187238106Sdes Therefore the error check is removed, so they can use the option. 2188238106Sdes 2189238106Sdes19 October 2010: Wouter 2190238106Sdes - Fix for request list growth, if a server has long timeout but the 2191238106Sdes lost counter is low, then its effective rtt is the one without 2192238106Sdes exponential backoff applied. Because the backoff is not working. 2193238106Sdes The lost counter can then increase and the server is blacklisted, 2194238106Sdes or the lost counter does not increase and the server is working 2195238106Sdes for some queries. 2196238106Sdes 2197238106Sdes18 October 2010: Wouter 2198238106Sdes - iana portlist updated. 2199238106Sdes 2200238106Sdes13 October 2010: Wouter 2201238106Sdes - Fix TCP so it uses a random outgoing-interface. 2202238106Sdes - unbound-anchor handles ADDPEND keystate. 2203238106Sdes 2204238106Sdes11 October 2010: Wouter 2205238106Sdes - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where 2206238106Sdes the zone has a secure delegation hosted on the same server did not 2207238106Sdes verify as secure (it was insecure by mistake). 2208238106Sdes - iana portlist updated. 2209238106Sdes - ldns tarball updated (for reading cachedumps with bad RR data). 2210238106Sdes 2211238106Sdes1 October 2010: Wouter 2212238106Sdes - test for unbound-anchor. fix for reading certs. 2213238106Sdes - Fix alloc_reg_release for longer uptime in out of memory conditions. 2214238106Sdes 2215238106Sdes28 September 2010: Wouter 2216238106Sdes - unbound-anchor working, it creates or updates a root.key file. 2217238106Sdes Use it before you start the validator (e.g. at system boot time). 2218238106Sdes 2219238106Sdes27 September 2010: Wouter 2220238106Sdes - iana portlist updated. 2221238106Sdes 2222238106Sdes24 September 2010: Wouter 2223238106Sdes - bug#329: in example.conf show correct ipv4 link-local 169.254/16. 2224238106Sdes 2225238106Sdes23 September 2010: Wouter 2226238106Sdes - unbound-anchor app, unbound requires libexpat (xml parser library). 2227238106Sdes 2228238106Sdes22 September 2010: Wouter 2229238106Sdes - compliance with draft-ietf-dnsop-default-local-zones-14, removed 2230238106Sdes reverse ipv6 orchid prefix from builtin list. 2231238106Sdes - iana portlist updated. 2232238106Sdes 2233238106Sdes17 September 2010: Wouter 2234238106Sdes - DLV has downgrade protection again, because the RFC says so. 2235238106Sdes - iana portlist updated. 2236238106Sdes 2237238106Sdes16 September 2010: Wouter 2238238106Sdes - Algorithm rollover operational reality intrudes, for trust-anchor, 2239238106Sdes 5011-store, and DLV-anchor if one key matches it's good enough. 2240238106Sdes - iana portlist updated. 2241238106Sdes - Fix reported validation error in out of memory condition. 2242238106Sdes 2243238106Sdes15 September 2010: Wouter 2244238106Sdes - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout. 2245238106Sdes 2246238106Sdes14 September 2010: Wouter 2247238106Sdes - increased mesh-max-activation from 1000 to 3000 for crazy domains 2248238106Sdes like _tcp.slb.com with 262 servers. 2249238106Sdes - iana portlist updated. 2250238106Sdes 2251238106Sdes13 September 2010: Wouter 2252238106Sdes - bug#327: Fix for cannot access stub zones until the root is primed. 2253238106Sdes 2254238106Sdes9 September 2010: Wouter 2255238106Sdes - unresponsive servers are not completely blacklisted (because of 2256238106Sdes firewalls), but also not probed all the time (because of the request 2257238106Sdes list size it generates). The probe rate is 1%. 2258238106Sdes - iana portlist updated. 2259238106Sdes 2260238106Sdes20 August 2010: Wouter 2261238106Sdes - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled. 2262238106Sdes iterator get_mem includes priv_get_mem. delegpt nodup removed. 2263238106Sdes listen_pushback, query_info_allocqname, write_socket, send_packet, 2264238106Sdes comm_point_set_cb_arg and listen_resume removed. 2265238106Sdes 2266238106Sdes19 August 2010: Wouter 2267238106Sdes - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20. 2268238106Sdes Delegpt structures checked for duplicates always. 2269238106Sdes No more nameserver lookups generated when depth is full anyway. 2270238106Sdes - example.conf notes how to do DNSSEC validation and track the root. 2271238106Sdes - iana portlist updated. 2272238106Sdes 2273238106Sdes18 August 2010: Wouter 2274238106Sdes - Fix bug#322: configure does not respect CFLAGS on Solaris. 2275238106Sdes Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line 2276238106Sdes if use sun-cc, but some systems need different flags. 2277238106Sdes 2278238106Sdes16 August 2010: Wouter 2279238106Sdes - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP 2280238106Sdes changes, uses m4_bpatsubst now. 2281238106Sdes - make test (or make check) should be more portable and run the unit 2282238106Sdes test and testbound scripts. (make longtest has special requirements). 2283238106Sdes 2284238106Sdes13 August 2010: Wouter 2285238106Sdes - More pleasant remote control command parsing. 2286238106Sdes - documentation added for return values reported by doxygen 1.7.1. 2287238106Sdes - iana portlist updated. 2288238106Sdes 2289238106Sdes9 August 2010: Wouter 2290238106Sdes - Fix name of rrset printed that failed validation. 2291238106Sdes 2292238106Sdes5 August 2010: Wouter 2293238106Sdes - Return NXDOMAIN after chain of CNAMEs ends at name-not-found. 2294238106Sdes 2295238106Sdes4 August 2010: Wouter 2296238106Sdes - Fix validation in case a trust anchor enters into a zone with 2297238106Sdes unsupported algorithms. 2298238106Sdes 2299238106Sdes3 August 2010: Wouter 2300238106Sdes - updated ldns tarball with bugfixes. 2301238106Sdes - release tag 1.4.6. 2302238106Sdes - trunk becomes 1.4.7 develop. 2303238106Sdes - iana portlist updated. 2304238106Sdes 2305238106Sdes22 July 2010: Wouter 2306238106Sdes - more error details on failed remote control connection. 2307238106Sdes 2308238106Sdes15 July 2010: Wouter 2309238106Sdes - rlimit adjustments for select and ulimit can happen at the same time. 2310238106Sdes 2311238106Sdes14 July 2010: Wouter 2312238106Sdes - Donation text added to README. 2313238106Sdes - Fix integer underflow in prefetch ttl creation from cache. This 2314238106Sdes fixes a potential negative prefetch ttl. 2315238106Sdes 2316238106Sdes12 July 2010: Wouter 2317238106Sdes - Changed the defaults for num-queries-per-thread/outgoing-range. 2318238106Sdes For builtin-select: 512/960, for libevent 1024/4096 and for 2319238106Sdes windows 24/48 (because of win api). This makes the ratio this way 2320238106Sdes to improve resilience under heavy load. For high performance, use 2321238106Sdes libevent and possibly higher numbers. 2322238106Sdes 2323238106Sdes10 July 2010: Wouter 2324238106Sdes - GOST enabled if SSL is recent and ldns has GOST enabled too. 2325238106Sdes - ldns tarball updated. 2326238106Sdes 2327238106Sdes9 July 2010: Wouter 2328238106Sdes - iana portlist updated. 2329238106Sdes - Fix validation of qtype DNSKEY when a key-cache entry exists but 2330238106Sdes no rr-cache entry is used (it expired or prefetch), it then goes 2331238106Sdes back up to the DS or trust-anchor to validate the DNSKEY. 2332238106Sdes 2333238106Sdes7 July 2010: Wouter 2334238106Sdes - Neat function prototypes, unshadowed local declarations. 2335238106Sdes 2336238106Sdes6 July 2010: Wouter 2337238106Sdes - failure to chown the pidfile is not fatal any more. 2338238106Sdes - testbound uses UTC timezone. 2339238106Sdes - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add 2340238106Sdes /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake. 2341238106Sdes 2342238106Sdes5 July 2010: Wouter 2343238106Sdes - log if a server is skipped because it is on the donotquery list, 2344238106Sdes at verbosity 4, to enable diagnosis why no queries to 127.0.0.1. 2345238106Sdes - added feature to print configure date, target and options with -h. 2346238106Sdes - added feature to print event backend system details with -h. 2347238106Sdes - wdiff is not actually required by make test, updated requirements. 2348238106Sdes 2349238106Sdes1 July 2010: Wouter 2350238106Sdes - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex 2351238106Sdes must be signed with all algorithms from the DS rrset at the parent. 2352238106Sdes This is now checked and becomes bogus if not. 2353238106Sdes 2354238106Sdes28 June 2010: Wouter 2355238106Sdes - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps 2356238106Sdes in overload situations to be about 5 qps for the class of shortly 2357238106Sdes serviced queries. 2358238106Sdes The capacity of the resolver is then about (numqueriesperthread / 2) 2359238106Sdes / (average time for such long queries) qps for long queries. 2360238106Sdes And about (numqueriesperthread / 2)/(jostletimeout in whole seconds) 2361238106Sdes qps for short queries, per thread. 2362238106Sdes - Fix the max number of reply-address count to be applied for duplicate 2363238106Sdes queries, and not for new query list entries. This raises the memory 2364238106Sdes usage to a max of (16+1)*numqueriesperthread reply addresses. 2365238106Sdes 2366238106Sdes25 June 2010: Wouter 2367238106Sdes - Fix handling of corner case reply from lame server, follows rfc2308. 2368238106Sdes It could lead to a nodata reply getting into the cache if the search 2369238106Sdes for a non-lame server turned up other misconfigured servers. 2370238106Sdes - unbound.h has extern "C" statement for easier include in c++. 2371238106Sdes 2372238106Sdes23 June 2010: Wouter 2373238106Sdes - iana portlist updated. 2374238106Sdes - makedist upgraded cross compile openssl option, like this: 2375238106Sdes ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost 2376238106Sdes 2377238106Sdes22 June 2010: Wouter 2378238106Sdes - Unbound reports libev or libevent correctly in logs in verbose mode. 2379238106Sdes - Fix to unload gost dynamic library module for leak testing. 2380238106Sdes 2381238106Sdes18 June 2010: Wouter 2382238106Sdes - iana portlist updated. 2383238106Sdes 2384238106Sdes17 June 2010: Wouter 2385238106Sdes - Add AAAA to root hints for I.ROOT-SERVERS.NET. 2386238106Sdes 2387238106Sdes16 June 2010: Wouter 2388238106Sdes - Fix assertion failure reported by Kai Storbeck from XS4ALL, the 2389238106Sdes assertion was wrong. 2390238106Sdes - updated ldns tarball. 2391238106Sdes 2392238106Sdes15 June 2010: Wouter 2393238106Sdes - tag 1.4.5 created. 2394238106Sdes - trunk contains 1.4.6 in development. 2395238106Sdes - Fix TCPreply on systems with no writev, if just 1 byte could be sent. 2396238106Sdes - Fix to use one pointer less for iterator query state store_parent_NS. 2397238106Sdes - makedist crosscompile to windows uses builtin ldns not host ldns. 2398238106Sdes - Max referral count from 30 to 130, because 128 one character domains 2399238106Sdes is valid DNS. 2400238106Sdes - added documentation for the histogram printout to syslog. 2401238106Sdes 2402238106Sdes11 June 2010: Wouter 2403238106Sdes - When retry to parent the retrycount is not wiped, so failed 2404238106Sdes nameservers are not tried again. 2405238106Sdes - iana portlist updated. 2406238106Sdes 2407238106Sdes10 June 2010: Wouter 2408238106Sdes - Fix bug where a long loop could be entered, now cycle detection 2409238106Sdes has a loop-counter and maximum search amount. 2410238106Sdes 2411238106Sdes4 June 2010: Wouter 2412238106Sdes - iana portlist updated. 2413238106Sdes - 1.4.5rc1 tag created. 2414238106Sdes 2415238106Sdes3 June 2010: Wouter 2416238106Sdes - ldns tarball updated, 1.6.5. 2417238106Sdes - review comments, split dependency cycle tracking for parentside 2418238106Sdes last resort lookups for A and AAAA so there are more lookup options. 2419238106Sdes 2420238106Sdes2 June 2010: Wouter 2421238106Sdes - Fix compile warning if compiled without threads. 2422238106Sdes - updated ldns-tarball with current ldns svn (pre 1.6.5). 2423238106Sdes - GOST disabled-by-default, the algorithm number is allocated but the 2424238106Sdes RFC is still has to pass AUTH48 at the IETF. 2425238106Sdes 2426238106Sdes1 June 2010: Wouter 2427238106Sdes - Ignore Z flag in incoming messages too. 2428238106Sdes - Fix storage of negative parent glue if that last resort fails. 2429238106Sdes - libtoolize 2.2.6b, autoconf 2.65 applied to configure. 2430238106Sdes - new splint flags for newer splint install. 2431238106Sdes 2432238106Sdes31 May 2010: Wouter 2433238106Sdes - Fix AD flag handling, it could in some cases mistakenly copy the AD 2434238106Sdes flag from upstream servers. 2435238106Sdes - alloc_special_obtain out of memory is not a fatal error any more, 2436238106Sdes enabling unbound to continue longer in out of memory conditions. 2437238106Sdes - parentside names are dispreferred but not said to be dnssec-lame. 2438238106Sdes - parentside check for cached newname glue. 2439238106Sdes - fix parentside and querytargets modulestate, for dump_requestlist. 2440238106Sdes - unbound-control-setup makes keys -rw-r--- so not all users permitted. 2441238106Sdes - fix parentside from cache to be marked dispreferred for bad names. 2442238106Sdes 2443238106Sdes28 May 2010: Wouter 2444238106Sdes - iana portlist updated. 2445238106Sdes - parent-child disagreement approach altered. Older fixes are 2446238106Sdes removed in place of a more exhaustive search for misconfigured data 2447238106Sdes available via the parent of a delegation. 2448238106Sdes This is designed to be throttled by cache entries, with TTL from the 2449238106Sdes parent if possible. Additionally the loop-counter is used. 2450238106Sdes It also tests for NS RRset differences between parent and child. 2451238106Sdes The fetch of misconfigured data should be more reliable and thorough. 2452238106Sdes It should work reliably even with no or only partial data in cache. 2453238106Sdes Data received from the child (as always) is deemed more 2454238106Sdes authoritative than information received from the delegation parent. 2455238106Sdes The search for misconfigured data is not performed normally. 2456238106Sdes 2457238106Sdes26 May 2010: Wouter 2458238106Sdes - Contribution from Migiel de Vos (Surfnet): nagios patch for 2459238106Sdes unbound-host, in contrib/ (in the source tarball). Makes 2460238106Sdes unbound-host suitable for monitoring dnssec(-chain) status. 2461238106Sdes 2462238106Sdes21 May 2010: Wouter 2463238106Sdes - EDNS timeout code will not fire if EDNS status already known. 2464238106Sdes - EDNS failure not stored if EDNS status known to work. 2465238106Sdes 2466238106Sdes19 May 2010: Wouter 2467238106Sdes - Fix resolution for domains like safesvc.com.cn. If the iterator 2468238106Sdes can not recurse further and it finds the delegation in a state 2469238106Sdes where it would otherwise have rejected it outhand if so received 2470238106Sdes from a cache lookup, then it can try to ask higherup (with loop 2471238106Sdes protection). 2472238106Sdes - Fix comments in iter_utils:dp_is_useless. 2473238106Sdes 2474238106Sdes18 May 2010: Wouter 2475238106Sdes - Fix various compiler warnings from the clang llvm compiler. 2476238106Sdes - iana portlist updated. 2477238106Sdes 2478238106Sdes6 May 2010: Wouter 2479238106Sdes - Fix bug#308: spelling error in variable name in parser and lexer. 2480238106Sdes 2481238106Sdes4 May 2010: Wouter 2482238106Sdes - Fix dnssec-missing detection that was turned off by server selection. 2483238106Sdes - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default 2484238106Sdes reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa, 2485238106Sdes 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa. 2486238106Sdes 2487238106Sdes29 April 2010: Wouter 2488238106Sdes - Fix for dnssec lameness detection to use the key cache. 2489238106Sdes - infra cache entries that are expired are wiped clean. Previously 2490238106Sdes it was possible to not expire host data (if accessed often). 2491238106Sdes 2492238106Sdes28 April 2010: Wouter 2493238106Sdes - ldns tarball updated and GOST support is detected and then enabled. 2494238106Sdes - iana portlist updated. 2495238106Sdes - Fix detection of gost support in ldns (reported by Chris Smith). 2496238106Sdes 2497238106Sdes27 April 2010: Wouter 2498238106Sdes - unbound-control get_option domain-insecure shows config file items. 2499238106Sdes - fix retry sequence if prime hints are recursion-lame. 2500238106Sdes - autotrust anchor file can be initialized with a ZSK key as well. 2501238106Sdes - harden-referral-path does not result in failures due to max-depth. 2502238106Sdes You can increase the max-depth by adding numbers (' 0') after the 2503238106Sdes target-fetch-policy, this increases the depth to which is checked. 2504238106Sdes 2505238106Sdes26 April 2010: Wouter 2506238106Sdes - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use 2507238106Sdes CPPFLAGS during configure process. 2508238106Sdes - if libev is installed on the base system (not libevent), detect 2509238106Sdes it from the event.h header file and link with -lev. 2510238106Sdes - configlexer.lex gets config.h, and configyyrename.h added by make, 2511238106Sdes no more double include. 2512238106Sdes - More strict scrubber (Thanks to George Barwood for the idea): 2513238106Sdes NS set must be pertinent to the query (qname subdomain nsname). 2514238106Sdes - Fix bug#307: In 0x20 backoff fix fallback so the number of 2515238106Sdes outstanding queries does not become -1 and block the request. 2516238106Sdes Fixed handling of recursion-lame in combination with 0x20 fallback. 2517238106Sdes Fix so RRsets are compared canonicalized and sorted if the immediate 2518238106Sdes comparison fails, this makes it work around round-robin sites. 2519238106Sdes 2520238106Sdes23 April 2010: Wouter 2521238106Sdes - Squelch log message: sendto failed permission denied for 2522238106Sdes 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2). 2523238106Sdes - Fix to fetch data as last resort more tenaciously. When cycle 2524238106Sdes targets cause the server selection to believe there are more options 2525238106Sdes when they really are not there, the server selection is reinitiated. 2526238106Sdes - Fix fetch from blacklisted dnssec lame servers as last resort. The 2527238106Sdes server's IP address is then given in validator errors as well. 2528238106Sdes - Fix local-zone type redirect that did not use the query name for 2529238106Sdes the answer rrset. 2530238106Sdes 2531238106Sdes22 April 2010: Wouter 2532238106Sdes - tag 1.4.4. 2533238106Sdes - trunk contains 1.4.5 in development. 2534238106Sdes - Fix validation failure for qtype ANY caused by a RRSIG parse failure. 2535238106Sdes The validator error message was 'no signatures from ...'. 2536238106Sdes 2537238106Sdes16 April 2010: Wouter 2538238106Sdes - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN. 2539238106Sdes - tag 1.4.4rc1. 2540238106Sdes 2541238106Sdes15 April 2010: Wouter 2542238106Sdes - ECC-GOST algorithm number 12 that is assigned by IANA. New test 2543238106Sdes example key and signatures for GOST. GOST requires openssl-1.0.0. 2544238106Sdes GOST is still disabled by default. 2545238106Sdes 2546238106Sdes9 April 2010: Wouter 2547238106Sdes - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or 2548238106Sdes get into an endless loop, if 0x20 was enabled, and buffers are small 2549238106Sdes or particular broken packets are received. 2550238106Sdes - Fix chain of trust with CNAME at an intermediate step, for the DS 2551238106Sdes processing proof. 2552238106Sdes 2553238106Sdes8 April 2010: Wouter 2554238106Sdes - Fix validation of queries with wildcard names (*.example). 2555238106Sdes 2556238106Sdes6 April 2010: Wouter 2557238106Sdes - Fix EDNS probe for .de DNSSEC testbed failure, where the infra 2558238106Sdes cache timeout coincided with a server update, the current EDNS 2559238106Sdes backoff is less sensitive, and does not cache the backoff unless 2560238106Sdes the backoff actually works and the domain is not expecting DNSSEC. 2561238106Sdes - GOST support with correct algorithm numbers. 2562238106Sdes 2563238106Sdes1 April 2010: Wouter 2564238106Sdes - iana portlist updated. 2565238106Sdes 2566238106Sdes24 March 2010: Wouter 2567238106Sdes - unbound control flushed items are not counted when flushed again. 2568238106Sdes 2569238106Sdes23 March 2010: Wouter 2570238106Sdes - iana portlist updated. 2571238106Sdes 2572238106Sdes22 March 2010: Wouter 2573238106Sdes - unbound-host disables use-syslog from config file so that the 2574238106Sdes config file for the main server can be used more easily. 2575238106Sdes - fix bug#301: unbound-checkconf could not parse interface 2576238106Sdes '0.0.0.0@5353', even though unbound itself worked fine. 2577238106Sdes 2578238106Sdes19 March 2010: Wouter 2579238106Sdes - fix fwd_ancil test to pass if the socket options are not supported. 2580238106Sdes 2581238106Sdes18 March 2010: Wouter 2582238106Sdes - Fixed random numbers for port, interface and server selection. 2583238106Sdes Removed very small bias. 2584238106Sdes - Refer to the listing in unbound-control man page in the extended 2585238106Sdes statistics entry in the unbound.conf man page. 2586238106Sdes 2587238106Sdes16 March 2010: Wouter 2588238106Sdes - Fix interface-automatic for OpenBSD: msg.controllen was too small, 2589238106Sdes also assertions on ancillary data buffer. 2590238106Sdes - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO. 2591238106Sdes - for NSEC3 check if signatures are cached. 2592238106Sdes 2593238106Sdes15 March 2010: Wouter 2594238106Sdes - unit test for util/regional.c. 2595238106Sdes 2596238106Sdes12 March 2010: Wouter 2597238106Sdes - Reordered configure checks so fork and -lnsl -lsocket checks are 2598238106Sdes earlier, and thus later checks benefit from and do not hinder them. 2599238106Sdes - iana portlist updated. 2600238106Sdes - ldns tarball updated. 2601238106Sdes - Fix python use when multithreaded. 2602238106Sdes - Fix solaris python compile. 2603238106Sdes - Include less in config.h and include per code file for ldns, ssl. 2604238106Sdes 2605238106Sdes11 March 2010: Wouter 2606238106Sdes - another memory allocation option: --enable-alloc-nonregional. 2607238106Sdes exposes the regional allocations to other memory purifiers. 2608238106Sdes - fix for memory alignment in struct sock_list allocation. 2609238106Sdes - Fix for MacPorts ldns without ssl default, unbound checks if ldns 2610238106Sdes has dnssec functionality and uses the builtin if not. 2611238106Sdes - Fix daemonize on Solaris 10, it did not detach from terminal. 2612238106Sdes - tag 1.4.3 created. 2613238106Sdes - trunk is 1.4.4 in development. 2614238106Sdes - spelling fix in validation error involving cnames. 2615238106Sdes 2616238106Sdes10 March 2010: Wouter 2617238106Sdes - --enable-alloc-lite works with test set. 2618238106Sdes - portability in the testset: printf format conversions, prototypes. 2619238106Sdes 2620238106Sdes9 March 2010: Wouter 2621238106Sdes - tag 1.4.2 created. 2622238106Sdes - trunk is 1.4.3 in development. 2623238106Sdes - --enable-alloc-lite debug option. 2624238106Sdes 2625238106Sdes8 March 2010: Wouter 2626238106Sdes - iana portlist updated. 2627238106Sdes 2628238106Sdes4 March 2010: Wouter 2629238106Sdes - Fix crash in control channel code. 2630238106Sdes 2631238106Sdes3 March 2010: Wouter 2632238106Sdes - better casts in pipe code, brackets placed wrongly. 2633238106Sdes - iana portlist updated. 2634238106Sdes 2635238106Sdes1 March 2010: Wouter 2636238106Sdes - make install depends on make all. 2637238106Sdes - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs. 2638238106Sdes - --enable-checking: enables assertions but does not look nonproduction. 2639238106Sdes - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with 2640238106Sdes nxdomain and nodata distinguished. 2641238106Sdes - ldns tarball updated. 2642238106Sdes - --disable-rpath fixed for libtool not found errors. 2643238106Sdes - new fedora specfile from Fedora13 in contrib from Paul Wouters. 2644238106Sdes 2645238106Sdes26 February 2010: Wouter 2646238106Sdes - Fixup prototype for lexer cleanup in daemon code. 2647238106Sdes - unbound-control list_stubs, list_forwards, list_local_zones and 2648238106Sdes list_local_data. 2649238106Sdes 2650238106Sdes24 February 2010: Wouter 2651238106Sdes - Fix scrubber bug that potentially let NS records through. Reported 2652238106Sdes by Amanda Constant. 2653238106Sdes - Also delete potential poison references from additional. 2654238106Sdes - Fix: no classification of a forwarder as lame, throw away instead. 2655238106Sdes 2656238106Sdes23 February 2010: Wouter 2657238106Sdes - libunbound ub_ctx_get_option() added. 2658238106Sdes - unbound-control set_option and get_option commands. 2659238106Sdes - iana portlist updated. 2660238106Sdes 2661238106Sdes18 February 2010: Wouter 2662238106Sdes - A little more strict DS scrubbing. 2663238106Sdes - No more blacklisting of unresponsive servers, a 2 minute timeout 2664238106Sdes is backed off to. 2665238106Sdes - RD flag not enabled for dnssec-blacklisted tries, unless necessary. 2666238106Sdes - pickup ldns compile fix, libdl for libcrypto. 2667238106Sdes - log 'tcp connect: connection timed out' only in high verbosity. 2668238106Sdes - unbound-control log_reopen command. 2669238106Sdes - moved get_option code from unbound-checkconf to util/config_file.c 2670238106Sdes 2671238106Sdes17 February 2010: Wouter 2672238106Sdes - Disregard DNSKEY from authority section for chain of trust. 2673238106Sdes DS records that are irrelevant to a referral scrubbed. Anti-poison. 2674238106Sdes - iana portlist updated. 2675238106Sdes 2676238106Sdes16 February 2010: Wouter 2677238106Sdes - Check for 'no space left on device' (or other errors) when 2678238106Sdes writing updated autotrust anchors and print errno to log. 2679238106Sdes 2680238106Sdes15 February 2010: Wouter 2681238106Sdes - Fixed the requery protection, the TTL was 0, it is now 900 seconds, 2682238106Sdes hardcoded. We made the choice to send out more conservatively, 2683238106Sdes protecting against an aggregate effect more than protecting a 2684238106Sdes single user (from their own folly, perhaps in case of misconfig). 2685238106Sdes 2686238106Sdes12 February 2010: Wouter 2687238106Sdes - Re-query pattern changed on validation failure. To protect troubled 2688238106Sdes authority servers, unbound caches a failure for the DNSKEY or DS 2689238106Sdes records for the entire zone, and only retries that 900 seconds later. 2690238106Sdes This implies that only a handful of packets are sent extra to the 2691238106Sdes authority if the zone fails. 2692238106Sdes 2693238106Sdes11 February 2010: Wouter 2694238106Sdes - ldns tarball update for long label length syntax error fix. 2695238106Sdes - iana portlist updated. 2696238106Sdes 2697238106Sdes9 February 2010: Wouter 2698238106Sdes - Fixup in compat snprintf routine, %f 1.02 and %g support. 2699238106Sdes - include math.h for testbound test compile portability. 2700238106Sdes 2701238106Sdes2 February 2010: Wouter 2702238106Sdes - Updated url of IANA itar, interim trust anchor repository, in script. 2703238106Sdes 2704238106Sdes1 February 2010: Wouter 2705238106Sdes - iana portlist updated. 2706238106Sdes - configure test for memcmp portability. 2707238106Sdes 2708238106Sdes27 January 2010: Wouter 2709238106Sdes - removed warning on format string in validator error log statement. 2710238106Sdes - iana portlist updated. 2711238106Sdes 2712238106Sdes22 January 2010: Wouter 2713238106Sdes - libtool finish the install of unbound python dynamic library. 2714238106Sdes 2715238106Sdes21 January 2010: Wouter 2716238106Sdes - acx_nlnetlabs.m4 synchronised with nsd's version. 2717238106Sdes 2718238106Sdes20 January 2010: Wouter 2719238106Sdes - Fixup lookup trouble for parent-child domains on the first query. 2720238106Sdes 2721238106Sdes14 January 2010: Wouter 2722238106Sdes - Fixup ldns detection to also check for header files. 2723238106Sdes 2724238106Sdes13 January 2010: Wouter 2725238106Sdes - prefetch-key option that performs DNSKEY queries earlier in the 2726238106Sdes validation process, and that could halve the latency on DNSSEC 2727238106Sdes queries. It takes some extra processing (CPU, a cache is needed). 2728238106Sdes 2729238106Sdes12 January 2010: Wouter 2730238106Sdes - Fix unbound-checkconf for auto-trust-anchor-file present checks. 2731238106Sdes 2732238106Sdes8 January 2010: Wouter 2733238106Sdes - Fix for parent-child disagreement code which could have trouble 2734238106Sdes when (a) ipv6 was disabled and (b) the TTL for parent and child 2735238106Sdes were different. There were two bugs, the parent-side information 2736238106Sdes is fixed to no longer block lookup of child side information and 2737238106Sdes the iterator is fixed to no longer attempt to get ipv6 when it is 2738238106Sdes not enabled and then give up in failure. 2739238106Sdes - test and fixes to make prefetch actually store the answer in the 2740238106Sdes cache. Considers some rrsets 'already expired' but does not allow 2741238106Sdes overwriting of rrsets considered more secure. 2742238106Sdes 2743238106Sdes7 January 2010: Wouter 2744238106Sdes - Fixup python documentation (thanks Leo Vandewoestijne). 2745238106Sdes - Work on cache prefetch feature. 2746238106Sdes - Stats for prefetch, in log print stats, unbound-control stats 2747238106Sdes and in unbound_munin plugin. 2748238106Sdes 2749238106Sdes6 January 2010: Wouter 2750238106Sdes - iana portlist updated. 2751238106Sdes - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length. 2752238106Sdes - verbose output includes parent-side-address notion for lameness. 2753238106Sdes - documented val-log-level: 2 setting in example.conf and man page. 2754238106Sdes - change unbound-control-setup from 1024(sha1) to 1536(sha256). 2755238106Sdes 2756238106Sdes1 January 2010: Wouter 2757238106Sdes - iana portlist updated. 2758238106Sdes 2759238106Sdes22 December 2009: Wouter 2760238106Sdes - configure with newer libtool 2.2.6b. 2761238106Sdes 2762238106Sdes17 December 2009: Wouter 2763238106Sdes - review comments. 2764238106Sdes - tag 1.4.1. 2765238106Sdes - trunk to version 1.4.2. 2766238106Sdes 2767238106Sdes15 December 2009: Wouter 2768238106Sdes - Answer to qclass=ANY queries, with class IN contents. 2769238106Sdes Test that validation also works. 2770238106Sdes - updated ldns snapshot tarball with latest fixes (parsing records). 2771238106Sdes 2772238106Sdes11 December 2009: Wouter 2773238106Sdes - on IPv4 UDP turn off DF flag. 2774238106Sdes 2775238106Sdes10 December 2009: Wouter 2776238106Sdes - requirements.txt updated with design choice explanations. 2777238106Sdes - Reading fixes: fix to set unlame when child confirms parent glue, 2778238106Sdes and fix to avoid duplicate addresses in delegation point. 2779238106Sdes - verify_rrsig routine checks expiration last. 2780238106Sdes 2781238106Sdes9 December 2009: Wouter 2782238106Sdes - Fix Bug#287(reopened): update of ldns tarball with fix for parse 2783238106Sdes errors generated for domain names like '.example.com'. 2784238106Sdes - Fix SOA excluded from negative DS responses. Reported by Hauke 2785238106Sdes Lampe. The negative cache did not include proper SOA records for 2786238106Sdes negative qtype DS responses which makes BIND barf on it, such 2787238106Sdes responses are now only used internally. 2788238106Sdes - Fix negative cache lookup of closestencloser check of DS type bit. 2789238106Sdes 2790238106Sdes8 December 2009: Wouter 2791238106Sdes - Fix for lookup of parent-child disagreement domains, where the 2792238106Sdes parent-side glue works but it does not provide proper NS, A or AAAA 2793238106Sdes for itself, fixing domains such as motorcaravanners.eu. 2794238106Sdes - Feature: you can specify a port number in the interface: line, so 2795238106Sdes you can bind the same interface multiple times at different ports. 2796238106Sdes 2797238106Sdes7 December 2009: Wouter 2798238106Sdes - Bug#287: Fix segfault when unbound-control remove nonexistent local 2799238106Sdes data. Added check to tests. 2800238106Sdes 2801238106Sdes1 December 2009: Wouter 2802238106Sdes - Fix crash with module-config "iterator". 2803238106Sdes - Added unit test that has "iterator" module-config. 2804238106Sdes 2805238106Sdes30 November 2009: Wouter 2806238106Sdes - bug#284: fix parse of # without end-of-line at end-of-file. 2807238106Sdes 2808238106Sdes26 November 2009: Wouter 2809238106Sdes - updated ldns with release candidate for version 1.6.3. 2810238106Sdes - tag for 1.4.0 release. 2811238106Sdes - 1.4.1 version in trunk. 2812238106Sdes - Fixup major libtool version to 2 because of why_bogus change. 2813238106Sdes It was 1:5:0 but should have been 2:0:0. 2814238106Sdes 2815238106Sdes23 November 2009: Wouter 2816238106Sdes - Patch from David Hubbard for libunbound manual page. 2817238106Sdes - Fixup endless spinning in unbound-control stats reported by 2818238106Sdes Attila Nagy. Probably caused by clock reversal. 2819238106Sdes 2820238106Sdes20 November 2009: Wouter 2821238106Sdes - contrib/split-itar.sh contributed by Tom Hendrikx. 2822238106Sdes 2823238106Sdes19 November 2009: Wouter 2824238106Sdes - better argument help for unbound-control. 2825238106Sdes - iana portlist updated. 2826238106Sdes 2827238106Sdes17 November 2009: Wouter 2828238106Sdes - noted multiple entries for multiple domain names in example.conf. 2829238106Sdes - iana portlist updated. 2830238106Sdes 2831238106Sdes16 November 2009: Wouter 2832238106Sdes - Fixed signer detection of CNAME responses without signatures. 2833238106Sdes - Fix#282 libunbound memleak on error condition by Eric Sesterhenn. 2834238106Sdes - Tests for CNAMEs to deeper trust anchors, secure and bogus. 2835238106Sdes - svn tag 1.4.0rc1 made. 2836238106Sdes 2837238106Sdes13 November 2009: Wouter 2838238106Sdes - Fixed validation failure for CNAME to optout NSEC3 nodata answer. 2839238106Sdes - unbound-host does not fail on type ANY. 2840238106Sdes - Fixed wireparse failure to put RRSIGs together with data in some 2841238106Sdes long ANY mix cases, which fixes validation failures. 2842238106Sdes 2843238106Sdes12 November 2009: Wouter 2844238106Sdes - iana portlist updated. 2845238106Sdes - fix manpage errors reported by debian lintian. 2846238106Sdes - review comments. 2847238106Sdes - fixup very long vallog2 level error strings. 2848238106Sdes 2849238106Sdes11 November 2009: Wouter 2850238106Sdes - ldns tarball updated (to 1.6.2). 2851238106Sdes - review comments. 2852238106Sdes 2853238106Sdes10 November 2009: Wouter 2854238106Sdes - Thanks to Surfnet found bug in new dnssec-retry code that failed 2855238106Sdes to combine well when combined with DLV and a particular failure. 2856238106Sdes - Fixed unbound-control -h output about argument optionality. 2857238106Sdes - review comments. 2858238106Sdes 2859238106Sdes5 November 2009: Wouter 2860238106Sdes - lint fixes and portability tests. 2861238106Sdes - better error text for multiple domain keys in one autotrust file. 2862238106Sdes 2863238106Sdes2 November 2009: Wouter 2864238106Sdes - Fix bug where autotrust does not work when started with a DS. 2865238106Sdes - Updated GOST unit tests for unofficial algorithm number 249 2866238106Sdes and DNSKEY-format changes in draft version -01. 2867238106Sdes 2868238106Sdes29 October 2009: Wouter 2869238106Sdes - iana portlist updated. 2870238106Sdes - edns-buffer-size option, default 4096. 2871238106Sdes - fixed do-udp: no. 2872238106Sdes 2873238106Sdes28 October 2009: Wouter 2874238106Sdes - removed abort on prealloc failure, error still printed but softfail. 2875238106Sdes - iana portlist updated. 2876238106Sdes - RFC 5702: RSASHA256 and RSASHA512 support enabled by default. 2877238106Sdes - ldns tarball updated (which also enables rsasha256 support). 2878238106Sdes 2879238106Sdes27 October 2009: Wouter 2880238106Sdes - iana portlist updated. 2881238106Sdes 2882238106Sdes8 October 2009: Wouter 2883238106Sdes - please doxygen 2884238106Sdes - add val-log-level print to corner case (nameserver.epost.bg). 2885238106Sdes - more detail to errors from insecure delegation checks. 2886238106Sdes - Fix double time subtraction in negative cache reported by 2887238106Sdes Amanda Constant and Hugh Mahon. 2888238106Sdes - Made new validator error string available from libunbound for 2889238106Sdes applications. It is in result->why_bogus, a zero-terminated string. 2890238106Sdes unbound-host prints it by default if a result is bogus. 2891238106Sdes Also the errinf is public in module_qstate (for other modules). 2892238106Sdes 2893238106Sdes7 October 2009: Wouter 2894238106Sdes - retry for validation failure in DS and prime results. Less mem use. 2895238106Sdes unit test. Provisioning in other tests for requeries. 2896238106Sdes - retry for validation failure in DNSKEY in middle of chain of trust. 2897238106Sdes unit test. 2898238106Sdes - retry for empty non terminals in chain of trust and unit test. 2899238106Sdes - Fixed security bug where the signatures for NSEC3 records were not 2900238106Sdes checked when checking for absence of DS records. This could have 2901238106Sdes enabled the substitution of an insecure delegation. 2902238106Sdes - moved version number to 1.4.0 because of 1.3.4 release with only 2903238106Sdes the NSEC3 patch from the entry above. 2904238106Sdes - val-log-level: 2 shows extended error information for validation 2905238106Sdes failures, but still one (longish) line per failure. For example: 2906238106Sdes validation failure <example.com. DNSKEY IN>: signature expired from 2907238106Sdes 192.0.2.4 for trust anchor example.com. while building chain of trust 2908238106Sdes validation failure <www.example.com. A IN>: no signatures from 2909238106Sdes 192.0.2.6 for key example.com. while building chain of trust 2910238106Sdes 2911238106Sdes6 October 2009: Wouter 2912238106Sdes - Test set updated to provide additional ns lookup result. 2913238106Sdes The retry would attempt to fetch the data from other nameservers 2914238106Sdes for bogus data, and this needed to be provisioned in the tests. 2915238106Sdes 2916238106Sdes5 October 2009: Wouter 2917238106Sdes - first validation failure retry code. Retries for data failures. 2918238106Sdes And unit test. 2919238106Sdes 2920238106Sdes2 October 2009: Wouter 2921238106Sdes - improve 5011 modularization. 2922238106Sdes - fix unbound-host so -d can be given before -C. 2923238106Sdes - iana portlist updated. 2924238106Sdes 2925238106Sdes28 September 2009: Wouter 2926238106Sdes - autotrust-anchor-file can read multiline input and $ORIGIN. 2927238106Sdes - prevent integer overflow in holddown calculation. review fixes. 2928238106Sdes - fixed race condition in trust point revocation. review fix. 2929238106Sdes - review fixes to comments, removed unused code. 2930238106Sdes 2931238106Sdes25 September 2009: Wouter 2932238106Sdes - so-rcvbuf: 4m option added. Set this on large busy servers to not 2933238106Sdes drop the occasional packet in spikes due to full socket buffers. 2934238106Sdes netstat -su keeps a counter of UDP dropped due to full buffers. 2935238106Sdes - review of validator/autotrust.c, small fixes and comments. 2936238106Sdes 2937238106Sdes23 September 2009: Wouter 2938238106Sdes - 5011 query failed counts verification failures, not lookup failures. 2939238106Sdes - 5011 probe failure handling fixup. 2940238106Sdes - test unbound reading of original autotrust data. 2941238106Sdes The metadata per-key, such as key state (PENDING, MISSING, VALID) is 2942238106Sdes picked up, otherwise performs initial probe like usual. 2943238106Sdes 2944238106Sdes22 September 2009: Wouter 2945238106Sdes - autotrust test with algorithm rollover, new ordering of checks 2946238106Sdes assists in orderly rollover. 2947238106Sdes - autotrust test with algorithm rollover to unknown algorithm. 2948238106Sdes checks if new keys are supported before adding them. 2949238106Sdes - autotrust test with trust point revocation, becomes unsigned. 2950238106Sdes - fix DNSSEC-missing-signature detection for minimal responses 2951238106Sdes for qtype DNSKEY (assumes DNSKEY occurs at zone apex). 2952238106Sdes 2953238106Sdes18 September 2009: Wouter 2954238106Sdes - autotrust tests, fix trustpoint timer deletion code. 2955238106Sdes fix count of valid anchors during missing remove. 2956238106Sdes - autotrust: pick up REVOKE even if not signed with known other keys. 2957238106Sdes 2958238106Sdes17 September 2009: Wouter 2959238106Sdes - fix compile of unbound-host when --enable-alloc-checks. 2960238106Sdes - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis. 2961238106Sdes - Manual page fixes reported by Tony Finch. 2962238106Sdes 2963238106Sdes16 September 2009: Wouter 2964238106Sdes - Fix memory leak reported by Tao Ma. 2965238106Sdes - Fix memstats test tool for log-time-ascii log format. 2966238106Sdes 2967238106Sdes15 September 2009: Wouter 2968238106Sdes - iana portlist updated. 2969238106Sdes 2970238106Sdes10 September 2009: Wouter 2971238106Sdes - increased MAXSYSLOGLEN so .bg key can be printed in debug output. 2972238106Sdes - use linebuffering for log-file: output, this can be significantly 2973238106Sdes faster than the previous fflush method and enable some class of 2974238106Sdes resolvers to use high verbosity (for short periods). 2975238106Sdes Not on windows, because line buffering does not work there. 2976238106Sdes 2977238106Sdes9 September 2009: Wouter 2978238106Sdes - Fix bug where DNSSEC-bogus messages were marked with too high TTL. 2979238106Sdes The RRsets would still expire at the normal time, but this would 2980238106Sdes keep messages bogus in the cache for too long. 2981238106Sdes - regression test for that bug. 2982238106Sdes - documented that load_cache is meant for debugging. 2983238106Sdes 2984238106Sdes8 September 2009: Wouter 2985238106Sdes - fixup printing errors when load_cache, they were printed to the 2986238106Sdes SSL connection which broke, now to the log. 2987238106Sdes - new ldns - with fixed parse of large SOA values. 2988238106Sdes 2989238106Sdes7 September 2009: Wouter 2990238106Sdes - autotrust testbound scenarios. 2991238106Sdes - autotrust fix that failure count is written to file. 2992238106Sdes - autotrust fix that keys may become valid after add holddown time 2993238106Sdes alone, before the probe returns. 2994238106Sdes 2995238106Sdes4 September 2009: Wouter 2996238106Sdes - Changes to make unbound work with libevent-2.0.3 alpha. (in 2997238106Sdes configure detection due to new ssl dependency in libevent) 2998238106Sdes - do not call sphinx for documentation when python is disabled. 2999238106Sdes - remove EV_PERSIST from libevent timeout code to make the code 3000238106Sdes compatible with the libevent-2.0. Works with older libevent too. 3001238106Sdes - fix memory leak in python code. 3002238106Sdes 3003238106Sdes3 September 2009: Wouter 3004238106Sdes - Got a patch from Luca Bruno for libunbound support on windows to 3005238106Sdes pick up the system resolvconf nameservers and hosts there. 3006238106Sdes - included ldns updated (enum warning fixed). 3007238106Sdes - makefile fix for parallel makes. 3008238106Sdes - Patch from Zdenek Vasicek and Attila Nagy for using the source IP 3009238106Sdes from python scripts. See pythonmod/examples/resip.py. 3010238106Sdes - doxygen comment fixes. 3011238106Sdes 3012238106Sdes2 September 2009: Wouter 3013238106Sdes - TRAFFIC keyword for testbound. Simplifies test generation. 3014238106Sdes ${range lower val upper} to check probe timeout values. 3015238106Sdes - test with 5011-prepublish rollover and revocation. 3016238106Sdes - fix revocation of RR for autotrust, stray exclamation mark. 3017238106Sdes 3018238106Sdes1 September 2009: Wouter 3019238106Sdes - testbound variable arithmetic. 3020238106Sdes - autotrust probe time is randomised. 3021238106Sdes - autotrust: the probe is active and does not fetch from cache. 3022238106Sdes 3023238106Sdes31 August 2009: Wouter 3024238106Sdes - testbound variable processing. 3025238106Sdes 3026238106Sdes28 August 2009: Wouter 3027238106Sdes - fixup unbound-control lookup to print forward and stub servers. 3028238106Sdes 3029238106Sdes27 August 2009: Wouter 3030238106Sdes - autotrust: mesh answer callback is empty. 3031238106Sdes 3032238106Sdes26 August 2009: Wouter 3033238106Sdes - autotrust probing. 3034238106Sdes - iana portlist updated. 3035238106Sdes 3036238106Sdes25 August 2009: Wouter 3037238106Sdes - fixup memleak in trust anchor unsupported algorithm check. 3038238106Sdes - iana portlist updated. 3039238106Sdes - autotrust options: add-holddown, del-holddown, keep-missing. 3040238106Sdes - autotrust store revoked status of trust points. 3041238106Sdes - ctime_r compat definition. 3042238106Sdes - detect yylex_destroy() in configure. 3043238106Sdes - detect SSL_get_compression_methods declaration in configure. 3044238106Sdes - fixup DS lookup at anchor point with unsigned parent. 3045238106Sdes - fixup DLV lookup for DS queries to unsigned domains. 3046238106Sdes 3047238106Sdes24 August 2009: Wouter 3048238106Sdes - cleaner memory allocation on exit. autotrust test routines. 3049238106Sdes - free all memory on program exit, fix for ssl and flex. 3050238106Sdes 3051238106Sdes21 August 2009: Wouter 3052238106Sdes - autotrust: debug routines. Read,write and conversions work. 3053238106Sdes 3054238106Sdes20 August 2009: Wouter 3055238106Sdes - autotrust: save and read trustpoint variables. 3056238106Sdes 3057238106Sdes19 August 2009: Wouter 3058238106Sdes - autotrust: state table updates. 3059238106Sdes - iana portlist updated. 3060238106Sdes 3061238106Sdes17 August 2009: Wouter 3062238106Sdes - autotrust: process events. 3063238106Sdes 3064238106Sdes17 August 2009: Wouter 3065238106Sdes - Fix so that servers are only blacklisted if they fail to reply 3066238106Sdes to 16 queries in a row and the timeout gets above 2 minutes. 3067238106Sdes - autotrust work, split up DS verification of DNSKEYs. 3068238106Sdes 3069238106Sdes14 August 2009: Wouter 3070238106Sdes - unbound-control lookup prints out infra cache information, like RTT. 3071238106Sdes - Fix bug in DLV lookup reported by Amanda from Secure64. 3072238106Sdes It could sometimes wrongly classify a domain as unsigned, which 3073238106Sdes does not give the AD bit on replies. 3074238106Sdes 3075238106Sdes13 August 2009: Wouter 3076238106Sdes - autotrust read anchor files. locked trust anchors. 3077238106Sdes 3078238106Sdes12 August 2009: Wouter 3079238106Sdes - autotrust import work. 3080238106Sdes 3081238106Sdes11 August 2009: Wouter 3082238106Sdes - Check for openssl compatible with gost if enabled. 3083238106Sdes - updated unit test for GOST=211 code. 3084238106Sdes Nicer naming of test files. 3085238106Sdes - iana portlist updated. 3086238106Sdes 3087238106Sdes7 August 2009: Wouter 3088238106Sdes - call OPENSSL_config() in unbound and unit test so that the 3089238106Sdes operator can use openssl.cnf for configuration options. 3090238106Sdes - removed small memory leak from config file reader. 3091238106Sdes 3092238106Sdes6 August 2009: Wouter 3093238106Sdes - configure --enable-gost for GOST support, experimental 3094238106Sdes implementation of draft-dolmatov-dnsext-dnssec-gost-01. 3095238106Sdes - iana portlist updated. 3096238106Sdes - ldns tarball updated (with GOST support). 3097238106Sdes 3098238106Sdes5 August 2009: Wouter 3099238106Sdes - trunk moved to 1.3.4. 3100238106Sdes 3101238106Sdes4 August 2009: Wouter 3102238106Sdes - Added test that the examples from draft rsasha256-14 verify. 3103238106Sdes - iana portlist updated. 3104238106Sdes - tagged 1.3.3 3105238106Sdes 3106238106Sdes3 August 2009: Wouter 3107238106Sdes - nicer warning when algorithm not supported, tells you to upgrade. 3108238106Sdes - iana portlist updated. 3109238106Sdes 3110238106Sdes27 July 2009: Wouter 3111238106Sdes - Updated unbound-cacti contribution from Dmitriy Demidov, with 3112238106Sdes the queue statistics displayed in its own graph. 3113238106Sdes - iana portlist updated. 3114238106Sdes 3115238106Sdes22 July 2009: Wouter 3116238106Sdes - Fix bug found by Michael Tokarev where unbound would try to 3117238106Sdes prime the root servers even though forwarders are configured for 3118238106Sdes the root. 3119238106Sdes - tagged 1.3.3rc1 3120238106Sdes 3121238106Sdes21 July 2009: Wouter 3122238106Sdes - Fix server selection, so that it waits for open target queries when 3123238106Sdes faced with lameness. 3124238106Sdes 3125238106Sdes20 July 2009: Wouter 3126238106Sdes - Ignore transient sendto errors, no route to host, and host, net down. 3127238106Sdes - contrib/update-anchor.sh has -r option for root-hints. 3128238106Sdes - feature val-log-level: 1 prints validation failures so you can 3129238106Sdes keep track of them during dnssec deployment. 3130238106Sdes 3131238106Sdes16 July 2009: Wouter 3132238106Sdes - fix replacement malloc code. Used in crosscompile. 3133238106Sdes - makedist -w creates crosscompiled setup.exe on fedora11. 3134238106Sdes 3135238106Sdes15 July 2009: Wouter 3136238106Sdes - dependencies for compat items, for crosscompile. 3137238106Sdes - mingw32 crosscompile changes, dependencies and zipfile creation. 3138238106Sdes and with System.dll from the windows NSIS you can make setup.exe. 3139238106Sdes - package libgcc_s_sjlj exception handler for NSISdl.dll. 3140238106Sdes 3141238106Sdes14 July 2009: Wouter 3142238106Sdes - updated ldns tarball for solaris x64 compile assistance. 3143238106Sdes - no need to define RAND_MAX from config.h. 3144238106Sdes - iana portlist updated. 3145238106Sdes - configure changes and ldns update for mingw32 crosscompile. 3146238106Sdes 3147238106Sdes13 July 2009: Wouter 3148238106Sdes - Fix for crash at start on windows. 3149238106Sdes - tag for release 1.3.2. 3150238106Sdes - trunk has version 1.3.3. 3151238106Sdes - Fix for ID bits on windows to use all 16. RAND_MAX was not 3152238106Sdes defined like you'd expect on mingw. Reported by Mees de Roo. 3153238106Sdes 3154238106Sdes9 July 2009: Wouter 3155238106Sdes - tag for release 1.3.1. 3156238106Sdes - trunk has version 1.3.2. 3157238106Sdes 3158238106Sdes7 July 2009: Wouter 3159238106Sdes - iana portlist updated. 3160238106Sdes 3161238106Sdes6 July 2009: Wouter 3162238106Sdes - prettier error handling in SSL setup. 3163238106Sdes - makedist.sh uname fix (same as ldns). 3164238106Sdes - updated fedora spec file. 3165238106Sdes 3166238106Sdes3 July 2009: Wouter 3167238106Sdes - fixup linking when ldnsdir is "". 3168238106Sdes 3169238106Sdes30 June 2009: Wouter 3170238106Sdes - more lenient truncation checks. 3171238106Sdes 3172238106Sdes29 June 2009: Wouter 3173238106Sdes - ldns trunk r2959 imported as tarball, because of solaris cc compile 3174238106Sdes support for c99. r2960 for better configure. 3175238106Sdes - better wrongly_truncated check. 3176238106Sdes - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to 3177238106Sdes avoid dropped packets at routers. 3178238106Sdes 3179238106Sdes26 June 2009: Wouter 3180238106Sdes - Fix EDNS fallback when EDNS works for short answers but long answers 3181238106Sdes are dropped. 3182238106Sdes 3183238106Sdes22 June 2009: Wouter 3184238106Sdes - fixup iter priv strict aliasing while preserving size of sockaddr. 3185238106Sdes - iana portlist updated. (one less port allocated, one more fraction 3186238106Sdes of a bit for security!) 3187238106Sdes - updated fedora specfile in contrib from Paul Wouters. 3188238106Sdes 3189238106Sdes19 June 2009: Wouter 3190238106Sdes - Fixup strict aliasing warning in iter priv code. 3191238106Sdes and config_file code. 3192238106Sdes - iana portlist updated. 3193238106Sdes - harden-referral-path: handle cases where NS is in answer section. 3194238106Sdes 3195238106Sdes18 June 2009: Wouter 3196238106Sdes - Fix of message parse bug where (specifically) an NSEC and RRSIG 3197238106Sdes in the wrong order would be parsed, but put wrongly into internal 3198238106Sdes structures so that later validation would fail. 3199238106Sdes - Extreme lenience for wrongly truncated replies where a positive 3200238106Sdes reply has an NS in the authority but no signatures. They are 3201238106Sdes turned into minimal responses with only the (secure) answer. 3202238106Sdes - autoconf 2.63 for configure. 3203238106Sdes - python warnings suppress. Keep python API away from header files. 3204238106Sdes 3205238106Sdes17 June 2009: Wouter 3206238106Sdes - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was 3207238106Sdes used for the python code in unbound. (http://www.nic.cz/vip/ in cz). 3208238106Sdes 3209238106Sdes16 June 2009: Wouter 3210238106Sdes - Fixup opportunistic target query generation to it does not 3211238106Sdes generate queries that are known to fail. 3212238106Sdes - Touchup on munin total memory report. 3213238106Sdes - messages picked out of the cache by the iterator are checked 3214238106Sdes if their cname chain is still correct and if validation status 3215238106Sdes has to be reexamined. 3216238106Sdes 3217238106Sdes15 June 2009: Wouter 3218238106Sdes - iana portlist updated. 3219238106Sdes 3220238106Sdes14 June 2009: Wouter 3221238106Sdes - Fixed bug where cached responses would lose their security 3222238106Sdes status on second validation, which especially impacted dlv 3223238106Sdes lookups. Reported by Hauke Lampe. 3224238106Sdes 3225238106Sdes13 June 2009: Wouter 3226238106Sdes - bug #254. removed random whitespace from example.conf. 3227238106Sdes 3228238106Sdes12 June 2009: Wouter 3229238106Sdes - Fixup potential wrong NSEC picked out of the cache. 3230238106Sdes - If unfulfilled callbacks are deleted they are called with an error. 3231238106Sdes - fptr wlist checks for mesh callbacks. 3232238106Sdes - fwd above stub in configuration works. 3233238106Sdes 3234238106Sdes11 June 2009: Wouter 3235238106Sdes - Fix queries for type DS when forward or stub zones are there. 3236238106Sdes They are performed to higherup domains, and thus treated as if 3237238106Sdes going to higher zones when looking up the right forward or stub 3238238106Sdes server. This makes a stub pointing to a local server that has 3239238106Sdes a local view of example.com signed with the same keys as are 3240238106Sdes publicly used work. Reported by Johan Ihren. 3241238106Sdes - Added build-unbound-localzone-from-hosts.pl to contrib, from 3242238106Sdes Dennis DeDonatis. It converts /etc/hosts into config statements. 3243238106Sdes - same thing fixed for forward-zone and DS, chain of trust from 3244238106Sdes public internet into the forward-zone works now. Added unit test. 3245238106Sdes 3246238106Sdes9 June 2009: Wouter 3247238106Sdes - openssl key files are opened apache-style, when user is root and 3248238106Sdes before chrooting. This makes permissions on remote-control key 3249238106Sdes files easier to set up. Fixes bug #251. 3250238106Sdes - flush_type and flush_name remove msg cache entries. 3251238106Sdes - codereview - dp copy bogus setting fix. 3252238106Sdes 3253238106Sdes8 June 2009: Wouter 3254238106Sdes - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause 3255238106Sdes inadvertant behaviour. 3256238106Sdes - 1.3.0 tarball for release created. 3257238106Sdes - 1.3.1 development in svn trunk. 3258238106Sdes - iana portlist updated. 3259238106Sdes - fix lint from complaining on ldns/sha.h. 3260238106Sdes - help compiler figure out aliasing in priv_rrset_bad() routine. 3261238106Sdes - fail to configure with python if swig is not found. 3262238106Sdes - unbound_munin_ in contrib uses ps to show rss if sbrk does not work. 3263238106Sdes 3264238106Sdes3 June 2009: Wouter 3265238106Sdes - fixup bad free() when wrongly encoded DSA signature is seen. 3266238106Sdes Reported by Paul Wouters. 3267238106Sdes - review comments from Matthijs. 3268238106Sdes 3269238106Sdes2 June 2009: Wouter 3270238106Sdes - --enable-sha2 option. The draft rsasha256 changed its algorithm 3271238106Sdes numbers too often. Therefore it is more prudent to disable the 3272238106Sdes RSASHA256 and RSASHA512 support by default. 3273238106Sdes - ldns trunk included as new tarball. 3274238106Sdes - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point. 3275238106Sdes 3276238106Sdes29 May 2009: Wouter 3277238106Sdes - fixup doc bug in README reported by Matthew Dempsky. 3278238106Sdes 3279238106Sdes28 May 2009: Wouter 3280238106Sdes - update iana port list 3281238106Sdes - update ldns lib tarball 3282238106Sdes 3283238106Sdes27 May 2009: Wouter 3284238106Sdes - detect lack of IPv6 support on XP (with a different error code). 3285238106Sdes - Fixup a crash-on-exit which was triggered by a very long queue. 3286238106Sdes Unbound would try to re-use ports that came free, but this is 3287238106Sdes of course not really possible because everything is deleted. 3288238106Sdes Most easily triggered on XP (not Vista), maybe because of the 3289238106Sdes network stack encouraging large messages backlogs. 3290238106Sdes - change in debug statements. 3291238106Sdes - Fixed bug that could cause a crash if root prime failed when there 3292238106Sdes were message backlogs. 3293238106Sdes 3294238106Sdes26 May 2009: Wouter 3295238106Sdes - Thanks again to Brett Carr, found an assertion that was not true. 3296238106Sdes Assertion checked if recursion parent query still existed. 3297238106Sdes 3298238106Sdes29 April 2009: Wouter 3299238106Sdes - Thanks to Brett Carr, caught windows resource leak, use 3300238106Sdes closesocket() and not close() on sockets or else the network stack 3301238106Sdes starts to leak handles. 3302238106Sdes - Removed usage of windows Mutex because windows cannot handle enough 3303238106Sdes mutexes open. Provide own mutex implementation using primitives. 3304238106Sdes 3305238106Sdes28 April 2009: Wouter 3306238106Sdes - created svn tag for 1.3.0. 3307238106Sdes 3308238106Sdes27 April 2009: Wouter 3309238106Sdes - optimised cname from cache. 3310238106Sdes - ifdef windows functions in testbound. 3311238106Sdes 3312238106Sdes23 April 2009: Wouter 3313238106Sdes - fix for threadsafety in solaris thr_key_create() in tests. 3314238106Sdes - iana portlist updated. 3315238106Sdes - fix pylib test for Darwin. 3316238106Sdes - fix pymod test for Darwin and a python threading bug in pymod init. 3317238106Sdes - check python >= 2.4 in configure. 3318238106Sdes - -ldl check for libcrypto 1.0.0beta. 3319238106Sdes 3320238106Sdes21 April 2009: Wouter 3321238106Sdes - fix for build outside sourcedir. 3322238106Sdes - fix for configure script swig detection. 3323238106Sdes 3324238106Sdes17 April 2009: Wouter 3325238106Sdes - Fix reentrant in minievent handler for unix. Could have resulted 3326238106Sdes in spurious event callbacks. 3327238106Sdes - timers do not take up a fd slot for winsock handler. 3328238106Sdes - faster fix for winsock reentrant check. 3329238106Sdes - fix rsasha512 unit test for new (interim) algorithm number. 3330238106Sdes - fix test:ldns doesn't like DOS line endings in keyfiles on unix. 3331238106Sdes - fix compile warning on ubuntu (configlexer fwrite return value). 3332238106Sdes - move python include directives into CPPFLAGS instead of CFLAGS. 3333238106Sdes 3334238106Sdes16 April 2009: Wouter 3335238106Sdes - winsock event handler exit very quickly on signal, even if 3336238106Sdes under heavy load. 3337238106Sdes - iana portlist updated. 3338238106Sdes - fixup windows winsock handler reentrant problem. 3339238106Sdes 3340238106Sdes14 April 2009: Wouter 3341238106Sdes - bug #245: fix munin plugin, perform cleanup of stale lockfiles. 3342238106Sdes - makedist.sh; better help text. 3343238106Sdes - cache-min-ttl option and tests. 3344238106Sdes - mingw detect error condition on TCP sockets (NOTCONN). 3345238106Sdes 3346238106Sdes9 April 2009: Wouter 3347238106Sdes - Fix for removal of RSASHA256_NSEC3 protonumber from ldns. 3348238106Sdes - ldns tarball updated. 3349238106Sdes - iana portlist update. 3350238106Sdes - detect GOST support in openssl-1.0.0-beta1, and fix compile problem 3351238106Sdes because that openssl defines the name STRING for itself. 3352238106Sdes 3353238106Sdes6 April 2009: Wouter 3354238106Sdes - windows compile fix. 3355238106Sdes - Detect FreeBSD jail without ipv6 addresses assigned. 3356238106Sdes - python libunbound wrapper unit test. 3357238106Sdes - installs the following files. Default is to not build them. 3358238106Sdes from configure --with-pythonmodule: 3359238106Sdes /usr/lib/python2.x/site-packages/unboundmodule.py 3360238106Sdes from configure --with-pyunbound: 3361238106Sdes /usr/lib/python2.x/site-packages/unbound.py 3362238106Sdes /usr/lib/python2.x/site-packages/_unbound.so* 3363238106Sdes The example python scripts (pythonmod/examples and 3364238106Sdes libunbound/python/examples) are not installed. 3365238106Sdes - python invalidate routine respects packed rrset ids and locks. 3366238106Sdes - clock skew checks in unbound, config statements. 3367238106Sdes - nxdomain ttl considerations in requirements.txt 3368238106Sdes 3369238106Sdes3 April 2009: Wouter 3370238106Sdes - Fixed a bug that caused messages to be stored in the cache too 3371238106Sdes long. Hard to trigger, but NXDOMAINs for nameservers or CNAME 3372238106Sdes targets have been more vulnerable to the TTL miscalculation bug. 3373238106Sdes - documentation test fixed for python addition. 3374238106Sdes 3375238106Sdes2 April 2009: Wouter 3376238106Sdes - pyunbound (libunbound python plugin) compiles using libtool. 3377238106Sdes - documentation for pythonmod and pyunbound is generated in doc/html. 3378238106Sdes - iana portlist updated. 3379238106Sdes - fixed bug in unbound-control flush_zone where it would not flush 3380238106Sdes every message in the target domain. This especially impacted 3381238106Sdes NXDOMAIN messages which could remain in the cache regardless. 3382238106Sdes - python module test package. 3383238106Sdes 3384238106Sdes1 April 2009: Wouter 3385238106Sdes - suppress errors when trying to contact authority servers that gave 3386238106Sdes ipv6 AAAA records for their nameservers with ipv4 mapped contents. 3387238106Sdes Still tries to do so, could work when deployed in intranet. 3388238106Sdes Higher verbosity shows the error. 3389238106Sdes - new libunbound calls documented. 3390238106Sdes - pyunbound in libunbound/python. Removed compile warnings. 3391238106Sdes Makefile to make it. 3392238106Sdes 3393238106Sdes30 March 2009: Wouter 3394238106Sdes - Fixup LDFLAGS from libevent sourcedir compile configure restore. 3395238106Sdes - Fixup so no non-absolute rpaths are added. 3396238106Sdes - Fixup validation of RRSIG queries, they are let through. 3397238106Sdes - read /dev/random before chroot 3398238106Sdes - checkconf fix no python checks when no python module enabled. 3399238106Sdes - fix configure, pthread first, so other libs do not change outcome. 3400238106Sdes 3401238106Sdes27 March 2009: Wouter 3402238106Sdes - nicer -h output. report linked libraries and modules. 3403238106Sdes - prints modules in intuitive order (config file friendly). 3404238106Sdes - python compiles easily on BSD. 3405238106Sdes 3406238106Sdes26 March 2009: Wouter 3407238106Sdes - ignore swig varargs warnings with gcc. 3408238106Sdes - remove duplicate example.conf text from python example configs. 3409238106Sdes - outofdir compile fix for python. 3410238106Sdes - pyunbound works. 3411238106Sdes - print modules compiled in on -h. manpage. 3412238106Sdes 3413238106Sdes25 March 2009: Wouter 3414238106Sdes - initial import of the python contribution from Zdenek Vasicek and 3415238106Sdes Marek Vavrusa. 3416238106Sdes - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0. 3417238106Sdes 3418238106Sdes24 March 2009: Wouter 3419238106Sdes - more neat configure.ac. Removed duplicate config.h includes. 3420238106Sdes - neater config.h.in. 3421238106Sdes - iana portlist updated. 3422238106Sdes - fix util/configlexer.c and solaris -std=c99 flag. 3423238106Sdes - fix postcommit aclocal errors. 3424238106Sdes - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R. 3425238106Sdes - swap order of host detect and libtool generation. 3426238106Sdes 3427238106Sdes23 March 2009: Wouter 3428238106Sdes - added launchd plist example file for MacOSX to contrib. 3429238106Sdes - deprecation test for daemon(3). 3430238106Sdes - moved common configure actions to m4 include, prettier Makefile. 3431238106Sdes 3432238106Sdes20 March 2009: Wouter 3433238106Sdes - bug #239: module-config entries order is important. Documented. 3434238106Sdes - build fix for test asynclook. 3435238106Sdes 3436238106Sdes19 March 2009: Wouter 3437238106Sdes - winrc/README.txt dos-format text file. 3438238106Sdes - iana portlist updated. 3439238106Sdes - use _beginthreadex() when available (performs stack alignment). 3440238106Sdes - defaults for windows baked into configure.ac (used if on mingw). 3441238106Sdes 3442238106Sdes18 March 2009: Wouter 3443238106Sdes - Added tests, unknown algorithms become insecure. fallback works. 3444238106Sdes - Fix for and test for unknown algorithms in a trust anchor 3445238106Sdes definition. Trust anchors with no supported algos are ignored. 3446238106Sdes This means a (higher)DS or DLV entry for them could succeed, and 3447238106Sdes otherwise they are treated as insecure. 3448238106Sdes - domain-insecure: "example.com" statement added. Sets domain 3449238106Sdes insecure regardless of chain of trust DSs or DLVs. The inverse 3450238106Sdes of a trust-anchor. 3451238106Sdes 3452238106Sdes17 March 2009: Wouter 3453238106Sdes - unit test for unsupported algorithm in anchor warning. 3454238106Sdes - fixed so queries do not fail on opportunistic target queries. 3455238106Sdes 3456238106Sdes16 March 2009: Wouter 3457238106Sdes - fixup diff error printout in contrib/update-itar.sh. 3458238106Sdes - added contrib/unbound_cacti for statistics support in cacti, 3459238106Sdes contributed by Dmitriy Demidov. 3460238106Sdes 3461238106Sdes13 March 2009: Wouter 3462238106Sdes - doxygen and lex/yacc on linux. 3463238106Sdes - strip update-anchor on makedist -w. 3464238106Sdes - fix testbound on windows. 3465238106Sdes - default log to syslog for windows. 3466238106Sdes - uninstaller can stop unbound - changed text on it to reflect that. 3467238106Sdes - remove debugging from windows 'cron' actions. 3468238106Sdes 3469238106Sdes12 March 2009: Wouter 3470238106Sdes - log to App.logs on windows prints executable identity. 3471238106Sdes - fixup tests. 3472238106Sdes - munin plugin fix benign locking error printout. 3473238106Sdes - anchor-update for windows, called every 24 hours; unbound reloads. 3474238106Sdes 3475238106Sdes11 March 2009: Wouter 3476238106Sdes - winsock event handler resets WSAevents after signalled. 3477238106Sdes - winsock event handler tests if signals are really signalled. 3478238106Sdes - install and service with log to file works on XP and Vista on 3479238106Sdes default install location. 3480238106Sdes - on windows logging to the Application logbook works (as a service). 3481238106Sdes - fix RUN_DIR on windows compile setting in makedist. 3482238106Sdes - windows registry has Software\Unbound\ConfigFile element. 3483238106Sdes If does not exist, the default is used. The -c switch overrides it. 3484238106Sdes - fix makedist version cleanup function. 3485238106Sdes 3486238106Sdes10 March 2009: Wouter 3487238106Sdes - makedist -w strips out old rc.. and snapshot info from version. 3488238106Sdes - setup.exe starts and stops unbound after install, before uninstall. 3489238106Sdes - unbound-checkconf recognizes absolute pathnames on windows (C:...). 3490238106Sdes 3491238106Sdes9 March 2009: Wouter 3492238106Sdes - Nullsoft NSIS installer creation script. 3493238106Sdes 3494238106Sdes5 March 2009: Wouter 3495238106Sdes - fixup memory leak introduced on 18feb in mesh reentrant fix. 3496238106Sdes 3497238106Sdes3 March 2009: Wouter 3498238106Sdes - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8). 3499238106Sdes - service works on xp/vista, no config necessary (using defaults). 3500238106Sdes - windows registry settings. 3501238106Sdes 3502238106Sdes2 March 2009: Wouter 3503238106Sdes - fixup --export-symbols to be -export-symbls for libtool. 3504238106Sdes This should fix extraneous symbols exported from libunbound. 3505238106Sdes Thanks to Ondrej Sury and Robert Edmonds for finding it. 3506238106Sdes - iana portlist updated. 3507238106Sdes - document FAQ entry on stub/forward zones and default blocking. 3508238106Sdes - fix asynclook test app for libunbound not exporting symbols. 3509238106Sdes - service install and remove utils that work with vista UAC. 3510238106Sdes 3511238106Sdes27 February 2009: Wouter 3512238106Sdes - Fixup lexer, to not give warnings about fwrite. Appeared in 3513238106Sdes new lexer features. 3514238106Sdes - makedistro functionality for mingw. Has RC support. 3515238106Sdes - support spaces and backslashes in configured defaults paths. 3516238106Sdes - register, deregister in service control manager. 3517238106Sdes 3518238106Sdes25 February 2009: Wouter 3519238106Sdes - windres usage for application resources. 3520238106Sdes 3521238106Sdes24 February 2009: Wouter 3522238106Sdes - isc moved their dlv key download location. 3523238106Sdes - fixup warning on vista/mingw. 3524238106Sdes - makedist -w for window zip distribution first version. 3525238106Sdes 3526238106Sdes20 February 2009: Wouter 3527238106Sdes - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped. 3528238106Sdes Nicer script layout. Added url to site in -h output. 3529238106Sdes 3530238106Sdes19 February 2009: Wouter 3531238106Sdes - unbound-checkconf and unbound print warnings when trust anchors 3532238106Sdes have unsupported algorithms. 3533238106Sdes - added contrib/update-itar.sh This script is similar to 3534238106Sdes update-anchor.sh, and updates from the IANA ITAR repository. 3535238106Sdes You can provide your own PGP key and trust repo, or can use the 3536238106Sdes builtin. The program uses wget and gpg to work. 3537238106Sdes - iana portlist updated. 3538238106Sdes - update-itar.sh: using ftp:// urls because https godaddy certificate 3539238106Sdes is not available everywhere and then gives fatal errors. The 3540238106Sdes security is provided by pgp signature. 3541238106Sdes 3542238106Sdes18 February 2009: Wouter 3543238106Sdes - more cycle detection. Also for target queries. 3544238106Sdes - fixup bug where during deletion of the mesh queries the callbacks 3545238106Sdes that were reentrant caused assertion failures. Keep the mesh in 3546238106Sdes a reentrant safe state. Affects libunbound, reload of server, 3547238106Sdes on quit and flush_requestlist. 3548238106Sdes - iana portlist updated. 3549238106Sdes 3550238106Sdes13 February 2009: Wouter 3551238106Sdes - forwarder information now per-thread duplicated. 3552238106Sdes This keeps it read only for speed, with no locking necessary. 3553238106Sdes - forward command for unbound control to change forwarders to use 3554238106Sdes on the fly. 3555238106Sdes - document that unbound-host reads no config file by default. 3556238106Sdes - updated iana portlist. 3557238106Sdes 3558238106Sdes12 February 2009: Wouter 3559238106Sdes - call setusercontext if available (on BSD). 3560238106Sdes - small refactor of stats clearing. 3561238106Sdes - #227: flush_stats feature for unbound-control. 3562238106Sdes - stats_noreset feature for unbound-control. 3563238106Sdes - flush_requestlist feature for unbound-control. 3564238106Sdes - libunbound version upped API (was changed 5 feb). 3565238106Sdes - unbound-control status shows if root forwarding is in use. 3566238106Sdes - slightly nicer memory management in iter-fwd code. 3567238106Sdes 3568238106Sdes10 February 2009: Wouter 3569238106Sdes - keys with rfc5011 REVOKE flag are skipped and not considered when 3570238106Sdes validating data. 3571238106Sdes - iana portlist updated 3572238106Sdes - #226: dump_requestlist feature for unbound-control. 3573238106Sdes 3574238106Sdes6 February 2009: Wouter 3575238106Sdes - contrib contains specfile for fedora 1.2.1 (from Paul Wouters). 3576238106Sdes - iana portlist updated. 3577238106Sdes - fixup EOL in include directive (reported by Paul Wouters). 3578238106Sdes You can no longer specify newlines in the names of included files. 3579238106Sdes - config parser changed. Gives some syntax errors closer to where they 3580238106Sdes occurred. Does not enforce a space after keyword anymore. 3581238106Sdes Does not allow literal newlines inside quoted strings anymore. 3582238106Sdes - verbosity level 5 logs customer IP for new requestlist entries. 3583238106Sdes - test fix, lexer and cancel test. 3584238106Sdes - new option log-time-ascii: yes if you enable it prints timestamps 3585238106Sdes in the log file as Feb 06 13:45:26 (like syslog does). 3586238106Sdes - detect event_base_new in libevent-1.4.1 and later and use it. 3587238106Sdes - #231 unbound-checkconf -o option prints that value from config file. 3588238106Sdes Useful for scripting in management scripts and the like. 3589238106Sdes 3590238106Sdes5 February 2009: Wouter 3591238106Sdes - ldns 1.5.0 rc as tarball included. 3592238106Sdes - 1.3.0 development continues: 3593238106Sdes change in libunbound API: ub_cancel can return an error, that 3594238106Sdes the async_id did not exist, or that it was already delivered. 3595238106Sdes The result could have been delivered just before the cancel 3596238106Sdes routine managed to acquire the lock, so a caller may get the 3597238106Sdes result at the same time they call cancel. For this case, 3598238106Sdes ub_cancel tries to return an error code. 3599238106Sdes Fixes race condition in ub_cancel() libunbound function. 3600238106Sdes - MacOSX Leopard cleaner text output from configure. 3601238106Sdes - initgroups(3) is called to drop secondary group permissions, if 3602238106Sdes applicable. 3603238106Sdes - configure option --with-ldns-builtin forces the use of the 3604238106Sdes inluded ldns package with the unbound source. The -I include 3605238106Sdes is put before the others, so it avoids bad include files from 3606238106Sdes an older ldns install. 3607238106Sdes - daemon(3) posix call is used when available. 3608238106Sdes - testbound test for older fix added. 3609238106Sdes 3610238106Sdes4 February 2009: Wouter 3611238106Sdes - tag for release 1.2.1. 3612238106Sdes - trunk setup for 1.3.0 development. 3613238106Sdes 3614238106Sdes3 February 2009: Wouter 3615238106Sdes - noted feature requests in doc/TODO. 3616238106Sdes - printout more detailed errors on ssl certificate loading failures. 3617238106Sdes - updated IANA portlist. 3618238106Sdes 3619238106Sdes16 January 2009: Wouter 3620238106Sdes - more quiet about ipv6 network failures, i.e. when ipv6 is not 3621238106Sdes available (network unreachable). Debug still printed on high 3622238106Sdes verbosity. 3623238106Sdes - unbound-host -4 and -6 options. Stops annoying ipv6 errors when 3624238106Sdes debugging with unbound-host -4 -d ... 3625238106Sdes - more cycle detection for NS-check, addr-check, root-prime and 3626238106Sdes stub-prime queries in the iterator. Avoids possible deadlock 3627238106Sdes when priming fails. 3628238106Sdes 3629238106Sdes15 January 2009: Wouter 3630238106Sdes - bug #229: fixup configure checks for compilation with Solaris 3631238106Sdes Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc 3632238106Sdes - fixup suncc warnings. 3633238106Sdes - fix bug where unbound could crash using libevent 1.3 and older. 3634238106Sdes - update testset for recent retry change. 3635238106Sdes 3636238106Sdes14 January 2009: Wouter 3637238106Sdes - 1.2.1 feature: negative caching for failed queries. 3638238106Sdes Queries that failed are cached for 5 seconds (NORR_TTL). 3639238106Sdes If the failure is local, like out of memory, it is not cached. 3640238106Sdes - the TTL comparison for the cache used different comparisons, 3641238106Sdes causing many cache responses that used the iterator and validator 3642238106Sdes state machines unnecessarily. 3643238106Sdes - retry from 4 to 5 so that EDNS drop retry is part of the first 3644238106Sdes query resolve attempt, and cached error does not stop EDNS fallback. 3645238106Sdes - remove debug prints that protect against bad referrals. 3646238106Sdes - honor QUIET=no on make commandline (or QUIET=yes ). 3647238106Sdes 3648238106Sdes13 January 2009: Wouter 3649238106Sdes - fixed bug in lameness marking, removed printouts. 3650238106Sdes - find NS rrset more cleanly for qtype NS. 3651238106Sdes - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for 3652238106Sdes reporting and logs. 3653238106Sdes - 1.2.1 feature: stops resolving AAAAs promiscuously when they 3654238106Sdes are in the negative cache. 3655238106Sdes 3656238106Sdes12 January 2009: Wouter 3657238106Sdes - fixed bug in infrastructure lameness cache, did not lowercase 3658238106Sdes name of zone to hash when setting lame. 3659238106Sdes - lameness debugging printouts. 3660238106Sdes 3661238106Sdes9 January 2009: Wouter 3662238106Sdes - created svn tag for 1.2.0 release. 3663238106Sdes - svn trunk contains 1.2.1 version number. 3664238106Sdes - iana portlist updated for todays list. 3665238106Sdes - removed debug print. 3666238106Sdes 3667238106Sdes8 January 2009: Wouter 3668238106Sdes - new version of ldns-trunk (today) included as tarball, fixed 3669238106Sdes bug #224, building with -j race condition. 3670238106Sdes - remove possible race condition in the test for race conditions. 3671238106Sdes 3672238106Sdes7 January 2009: Wouter 3673238106Sdes - version 1.2.0 in preparation. 3674238106Sdes - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file 3675238106Sdes statements. (Adapted from patch by Paul Wouters). 3676238106Sdes - typo fix and iana portlist updated. 3677238106Sdes - porting testsuite; unused var warning, and type fixup. 3678238106Sdes 3679238106Sdes6 January 2009: Wouter 3680238106Sdes - fixup packet-of-death when compiled with --enable-debug. 3681238106Sdes A malformed packet could cause an internal assertion failure. 3682238106Sdes - added test for HINFO canonicalisation behaviour. 3683238106Sdes - fixup reported problem with transparent local-zone data where 3684238106Sdes queries with different type could get nxdomain. Now queries 3685238106Sdes with a different name get resolved normally, with different type 3686238106Sdes get a correct NOERROR/NODATA answer. 3687238106Sdes - HINFO no longer downcased for validation, making unbound compatible 3688238106Sdes with bind and ldns. 3689238106Sdes - fix reading included config files when chrooted. 3690238106Sdes Give full path names for include files. 3691238106Sdes Relative path names work if the start dir equals the working dir. 3692238106Sdes - fix libunbound message transport when no packet buffer is available. 3693238106Sdes 3694238106Sdes5 January 2009: Wouter 3695238106Sdes - fixup getaddrinfo failure handling for remote control port. 3696238106Sdes - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints. 3697238106Sdes - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/ 3698238106Sdes - comm_timer_set performs base_set operation after event_add. 3699238106Sdes 3700238106Sdes18 December 2008: Wouter 3701238106Sdes - fixed bug reported by Duane Wessels: error in DLV lookup, would make 3702238106Sdes some zones that had correct DLV keys as insecure. 3703238106Sdes - follows -rc makedist from ldns changes (no _rc). 3704238106Sdes - ldns tarball updated with 1.4.1rc for DLV unit test. 3705238106Sdes - verbose prints about recursion lame detection and server selection. 3706238106Sdes - fixup BSD port for infra host storage. It hashed wrongly. 3707238106Sdes - fixup makedist snapshot name generation. 3708238106Sdes - do not reopen syslog to avoid dev/log dependency. 3709238106Sdes 3710238106Sdes17 December 2008: Wouter 3711238106Sdes - follows ldns makedist.sh. -rc option. autom4te dir removed. 3712238106Sdes - unbound-control status command. 3713238106Sdes - extended statistics has a number of ipv6 queries counter. 3714238106Sdes contrib/unbound_munin_ was updated to draw ipv6 in the hits graph. 3715238106Sdes 3716238106Sdes16 December 2008: Wouter 3717238106Sdes - follow makedist improvements from ldns, for maintainers prereleases. 3718238106Sdes - snapshot version uses _ not - to help rpm distinguish the 3719238106Sdes version number. 3720238106Sdes 3721238106Sdes11 December 2008: Wouter 3722238106Sdes - better fix for bug #219: use LOG_NDELAY with openlog() call. 3723238106Sdes Thanks to Tamas Tevesz. 3724238106Sdes 3725238106Sdes9 December 2008: Wouter 3726238106Sdes - bug #221 fixed: unbound checkconf checks if key files exist if 3727238106Sdes remote control is enabled. Also fixed NULL printf when not chrooted. 3728238106Sdes - iana portlist updated. 3729238106Sdes 3730238106Sdes3 December 2008: Wouter 3731238106Sdes - Fix problem reported by Jaco Engelbrecht where unbound-control stats 3732238106Sdes freezes up unbound if this was compiled without threading, and 3733238106Sdes was using multiple processes. 3734238106Sdes - iana portlist updated. 3735238106Sdes - test for remote control with interprocess communication. 3736238106Sdes - created command distribution mechanism so that remote control 3737238106Sdes commands other than 'stats' work on all processes in a nonthreaded 3738238106Sdes compiled version. dump/load cache work, on the first process. 3739238106Sdes - fixup remote control local_data addition memory corruption bug. 3740238106Sdes 3741238106Sdes1 December 2008: Wouter 3742238106Sdes - SElinux policy files in contrib/selinux for the unbound daemon, 3743238106Sdes by Paul Wouters and Adam Tkac. 3744238106Sdes 3745238106Sdes25 November 2008: Wouter 3746238106Sdes - configure complains when --without-ssl is given (bug #220). 3747238106Sdes - skip unsupported feature tests on vista/mingw. 3748238106Sdes - fixup testcode/streamtcp to work on vista/mingw. 3749238106Sdes - root-hints test checks version of dig required. 3750238106Sdes - blacklisted servers are polled at a low rate (1%) to see if they 3751238106Sdes come back up. But not if there is some other working server. 3752238106Sdes 3753238106Sdes24 November 2008: Wouter 3754238106Sdes - document that the user of the server daemon needs read privileges 3755238106Sdes on the keys and certificates generated by unbound-control-setup. 3756238106Sdes This is different per system or distribution, usually, running the 3757238106Sdes script under the same username as the server uses suffices. 3758238106Sdes i.e. sudo -u unbound unbound-control-setup 3759238106Sdes - testset port to vista/mingw. 3760238106Sdes - tcp_sigpipe to freebsd port. 3761238106Sdes 3762238106Sdes21 November 2008: Wouter 3763238106Sdes - fixed tcp accept, errors were printed when they should not. 3764238106Sdes - unbound-control-setup.sh removes read/write permissions other 3765238106Sdes from the keys it creates (as suggested by Dmitriy Demidov). 3766238106Sdes 3767238106Sdes20 November 2008: Wouter 3768238106Sdes - fixup fatal error due to faulty error checking after tcp accept. 3769238106Sdes - add check in rlimit to avoid integer underflow. 3770238106Sdes - rlimit check with new formula; better estimate for number interfaces 3771238106Sdes - nicer comments in rlimit check. 3772238106Sdes - tag 1.1.1 created in svn. 3773238106Sdes - trunk label is 1.1.2 3774238106Sdes 3775238106Sdes19 November 2008: Wouter 3776238106Sdes - bug #219: fixed so that syslog which delays opening until the first 3777238106Sdes log line is written, gets a log line while not chroot'ed yet. 3778238106Sdes 3779238106Sdes18 November 2008: Wouter 3780238106Sdes - iana portlist updated. 3781238106Sdes - removed cast in unit test debug print that was not 64bit safe. 3782238106Sdes - trunk back to 1.1.0; copied to tags 1.1.0 release. 3783238106Sdes - trunk to has version number 1.1.1 again. 3784238106Sdes - in 1.1.1; make clean nicer. grammar in manpage. 3785238106Sdes 3786238106Sdes17 November 2008: Wouter 3787238106Sdes - theoretical fix for problems reported on mailing list. 3788238106Sdes If a delegation point has no A but only AAAA and do-ip6 is no, 3789238106Sdes resolution would fail. Fixed to ask for the A and AAAA records. 3790238106Sdes It has to ask for both always, so that it can fail quietly, from 3791238106Sdes TLD perspective, when a zone is only reachable on one transport. 3792238106Sdes - test for above, only AAAA and doip6 is no. Fix causes A record 3793238106Sdes for nameserver to be fetched. 3794238106Sdes - fixup address duplication on cache fillup for delegation points. 3795238106Sdes - testset updated for new query answer requirements. 3796238106Sdes 3797238106Sdes14 November 2008: Wouter 3798238106Sdes - created 1.1.0 release tag in svn. 3799238106Sdes - trunk moved to 1.1.1 3800238106Sdes - fixup unittest-neg for locking. 3801238106Sdes 3802238106Sdes13 November 2008: Wouter 3803238106Sdes - added fedora init and specfile to contrib (by Paul Wouters). 3804238106Sdes - added configure check for ldns 1.4.0 (using its compat funcs). 3805238106Sdes - neater comments in worker.h. 3806238106Sdes - removed doc/plan and updated doc/TODO. 3807238106Sdes - silenced EHOSTDOWN (verbosity 2 or higher to see it). 3808238106Sdes - review comments from Jelte, Matthijs. Neater code. 3809238106Sdes 3810238106Sdes12 November 2008: Wouter 3811238106Sdes - add unbound-control manpage to makedist replace list. 3812238106Sdes 3813238106Sdes11 November 2008: Wouter 3814238106Sdes - unit test for negative cache, stress tests the refcounting. 3815238106Sdes - fix for refcounting error that could cause fptr_wlist fatal exit 3816238106Sdes in the negative cache rbtree (upcoming 1.1 feature). (Thanks to 3817238106Sdes Attila Nagy for testing). 3818238106Sdes - nicer comments in cachedump about failed RR to string conversion. 3819238106Sdes - fix 32bit wrap around when printing large (4G and more) mem usage 3820238106Sdes for extended statistics. 3821238106Sdes 3822238106Sdes10 November 2008: Wouter 3823238106Sdes - fixup the getaddrinfo compat code rename. 3824238106Sdes 3825238106Sdes8 November 2008: Wouter 3826238106Sdes - added configure check for eee build warning. 3827238106Sdes 3828238106Sdes7 November 2008: Wouter 3829238106Sdes - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4. 3830238106Sdes - detect nonblocking problems in network stack in configure script. 3831238106Sdes 3832238106Sdes6 November 2008: Wouter 3833238106Sdes - dname_priv must decompress the name before comparison. 3834238106Sdes - iana portlist updated. 3835238106Sdes 3836238106Sdes5 November 2008: Wouter 3837238106Sdes - fixed possible memory leak in key_entry_key deletion. 3838238106Sdes Would leak a couple bytes when trust anchors were replaced. 3839238106Sdes - if query and reply qname overlap, the bytes are skipped not copied. 3840238106Sdes - fixed file descriptor leak when messages were jostled out that 3841238106Sdes had outstanding (TCP) replies. 3842238106Sdes - DNAMEs used from cache have their synthesized CNAMEs initialized 3843238106Sdes properly. 3844238106Sdes - fixed file descriptor leak for localzone type deny (for TCP). 3845238106Sdes - fixed memleak at exit for nsec3 negative cached zones. 3846238106Sdes - fixed memleak for the keyword 'nodefault' when reading config. 3847238106Sdes - made verbosity of 'edns incapable peer' warning higher, so you 3848238106Sdes do not get spammed by it. 3849238106Sdes - caught elusive Bad file descriptor error bug, that would print the 3850238106Sdes error while unnecessarily try to listen to a closed fd. Fixed. 3851238106Sdes 3852238106Sdes4 November 2008: Wouter 3853238106Sdes - fixed -Wwrite-strings warnings that result in better code. 3854238106Sdes 3855238106Sdes3 November 2008: Wouter 3856238106Sdes - fixup build process for Mac OSX linker, use ldns b32 compat funcs. 3857238106Sdes - generated configure with autoconf-2.61. 3858238106Sdes - iana portlist updated. 3859238106Sdes - detect if libssl needs libdl. For static linking with libssl. 3860238106Sdes - changed to use new algorithm identifiers for sha256/sha512 3861238106Sdes from ldns 1.4.0 (need very latest version). 3862238106Sdes - updated the included ldns tarball. 3863238106Sdes - proper detection of SHA256 and SHA512 functions (not just sizes). 3864238106Sdes 3865238106Sdes23 October 2008: Wouter 3866238106Sdes - a little more debug info for failure on signer names. prints names. 3867238106Sdes 3868238106Sdes22 October 2008: Wouter 3869238106Sdes - CFLAGS are picked up by configure from the environment. 3870238106Sdes - iana portlist updated. 3871238106Sdes - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too. 3872238106Sdes - new stub-prime: yesno option. Default is off, so it does not prime. 3873238106Sdes can be turned on to get same behaviour as previous unbound release. 3874238106Sdes - made automated test that checks if builtin root hints are uptodate. 3875238106Sdes - finished draft-wijngaards-dnsext-resolver-side-mitigation 3876238106Sdes implementation. The unwanted-reply-threshold can be set. 3877238106Sdes - fixup so fptr_whitelist test in alloc.c works. 3878238106Sdes 3879238106Sdes21 October 2008: Wouter 3880238106Sdes - fix update-anchors.sh, so it does not report different RR order 3881238106Sdes as an update. Sorts the keys in the file. Updated copyright. 3882238106Sdes - fixup testbound on windows, the command control pipe doesn't exist. 3883238106Sdes - skip 08hostlib test on windows, no fork() available. 3884238106Sdes - made unbound-remote work on windows. 3885238106Sdes 3886238106Sdes20 October 2008: Wouter 3887238106Sdes - quench a log message that is debug only. 3888238106Sdes - iana portlist updated. 3889238106Sdes - do not query bogus nameservers. It is like nameservers that have 3890238106Sdes the NS or A or AAAA record bogus are listed as donotquery. 3891238106Sdes - if server selection is faced with only bad choices, it will 3892238106Sdes attempt to get more options to be fetched. 3893238106Sdes - changed bogus-ttl default value from 900 to 60 seconds. 3894238106Sdes In anticipation that operator caused failures are more likely than 3895238106Sdes actual attacks at this time. And thus repeated validation helps 3896238106Sdes the operators get the problem fixed sooner. It makes validation 3897238106Sdes failures go away sooner (60 seconds after the zone is fixed). 3898238106Sdes Also it is likely to try different nameserver targets every minute, 3899238106Sdes so that if a zone is bad on one server but not another, it is 3900238106Sdes likely to pick up the 'correct' one after a couple minutes, 3901238106Sdes and if the TTL is big enough that solves validation for the zone. 3902238106Sdes - fixup unbound-control compilation on windows. 3903238106Sdes 3904238106Sdes17 October 2008: Wouter 3905238106Sdes - port Leopard/G5: fixup type conversion size_t/uint32. 3906238106Sdes please ranlib, stop file without symbols warning. 3907238106Sdes - harden referral path now also validates the root after priming. 3908238106Sdes It looks up the root NS authoritatively as well as the root servers 3909238106Sdes and attemps to validate the entries. 3910238106Sdes 3911238106Sdes16 October 2008: Wouter 3912238106Sdes - Fixup negative TTL values appearing (reported by Attila Nagy). 3913238106Sdes 3914238106Sdes15 October 2008: Wouter 3915238106Sdes - better documentation for 0x20; remove fallback TODO, it is done. 3916238106Sdes - harden-referral-path feature includes A, AAAA queries for glue, 3917238106Sdes as well as very careful NS caching (only when doing NS query). 3918238106Sdes A, AAAA use the delegation from the NS-query. 3919238106Sdes 3920238106Sdes14 October 2008: Wouter 3921238106Sdes - fwd_three.tpkg test was flaky. If the three requests hit the 3922238106Sdes wrong threads by chance (or bad OS) then the test would fail. 3923238106Sdes Made less flaky by increasing number of retries. 3924238106Sdes - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs. 3925238106Sdes - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014). 3926238106Sdes Which includes the ldns_dname_absolute fix. 3927238106Sdes - fwd_three test remains flaky now that unbound does not stop 3928238106Sdes listening when full. Thus, removed timeout problem. 3929238106Sdes It may be serviced by three threads, or maybe by one. 3930238106Sdes Mostly only useful for lock-check testing now. 3931238106Sdes 3932238106Sdes13 October 2008: Wouter 3933238106Sdes - fixed recursion servers deployed as authoritative detection, so 3934238106Sdes that as a last resort, a +RD query is sent there to get the 3935238106Sdes correct answer. 3936238106Sdes - iana port list update. 3937238106Sdes - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013). 3938238106Sdes 3939238106Sdes10 October 2008: Wouter 3940238106Sdes - fixup tests - the negative cache contained the correct NSEC3s for 3941238106Sdes two tests that are supposed to fail to validate. 3942238106Sdes 3943238106Sdes9 October 2008: Wouter 3944238106Sdes - negative cache caps max iterations of NSEC3 done. 3945238106Sdes - NSEC3 negative cache for qtype DS works. 3946238106Sdes 3947238106Sdes8 October 2008: Wouter 3948238106Sdes - NSEC negative cache for DS. 3949238106Sdes 3950238106Sdes6 October 2008: Wouter 3951238106Sdes - jostle-timeout option, so you can config for slow links. 3952238106Sdes - 0x20 fallback code. Tries 3xnumber of nameserver addresses 3953238106Sdes queries that must all be the same. Sent to random nameservers. 3954238106Sdes - documented choices for DoS, EDNS, 0x20. 3955238106Sdes 3956238106Sdes2 October 2008: Wouter 3957238106Sdes - fixup unlink of pidfile. 3958238106Sdes - fixup SHA256 algorithm collation code. 3959238106Sdes - contrib/update-anchor.sh does not overwrite anchors if not needed. 3960238106Sdes exits 0 when a restart is needed, other values if not. 3961238106Sdes so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart 3962238106Sdes can restart unbound exactly when needed. 3963238106Sdes 3964238106Sdes30 September 2008: Wouter 3965238106Sdes - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1. 3966238106Sdes - tests for sha256 support and downgrade resistance. 3967238106Sdes - RSASHA256 and RSASHA512 support (using the draft in dnsext), 3968238106Sdes using the drafted protocol numbers. 3969238106Sdes - when using stub on localhost (127.0.0.1@10053) unbound works. 3970238106Sdes Like when running NSD to host a local zone, on the same machine. 3971238106Sdes The noprime feature. manpages more explanation. Added a test for it. 3972238106Sdes - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com" 3973238106Sdes 3974238106Sdes29 September 2008: Wouter 3975238106Sdes - EDNS lameness detection, if EDNS packets are dropped this is 3976238106Sdes detected, eventually. 3977238106Sdes - multiple query timeout rtt backoff does not backoff too much. 3978238106Sdes 3979238106Sdes26 September 2008: Wouter 3980238106Sdes - tests for remote-control. 3981238106Sdes - small memory leak in exception during remote control fixed. 3982238106Sdes - fixup for lock checking but not unchecking in remote control. 3983238106Sdes - iana portlist updated. 3984238106Sdes 3985238106Sdes23 September 2008: Wouter 3986238106Sdes - Msg cache is loaded. A cache load enables cache responses. 3987238106Sdes - unbound-control flush [name], flush_type and flush_zone. 3988238106Sdes 3989238106Sdes22 September 2008: Wouter 3990238106Sdes - dump_cache and load_cache statements in unbound-control. 3991238106Sdes RRsets are dumped and loaded correctly. 3992238106Sdes Msg cache is dumped. 3993238106Sdes 3994238106Sdes19 September 2008: Wouter 3995238106Sdes - locking on the localdata structure. 3996238106Sdes - add and remove local zone and data with unbound-control. 3997238106Sdes - ldns trunk snapshot updated, make tests work again. 3998238106Sdes 3999238106Sdes18 September 2008: Wouter 4000238106Sdes - fixup error in time calculation. 4001238106Sdes - munin plugin improvements. 4002238106Sdes - nicer abbreviations for high query types values (ixfr, axfr, any...) 4003238106Sdes - documented the statistics output in unbound-control man page. 4004238106Sdes - extended statistics prints out histogram, over unbound-control. 4005238106Sdes 4006238106Sdes17 September 2008: Wouter 4007238106Sdes - locking for threadsafe bogus rrset counter. 4008238106Sdes - ldns trunk no longer exports b32 functions, provide compat. 4009238106Sdes - ldns tarball updated. 4010238106Sdes - testcode/ldns-testpkts.c const fixups. 4011238106Sdes - fixed rcode stat printout. 4012238106Sdes - munin plugin in contrib. 4013238106Sdes - stats always printout uptime, because stats plugins need it. 4014238106Sdes 4015238106Sdes16 September 2008: Wouter 4016238106Sdes - extended-statistics: yesno config option. 4017238106Sdes - unwanted replies spoof nearmiss detector. 4018238106Sdes - iana portlist updated. 4019238106Sdes 4020238106Sdes15 September 2008: Wouter 4021238106Sdes - working start, stop, reload commands for unbound-control. 4022238106Sdes - test for unbound-control working; better exit value for control. 4023238106Sdes - verbosity control via unbound-control. 4024238106Sdes - unbound-control stats. 4025238106Sdes 4026238106Sdes12 September 2008: Wouter 4027238106Sdes - removed browser control mentions. Proto speccy. 4028238106Sdes 4029238106Sdes11 September 2008: Wouter 4030238106Sdes - set nonblocking on new TCP streams, because linux does not inherit 4031238106Sdes the socket options to the accepted socket. 4032238106Sdes - fix TCP timeouts. 4033238106Sdes - SSL protected connection between server and unbound-control. 4034238106Sdes 4035238106Sdes10 September 2008: Wouter 4036238106Sdes - remove memleak in privacy addresses on reloads and quits. 4037238106Sdes - remote control work. 4038238106Sdes 4039238106Sdes9 September 2008: Wouter 4040238106Sdes - smallapp/unbound-control-setup.sh script to set up certificates. 4041238106Sdes 4042238106Sdes4 September 2008: Wouter 4043238106Sdes - scrubber scrubs away private addresses. 4044238106Sdes - test for private addresses. man page entry. 4045238106Sdes - code refactored for name and address tree lookups. 4046238106Sdes 4047238106Sdes3 September 2008: Wouter 4048238106Sdes - options for 'DNS Rebinding' protection: private-address and 4049238106Sdes private-domain. 4050238106Sdes - dnstree for reuse of routines that help with domain, addr lookups. 4051238106Sdes - private-address and private-domain config option read, stored. 4052238106Sdes 4053238106Sdes2 September 2008: Wouter 4054238106Sdes - DoS protection features. Queries are jostled out to make room. 4055238106Sdes - testbound can pass time, increasing the internal timer. 4056238106Sdes - do not mark unsigned additionals bogus, leave unchecked, which 4057238106Sdes is removed too. 4058238106Sdes 4059238106Sdes1 September 2008: Wouter 4060238106Sdes - disallow nonrecursive queries for cache snooping by default. 4061238106Sdes You can allow is using access-control: <subnet> allow_snoop. 4062238106Sdes The defaults do allow access no authoritative data without RD bit. 4063238106Sdes - two tests for it and fixups of tests for nonrec refused. 4064238106Sdes 4065238106Sdes29 August 2008: Wouter 4066238106Sdes - version 1.1 number in trunk. 4067238106Sdes - harden-referral-path option for query for NS records. 4068238106Sdes Default turns off expensive, experimental option. 4069238106Sdes 4070238106Sdes28 August 2008: Wouter 4071238106Sdes - fixup logfile handling; it is created with correct permissions 4072238106Sdes again. (from bugfix#199). 4073238106Sdes Some errors are not written to logfile (pidfile writing, forking), 4074238106Sdes and these are only visible by using the -d commandline flag. 4075238106Sdes 4076238106Sdes27 August 2008: Wouter 4077238106Sdes - daemon(3) is causing problems for people. Reverting the patch. 4078238106Sdes bug#200, and 199 and 203 contain sideline discussion on it. 4079238106Sdes - bug#199 fixed: pidfile can be outside chroot. openlog is done before 4080238106Sdes chroot and drop permissions. 4081238106Sdes - config option to set size of aggressive negative cache, 4082238106Sdes neg-cache-size. 4083238106Sdes - bug#203 fixed: dlv has been implemented. 4084238106Sdes 4085238106Sdes26 August 2008: Wouter 4086238106Sdes - test for insecure zone when DLV is in use, also does negative cache. 4087238106Sdes - test for trustanchor when DLV is in use (the anchor works). 4088238106Sdes - test for DLV used for a zone below a trustanchor. 4089238106Sdes - added scrub filter for overreaching NSEC records and unit test. 4090238106Sdes - iana portlist update 4091238106Sdes - use of setresuid or setreuid when available. 4092238106Sdes - use daemon(3) if available. 4093238106Sdes 4094238106Sdes25 August 2008: Wouter 4095238106Sdes - realclean patch from Robert Edmonds. 4096238106Sdes 4097238106Sdes22 August 2008: Wouter 4098238106Sdes - nicer debuglogging of DLV. 4099238106Sdes - test with secure delegation inside the DLV repository. 4100238106Sdes 4101238106Sdes21 August 2008: Wouter 4102238106Sdes - negative cache code linked into validator, for DLV use. 4103238106Sdes negative cache works for DLV. 4104238106Sdes - iana portlist update. 4105238106Sdes - dlv-anchor option for unit tests. 4106238106Sdes - fixup NSEC_AT_APEX classification for short typemaps. 4107238106Sdes - ldns-testns has subdomain checks, for unit tests. 4108238106Sdes 4109238106Sdes20 August 2008: Wouter 4110238106Sdes - negative cache code, reviewed. 4111238106Sdes 4112238106Sdes18 August 2008: Wouter 4113238106Sdes - changes info: in logfile to notice: info: or debug: depending on 4114238106Sdes the verbosity of the statements. Better logfile message 4115238106Sdes classification. 4116238106Sdes - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd. 4117238106Sdes 4118238106Sdes15 August 2008: Wouter 4119238106Sdes - DLV nsec code fixed for better detection of closest existing 4120238106Sdes enclosers from NSEC responses. 4121238106Sdes - DLV works, straight to the dlv repository, so not for production. 4122238106Sdes - Iana port update. 4123238106Sdes 4124238106Sdes14 August 2008: Wouter 4125238106Sdes - synthesize DLV messages from the rrset cache, like done for DS. 4126238106Sdes 4127238106Sdes13 August 2008: Wouter 4128238106Sdes - bug #203: nicer do-auto log message when user sets incompatible 4129238106Sdes options. 4130238106Sdes - bug #204: variable name ameliorated in log.c. 4131238106Sdes - bug #206: in iana_update, no egrep, but awk use. 4132238106Sdes - ldns snapshot r2699 taken (includes DLV type). 4133238106Sdes - DLV work, config file element, trust anchor read in. 4134238106Sdes 4135238106Sdes12 August 2008: Wouter 4136238106Sdes - finished adjusting testset to provide qtype NS answers. 4137238106Sdes 4138238106Sdes11 August 2008: Wouter 4139238106Sdes - Fixup rrset security updates overwriting 2181 trust status. 4140238106Sdes This makes validated to be insecure data just as worthless as 4141238106Sdes nonvalidated data, and 2181 rules prevent cache overwrites to them. 4142238106Sdes - Fix assertion fail on bogus key handling. 4143238106Sdes - dnssec lameness detection works on first query at trust apex. 4144238106Sdes - NS queries get proper cache and dnssec lameness treatment. 4145238106Sdes - fixup compilation without pthreads on linux. 4146238106Sdes 4147238106Sdes8 August 2008: Wouter 4148238106Sdes - NS queries are done after every referral. 4149238106Sdes validator is used on those NS records (if anchors enabled). 4150238106Sdes 4151238106Sdes7 August 2008: Wouter 4152238106Sdes - Scrubber more strict. CNAME chains, DNAMEs from cache, other 4153238106Sdes irrelevant rrsets removed. 4154238106Sdes - 1.0.2 released from 1.0 support branch. 4155238106Sdes - fixup update-anchor.sh to work both in BSD shell and bash. 4156238106Sdes 4157238106Sdes5 August 2008: Wouter 4158238106Sdes - fixup DS test so apex nodata works again. 4159238106Sdes 4160238106Sdes4 August 2008: Wouter 4161238106Sdes - iana port update. 4162238106Sdes - TODO update. 4163238106Sdes - fix bug 201: null ptr deref on cleanup while udp pkts wait for port. 4164238106Sdes - added explanatory text for outgoing-port-permit in manpage. 4165238106Sdes 4166238106Sdes30 July 2008: Wouter 4167238106Sdes - fixup bug qtype DS for unsigned zone and signed parent validation. 4168238106Sdes 4169238106Sdes25 July 2008: Wouter 4170238106Sdes - added original copyright statement of OpenBSD arc4random code. 4171238106Sdes - created tube signaling solution on windows, as a pipe replacement. 4172238106Sdes this makes background asynchronous resolution work on windows. 4173238106Sdes - removed very insecure socketpair compat code. It also did not 4174238106Sdes work with event_waiting. Solved by pipe replacement. 4175238106Sdes - unbound -h prints openssl version number as well. 4176238106Sdes 4177238106Sdes22 July 2008: Wouter 4178238106Sdes - moved pipe actions to util/tube.c. easier porting and shared code. 4179238106Sdes - check _raw() commpoint callbacks with fptr_wlist. 4180238106Sdes - iana port update. 4181238106Sdes 4182238106Sdes21 July 2008: Wouter 4183238106Sdes - #198: nicer entropy warning message. manpage OS hints. 4184238106Sdes 4185238106Sdes19 July 2008: Wouter 4186238106Sdes - #198: fixup man page to suggest chroot entropy fix. 4187238106Sdes 4188238106Sdes18 July 2008: Wouter 4189238106Sdes - branch for 1.0 support. 4190238106Sdes - trunk work on tube.c. 4191238106Sdes 4192238106Sdes17 July 2008: Wouter 4193238106Sdes - fix bug #196, compile outside source tree. 4194238106Sdes - fix bug #195, add --with-username=user configure option. 4195238106Sdes - print error and exit if started with config that requires more 4196238106Sdes fds than the builtin minievent can handle. 4197238106Sdes 4198238106Sdes16 July 2008: Wouter 4199238106Sdes - made svn tag 1.0.1, trunk now 1.0.2 4200238106Sdes - sha256 checksums enabled in makedist.sh 4201238106Sdes 4202238106Sdes15 July 2008: Wouter 4203238106Sdes - Follow draft-ietf-dnsop-default-local-zones-06 added reverse 4204238106Sdes IPv6 example prefix to AS112 default blocklist. 4205238106Sdes - fixup lookup of DS records by client with trustanchor for same. 4206238106Sdes - libunbound ub_resolve, fix handling of error condition during setup. 4207238106Sdes - lowered log_hex blocksize to fit through BSD syslog linesize. 4208238106Sdes - no useless initialisation if getpwnam not available. 4209238106Sdes - iana, ldns snapshot updated. 4210238106Sdes 4211238106Sdes3 July 2008: Wouter 4212238106Sdes - Matthijs fixed memory leaks in root hints file reading. 4213238106Sdes 4214238106Sdes26 June 2008: Wouter 4215238106Sdes - fixup streamtcp bounds setting for udp mode, in the test framework. 4216238106Sdes - contrib item for updating trust anchors. 4217238106Sdes 4218238106Sdes25 June 2008: Wouter 4219238106Sdes - fixup fwd_ancil test typos. 4220238106Sdes - Fix for newegg lameness : ok for qtype=A, but lame for others. 4221238106Sdes - fixup unit test for infra cache, test lame merging. 4222238106Sdes - porting to mingw, bind, listen, getsockopt and setsockopt error 4223238106Sdes handling. 4224238106Sdes 4225238106Sdes24 June 2008: Wouter 4226238106Sdes - removed testcode/checklocks from production code compilation path. 4227238106Sdes - streamtcp can use UDP mode (connected UDP socket), for testing IPv6 4228238106Sdes on windows. 4229238106Sdes - fwd_ancil test fails if platform support is lacking. 4230238106Sdes 4231238106Sdes23 June 2008: Wouter 4232238106Sdes - fixup minitpkg to cleanup on windows with its file locking troubles. 4233238106Sdes - minitpkg shows skipped tests in report. 4234238106Sdes - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not 4235238106Sdes ipv6 connectivity). 4236238106Sdes - winsock event handler keeps track of sticky TCP events, that have 4237238106Sdes not been fully handled yet. when interest in the event(s) resumes, 4238238106Sdes they are sent again. When WOULDBLOCK is returned events are cleared. 4239238106Sdes - skip tests that need signals when testing on mingw. 4240238106Sdes 4241238106Sdes18 June 2008: Wouter 4242238106Sdes - open testbound replay files in binary mode, because fseek/ftell 4243238106Sdes do not work in ascii-mode on windows. The b does nothing on unix. 4244238106Sdes unittest and testbound tests work on windows (xp too). 4245238106Sdes - ioctlsocket prints nicer error message. 4246238106Sdes - fixed up some TCP porting for winsock. 4247238106Sdes - lack of IPv6 gives a warning, no fatal error. 4248238106Sdes - use WSAGetLastError() on windows instead of errno for some errors. 4249238106Sdes 4250238106Sdes17 June 2008: Wouter 4251238106Sdes - outgoing num fds 32 by default on windows ; it supports less 4252238106Sdes fds for waiting on than unixes. 4253238106Sdes - winsock_event minievent handler for windows. (you could also 4254238106Sdes attempt to link with libevent/libev ports for windows). 4255238106Sdes - neater crypto check and gdi32 detection. 4256238106Sdes - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista. 4257238106Sdes 4258238106Sdes16 June 2008: Wouter 4259238106Sdes - on windows, use windows threads, mutex and thread-local-storage(Tls). 4260238106Sdes - detect if openssl needs gdi32. 4261238106Sdes - if no threading, THREADS_DISABLED is defined for use in the code. 4262238106Sdes - sets USE_WINSOCK if using ws2_32 on windows. 4263238106Sdes - wsa_strerror() function for more readable errors. 4264238106Sdes - WSA Startup and Cleanup called in unbound.exe. 4265238106Sdes 4266238106Sdes13 June 2008: Wouter 4267238106Sdes - port mingw32, more signal ifdefs, detect sleep, usleep, 4268238106Sdes random, srandom (used inside the tests). 4269238106Sdes - signed or unsigned FD_SET is cast. 4270238106Sdes 4271238106Sdes10 June 2008: Wouter 4272238106Sdes - fixup warnings compiling on eeepc xandros linux. 4273238106Sdes 4274238106Sdes9 June 2008: Wouter 4275238106Sdes - in iteration response type code 4276238106Sdes * first check for SOA record (negative answer) before NS record 4277238106Sdes and lameness. 4278238106Sdes * check if no AA bit for non-forwarder, and thus lame zone. 4279238106Sdes In response to error report by Richard Doty for mail.opusnet.com. 4280238106Sdes - fixup unput warning from lexer on freeBSD. 4281238106Sdes - bug#183. pidfile, rundir, and chroot configure options. Also the 4282238106Sdes example.conf and manual pages get the configured defaults. 4283238106Sdes You can use: (or accept the defaults to /usr/local/etc/unbound/) 4284238106Sdes --with-conf-file=filename 4285238106Sdes --with-pidfile=filename 4286238106Sdes --with-run-dir=path 4287238106Sdes --with-chroot-dir=path 4288238106Sdes 4289238106Sdes8 June 2008: Wouter 4290238106Sdes - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug. 4291238106Sdes Reported by Robert Edmonds. 4292238106Sdes - iana port updated. 4293238106Sdes 4294238106Sdes4 June 2008: Wouter 4295238106Sdes - updated libtool files with newer version. 4296238106Sdes - iana portlist updated. 4297238106Sdes 4298238106Sdes3 June 2008: Wouter 4299238106Sdes - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the 4300238106Sdes trailing dot is not used during comparison. 4301238106Sdes 4302238106Sdes2 June 2008: Wouter 4303238106Sdes - Jelte fixed bugs in my absence 4304238106Sdes - bug 178: fixed unportable shell usage in configure (relied on 4305238106Sdes bash shell). 4306238106Sdes - bug 180: fixed buffer overflow in unbound-checkconf use of strncat. 4307238106Sdes - bug 181: fixed buffer overflow in ldns (called by unbound to parse 4308238106Sdes config file parts). 4309238106Sdes - fixes by Wouter 4310238106Sdes - bug 177: fixed compilation failure on opensuse, the 4311238106Sdes --disable-static configure flag caused problems. (Patch from 4312238106Sdes Klaus Singvogel) 4313238106Sdes - bug 179: same fix as 177. 4314238106Sdes - bug 185: --disable-shared not passed along to ldns included with 4315238106Sdes unbound. Fixed so that configure parameters are passed to the 4316238106Sdes subdir configure script. 4317238106Sdes fixed that ./libtool is used always, you can still override 4318238106Sdes manually with ./configure libtool=mylibtool or set $libtool in 4319238106Sdes the environment. 4320238106Sdes - update of the ldns tarball to current ldns svn version (fix 181). 4321238106Sdes - bug 184: -r option for unbound-host, read resolv.conf for 4322238106Sdes forwarder. (Note that forwarder must support DNSSEC for validation 4323238106Sdes to succeed). 4324238106Sdes 4325238106Sdes23 May 2008: Wouter 4326238106Sdes - mingw32 porting. 4327238106Sdes - test for sys/wait.h 4328238106Sdes - WSAEWOULDBLOCK test after nonblocking TCP connect. 4329238106Sdes - write_iov_buffer removed: unused and no struct iov on windows. 4330238106Sdes - signed/unsigned warning fixup mini_event. 4331238106Sdes - use ioctlsocket to set nonblocking I/O if fnctl is unavailable. 4332238106Sdes - skip signals that are not defined 4333238106Sdes - detect pwd.h. 4334238106Sdes - detect getpwnam, getrlimit, setsid, sbrk, chroot. 4335238106Sdes - default config has no chroot if chroot() unavailable. 4336238106Sdes - if no kill() then no pidfile is read or written. 4337238106Sdes - gmtime_r is replaced by nonthreadsafe alternative if unavail. 4338238106Sdes used in rrsig time validation errors. 4339238106Sdes 4340238106Sdes22 May 2008: Wouter 4341238106Sdes - contrib unbound.spec from Patrick Vande Walle. 4342238106Sdes - fixup bug#175: call tzset before chroot to have correct timestamps 4343238106Sdes in system log. 4344238106Sdes - do not generate lex input and lex unput functions. 4345238106Sdes - mingw port. replacement functions labelled _unbound. 4346238106Sdes - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed. 4347238106Sdes 4348238106Sdes19 May 2008: Wouter 4349238106Sdes - fedora 9, check in6_pktinfo define in configure. 4350238106Sdes - CREDITS fixup of history. 4351238106Sdes - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative. 4352238106Sdes 4353238106Sdes16 May 2008: Wouter 4354238106Sdes - fixup for MacOSX hosts file reading (reported by John Dickinson). 4355238106Sdes - created 1.0.0 svn tag. 4356238106Sdes - trunk version 1.0.1. 4357238106Sdes 4358238106Sdes14 May 2008: Wouter 4359238106Sdes - accepted patch from Ondrej Sury for library version libtool option. 4360238106Sdes - configure --disable-rpath fixes up libtool for rpath trouble. 4361238106Sdes Adapted from debian package patch file. 4362238106Sdes 4363238106Sdes13 May 2008: Wouter 4364238106Sdes - Added root ipv6 addresses to builtin root hints. 4365238106Sdes - TODO modified for post 1.0 plans. 4366238106Sdes - trunk version set to 1.0.0. 4367238106Sdes - no unnecessary linking with librt (only when libevent/libev used). 4368238106Sdes 4369238106Sdes7 May 2008: Wouter 4370238106Sdes - fixup no-ip4 problem with error callback in outside network. 4371238106Sdes 4372238106Sdes25 April 2008: Wouter 4373238106Sdes - DESTDIR is honored by the Makefile for rpms. 4374238106Sdes - contrib files unbound.spec and unbound.init, builds working RPM 4375238106Sdes on FC7 Linux, a chrooted caching resolver, and libunbound. 4376238106Sdes - iana ports update. 4377238106Sdes 4378238106Sdes24 April 2008: Wouter 4379238106Sdes - chroot checks improved. working directory relative to chroot. 4380238106Sdes checks if config file path is inside chroot. Documentation on it. 4381238106Sdes - nicer example.conf text. 4382238106Sdes - created 0.11 tag. 4383238106Sdes 4384238106Sdes23 April 2008: Wouter 4385238106Sdes - parseunbound.pl contrib update from Kai Storbeck for threads. 4386238106Sdes - iana ports update 4387238106Sdes 4388238106Sdes22 April 2008: Wouter 4389238106Sdes - ignore SIGPIPE. 4390238106Sdes - unit test for SIGPIPE ignore. 4391238106Sdes 4392238106Sdes21 April 2008: Wouter 4393238106Sdes - FEATURES document. 4394238106Sdes - fixup reread of config file if it was given as a full path 4395238106Sdes and chroot was used. 4396238106Sdes 4397238106Sdes16 April 2008: Wouter 4398238106Sdes - requirements doc, updated clean query returns. 4399238106Sdes - parseunbound.pl update from Kai Storbeck. 4400238106Sdes - sunos4 porting changes. 4401238106Sdes 4402238106Sdes15 April 2008: Wouter 4403238106Sdes - fixup default rc.d pidfile location to /usr/local/etc. 4404238106Sdes - iana ports updated. 4405238106Sdes - copyright updated in ldns-testpkts to keep same as in ldns. 4406238106Sdes - fixup checkconf chroot tests a bit more, chdir must be inside 4407238106Sdes chroot dir. 4408238106Sdes - documented 'gcc: unrecognized -KPIC option' errors on Solaris. 4409238106Sdes - example.conf values changed to /usr/local/etc/unbound 4410238106Sdes - DSA test work. 4411238106Sdes - DSA signatures: unbound is compatible with both encodings found. 4412238106Sdes It will detect and convert when necessary. 4413238106Sdes 4414238106Sdes14 April 2008: Wouter 4415238106Sdes - got update for parseunbound.pl statistics script from Kai Storbeck. 4416238106Sdes - tpkg tests for udp wait list. 4417238106Sdes - documented 0x20 status. 4418238106Sdes - fixup chroot and checkconf, it is much smarter now. 4419238106Sdes - fixup DSA EVP signature decoding. Solution that Jelte found copied. 4420238106Sdes - and check first sig byte for the encoding type. 4421238106Sdes 4422238106Sdes11 April 2008: Wouter 4423238106Sdes - random port selection out of the configged ports. 4424238106Sdes - fixup threadsafety for libevent-1.4.3+ (event_base_get_method). 4425238106Sdes - removed base_port. 4426238106Sdes - created 256-port ephemeral space for the OS, 59802 available. 4427238106Sdes - fixup consistency of port_if out array during heavy use. 4428238106Sdes 4429238106Sdes10 April 2008: Wouter 4430238106Sdes - --with-libevent works with latest libevent 1.4.99-trunk. 4431238106Sdes - added log file statistics perl script to contrib. 4432238106Sdes - automatic iana ports update from makefile. 60058 available. 4433238106Sdes 4434238106Sdes9 April 2008: Wouter 4435238106Sdes - configure can detect libev(from its build directory) when passed 4436238106Sdes --with-libevent=/home/wouter/libev-3.2 4437238106Sdes libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%). 4438238106Sdes - unused commpoints not listed in epoll list. 4439238106Sdes - statistics-cumulative option so that the values are not reset. 4440238106Sdes - config creates array of available ports, 61841 available, 4441238106Sdes it excludes <1024 and iana assigned numbers. 4442238106Sdes config statements to modify the available port numbers. 4443238106Sdes 4444238106Sdes8 April 2008: Wouter 4445238106Sdes - unbound tries to set the ulimit fds when started as server. 4446238106Sdes if that does not work, it will scale back its requirements. 4447238106Sdes 4448238106Sdes27 March 2008: Wouter 4449238106Sdes - documented /dev/random symlink from chrootdir as FAQ entry. 4450238106Sdes 4451238106Sdes26 March 2008: Wouter 4452238106Sdes - implemented AD bit signaling. If a query sets AD bit (but not DO) 4453238106Sdes then the AD bit is set in the reply if the answer validated. 4454238106Sdes Without including DNSSEC signatures. Useful if you have a trusted 4455238106Sdes path from the client to the resolver. Follows dnssec-updates draft. 4456238106Sdes 4457238106Sdes25 March 2008: Wouter 4458238106Sdes - implemented check that for NXDOMAIN and NOERROR answers a query 4459238106Sdes section must be present in the reply (by the scrubber). And it must 4460238106Sdes be equal to the question sent, at least lowercase folded. 4461238106Sdes Previously this feature happened because the cache code refused 4462238106Sdes to store such messages. However blocking by the scrubber makes 4463238106Sdes sure nothing gets into the RRset cache. Also, this looks like a 4464238106Sdes timeout (instead of an allocation failure) and this retries are 4465238106Sdes done (which is useful in a spoofing situation). 4466238106Sdes - RTT banding. Band size 400 msec, this makes band around zero (fast) 4467238106Sdes include unknown servers. This makes unbound explore unknown servers. 4468238106Sdes 4469238106Sdes7 March 2008: Wouter 4470238106Sdes - -C config feature for harvest program. 4471238106Sdes - harvest handles CNAMEs too. 4472238106Sdes 4473238106Sdes5 March 2008: Wouter 4474238106Sdes - patch from Hugo Koji Kobayashi for iterator logs spelling. 4475238106Sdes 4476238106Sdes4 March 2008: Wouter 4477238106Sdes - From report by Jinmei Tatuya, rfc2181 trust value for remainder 4478238106Sdes of a cname trust chain is lower; not full answer_AA. 4479238106Sdes - test for this fix. 4480238106Sdes - default config file location is /usr/local/etc/unbound. 4481238106Sdes Thus prefix is used to determine the location. This is also the 4482238106Sdes chroot and pidfile default location. 4483238106Sdes 4484238106Sdes3 March 2008: Wouter 4485238106Sdes - Create 0.10 svn tag. 4486238106Sdes - 0.11 version in trunk. 4487238106Sdes - indentation nicer. 4488238106Sdes 4489238106Sdes29 February 2008: Wouter 4490238106Sdes - documentation update. 4491238106Sdes - fixup port to Solaris of perf test tool. 4492238106Sdes - updated ldns-tarball with decl-after-statement fixes. 4493238106Sdes 4494238106Sdes28 February 2008: Wouter 4495238106Sdes - fixed memory leaks in libunbound (during cancellation and wait). 4496238106Sdes - libunbound returns the answer packet in full. 4497238106Sdes - snprintf compat update. 4498238106Sdes - harvest performs lookup. 4499238106Sdes - ldns-tarball update with fix for ldns_dname_label. 4500238106Sdes - installs to sbin by default. 4501238106Sdes - install all manual pages (unbound-host and libunbound too). 4502238106Sdes 4503238106Sdes27 February 2008: Wouter 4504238106Sdes - option to use caps for id randomness. 4505238106Sdes - config file option use-caps-for-id: yes 4506238106Sdes - harvest debug tool 4507238106Sdes 4508238106Sdes26 February 2008: Wouter 4509238106Sdes - delay utility delays TCP as well. If the server that is forwarded 4510238106Sdes to has a TCP error, the delay utility closes the connection. 4511238106Sdes - delay does REUSE_ADDR, and can handle a server that closes its end. 4512238106Sdes - answers use casing from query. 4513238106Sdes 4514238106Sdes25 February 2008: Wouter 4515238106Sdes - delay utility works. Gets decent thoughput too (>20000). 4516238106Sdes 4517238106Sdes22 February 2008: Wouter 4518238106Sdes - +2% for recursions, if identical queries (except for destination 4519238106Sdes and query ID) in the reply list, avoid re-encoding the answer. 4520238106Sdes - removed TODO items for optimizations that do not show up in 4521238106Sdes profile reports. 4522238106Sdes - default is now minievent - not libevent. As its faster and 4523238106Sdes not needed for regular installs, only for very large port ranges. 4524238106Sdes - loop check different speedup pkt-dname-reading, 1% faster for 4525238106Sdes nocache-recursion check. 4526238106Sdes - less hashing during msg parse, 4% for recursion. 4527238106Sdes - small speed fix for dname_count_size_labels, +1 or +2% recursion. 4528238106Sdes - some speed results noted: 4529238106Sdes optimization resulted in +40% for recursion (cache miss) and 4530238106Sdes +70 to +80 for cache hits, and +96% for version.bind. 4531238106Sdes zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4 4532238106Sdes www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3 4533238106Sdes www with DO bit set : BIND 8269.31 Ub 28735.6 qps. 4534238106Sdes So, unbound can be about equal qps to NSD in cache hits. 4535238106Sdes And about 3.4x faster than BIND in cache performance. 4536238106Sdes - delay utility for testing. 4537238106Sdes 4538238106Sdes21 February 2008: Wouter 4539238106Sdes - speedup of root-delegation message encoding by 15%. 4540238106Sdes - minor speedup of compress tree_lookup, maybe 1%. 4541238106Sdes - speedup of dname_lab_cmp and memlowercmp - the top functions in 4542238106Sdes profiler output, maybe a couple percent when it matters. 4543238106Sdes 4544238106Sdes20 February 2008: Wouter 4545238106Sdes - setup speec_cache for need-ldns-testns in dotests. 4546238106Sdes - check number of queued replies on incoming queries to avoid overload 4547238106Sdes on that account. 4548238106Sdes - fptr whitelist checks are not disabled in optimize mode. 4549238106Sdes - do-daemonize config file option. 4550238106Sdes - minievent time share initializes time at start. 4551238106Sdes - updated testdata for nsec3 new algorithm numbers (6, 7). 4552238106Sdes - small performance test of packet encoding (root delegation). 4553238106Sdes 4554238106Sdes19 February 2008: Wouter 4555238106Sdes - applied patch to unbound-host man page from Jan-Piet Mens. 4556238106Sdes - fix donotquery-localhost: yes default (it erroneously was switched 4557238106Sdes to default 'no'). 4558238106Sdes - time is only gotten once and the value is shared across unbound. 4559238106Sdes - unittest cleans up crypto, so that it has no memory leaks. 4560238106Sdes - mini_event shares the time value with unbound this results in 4561238106Sdes +3% speed for cache responses and +9% for recursions. 4562238106Sdes - ldns tarball update with new NSEC3 sign code numbers. 4563238106Sdes - perform several reads per UDP operation. This improves performance 4564238106Sdes in DoS conditions, and costs very little in normal conditions. 4565238106Sdes improves cache response +50%, and recursions +10%. 4566238106Sdes - modified asynclook test. because the callback from async is not 4567238106Sdes in any sort of lock (and thus can use all library functions freely), 4568238106Sdes this causes a tiny race condition window when the last lock is 4569238106Sdes released for a callback and a new cancel() for that callback. 4570238106Sdes The only way to remove this is by putting callbacks into some 4571238106Sdes lock window. I'd rather have the small possibility of a callback 4572238106Sdes for a cancelled function then no use of library functions in 4573238106Sdes callbacks. Could be possible to only outlaw process(), wait(), 4574238106Sdes cancel() from callbacks, by adding another lock, but I'd rather not. 4575238106Sdes 4576238106Sdes18 February 2008: Wouter 4577238106Sdes - patch to unbound-host from Jan-Piet Mens. 4578238106Sdes - unbound host prints errors if fails to configure context. 4579238106Sdes - fixup perf to resend faster, so that long waiting requests do 4580238106Sdes not hold up the queue, they become lost packets or SERVFAILs, 4581238106Sdes or can be sent a little while later (i.e. processing time may 4582238106Sdes take long, but throughput has to be high). 4583238106Sdes - fixup iterator operating in no cache conditions (RD flag unset 4584238106Sdes after a CNAME). 4585238106Sdes - streamlined code for RD flag setting. 4586238106Sdes - profiled code and changed dname compares to be faster. 4587238106Sdes The speedup is about +3% to +8% (depending on the test). 4588238106Sdes - minievent tests for eintr and eagain. 4589238106Sdes 4590238106Sdes15 February 2008: Wouter 4591238106Sdes - added FreeBSD rc.d script to contrib. 4592238106Sdes - --prefix option for configure also changes directory: pidfile: 4593238106Sdes and chroot: defaults in config file. 4594238106Sdes - added cache speed test, for cache size OK and cache too small. 4595238106Sdes 4596238106Sdes14 February 2008: Wouter 4597238106Sdes - start without a config file (will complain, but start with 4598238106Sdes defaults). 4599238106Sdes - perf test program works. 4600238106Sdes 4601238106Sdes13 February 2008: Wouter 4602238106Sdes - 0.9 released. 4603238106Sdes - 1.0 development. Printout ldns version on unbound -h. 4604238106Sdes - start of perf tool. 4605238106Sdes - bugfix to read empty lines from /etc/hosts. 4606238106Sdes 4607238106Sdes12 February 2008: Wouter 4608238106Sdes - fixup problem with configure calling itself if ldns-src tarball 4609238106Sdes is not present. 4610238106Sdes 4611238106Sdes11 February 2008: Wouter 4612238106Sdes - changed library to use ub_ instead of ub_val_ as prefix. 4613238106Sdes - statistics output text nice. 4614238106Sdes - etc/hosts handling. 4615238106Sdes - library function to put logging to a stream. 4616238106Sdes - set any option interface. 4617238106Sdes 4618238106Sdes8 February 2008: Wouter 4619238106Sdes - test program for multiple queries over a TCP channel. 4620238106Sdes - tpkg test for stream tcp queries. 4621238106Sdes - unbound replies to multiple TCP queries on a TCP channel. 4622238106Sdes - fixup misclassification of root referral with NS in answer 4623238106Sdes when validating a nonrec query. 4624238106Sdes - tag 0.9 4625238106Sdes - layout of manpages, spelling fix in header, manpages process by 4626238106Sdes makedist, list asynclook and tcpstream tests as ldns-testns 4627238106Sdes required. 4628238106Sdes 4629238106Sdes7 February 2008: Wouter 4630238106Sdes - moved up all current level 2 to be level 3. And 3 to 4. 4631238106Sdes to make room for new debug level 2 for detailed information 4632238106Sdes for operators. 4633238106Sdes - verbosity level 2. Describes recursion and validation. 4634238106Sdes - cleaner configure script and fixes for libevent solaris. 4635238106Sdes - signedness for log output memory sizes in high verbosity. 4636238106Sdes 4637238106Sdes6 February 2008: Wouter 4638238106Sdes - clearer explanation of threading configure options. 4639238106Sdes - fixup asynclook test for nothreading (it creates only one process 4640238106Sdes to do the extended test). 4641238106Sdes - changed name of ub_val_result_free to ub_val_resolve_free. 4642238106Sdes - removes warning message during library linking, renamed 4643238106Sdes libunbound/unbound.c -> libunbound.c and worker to libworker. 4644238106Sdes - fallback without EDNS if result is NOTIMPL as well as on FORMERR. 4645238106Sdes 4646238106Sdes5 February 2008: Wouter 4647238106Sdes - statistics-interval: seconds option added. 4648238106Sdes - test for statistics option 4649238106Sdes - ignore errors making directories, these can occur in parallel builds 4650238106Sdes - fixup Makefile strip command and libunbound docs typo. 4651238106Sdes 4652238106Sdes31 January 2008: Wouter 4653238106Sdes - bg thread/process reads and writes the pipe nonblocking all the time 4654238106Sdes so that even if the pipe is buffered or so, the bg thread does not 4655238106Sdes block, and services both pipes and queries. 4656238106Sdes 4657238106Sdes30 January 2008: Wouter 4658238106Sdes - check trailing / on chrootdir in checkconf. 4659238106Sdes - check if root hints and anchor files are in chrootdir. 4660238106Sdes - no route to host tcp error is verbosity level 2. 4661238106Sdes - removed unused send_reply_iov. and its configure check. 4662238106Sdes - added prints of 'remote address is 1.2.3.4 port 53' to errors 4663238106Sdes from netevent; the basic socket errors. 4664238106Sdes 4665238106Sdes28 January 2008: Wouter 4666238106Sdes - fixup uninit use of buffer by libunbound (query id, flags) for 4667238106Sdes local_zone answers. 4668238106Sdes - fixup uninit warning from random.c; also seems to fix sporadic 4669238106Sdes sigFPE coming out of openssl. 4670238106Sdes - made openssl entropy warning more silent for library use. Needs 4671238106Sdes verbosity 1 now. 4672238106Sdes - fixup forgotten locks for rbtree_searches on ctx->query tree. 4673238106Sdes - random generator cleanup - RND_STATE_SIZE removed, and instead 4674238106Sdes a super-rnd can be passed at init to chain init random states. 4675238106Sdes - test also does lock checks if available. 4676238106Sdes - protect config access in libworker_setup(). 4677238106Sdes - libevent doesn't like comm_base_exit outside of runloop. 4678238106Sdes - close fds after removing commpoints only (for epoll, kqueue). 4679238106Sdes 4680238106Sdes25 January 2008: Wouter 4681238106Sdes - added tpkg for asynclook and library use. 4682238106Sdes - allows localhost to be queried when as a library. 4683238106Sdes - fixup race condition between cancel and answer (in case of 4684238106Sdes really fast answers that beat the cancel). 4685238106Sdes - please doxygen, put doxygen comment in one place. 4686238106Sdes - asynclook -b blocking mode and test. 4687238106Sdes - refactor asynclook, nicer code. 4688238106Sdes - fixup race problems from opensll in rand init from library, with 4689238106Sdes a mutex around the rand init. 4690238106Sdes - fix pass async_id=NULL to _async resolve(). 4691238106Sdes - rewrote _wait() routine, so that it is threadsafe. 4692238106Sdes - cancelation is threadsafe. 4693238106Sdes - asynclook extended test in tpkg. 4694238106Sdes - fixed two races where forked bg process waits for (somehow shared?) 4695238106Sdes locks, so does not service the query pipe on the bg side. 4696238106Sdes Now those locks are only held for fg_threads and for bg_as_a_thread. 4697238106Sdes 4698238106Sdes24 January 2008: Wouter 4699238106Sdes - tested the cancel() function. 4700238106Sdes - asynclook -c (cancel) feature. 4701238106Sdes - fix fail to allocate context actions. 4702238106Sdes - make pipe nonblocking at start. 4703238106Sdes - update plane for retry mode with caution to limit bandwidth. 4704238106Sdes - fix Makefile for concurrent make of unbound-host. 4705238106Sdes - renamed ub_val_ctx_wait/poll/process/fd to ub_val*. 4706238106Sdes - new calls to set forwarding added to header and docs. 4707238106Sdes 4708238106Sdes23 January 2008: Wouter 4709238106Sdes - removed debug prints from if-auto, verb-algo enables some. 4710238106Sdes - libunbound QUIT setup, remove memory leaks, when using threads 4711238106Sdes will share memory for passing results instead of writing it over 4712238106Sdes the pipe, only writes ID number over the pipe (towards the handler 4713238106Sdes thread that does process() ). 4714238106Sdes 4715238106Sdes22 January 2008: Wouter 4716238106Sdes - library code for async in libunbound/unbound.c. 4717238106Sdes - fix link testbound. 4718238106Sdes - fixup exit bug in mini_event. 4719238106Sdes - background worker query enter and result functions. 4720238106Sdes - bg query test application asynclook, it looks up multiple 4721238106Sdes hostaddresses (A records) at the same time. 4722238106Sdes 4723238106Sdes21 January 2008: Wouter 4724238106Sdes - libworker work, netevent raw commpoints, write_msg, serialize. 4725238106Sdes 4726238106Sdes18 January 2008: Wouter 4727238106Sdes - touch up of manpage for libunbound. 4728238106Sdes - support for IP_RECVDSTADDR (for *BSD ip4). 4729238106Sdes - fix for BSD, do not use ip4to6 mapping, make two sockets, once 4730238106Sdes ip6 and once ip4, uses socket options. 4731238106Sdes - goodbye ip4to6 mapping. 4732238106Sdes - update ldns-testpkts with latest version from ldns-trunk. 4733238106Sdes - updated makedist for relative ldns pathnames. 4734238106Sdes - library API with more information inside the result structure. 4735238106Sdes - work on background resolves. 4736238106Sdes 4737238106Sdes17 January 2008: Wouter 4738238106Sdes - fixup configure in case -lldns is installed. 4739238106Sdes - fixup a couple of doxygen warnings, about enum variables. 4740238106Sdes - interface-automatic now copies the interface address from the 4741238106Sdes PKT_INFO structure as well. 4742238106Sdes - manual page with library API, all on one page 'man libunbound'. 4743238106Sdes - rewrite of PKTINFO structure, it also captures IP4 PKTINFO. 4744238106Sdes 4745238106Sdes16 January 2008: Wouter 4746238106Sdes - incoming queries to the server with TC bit on are replied FORMERR. 4747238106Sdes - interface-automatic replied the wrong source address on localhost 4748238106Sdes queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying 4749238106Sdes to use ifnum=-1 to mean 'no interface, use kernel route'. 4750238106Sdes 4751238106Sdes15 January 2008: Wouter 4752238106Sdes - interface-automatic feature. experimental. Nice for anycast. 4753238106Sdes - tpkg test for ip6 ancillary data. 4754238106Sdes - removed debug prints. 4755238106Sdes - porting experience, define for Solaris, test refined for BSD 4756238106Sdes compatibility. The feature probably will not work on OpenBSD. 4757238106Sdes - makedist fixup for ldns-src in build-dir. 4758238106Sdes 4759238106Sdes14 January 2008: Wouter 4760238106Sdes - in no debug sets NDEBUG to remove asserts. 4761238106Sdes - configure --enable-debug is needed for dependency generation 4762238106Sdes for assertions and for compiler warnings. 4763238106Sdes - ldns.tgz updated with ldns-trunk (where buffer.h is updated). 4764238106Sdes - fix lint, unit test in optimize mode. 4765238106Sdes - default access control allows ::ffff:127.0.0.1 v6mapped localhost. 4766238106Sdes 4767238106Sdes11 January 2008: Wouter 4768238106Sdes - man page, warning removed. 4769238106Sdes - added text describing the use of stub zones for private zones. 4770238106Sdes - checkconf tests for bad hostnames (IP address), and for doubled 4771238106Sdes interface lines. 4772238106Sdes - memory sizes can be given with 'k', 'Kb', or M or G appended. 4773238106Sdes 4774238106Sdes10 January 2008: Wouter 4775238106Sdes - typo in example.conf. 4776238106Sdes - made using ldns-src that is included the package more portable 4777238106Sdes by linking with .lo instead of .o files in the ldns package. 4778238106Sdes - nicer do-ip6: yes/no documentation. 4779238106Sdes - nicer linking of libevent .o files. 4780238106Sdes - man pages render correctly on solaris. 4781238106Sdes 4782238106Sdes9 January 2008: Wouter 4783238106Sdes - fixup openssl RAND problem, when the system is not configured to 4784238106Sdes give entropy, and the rng needs to be seeded. 4785238106Sdes 4786238106Sdes8 January 2008: Wouter 4787238106Sdes - print median and quartiles with extensive logging. 4788238106Sdes 4789238106Sdes4 January 2008: Wouter 4790238106Sdes - document misconfiguration in private network. 4791238106Sdes 4792238106Sdes2 January 2008: Wouter 4793238106Sdes - fixup typo in requirements. 4794238106Sdes - document that 'refused' is a better choice than 'drop' for 4795238106Sdes the access control list, as refused will stop retries. 4796238106Sdes 4797238106Sdes7 December 2007: Wouter 4798238106Sdes - unbound-host has a -d option to show what happens. This can help 4799238106Sdes with debugging (why do I get this answer). 4800238106Sdes - fixup CNAME handling, on nodata, sets and display canonname. 4801238106Sdes - dot removed from CNAME display. 4802238106Sdes - respect -v for NXDOMAINs. 4803238106Sdes - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes). 4804238106Sdes - size_t to int for portability of the header file. 4805238106Sdes - fixup bogus handling. 4806238106Sdes - dependencies and lint for unbound-host. 4807238106Sdes 4808238106Sdes6 December 2007: Wouter 4809238106Sdes - library resolution works in foreground mode, unbound-host app 4810238106Sdes receives data. 4811238106Sdes - unbound-host prints rdata using ldns. 4812238106Sdes - unbound-host accepts trust anchors, and prints validation 4813238106Sdes information when you give -v. 4814238106Sdes 4815238106Sdes5 December 2007: Wouter 4816238106Sdes - locking in context_new() inside the function. 4817238106Sdes - setup of libworker. 4818238106Sdes 4819238106Sdes4 December 2007: Wouter 4820238106Sdes - minor Makefile fixup. 4821238106Sdes - moved module-stack code out of daemon/daemon into services/modstack, 4822238106Sdes preparing for code-reuse. 4823238106Sdes - move context into own header file. 4824238106Sdes - context query structure. 4825238106Sdes - removed unused variable pwd from checkconf. 4826238106Sdes - removed unused assignment from outside netw. 4827238106Sdes - check timeval length of string. 4828238106Sdes - fixup error in val_utils getsigner. 4829238106Sdes - fixup same (*var) error in netblocktostr. 4830238106Sdes - fixup memleak on parse error in localzone. 4831238106Sdes - fixup memleak on packet parse error. 4832238106Sdes - put ; after union in parser.y. 4833238106Sdes - small hardening in iter_operate against iq==NULL. 4834238106Sdes - hardening, if error reply with rcode=0 (noerror) send servfail. 4835238106Sdes - fixup same (*var) error in find_rrset in msgparse, was harmless. 4836238106Sdes - check return value of evtimer_add(). 4837238106Sdes - fixup lockorder in lruhash_reclaim(), building up a list of locked 4838238106Sdes entries one at a time. Instead they are removed and unlocked. 4839238106Sdes - fptr_wlist for markdelfunc. 4840238106Sdes - removed is_locked param from lruhash delkeyfunc. 4841238106Sdes - moved bin_unlock during bin_split purely to please. 4842238106Sdes 4843238106Sdes3 December 2007: Wouter 4844238106Sdes - changed checkconf/ to smallapp/ to make room for more support tools. 4845238106Sdes (such as unbound-host). 4846238106Sdes - install dirs created with -m 755 because they need to be accessible. 4847238106Sdes - library extensive featurelist added to TODO. 4848238106Sdes - please doxygen, lint. 4849238106Sdes - library test application, with basic functionality. 4850238106Sdes - fix for building in a subdirectory. 4851238106Sdes - link lib fix for Leopard. 4852238106Sdes 4853238106Sdes30 November 2007: Wouter 4854238106Sdes - makefile that creates libunbound.la, basic file or libunbound.a 4855238106Sdes when creating static executables (no libtool). 4856238106Sdes - more API setup. 4857238106Sdes 4858238106Sdes29 November 2007: Wouter 4859238106Sdes - 0.9 public API start. 4860238106Sdes 4861238106Sdes28 November 2007: Wouter 4862238106Sdes - Changeup plan for 0.8 - no complication needed, a simple solution 4863238106Sdes has been chosen for authoritative features. 4864238106Sdes - you can use single quotes in the config file, so it is possible 4865238106Sdes to specify TXT records in local data. 4866238106Sdes - fixup small memory problem in implicit transparent zone creation. 4867238106Sdes - test for implicit zone creation and multiple RR RRsets local data. 4868238106Sdes - local-zone nodefault test. 4869238106Sdes - show testbound testlist on commit. 4870238106Sdes - iterator normalizer changes CNAME chains ending in NXDOMAIN where 4871238106Sdes the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial 4872238106Sdes domain exists). 4873238106Sdes - nicer verbosity: 0 and 1 levels. 4874238106Sdes - lower nonRDquery chance of eliciting wrongly typed validation 4875238106Sdes requiring message from the cache. 4876238106Sdes - fix for nonRDquery validation typing; nodata is detected when 4877238106Sdes SOA record in auth section (all validation-requiring nodata messages 4878238106Sdes have a SOA record in authority, so this is OK for the validator), 4879238106Sdes and NS record is needed to be a referral. 4880238106Sdes - duplicate checking when adding NSECs for a CNAME, and test. 4881238106Sdes - created svn tag 0.8, after completing testbed tests. 4882238106Sdes 4883238106Sdes27 November 2007: Wouter 4884238106Sdes - per suggestion in rfc2308, replaced default max-ttl value with 1 day. 4885238106Sdes - set size of msgparse lookup table to 32, from 1024, so that its size 4886238106Sdes is below the 2048 regional large size threshold, and does not cause 4887238106Sdes a call to malloc when a message is parsed. 4888238106Sdes - update of memstats tool to print number of allocation calls. 4889238106Sdes This is what is taking time (not space) and indicates the avg size 4890238106Sdes of the allocations as well. region_alloc stat is removed. 4891238106Sdes 4892238106Sdes22 November 2007: Wouter 4893238106Sdes - noted EDNS in-the-middle dropping trouble as a TODO. 4894238106Sdes At this point theoretical, no user trouble has been reported. 4895238106Sdes - added all default AS112 zones. 4896238106Sdes - answers from local zone content. 4897238106Sdes * positive answer, the rrset in question 4898238106Sdes * nodata answer (exist, but not that type). 4899238106Sdes * nxdomain answer (domain does not exist). 4900238106Sdes * empty-nonterminal answer. 4901238106Sdes * But not: wildcard, nsec, referral, rrsig, cname/dname, 4902238106Sdes or additional section processing, NS put in auth. 4903238106Sdes - test for correct working of static and transparent and couple 4904238106Sdes of important defaults (localhost, as112, reverses). 4905238106Sdes Also checks deny and refuse settings. 4906238106Sdes - fixup implicit zone generation and AA bit for NXDOMAIN on localdata. 4907238106Sdes 4908238106Sdes21 November 2007: Wouter 4909238106Sdes - local zone internal data setup. 4910238106Sdes 4911238106Sdes20 November 2007: Wouter 4912238106Sdes - 0.8 - str2list config support for double string config options. 4913238106Sdes - local-zone and local-data options, config storage and documentation. 4914238106Sdes 4915238106Sdes19 November 2007: Wouter 4916238106Sdes - do not downcase NSEC and RRSIG for verification. Follows 4917238106Sdes draft-ietf-dnsext-dnssec-bis-updates-06.txt. 4918238106Sdes - fixup leaking unbound daemons at end of tests. 4919238106Sdes - README file updated. 4920238106Sdes - nice libevent not found error. 4921238106Sdes - README talks about gnu make. 4922238106Sdes - 0.8: unit test for addr_mask and fixups for it. 4923238106Sdes and unit test for addr_in_common(). 4924238106Sdes - 0.8: access-control config file element. 4925238106Sdes and unit test rpl replay file. 4926238106Sdes - 0.8: fixup address reporting from netevent. 4927238106Sdes 4928238106Sdes16 November 2007: Wouter 4929238106Sdes - privilege separation is not needed in unbound at this time. 4930238106Sdes TODO item marked as such. 4931238106Sdes - created beta-0.7 branch for support. 4932238106Sdes - tagged 0.7 for beta release. 4933238106Sdes - moved trunk to 0.8 for 0.8(auth features) development. 4934238106Sdes - 0.8: access control list setup. 4935238106Sdes 4936238106Sdes15 November 2007: Wouter 4937238106Sdes - review fixups from Jelte. 4938238106Sdes 4939238106Sdes14 November 2007: Wouter 4940238106Sdes - testbed script does not recreate configure, since its in svn now. 4941238106Sdes - fixup checkconf test so that it does not test 4942238106Sdes /etc/unbound/unbound.conf. 4943238106Sdes - tag 0.6. 4944238106Sdes 4945238106Sdes13 November 2007: Wouter 4946238106Sdes - remove debug print. 4947238106Sdes - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists. 4948238106Sdes 4949238106Sdes12 November 2007: Wouter 4950238106Sdes - fixup signal handling where SIGTERM could be ignored if a SIGHUP 4951238106Sdes arrives later on. 4952238106Sdes - bugreports to unbound-bugs@nlnetlabs.nl 4953238106Sdes - fixup testbound so it exits cleanly. 4954238106Sdes - cleanup the caches on a reload, so that rrsetID numbers won't clash. 4955238106Sdes 4956238106Sdes9 November 2007: Wouter 4957238106Sdes - took ldns snapshot in repo. 4958238106Sdes - default config file is /etc/unbound/unbound.conf. 4959238106Sdes If it doesn't exist, it is installed with the doc/example.conf file. 4960238106Sdes The file is not deleted on uninstall. 4961238106Sdes - default listening is not all, but localhost interfaces. 4962238106Sdes 4963238106Sdes8 November 2007: Wouter 4964238106Sdes - Fixup chroot and drop user privileges. 4965238106Sdes - new L root ip address in default hints. 4966238106Sdes 4967238106Sdes1 November 2007: Wouter 4968238106Sdes - Fixup of crash on reload, due to anchors in env not NULLed after 4969238106Sdes dealloc during deinit. 4970238106Sdes - Fixup of chroot call. Happens after privileges are dropped, so 4971238106Sdes that checking the passwd entry still works. 4972238106Sdes - minor touch up of clear() hashtable function. 4973238106Sdes - VERB_DETAIL prints out what chdir, username, chroot is being done. 4974238106Sdes - when id numbers run out, caches are cleared, as in design notes. 4975238106Sdes Tested with a mock setup with very few bits in id, it worked. 4976238106Sdes - harden-dnssec-stripped: yes is now default. It insists on dnssec 4977238106Sdes data for trust anchors. Included tests for the feature. 4978238106Sdes 4979238106Sdes31 October 2007: Wouter 4980238106Sdes - cache-max-ttl config option. 4981238106Sdes - building outside sourcedir works again. 4982238106Sdes - defaults more secure: 4983238106Sdes username: "unbound" 4984238106Sdes chroot: "/etc/unbound" 4985238106Sdes The operator can override them to be less secure ("") if necessary. 4986238106Sdes - fix horrible oversight in sorting rrset references in a message, 4987238106Sdes sort per reference key pointer, not on referencepointer itself. 4988238106Sdes - pidfile: "/etc/unbound/unbound.pid" is now the default. 4989238106Sdes - tests changed to reflect the updated default. 4990238106Sdes - created hashtable clear() function that respects locks. 4991238106Sdes 4992238106Sdes30 October 2007: Wouter 4993238106Sdes - fixup assertion failure that relied on compressed names to be 4994238106Sdes smaller than uncompressed names. A packet from comrite.com was seen 4995238106Sdes to be compressed to a larger size. Added it as unit test. 4996238106Sdes - quieter logging at low verbosity level for common tcp messages. 4997238106Sdes - no greedy TTL update. 4998238106Sdes 4999238106Sdes23 October 2007: Wouter 5000238106Sdes - fixup (grand-)parent problem for dnssec-lameness detection. 5001238106Sdes - fixup tests to do additional section processing for lame replies, 5002238106Sdes since the detection needs that. 5003238106Sdes - no longer trust in query section in reply during dnssec lame detect. 5004238106Sdes - dnssec lameness does not make the server never ever queried, but 5005238106Sdes non-preferred. If no other servers exist or answer, the dnssec lame 5006238106Sdes server is used; the fastest dnssec lame server is chosen. 5007238106Sdes - added test then when trust anchor cannot be primed (nodata), the 5008238106Sdes insecure mode from unbound works. 5009238106Sdes - Fixup max queries per thread, any more are dropped. 5010238106Sdes 5011238106Sdes22 October 2007: Wouter 5012238106Sdes - added donotquerylocalhost config option. Can be turned off for 5013238106Sdes out test cases. 5014238106Sdes - ISO C compat changes. 5015238106Sdes - detect RA-no-AA lameness, as LAME. 5016238106Sdes - DNSSEC-lameness detection, as LAME. 5017238106Sdes See notes in requirements.txt for choices made. 5018238106Sdes - tests for lameness detection. 5019238106Sdes - added all to make test target; need unbound for fwd tests. 5020238106Sdes - testbound does not pollute /etc/unbound. 5021238106Sdes 5022238106Sdes19 October 2007: Wouter 5023238106Sdes - added configure (and its files) to svn, so that the trunk is easier 5024238106Sdes to use. ./configure, config.guess, config.sub, ltmain.sh, 5025238106Sdes and config.h.in. 5026238106Sdes - added yacc/lex generated files, util/configlexer.c, 5027238106Sdes util/configparser.c util/configparser.h, to svn. 5028238106Sdes - without lex no attempt to use it. 5029238106Sdes - unsecure response validation collated into one block. 5030238106Sdes - remove warning about const cast of cfgfile name. 5031238106Sdes - outgoing-interfaces can be different from service interfaces. 5032238106Sdes - ldns-src configure is done during unbound configure and 5033238106Sdes ldns-src make is done during unbound make, and so inherits the 5034238106Sdes make arguments from the unbound make invocation. 5035238106Sdes - nicer error when libevent problem causes instant exit on signal. 5036238106Sdes - read root hints from a root hint file (like BIND does). 5037238106Sdes 5038238106Sdes18 October 2007: Wouter 5039238106Sdes - addresses are logged with errors. 5040238106Sdes - fixup testcode fake event to remove pending before callback 5041238106Sdes since the callback may create new pending items. 5042238106Sdes - tests updated because retries are now in iterator module. 5043238106Sdes - ldns-testpkts code is checked for differences between unbound 5044238106Sdes and ldns by makedist.sh. 5045238106Sdes - ldns trunk from today added in svn repo for fallback in case 5046238106Sdes no ldns is installed on the system. 5047238106Sdes make download_ldns refreshes the tarball with ldns svn trunk. 5048238106Sdes - ldns-src.tar.gz is used if no ldns is found on the system, and 5049238106Sdes statically linked into unbound. 5050238106Sdes - start of regional allocator code. 5051238106Sdes - regional uses less memory and variables, simplified code. 5052238106Sdes - remove of region-allocator. 5053238106Sdes - alloc cache keeps a cache of recently released regional blocks, 5054238106Sdes up to a maximum. 5055238106Sdes - make unit test cleanly free memory. 5056238106Sdes 5057238106Sdes17 October 2007: Wouter 5058238106Sdes - fixup another cycle detect and ns-addr timeout resolution bug. 5059238106Sdes This time by refusing delegations from the cache without addresses 5060238106Sdes when resolving a mandatory-glue nameserver-address for that zone. 5061238106Sdes We're going to have to ask a TLD server anyway; might as well be 5062238106Sdes the TLD server for this name. And this resolves a lot of cases where 5063238106Sdes the other nameserver names lead to cycles or are not available. 5064238106Sdes - changed random generator from random(3) clone to arc4random wrapped 5065238106Sdes for thread safety. The random generator is initialised with 5066238106Sdes entropy from the system. 5067238106Sdes - fix crash where failure to prime DNSKEY tried to print null pointer 5068238106Sdes in the log message. 5069238106Sdes - removed some debug prints, only verb_algo (4) enables them. 5070238106Sdes - fixup test; new random generator took new paths; such as one 5071238106Sdes where no scripted answer was available. 5072238106Sdes - mark insecure RRs as insecure. 5073238106Sdes - fixup removal of nonsecure items from the additional. 5074238106Sdes - reduced timeout values to more realistic, 376 msec (262 msec has 5075238106Sdes 90% of roundtrip times, 512 msec has 99% of roundtrip times.) 5076238106Sdes - server selection failover to next server after timeout (376 msec). 5077238106Sdes 5078238106Sdes16 October 2007: Wouter 5079238106Sdes - no malloc in log_hex. 5080238106Sdes - assertions around system calls. 5081238106Sdes - protect against gethostname without ending zero. 5082238106Sdes - ntop output is null terminated by unbound. 5083238106Sdes - pidfile content null termination 5084238106Sdes - various snprintf use sizeof(stringbuf) instead of fixed constant. 5085238106Sdes - changed loopdetect % 8 with & 0x7 since % can become negative for 5086238106Sdes weird negative input and particular interpretation of integer math. 5087238106Sdes - dname_pkt_copy checks length of result, to protect result buffers. 5088238106Sdes prints an error, this should not happen. Bad strings should have 5089238106Sdes been rejected earlier in the program. 5090238106Sdes - remove a size_t underflow from msgreply size func. 5091238106Sdes 5092238106Sdes15 October 2007: Wouter 5093238106Sdes - nicer warning. 5094238106Sdes - fix IP6 TCP, wrong definition check. With test package. 5095238106Sdes - fixup the fact that the query section was not compressed to, 5096238106Sdes the code was there but was called by value instead of by reference. 5097238106Sdes And test for the case, uses xxd and nc. 5098238106Sdes - more portable ip6 check for sockaddr types. 5099238106Sdes 5100238106Sdes8 October 2007: Wouter 5101238106Sdes - --disable-rpath option in configure for 64bit systems with 5102238106Sdes several dynamic lib dirs. 5103238106Sdes 5104238106Sdes7 October 2007: Wouter 5105238106Sdes - fixup tests for no AD bit in non-DO queries. 5106238106Sdes - test that makes sure AD bit is not set on non-DO query. 5107238106Sdes 5108238106Sdes6 October 2007: Wouter 5109238106Sdes - removed logfile open early. It did not have the proper permissions; 5110238106Sdes it was opened as root instead of the user. And we cannot change user 5111238106Sdes id yet, since chroot and bind ports need to be done. 5112238106Sdes - callback checks for event callbacks done from mini_event. Because 5113238106Sdes of deletions cannot do this from netevent. This means when using 5114238106Sdes libevent the protection does not work on event-callbacks. 5115238106Sdes - fixup too small reply (did not zero counts). 5116238106Sdes - fixup reply no longer AD bit when query without DO bit. 5117238106Sdes 5118238106Sdes5 October 2007: Wouter 5119238106Sdes - function pointer whitelist. 5120238106Sdes 5121238106Sdes4 October 2007: Wouter 5122238106Sdes - overwrite sensitive random seed value after use. 5123238106Sdes - switch to logfile very soon if not -d (console attached). 5124238106Sdes - error messages do not reveal the trustanchor contents. 5125238106Sdes - start work on function pointer whitelists. 5126238106Sdes 5127238106Sdes3 October 2007: Wouter 5128238106Sdes - fix for multiple empty nonterminals, after multiple DSes in the 5129238106Sdes chain of trust. 5130238106Sdes - mesh checks if modules are looping, and stops them. 5131238106Sdes - refetch with CNAMEd nameserver address regression test added. 5132238106Sdes - fixup line count bug in testcode, so testbound prints correct line 5133238106Sdes number with parse errors. 5134238106Sdes - unit test for multiple ENT case. 5135238106Sdes - fix for cname out of validated unsec zone. 5136238106Sdes - fixup nasty id=0 reuse. Also added assertions to detect its 5137238106Sdes return (the assertion catches in the existing test cases). 5138238106Sdes 5139238106Sdes1 October 2007: Wouter 5140238106Sdes - skip F77, CXX, objC tests in configure step. 5141238106Sdes - fixup crash in refetch glue after a CNAME. 5142238106Sdes and protection against similar failures (with error print). 5143238106Sdes 5144238106Sdes28 September 2007: Wouter 5145238106Sdes - test case for unbound-checkconf, fixed so it also checks the 5146238106Sdes interface: statements. 5147238106Sdes 5148238106Sdes26 September 2007: Wouter 5149238106Sdes - SIGHUP will reopen the log file. 5150238106Sdes - Option to log to syslog. 5151238106Sdes - please lint, fixup tests (that went to syslog on open, oops). 5152238106Sdes - config check program. 5153238106Sdes 5154238106Sdes25 September 2007: Wouter 5155238106Sdes - tests for NSEC3. Fixup bitmap checks for NSEC3. 5156238106Sdes - positive ANY response needs to check if wildcard expansion, and 5157238106Sdes check that original data did not exist. 5158238106Sdes - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure 5159238106Sdes delegation, for abuse of child zone apex nsec3. 5160238106Sdes - create 0.5 release tag. 5161238106Sdes 5162238106Sdes24 September 2007: Wouter 5163238106Sdes - do not make test programs by default. 5164238106Sdes - But 'make test' will perform all of the tests. 5165238106Sdes - Advertise builtin select libevent alternative when no libevent 5166238106Sdes is found. 5167238106Sdes - signit can generate NSEC3 hashes, for generating tests. 5168292206Sdes - multiple nsec3 parameters in message test. 5169238106Sdes - too high nsec3 iterations becomes insecure test. 5170238106Sdes 5171238106Sdes21 September 2007: Wouter 5172238106Sdes - fixup empty_DS_name allocated in wrong region (port DEC Alpha). 5173238106Sdes - fixup testcode lock safety (port FreeBSD). 5174238106Sdes - removes subscript has type char warnings (port Solaris 9). 5175238106Sdes - fixup of field with format type to int (port MacOS/X intel). 5176238106Sdes - added test for infinite loop case in nonRD answer validation. 5177238106Sdes It was a more general problem, but hard to reproduce. When an 5178238106Sdes unsigned rrset is being validated and the key fetched, the DS 5179238106Sdes sequence is followed, but if the final name has no DS, then no 5180238106Sdes proof is possible - the signature has been stripped off. 5181238106Sdes 5182238106Sdes20 September 2007: Wouter 5183238106Sdes - fixup and test for NSEC wildcard with empty nonterminals. 5184238106Sdes - makedist.sh fixup for svn info. 5185238106Sdes - acl features request in plan. 5186238106Sdes - improved DS empty nonterminal handling. 5187238106Sdes - compat with ANS nxdomain for empty nonterminals. Attempts the nodata 5188238106Sdes proof anyway, which succeeds in ANS failure case. 5189238106Sdes - striplab protection in case it becomes -1. 5190238106Sdes - plans for static and blacklist config. 5191238106Sdes 5192238106Sdes19 September 2007: Wouter 5193238106Sdes - comments about non-packed usage. 5194238106Sdes - plan for overload support in 0.6. 5195238106Sdes - added testbound tests for a failed resolution from the logs 5196238106Sdes and for failed prime when missing glue. 5197238106Sdes - fixup so useless delegation points are not returned from the 5198238106Sdes cache. Also the safety belt is used if priming fails to complete. 5199238106Sdes - fixup NSEC rdata not to be lowercased, bind compat. 5200238106Sdes 5201238106Sdes18 September 2007: Wouter 5202238106Sdes - wildcard nsec3 testcases, and fixup to get correct wildcard name. 5203238106Sdes - validator prints subtype classification for debug. 5204238106Sdes 5205238106Sdes17 September 2007: Wouter 5206238106Sdes - NSEC3 hash cache unit test. 5207238106Sdes - validator nsec3 nameerror test. 5208238106Sdes 5209238106Sdes14 September 2007: Wouter 5210238106Sdes - nsec3 nodata proof, nods proof, wildcard proof. 5211238106Sdes - nsec3 support for cname chain ending in noerror or nodata. 5212238106Sdes - validator calls nsec3 proof routines if no NSECs prove anything. 5213238106Sdes - fixup iterator bug where it stored the answer to a cname under 5214238106Sdes the wrong qname into the cache. When prepending the cnames, the 5215238106Sdes qname has to be reset to the original qname. 5216238106Sdes 5217238106Sdes13 September 2007: Wouter 5218238106Sdes - nsec3 find matching and covering, ce proof, prove namerror msg. 5219238106Sdes 5220238106Sdes12 September 2007: Wouter 5221238106Sdes - fixup of manual page warnings, like for NSD bugreport. 5222238106Sdes - nsec3 work, config, max iterations, filter, and hash cache. 5223238106Sdes 5224238106Sdes6 September 2007: Wouter 5225238106Sdes - fixup to find libevent on mac port install. 5226238106Sdes - fixup size_t vs unsigned portability in validator/sigcrypt. 5227238106Sdes - please compiler on different platforms, for unreachable code. 5228238106Sdes - val_nsec3 file. 5229238106Sdes - pthread_rwlock type is optional, in case of old pthread libs. 5230238106Sdes 5231238106Sdes5 September 2007: Wouter 5232238106Sdes - cname, name error validator tests. 5233238106Sdes - logging of qtype ANY works. 5234238106Sdes - ANY type answers get RRSIG in answer section of replies (but not 5235238106Sdes in other sections, unless DO bit is on). 5236238106Sdes - testbound can replay a TCP query (set MATCH TCP in the QUERY). 5237238106Sdes - DS and noDS referral validation test. 5238238106Sdes - if you configure many trust anchors, parent trust anchors can 5239292206Sdes securely deny existence of child trust anchors, if validated. 5240238106Sdes - not all *.name NSECs are present because a wildcard was matched, 5241238106Sdes and *.name NSECs can prove nodata for empty nonterminals. 5242238106Sdes Also, for wildcard name NSECs, check they are not from the parent 5243238106Sdes zone (for wildcarded zone cuts), and check absence of CNAME bit, 5244238106Sdes for a nodata proof. 5245238106Sdes - configure option for memory allocation debugging. 5246238106Sdes - port configure option for memory allocation to solaris10. 5247238106Sdes 5248238106Sdes4 September 2007: Wouter 5249238106Sdes - fixup of Leakage warning when serviced queries processed multiple 5250238106Sdes callbacks for the same query from the same server. 5251238106Sdes - testbound removes config file from /tmp on failed exit. 5252238106Sdes - fixup for referral cleanup of the additional section. 5253238106Sdes - tests for cname, referral validation. 5254238106Sdes - neater testbound tpkg output. 5255238106Sdes - DNAMEs no longer match their apex when synthesized from the cache. 5256238106Sdes - find correct signer name for DNAME responses. 5257238106Sdes - wildcarded DNAME test and fixup code to detect. 5258238106Sdes - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs. 5259238106Sdes So that wildcarded CNAMEs get their NSEC with them to the answer. 5260238106Sdes - test for a CNAME to a DNAME to a CNAME to an answer, all from 5261238106Sdes different domains, for key fetching and signature checking of 5262238106Sdes CNAME'd messages. 5263238106Sdes 5264238106Sdes3 September 2007: Wouter 5265238106Sdes - Fixed error in iterator that would cause assertion failure in 5266238106Sdes validator. CNAME to a NXDOMAIN response was collated into a response 5267238106Sdes with both a CNAME and the NXDOMAIN rcode. Added a test that the 5268238106Sdes rcode is changed to NOERROR (because of the CNAME). 5269238106Sdes - timeout on tcp does not lead to spurious leakage detect. 5270238106Sdes - account memory for name of lame zones, so that memory leakages does 5271238106Sdes not show lame cache growth as a leakage growth. 5272238106Sdes - config setting for lameness cache expressed in bytes, instead of 5273238106Sdes number of entries. 5274238106Sdes - tool too summarize allocations per code line. 5275238106Sdes 5276238106Sdes31 August 2007: Wouter 5277238106Sdes - can read bind trusted-keys { ... }; files, in a compatibility mode. 5278238106Sdes - iterator should not detach target queries that it still could need. 5279238106Sdes the protection against multiple outstanding queries is moved to a 5280238106Sdes current_query num check. 5281238106Sdes - validator nodata, positive, referral tests. 5282238106Sdes - dname print can print '*' wildcard. 5283238106Sdes 5284238106Sdes30 August 2007: Wouter 5285238106Sdes - fixup override date config option. 5286238106Sdes - config options to control memory usage. 5287238106Sdes - caught bad free of un-alloced data in worker_send error case. 5288238106Sdes - memory accounting for key cache (trust anchors and temporary cache). 5289238106Sdes - memory accounting fixup for outside network tcp pending waits. 5290238106Sdes - memory accounting fixup for outside network tcp callbacks. 5291238106Sdes - memory accounting for iterator fixed storage. 5292238106Sdes - key cache size and slabs config options. 5293238106Sdes - lib crypto cleanups at exit. 5294238106Sdes 5295238106Sdes29 August 2007: Wouter 5296238106Sdes - test tool to sign rrsets for testing validator with. 5297238106Sdes - added RSA and DSA test keys, public and private pairs, 512 bits. 5298238106Sdes - default configuration is with validation enabled. 5299238106Sdes Only a trust-anchor needs to be configured for DNSSEC to work. 5300238106Sdes - do not convert to DER for DSA signature verification. 5301238106Sdes - validator replay test file, for a DS to DNSKEY DSA key prime and 5302238106Sdes positive response. 5303238106Sdes 5304238106Sdes28 August 2007: Wouter 5305238106Sdes - removed double use for udp buffers, that could fail, 5306238106Sdes instead performs a malloc to do the backup. 5307238106Sdes - validator validates referral messages, by validating all the rrsets 5308238106Sdes and stores the rrsets in the cache. Further referral (nonRD queries) 5309238106Sdes replies are made from the rrset cache directly. Unless unchecked 5310238106Sdes rrsets are encountered, there are then validated. 5311238106Sdes - enforce that signing is done by a parent domain (or same domain). 5312238106Sdes - adjust TTL downwards if rrset TTL bigger than signature allows. 5313238106Sdes - permissive mode feature, sets AD bit for secure, but bogus does 5314238106Sdes not give servfail (bogus is changed into indeterminate). 5315238106Sdes - optimization of rrset verification. rr canonical sorting is reused, 5316238106Sdes for the same rrset. canonical rrset image in buffer is reused for 5317238106Sdes the same signature. 5318238106Sdes - if the rrset is too big (64k exactly + large owner name) the 5319238106Sdes canonicalization routine will fail if it does not fit in buffer. 5320238106Sdes - faster verification for large sigsets. 5321238106Sdes - verb_detail mode reports validation failures, but not the entire 5322238106Sdes algorithm for validation. Key prime failures are reported as 5323238106Sdes verb_ops level. 5324238106Sdes 5325238106Sdes27 August 2007: Wouter 5326238106Sdes - do not garble the edns if a cache answer fails. 5327238106Sdes - answer norecursive from cache if possible. 5328238106Sdes - honor clean_additional setting when returning secure non-recursive 5329238106Sdes referrals. 5330238106Sdes - do not store referral in msg cache for nonRD queries. 5331238106Sdes - store verification status in the rrset cache to speed up future 5332238106Sdes verification. 5333238106Sdes - mark rrsets indeterminate and insecure if they are found to be so. 5334238106Sdes and store this in the cache. 5335238106Sdes 5336238106Sdes24 August 2007: Wouter 5337238106Sdes - message is bogus if unsecure authority rrsets are present. 5338238106Sdes - val-clean-additional option, so you can turn it off. 5339238106Sdes - move rrset verification out of the specific proof types into one 5340238106Sdes routine. This makes the proof routines prettier. 5341238106Sdes - fixup cname handling in validator, cname-to-positive and cname-to- 5342238106Sdes nodata work. 5343238106Sdes - Do not synthesize DNSKEY and DS responses from the rrset cache if 5344238106Sdes the rrset is from the additional section. Signatures may have 5345238106Sdes fallen off the packet, and cause validation failure. 5346238106Sdes - more verbose signature date errors (with the date attached). 5347238106Sdes - increased default infrastructure cache size. It is important for 5348238106Sdes performance, and 1000 entries are only 212k (or a 400 k total cache 5349238106Sdes size). To 10000 entries (for 2M entries, 4M cache size). 5350238106Sdes 5351238106Sdes23 August 2007: Wouter 5352238106Sdes - CNAME handling - move needs_validation to before val_new(). 5353238106Sdes val_new() setups the chase-reply to be an edited copy of the msg. 5354238106Sdes new classification, and find signer can find for it. 5355238106Sdes removal of unsigned crap from additional, and query restart for 5356238106Sdes cname. 5357238106Sdes - refuse to follow wildcarded DNAMEs when validating. 5358238106Sdes But you can query for qtype ANY, or qtype DNAME and validate that. 5359238106Sdes 5360238106Sdes22 August 2007: Wouter 5361238106Sdes - bogus TTL. 5362238106Sdes - review - use val_error(). 5363238106Sdes 5364238106Sdes21 August 2007: Wouter 5365238106Sdes - ANY response validation. 5366238106Sdes - store security status in cache. 5367238106Sdes - check cache security status and either send the query to be 5368238106Sdes validated, return the query to client, or send servfail to client. 5369238106Sdes Sets AD bit on validated replies. 5370238106Sdes - do not examine security status on an error reply in mesh_done. 5371238106Sdes - construct DS, DNSKEY messages from rrset cache. 5372238106Sdes - manual page entry for override-date. 5373238106Sdes 5374238106Sdes20 August 2007: Wouter 5375238106Sdes - validate and positive validation, positive wildcard NSEC validation. 5376238106Sdes - nodata validation, nxdomain validation. 5377238106Sdes 5378238106Sdes18 August 2007: Wouter 5379238106Sdes - process DNSKEY response in FINDKEY state. 5380238106Sdes 5381238106Sdes17 August 2007: Wouter 5382238106Sdes - work on DS2KE routine. 5383238106Sdes - val_nsec.c for validator NSEC proofs. 5384238106Sdes - unit test for NSEC bitmap reading. 5385238106Sdes - dname iswild and canonical_compare with unit tests. 5386238106Sdes 5387238106Sdes16 August 2007: Wouter 5388238106Sdes - DS sig unit test. 5389238106Sdes - latest release libevent 1.3c and 1.3d have threading fixed. 5390238106Sdes - key entry fixup data pointer and ttl absolute. 5391238106Sdes - This makes a key-prime succeed in validator, with DS or DNSKEY as 5392238106Sdes trust-anchor. 5393238106Sdes - fixup canonical compare byfield routine, fix bug and also neater. 5394238106Sdes - fixed iterator response type classification for queries of type 5395238106Sdes ANY and NS. 5396238106Sdes dig ANY gives sometimes NS rrset in AN and NS section, and parser 5397238106Sdes removes the NS section duplicate. dig NS gives sometimes the NS 5398238106Sdes in the answer section, as referral. 5399238106Sdes - validator FINDKEY state. 5400238106Sdes 5401238106Sdes15 August 2007: Wouter 5402238106Sdes - crypto calls to verify signatures. 5403238106Sdes - unit test for rrsig verification. 5404238106Sdes 5405238106Sdes14 August 2007: Wouter 5406238106Sdes - default outgoing ports changed to avoid port 2049 by default. 5407238106Sdes This port is widely blocked by firewalls. 5408238106Sdes - count infra lameness cache in memory size. 5409238106Sdes - accounting of memory improved 5410238106Sdes - outbound entries are allocated in the query region they are for. 5411238106Sdes - extensive debugging for memory allocations. 5412238106Sdes - --enable-lock-checks can be used to enable lock checking. 5413238106Sdes - protect undefs in config.h from autoheaders ministrations. 5414238106Sdes - print all received udp packets. log hex will print on multiple 5415238106Sdes lines if needed. 5416238106Sdes - fixed error in parser with backwards rrsig references. 5417238106Sdes - mark cycle targets for iterator did not have CD flag so failed 5418238106Sdes its task. 5419238106Sdes 5420238106Sdes13 August 2007: Wouter 5421238106Sdes - fixup makefile, if lexer is missing give nice error and do not 5422238106Sdes mess up the dependencies. 5423238106Sdes - canonical compare routine updated. 5424238106Sdes - canonical hinfo compare. 5425238106Sdes - printout list of the queries that the mesh is working on. 5426238106Sdes 5427238106Sdes10 August 2007: Wouter 5428238106Sdes - malloc and free overrides that track total allocation and frees. 5429238106Sdes for memory debugging. 5430238106Sdes - work on canonical sort. 5431238106Sdes 5432238106Sdes9 August 2007: Wouter 5433238106Sdes - canonicalization, signature checks 5434238106Sdes - dname signature label count and unit test. 5435238106Sdes - added debug heap size print to memory printout. 5436238106Sdes - typo fixup in worker.c 5437238106Sdes - -R needed on solaris. 5438238106Sdes - validator override option for date check testing. 5439238106Sdes 5440238106Sdes8 August 2007: Wouter 5441238106Sdes - ldns _raw routines created (in ldns trunk). 5442238106Sdes - sigcrypt DS digest routines 5443238106Sdes - val_utils uses sigcrypt to perform signature cryptography. 5444238106Sdes - sigcrypt keyset processing 5445238106Sdes 5446238106Sdes7 August 2007: Wouter 5447238106Sdes - security status type. 5448238106Sdes - security status is copied when rdata is equal for rrsets. 5449238106Sdes - rrset id is updated to invalidate all the message cache entries 5450238106Sdes that refer to NSEC, NSEC3, DNAME rrsets that have changed. 5451238106Sdes - val_util work 5452238106Sdes - val_sigcrypt file for validator signature checks. 5453238106Sdes 5454238106Sdes6 August 2007: Wouter 5455238106Sdes - key cache for validator. 5456238106Sdes - moved isroot and dellabel to own dname routines, with unit test. 5457238106Sdes 5458238106Sdes3 August 2007: Wouter 5459238106Sdes - replanning. 5460238106Sdes - scrubber check section of lame NS set. 5461238106Sdes - trust anchors can be in config file or read from zone file, 5462238106Sdes DS and DNSKEY entries. 5463238106Sdes - unit test trust anchor storage. 5464238106Sdes - trust anchors converted to packed rrsets. 5465238106Sdes - key entry definition. 5466238106Sdes 5467238106Sdes2 August 2007: Wouter 5468238106Sdes - configure change for latest libevent trunk version (needs -lrt). 5469238106Sdes - query_done and walk_supers are moved out of module interface. 5470238106Sdes - fixup delegation point duplicates. 5471238106Sdes - fixup iterator scrubber; lame NS set is let through the scrubber 5472238106Sdes so that the classification is lame. 5473238106Sdes - validator module exists, and does nothing but pass through, 5474238106Sdes with calling of next module and return. 5475238106Sdes - validator work. 5476238106Sdes 5477238106Sdes1 August 2007: Wouter 5478238106Sdes - set version to 0.5 5479238106Sdes - module work for module to module interconnections. 5480238106Sdes - config of modules. 5481238106Sdes - detect cycle takes flags. 5482238106Sdes 5483238106Sdes31 July 2007: Wouter 5484238106Sdes - updated plan 5485238106Sdes - release 0.4 tag. 5486238106Sdes 5487238106Sdes30 July 2007: Wouter 5488238106Sdes - changed random state init, so that sequential process IDs are not 5489238106Sdes cancelled out by sequential thread-ids in the random number seed. 5490238106Sdes - the fwd_three test, which sends three queries to unbound, and 5491238106Sdes unbound is kept waiting by ldns-testns for 3 seconds, failed 5492238106Sdes because the retry timeout for default by unbound is 3 seconds too, 5493238106Sdes it would hit that timeout and fail the test. Changed so that unbound 5494238106Sdes is kept waiting for 2 seconds instead. 5495238106Sdes 5496238106Sdes27 July 2007: Wouter 5497238106Sdes - removed useless -C debug option. It did not work. 5498238106Sdes - text edit of documentation. 5499238106Sdes - added doc/CREDITS file, referred to by the manpages. 5500238106Sdes - updated planning. 5501238106Sdes 5502238106Sdes26 July 2007: Wouter 5503238106Sdes - cycle detection, for query state dependencies. Will attempt to 5504238106Sdes circumvent the cycle, but if no other targets available fails. 5505238106Sdes - unit test for AXFR, IXFR response. 5506238106Sdes - test for cycle detection. 5507238106Sdes 5508238106Sdes25 July 2007: Wouter 5509238106Sdes - testbound read ADDRESS and check it. 5510238106Sdes - test for version.bind and friends. 5511238106Sdes - test for iterator chaining through several referrals. 5512238106Sdes - test and fixup for refetch for glue. Refetch fails if glue 5513238106Sdes is still not provided. 5514238106Sdes 5515238106Sdes24 July 2007: Wouter 5516238106Sdes - Example section in config manual. 5517238106Sdes - Addr stored for range and moment in replay. 5518238106Sdes 5519238106Sdes20 July 2007: Wouter 5520238106Sdes - Check CNAME chain before returning cache entry with CNAMEs. 5521238106Sdes - Option harden-glue, default is on. It will discard out of zone 5522238106Sdes data. If disabled, performance is faster, but spoofing attempts 5523238106Sdes become a possibility. Note that still normalize scrubbing is done, 5524238106Sdes and that the potentially spoofed data is used for infrastructure 5525238106Sdes and not returned to the client. 5526238106Sdes - if glue times out, refetch by asking parent of delegation again. 5527238106Sdes Much like asking for DS at the parent side. 5528238106Sdes - TODO items from forgery-resilience draft. 5529238106Sdes and on memory handling improvements. 5530238106Sdes - renamed module_event_timeout to module_event_noreply. 5531238106Sdes - memory reporting code; reports on memory usage after handling 5532238106Sdes a network packet (not on cache replies). 5533238106Sdes 5534238106Sdes19 July 2007: Wouter 5535238106Sdes - shuffle NS selection when getting nameserver target addresses. 5536238106Sdes - fixup of deadlock warnings, yield cpu in checklock code so that 5537238106Sdes freebsd scheduler selects correct process to run. 5538238106Sdes - added identity and version config options and replies. 5539238106Sdes - store cname messages complete answers. 5540238106Sdes 5541238106Sdes18 July 2007: Wouter 5542238106Sdes - do not query addresses, 127.0.0.1, and ::1 by default. 5543238106Sdes 5544238106Sdes17 July 2007: Wouter 5545238106Sdes - forward zone options in config file. 5546292206Sdes - forward per zone in iterator. takes precedence over stubs. 5547238106Sdes - fixup commithooks. 5548238106Sdes - removed forward-to and forward-to-port features, subsumed by 5549238106Sdes new forward zones. 5550238106Sdes - fix parser to handle absent server: clause. 5551238106Sdes - change untrusted rrset test to account for scrubber that is now 5552238106Sdes applied during the test (which removes the poison, by the way). 5553238106Sdes - feature, addresses can be specified with @portnumber, like nsd.conf. 5554238106Sdes - test config files changed over to new forwarder syntax. 5555238106Sdes 5556238106Sdes27 June 2007: Wouter 5557238106Sdes - delete of mesh does a postorder traverse of the tree. 5558238106Sdes - found and fixed a memory leak. For TTL=0 messages, that would 5559238106Sdes not be cached, instead the msg-replyinfo structure was leaked. 5560238106Sdes - changed server selection so it will filter out hosts that are 5561238106Sdes unresponsive. This is defined as a host with the maximum rto value. 5562238106Sdes This means that unbound tried the host for retries up to 120 secs. 5563238106Sdes The rto value will time out after host-ttl seconds from the cache. 5564238106Sdes This keeps such unresolvable queries from taking up resources. 5565238106Sdes - utility for keeping histogram. 5566238106Sdes 5567238106Sdes26 June 2007: Wouter 5568238106Sdes - mesh is called by worker, and iterator uses it. 5569238106Sdes This removes the hierarchical code. 5570238106Sdes QueryTargets state and Finished state are merged for iterator. 5571238106Sdes - forwarder mode no longer sets AA bit on first reply. 5572238106Sdes - rcode in walk_supers is not needed. 5573238106Sdes 5574238106Sdes25 June 2007: Wouter 5575238106Sdes - more mesh work. 5576238106Sdes - error encode routine for ease. 5577238106Sdes 5578238106Sdes22 June 2007: Wouter 5579238106Sdes - removed unused _node iterator value from rbtree_t. Takes up space. 5580238106Sdes - iterator can handle querytargets state without a delegation point 5581238106Sdes set, so that a priming(stub) subquery error can be handled. 5582238106Sdes - iterator stores if it is priming or not. 5583238106Sdes - log_query_info() neater logging. 5584238106Sdes - changed iterator so that it does not alter module_qstate.qinfo 5585238106Sdes but keeps a chase query info. Also query_flags are not altered, 5586238106Sdes the iterator uses chase_flags. 5587238106Sdes - fixup crash in case no ports for the family exist. 5588238106Sdes 5589238106Sdes21 June 2007: Wouter 5590238106Sdes - Fixup secondary buffer in case of error callback. 5591238106Sdes - cleanup slumber list of runnable states. 5592238106Sdes - module_subreq_depth fails to work in slumber list. 5593238106Sdes - fixup query release for cached results to sub targets. 5594238106Sdes - neater error for tcp connection failure, shows addr in verbose. 5595238106Sdes - rbtree_init so that it can be used with preallocated memory. 5596238106Sdes 5597238106Sdes20 June 2007: Wouter 5598238106Sdes - new -C option to enable coredumps after forking away. 5599238106Sdes - doc update. 5600238106Sdes - fixup CNAME generation by scrubber, and memory allocation of it. 5601238106Sdes - fixup deletion of serviced queries when all callbacks delete too. 5602238106Sdes - set num target queries to 0 when you move them to slumber list. 5603238106Sdes - typo in check caused subquery errors to be ignored, fixed. 5604238106Sdes - make lint happy about rlim_t. 5605238106Sdes - freeup of modules after freeup of module-states. 5606238106Sdes - duplicate replies work, this uses secondary udp buffer in outnet. 5607238106Sdes 5608238106Sdes19 June 2007: Wouter 5609238106Sdes - nicer layout in stats.c, review 0.3 change. 5610238106Sdes - spelling improvement, review 0.3 change. 5611238106Sdes - uncapped timeout for server selection, so that very fast or slow 5612238106Sdes servers will stand out from the rest. 5613238106Sdes - target-fetch-policy: "3 2 1 0 0" config setting. 5614238106Sdes - fixup queries answered without RD bit (for root prime results). 5615238106Sdes - refuse AXFR and IXFR requests. 5616238106Sdes - fixup RD flag in error reply from iterator. fixup RA flag from 5617238106Sdes worker error reply. 5618238106Sdes - fixup encoding of very short edns buffer sizes, now sets TC bit. 5619238106Sdes - config options harden-short-bufsize and harden-large-queries. 5620238106Sdes 5621238106Sdes18 June 2007: Wouter 5622238106Sdes - same, move subqueries to slumber list when first has resolved. 5623238106Sdes - fixup last fix for duplicate callbacks. 5624238106Sdes - another offbyone in targetcounter. Also in Java prototype by the way. 5625238106Sdes 5626238106Sdes15 June 2007: Wouter 5627238106Sdes - if a query asks to be notified of the same serviced query result 5628238106Sdes multiple times, this will succeed. Only one callback will happen; 5629238106Sdes multiple outbound-list entries result (but the double cleanup of it 5630238106Sdes will not matter). 5631238106Sdes - when iterator moves on due to CNAME or referral, it will remove 5632238106Sdes the subqueries (for other targets). These are put on the slumber 5633238106Sdes list. 5634238106Sdes - state module wait subq is OK with no new subqs, an old one may have 5635238106Sdes stopped, with an error, and it is still waiting for other ones. 5636238106Sdes - if a query loops, halt entire query (easy way to clean up properly). 5637238106Sdes 5638238106Sdes14 June 2007: Wouter 5639238106Sdes - num query targets was > 0 , not >= 0 compared, so that fetch 5640238106Sdes policy of 0 did nothing. 5641238106Sdes 5642238106Sdes13 June 2007: Wouter 5643238106Sdes - debug option: configure --enable-static-exe for compile where 5644238106Sdes ldns and libevent are linked statically. Default is off. 5645238106Sdes - make install and make uninstall. Works with static-exe and without. 5646238106Sdes installation of unbound binary and manual pages. 5647292206Sdes - alignment problem fix on solaris 64. 5648238106Sdes - fixup address in case of TCP error. 5649238106Sdes 5650238106Sdes12 June 2007: Wouter 5651238106Sdes - num target queries was set to 0 at a bad time. Default it to 0 and 5652238106Sdes increase as target queries are done. 5653238106Sdes - synthesize CNAME and DNAME responses from the cache. 5654238106Sdes - Updated doxygen config for doxygen 1.5. 5655238106Sdes - aclocal newer version. 5656238106Sdes - doxygen 1.5 fixes for comments (for the strict check on docs). 5657238106Sdes 5658238106Sdes11 June 2007: Wouter 5659238106Sdes - replies on TCP queries have the address field set in replyinfo, 5660238106Sdes for serviced queries, because the initiator does not know that 5661238106Sdes a TCP fallback has occured. 5662238106Sdes - omit DNSSEC types from nonDO replies, except if qtype is ANY or 5663238106Sdes if qtype directly queries for the type (and then only show that 5664238106Sdes 'unknown type' in the answer section). 5665238106Sdes - fixed message parsing where rrsigs on their own would be put 5666238106Sdes in the signature list over the rrsig type. 5667238106Sdes 5668238106Sdes7 June 2007: Wouter 5669238106Sdes - fixup error in double linked list insertion for subqueries and 5670238106Sdes for outbound list of serviced queries for iterator module. 5671238106Sdes - nicer printout of outgoing port selection. 5672238106Sdes - fixup cname target readout. 5673238106Sdes - nicer debug output. 5674238106Sdes - fixup rrset counts when prepending CNAMEs to the answer. 5675238106Sdes - fixup rrset TTL for prepended CNAMEs. 5676238106Sdes - process better check for looping modules, and which submodule to 5677238106Sdes run next. 5678238106Sdes - subreq insertion code fixup for slumber list. 5679238106Sdes - VERB_DETAIL, verbosity: 2 level gives short but readable output. 5680238106Sdes VERB_ALGO, verbosity: 3 gives extensive output. 5681238106Sdes - fixup RA bit in cached replies. 5682238106Sdes - fixup CNAME responses from the cache no longer partial response. 5683238106Sdes - error in network send handled without leakage. 5684238106Sdes - enable ip6 from config, and try ip6 addresses if available, 5685238106Sdes if ip6 is not connected, skips to next server. 5686238106Sdes 5687238106Sdes5 June 2007: Wouter 5688238106Sdes - iterator state finished. 5689238106Sdes - subrequests without parent store in cache and stop. 5690238106Sdes - worker slumber list for ongoing promiscuous queries. 5691238106Sdes - subrequest error handling. 5692238106Sdes - priming failure returns SERVFAIL. 5693238106Sdes - priming gives LAME result, returns SERVFAIL. 5694238106Sdes - debug routine to print dns_msg as handled by iterator. 5695238106Sdes - memleak in config file stubs fixup. 5696238106Sdes - more small bugs, in scrubber, query compare no ID for lookup, 5697238106Sdes in dname validation for NS targets. 5698238106Sdes - sets entry.key for new special allocs. 5699238106Sdes - lognametypeclass can display unknown types and classes. 5700238106Sdes 5701238106Sdes4 June 2007: Wouter 5702238106Sdes - random selection of equally preferred nameserver targets. 5703238106Sdes - reply info copy routine. Reuses existing code. 5704238106Sdes - cache lameness in response handling. 5705238106Sdes - do not touch qstate after worker_process_query because it may have 5706238106Sdes been deleted by that routine. 5707238106Sdes - Prime response state. 5708238106Sdes - Process target response state. 5709238106Sdes - some memcmp changed to dname_compare for case preservation. 5710238106Sdes 5711238106Sdes1 June 2007: Wouter 5712238106Sdes - normalize incoming messages. Like unbound-java, with CNAME chain 5713238106Sdes checked, DNAME checked, CNAME's synthesized, glue checked. 5714238106Sdes - sanitize incoming messages. 5715238106Sdes - split msgreply encode functions into own file msgencode.c. 5716238106Sdes - msg_parse to queryinfo/replyinfo conversion more versatile. 5717238106Sdes - process_response, classify response, delegpt_from_message. 5718238106Sdes 5719238106Sdes31 May 2007: Wouter 5720238106Sdes - querytargets state. 5721238106Sdes - dname_subdomain_c() routine. 5722238106Sdes - server selection, based on RTT. ip6 is filtered out if not available, 5723238106Sdes and lameness is checked too. 5724238106Sdes - delegation point copy routine. 5725238106Sdes 5726238106Sdes30 May 2007: Wouter 5727238106Sdes - removed FLAG_CD from message and rrset caches. This was useful for 5728238106Sdes an agnostic forwarder, but not for a sophisticated (trust value per 5729238106Sdes rrset enabled) cache. 5730292206Sdes - iterator response typing. 5731238106Sdes - iterator cname handle. 5732238106Sdes - iterator prime start. 5733238106Sdes - subquery work. 5734238106Sdes - processInitRequest and processInitRequest2. 5735238106Sdes - cache synthesizes referral messages, with DS and NSEC. 5736238106Sdes - processInitRequest3. 5737238106Sdes - if a request creates multiple subrequests these are all activated. 5738238106Sdes 5739238106Sdes29 May 2007: Wouter 5740238106Sdes - routines to lock and unlock array of rrsets moved to cache/rrset. 5741238106Sdes - lookup message from msg cache (and copy to region). 5742238106Sdes - fixed cast error in dns msg lookup. 5743238106Sdes - message with duplicate rrset does not increase its TTLs twice. 5744238106Sdes - 'qnamesize' changed to 'qname_len' for similar naming scheme. 5745238106Sdes 5746238106Sdes25 May 2007: Wouter 5747238106Sdes - Acknowledge use of unbound-java code in iterator. Nicer readme. 5748238106Sdes - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and 5749238106Sdes rrset cache from module environment. 5750292206Sdes - packed rrset key has type and class as easily accessible struct 5751238106Sdes members. They are still kept in network format for fast msg encode. 5752238106Sdes - dns cache find_delegation routine. 5753238106Sdes - iterator main functions setup. 5754238106Sdes - dns cache lookup setup. 5755238106Sdes 5756238106Sdes24 May 2007: Wouter 5757238106Sdes - small changes to prepare for subqueries. 5758238106Sdes - iterator forwarder feature separated out. 5759238106Sdes - iterator hints stub code, config file stub code, so that first 5760238106Sdes testing can proceed locally. 5761238106Sdes - replay tests now have config option to enable forwarding mode. 5762238106Sdes 5763238106Sdes23 May 2007: Wouter 5764238106Sdes - outside network does precise timers for roundtrip estimates for rtt 5765238106Sdes and for setting timeout for UDP. Pending_udp takes milliseconds. 5766238106Sdes - cleaner iterator sockaddr conversion of forwarder address. 5767238106Sdes - iterator/iter_utils and iter_delegpt setup. 5768238106Sdes - root hints. 5769238106Sdes 5770238106Sdes22 May 2007: Wouter 5771238106Sdes - outbound query list for modules and support to callback with the 5772238106Sdes outbound entry to the module. 5773238106Sdes - testbound support for new serviced queries. 5774238106Sdes - test for retry to TCP cannot use testbound any longer. 5775238106Sdes - testns test for EDNS fallback, test for TCP fallback already exists. 5776238106Sdes - fixes for no-locking compile. 5777238106Sdes - mini_event timer precision and fix for change in timeouts during 5778238106Sdes timeout callback. Fix for fwd_three tests, performed nonexit query. 5779238106Sdes 5780238106Sdes21 May 2007: Wouter 5781238106Sdes - small comment on hash table locking. 5782238106Sdes - outside network serviced queries, contain edns and tcp fallback, 5783238106Sdes and udp retries and rtt timing. 5784238106Sdes 5785238106Sdes16 May 2007: Wouter 5786238106Sdes - lruhash_touch() would cause locking order problems. Fixup in 5787238106Sdes lock-verify in case locking cycle is found. 5788238106Sdes - services/cache/rrset.c for rrset cache code. 5789238106Sdes - special rrset_cache LRU updating function that uses the rrset id. 5790238106Sdes - no dependencies calculation when make clean is called. 5791238106Sdes - config settings for infra cache. 5792238106Sdes - daemon code slightly cleaner, only creates caches once. 5793238106Sdes 5794238106Sdes15 May 2007: Wouter 5795238106Sdes - host cache code. 5796238106Sdes - unit test for host cache. 5797238106Sdes 5798238106Sdes14 May 2007: Wouter 5799238106Sdes - Port to OS/X and Dec Alpha. Printf format and alignment fixes. 5800238106Sdes - extensive lock debug report on join timeout. 5801238106Sdes - proper RTT calculation, in utility code. 5802238106Sdes - setup of services/cache/infra, host cache. 5803238106Sdes 5804238106Sdes11 May 2007: Wouter 5805238106Sdes - iterator/iterator.c module. 5806238106Sdes - fixup to pass reply_info in testcode and in netevent. 5807238106Sdes 5808238106Sdes10 May 2007: Wouter 5809238106Sdes - created release-0.3 svn tag. 5810238106Sdes - util/module.h 5811238106Sdes - fixed compression - no longer compresses root name. 5812238106Sdes 5813238106Sdes9 May 2007: Wouter 5814238106Sdes - outside network cleans up waiting tcp queries on exit. 5815238106Sdes - fallback to TCP. 5816238106Sdes - testbound replay with retry in TCP mode. 5817238106Sdes - tpkg test for retry in TCP mode, against ldns-testns server. 5818238106Sdes - daemon checks max number of open files and complains if not enough. 5819238106Sdes - test where data expires in the cache. 5820238106Sdes - compiletests: fixed empty body ifstatements in alloc.c, in case 5821238106Sdes locks are disabled. 5822238106Sdes 5823238106Sdes8 May 2007: Wouter 5824238106Sdes - outgoing network keeps list of available tcp buffers for outgoing 5825238106Sdes tcp queries. 5826238106Sdes - outgoing-num-tcp config option. 5827238106Sdes - outgoing network keeps waiting list of queries waiting for buffer. 5828238106Sdes - netevent supports outgoing tcp commpoints, nonblocking connects. 5829238106Sdes 5830238106Sdes7 May 2007: Wouter 5831238106Sdes - EDNS read from query, used to make reply smaller. 5832238106Sdes - advertised edns value constants. 5833238106Sdes - EDNS BADVERS response, if asked for too high edns version. 5834292206Sdes - EDNS extended error responses once the EDNS record from the query 5835238106Sdes has successfully been parsed. 5836238106Sdes 5837238106Sdes4 May 2007: Wouter 5838238106Sdes - msgreply sizefunc is more accurate. 5839238106Sdes - config settings for rrset cache size and slabs. 5840238106Sdes - hashtable insert takes argument so that a thread can use its own 5841238106Sdes alloc cache to store released keys. 5842238106Sdes - alloc cache special_release() locks if necessary. 5843238106Sdes - rrset trustworthiness type added. 5844238106Sdes - thread keeps a scratchpad region for handling messages. 5845238106Sdes - writev used in netevent to write tcp length and data after another. 5846238106Sdes This saves a roundtrip on tcp replies. 5847238106Sdes - test for one rrset updated in the cache. 5848238106Sdes - test for one rrset which is not updated, as it is not deemed 5849238106Sdes trustworthy enough. 5850238106Sdes - test for TTL refreshed in rrset. 5851238106Sdes 5852238106Sdes3 May 2007: Wouter 5853238106Sdes - fill refs. Use new parse and encode to answer queries. 5854238106Sdes - stores rrsets in cache. 5855238106Sdes - uses new msgreply format in cache. 5856238106Sdes 5857238106Sdes2 May 2007: Wouter 5858238106Sdes - dname unit tests in own file and spread out neatly in functions. 5859238106Sdes - more dname unit tests. 5860238106Sdes - message encoding creates truncated TC flagged messages if they do 5861238106Sdes not fit, and will leave out (whole)rrsets from additional if needed. 5862238106Sdes 5863238106Sdes1 May 2007: Wouter 5864238106Sdes - decompress query section, extremely lenient acceptance. 5865238106Sdes But only for answers from other servers, not for plain queries. 5866238106Sdes - compression and decompression test cases. 5867238106Sdes - some stats added. 5868238106Sdes - example.conf interface: line is changed from 127.0.0.1 which leads 5869238106Sdes to problems if used (restricting communication to the localhost), 5870238106Sdes to a documentation and test address. 5871238106Sdes 5872238106Sdes27 April 2007: Wouter 5873238106Sdes - removed iov usage, it is not good for dns message encoding. 5874238106Sdes - owner name compression more optimal. 5875238106Sdes - rrsig owner name compression. 5876238106Sdes - rdata domain name compression. 5877238106Sdes 5878238106Sdes26 April 2007: Wouter 5879238106Sdes - floating point exception fix in lock-verify. 5880238106Sdes - lint uses make dependency 5881238106Sdes - fixup lint in dname owner domain name compression code. 5882238106Sdes - define for offset range that can be compressed to. 5883238106Sdes 5884238106Sdes25 April 2007: Wouter 5885238106Sdes - prettier code; parse_rrset->type kept in host byte order. 5886238106Sdes - datatype used for hashvalue of converted rrsig structure. 5887238106Sdes - unit test compares edns section data too. 5888238106Sdes 5889238106Sdes24 April 2007: Wouter 5890238106Sdes - ttl per RR, for RRSIG rrsets and others. 5891238106Sdes - dname_print debug function. 5892238106Sdes - if type is not known, size calc will skip DNAME decompression. 5893238106Sdes - RRSIG parsing and storing and putting in messages. 5894238106Sdes - dnssec enabled unit tests (from nlnetlabs.nl and se queries). 5895238106Sdes - EDNS extraction routine. 5896238106Sdes 5897238106Sdes20 April 2007: Wouter 5898238106Sdes - code comes through all of the unit tests now. 5899238106Sdes - disabled warning about spurious extra data. 5900238106Sdes - documented the RRSIG parse plan in msgparse.h. 5901238106Sdes - rrsig reading and outputting. 5902238106Sdes 5903238106Sdes19 April 2007: Wouter 5904238106Sdes - fix unit test to actually to tests. 5905238106Sdes - fix write iov helper, and fakevent code. 5906238106Sdes - extra builtin testcase (small packet). 5907238106Sdes - ttl converted to network format in packets. 5908238106Sdes - flags converted correctly 5909238106Sdes - rdatalen off by 2 error fixup. 5910238106Sdes - uses less iov space for header. 5911238106Sdes 5912238106Sdes18 April 2007: Wouter 5913238106Sdes - review of msgparse code. 5914238106Sdes - smaller test cases. 5915238106Sdes 5916238106Sdes17 April 2007: Wouter 5917238106Sdes - copy and decompress dnames. 5918238106Sdes - store calculated hash value too. 5919238106Sdes - routine to create message out of stored information. 5920238106Sdes - util/data/msgparse.c for message parsing code. 5921238106Sdes - unit test, and first fixes because of test. 5922238106Sdes * forgot rrset_count addition. 5923238106Sdes * did & of ptr on stack for memory position calculation. 5924238106Sdes * dname_pkt_copy forgot to read next label length. 5925238106Sdes - test from file and fixes 5926238106Sdes * double frees fixed in error conditions. 5927238106Sdes * types with less than full rdata allowed by parser. 5928238106Sdes Some dynamic update packets seem to use it. 5929238106Sdes 5930238106Sdes16 April 2007: Wouter 5931238106Sdes - following a small change in LDNS, parsing code calculates the 5932238106Sdes memory size to allocate for rrs. 5933238106Sdes - code to handle ID creation. 5934238106Sdes 5935238106Sdes13 April 2007: Wouter 5936238106Sdes - parse routines. Code that parses rrsets, rrs. 5937238106Sdes 5938238106Sdes12 April 2007: Wouter 5939238106Sdes - dname compare routine that preserves case, with unit tests. 5940238106Sdes 5941238106Sdes11 April 2007: Wouter 5942238106Sdes - parse work - dname packet parse, msgparse, querysection parse, 5943238106Sdes start of sectionparse. 5944238106Sdes 5945238106Sdes10 April 2007: Wouter 5946238106Sdes - Improved alignment of reply_info packet, nice for 32 and 64 bit. 5947238106Sdes - Put RRset counts in reply_info, because the number of RRs can change 5948238106Sdes due to RRset updates. 5949238106Sdes - import of region-allocator code from nsd. 5950238106Sdes - set alloc special type to ub_packed_rrset_key. 5951238106Sdes Uses lruhash entry overflow chain next pointer in alloc cache. 5952238106Sdes - doxygen documentation for region-allocator. 5953238106Sdes - setup for parse scratch data. 5954238106Sdes 5955238106Sdes5 April 2007: Wouter 5956238106Sdes - discussed packed rrset with Jelte. 5957238106Sdes 5958238106Sdes4 April 2007: Wouter 5959238106Sdes - moved to version 0.3. 5960238106Sdes - added util/data/dname.c 5961238106Sdes - layout of memory for rrsets. 5962238106Sdes 5963238106Sdes3 April 2007: Wouter 5964238106Sdes - detect sign of msghdr.msg_iovlen so that the cast to that type 5965238106Sdes in netevent (which is there to please lint) can be correct. 5966238106Sdes The type on several OSes ranges from int, int32, uint32, size_t. 5967238106Sdes Detects unsigned or signed using math trick. 5968238106Sdes - constants for DNS flags. 5969238106Sdes - compilation without locks fixup. 5970238106Sdes - removed include of unportable header from lookup3.c. 5971238106Sdes - more portable use of struct msghdr. 5972238106Sdes - casts for printf warning portability. 5973238106Sdes - tweaks to tests to port them to the testbed. 5974238106Sdes - 0.2 tag created. 5975238106Sdes 5976238106Sdes2 April 2007: Wouter 5977238106Sdes - check sizes of udp received messages, not too short. 5978238106Sdes - review changes. Some memmoves can be memcpys: 4byte aligned. 5979238106Sdes set id correctly on cached answers. 5980238106Sdes - review changes msgreply.c, memleak on error condition. AA flag 5981238106Sdes clear on cached reply. Lowercase queries on hashing. 5982238106Sdes unit test on lowercasing. Test AA bit not set on cached reply. 5983238106Sdes Note that no TTLs are managed. 5984238106Sdes 5985238106Sdes29 March 2007: Wouter 5986238106Sdes - writev or sendmsg used when answering from cache. 5987238106Sdes This avoids a copy of the data. 5988238106Sdes - do not do useless byteswap on query id. Store reply flags in uint16 5989238106Sdes for easier access (and no repeated byteswapping). 5990238106Sdes - reviewed code. 5991238106Sdes - configure detects and config.h includes sys/uio.h for writev decl. 5992238106Sdes 5993238106Sdes28 March 2007: Wouter 5994238106Sdes - new config option: num-queries-per-thread. 5995238106Sdes - added tpkg test for answering three queries at the same time 5996238106Sdes using one thread (from the query service list). 5997238106Sdes 5998238106Sdes27 March 2007: Wouter 5999238106Sdes - added test for cache and not cached answers, in testbound replays. 6000238106Sdes - testbound can give config file and commandline options from the 6001238106Sdes replay file to unbound. 6002238106Sdes - created test that checks if items drop out of the cache. 6003238106Sdes - added word 'partitioned hash table' to documentation on slab hash. 6004238106Sdes A slab hash is a partitioned hash table. 6005238106Sdes - worker can handle multiple queries at a time. 6006238106Sdes 6007238106Sdes26 March 2007: Wouter 6008238106Sdes - config settings for slab hash message cache. 6009238106Sdes - test for cached answer. 6010238106Sdes - Fixup deleting fake answer from testbound list. 6011238106Sdes 6012238106Sdes23 March 2007: Wouter 6013238106Sdes - review of yesterday's commits. 6014238106Sdes - covered up memory leak of the entry locks. 6015238106Sdes - answers from the cache correctly. Copies flags correctly. 6016238106Sdes - sanity check for incoming query replies. 6017238106Sdes - slabbed hash table. Much nicer contention, need dual cpu to see. 6018238106Sdes 6019238106Sdes22 March 2007: Wouter 6020238106Sdes - AIX configure check. 6021238106Sdes - lock-verify can handle references to locks that are created 6022238106Sdes in files it has not yet read in. 6023238106Sdes - threaded hash table test. 6024238106Sdes - unit test runs lock-verify afterwards and checks result. 6025238106Sdes - need writelock to update data on hash_insert. 6026238106Sdes - message cache code, msgreply code. 6027238106Sdes 6028238106Sdes21 March 2007: Wouter 6029238106Sdes - unit test of hash table, fixup locking problem in table_grow(). 6030238106Sdes - fixup accounting of sizes for removing items from hashtable. 6031238106Sdes - unit test for hash table, single threaded test of integrity. 6032238106Sdes - lock-verify reports errors nicely. More quiet in operation. 6033238106Sdes 6034238106Sdes16 March 2007: Wouter 6035238106Sdes - lock-verifier, checks consistent order of locking. 6036238106Sdes 6037238106Sdes14 March 2007: Wouter 6038238106Sdes - hash table insert (and subroutines) and lookup implemented. 6039238106Sdes - hash table remove. 6040238106Sdes - unit tests for hash internal bin, lru functions. 6041238106Sdes 6042238106Sdes13 March 2007: Wouter 6043238106Sdes - lock_unprotect in checklocks. 6044238106Sdes - util/storage/lruhash.h for LRU hash table structure. 6045238106Sdes 6046238106Sdes12 March 2007: Wouter 6047238106Sdes - configure.ac moved to 0.2. 6048238106Sdes - query_info and replymsg util/data structure. 6049238106Sdes 6050238106Sdes9 March 2007: Wouter 6051238106Sdes - added rwlock writelock checking. 6052238106Sdes So it will keep track of the writelock, and readlocks are enforced 6053238106Sdes to not change protected memory areas. 6054238106Sdes - log_hex function to dump hex strings to the logfile. 6055238106Sdes - checklocks zeroes its destroyed lock after checking memory areas. 6056238106Sdes - unit test for alloc. 6057238106Sdes - identifier for union in checklocks to please older compilers. 6058238106Sdes - created 0.1 tag. 6059238106Sdes 6060238106Sdes8 March 2007: Wouter 6061238106Sdes - Reviewed checklock code. 6062238106Sdes 6063238106Sdes7 March 2007: Wouter 6064238106Sdes - created a wrapper around thread calls that performs some basic 6065238106Sdes checking for data race and deadlock, and basic performance 6066238106Sdes contention measurement. 6067238106Sdes 6068238106Sdes6 March 2007: Wouter 6069238106Sdes - Testbed works with threading (different machines, different options). 6070238106Sdes - alloc work, does the special type. 6071238106Sdes 6072238106Sdes2 March 2007: Wouter 6073238106Sdes - do not compile fork funcs unless needed. Otherwise will give 6074238106Sdes type errors as their typedefs have not been enabled. 6075238106Sdes - log shows thread numbers much more nicely (and portably). 6076238106Sdes - even on systems with nonthreadsafe libevent signal handling, 6077238106Sdes unbound will exit if given a signal. 6078238106Sdes Reloads will not work, and exit is not graceful. 6079238106Sdes - start of alloc framework layout. 6080238106Sdes 6081238106Sdes1 March 2007: Wouter 6082238106Sdes - Signals, libevent and threads work well, with libevent patch and 6083238106Sdes changes to code (close after event_del). 6084238106Sdes - set ipc pipes nonblocking. 6085238106Sdes 6086238106Sdes27 February 2007: Wouter 6087238106Sdes - ub_thread_join portable definition. 6088238106Sdes - forking is used if no threading is available. 6089238106Sdes Tested, it works, since pipes work across processes as well. 6090238106Sdes Thread_join is replaced with waitpid. 6091238106Sdes - During reloads the daemon will temporarily handle signals, 6092238106Sdes so that they do not result in problems. 6093238106Sdes - Also randomize the outgoing port range for tests. 6094238106Sdes - If query list is full, will stop selecting listening ports for read. 6095238106Sdes This makes all threads service incoming requests, instead of one. 6096238106Sdes No memory is leaking during reloads, service of queries, etc. 6097238106Sdes - test that uses ldns-testns -f to test threading. Have to answer 6098238106Sdes three queries at the same time. 6099238106Sdes - with verbose=0 operates quietly. 6100238106Sdes 6101238106Sdes26 February 2007: Wouter 6102238106Sdes - ub_random code used to select ID and port. 6103238106Sdes - log code prints thread id. 6104238106Sdes - unbound can thread itself, with reload(HUP) and quit working 6105238106Sdes correctly. 6106238106Sdes - don't open pipes for #0, doesn't need it. 6107238106Sdes - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload). 6108238106Sdes 6109238106Sdes23 February 2007: Wouter 6110238106Sdes - Can do reloads on sigHUP. Everything is stopped, and freed, 6111238106Sdes except the listening ports. Then the config file is reread. 6112238106Sdes And everything is started again (and listening ports if needed). 6113238106Sdes - Ports for queries are shared. 6114238106Sdes - config file added interface:, chroot: and username:. 6115238106Sdes - config file: directory, logfile, pidfile. And they work too. 6116238106Sdes - will daemonize by default now. Use -d to stay in the foreground. 6117238106Sdes - got BSD random[256 state] code, made it threadsafe. util/random. 6118238106Sdes 6119238106Sdes22 February 2007: Wouter 6120238106Sdes - Have a config file. Removed commandline options, moved to config. 6121238106Sdes - tests use config file. 6122238106Sdes 6123238106Sdes21 February 2007: Wouter 6124238106Sdes - put -c option in man page. 6125238106Sdes - minievent fd array capped by FD_SETSIZE. 6126238106Sdes 6127238106Sdes20 February 2007: Wouter 6128238106Sdes - Added locks code and pthread spinlock detection. 6129238106Sdes - can use no locks, or solaris native thread library. 6130238106Sdes - added yacc and lex configure, and config file parsing code. 6131238106Sdes also makedist.sh, and manpage. 6132238106Sdes - put include errno.h in config.h 6133238106Sdes 6134238106Sdes19 February 2007: Wouter 6135238106Sdes - Created 0.0 svn tag. 6136238106Sdes - added acx_pthread.m4 autoconf check for pthreads from 6137238106Sdes the autoconf archive. It is GPL-with-autoconf-exception Licensed. 6138238106Sdes You can specify --with-pthreads, or --without-pthreads to configure. 6139238106Sdes 6140238106Sdes16 February 2007: Wouter 6141238106Sdes - Updated testbed script, works better by using make on remote end. 6142238106Sdes - removed check decls, we can compile without them. 6143238106Sdes - makefile supports LIBOBJ replacements. 6144238106Sdes - docs checks ignore compat code. 6145238106Sdes - added util/mini-event.c and .h, a select based alternative used with 6146238106Sdes ./configure --with-libevent=no 6147238106Sdes It is limited to 1024 file descriptors, and has less features. 6148238106Sdes - will not create ip6 sockets if ip6 not on the machine. 6149238106Sdes 6150238106Sdes15 February 2007: Wouter 6151238106Sdes - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64, 6152238106Sdes Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc. 6153238106Sdes - malloc rndstate, so that it is aligned for access. 6154238106Sdes - fixed rbtree cleanup with postorder traverse. 6155238106Sdes - fixed pending messages are deleted when handled. 6156238106Sdes - You can control verbosity; default is not verbose, every -v 6157238106Sdes adds more verbosity. 6158238106Sdes 6159238106Sdes14 February 2007: Wouter 6160238106Sdes - Included configure.ac changes from ldns. 6161238106Sdes - detect (some) headers before the standards check. 6162238106Sdes - do not use isblank to test c99, since its not available on solaris9. 6163238106Sdes - review of testcode. 6164238106Sdes * entries in a RANGE are no longer reversed. 6165238106Sdes * print name of file with replay entry parse errors. 6166238106Sdes - port to OSX: cast to int for some prints of sizet. 6167238106Sdes - Makefile copies ldnstestpkts.c before doing dependencies on it. 6168238106Sdes 6169238106Sdes13 February 2007: Wouter 6170238106Sdes - work on fake events, first fwd replay works. 6171238106Sdes - events can do timeouts and errors on queries to servers. 6172238106Sdes - test package that runs replay scenarios. 6173238106Sdes 6174238106Sdes12 February 2007: Wouter 6175238106Sdes - work on fake events. 6176238106Sdes 6177238106Sdes9 February 2007: Wouter 6178238106Sdes - replay file reading. 6179238106Sdes - fake event setup, it creates fake structures, and teardowns, 6180238106Sdes added signal callbacks to reply to be able to fake those, 6181238106Sdes and main structure of event replay routines. 6182238106Sdes 6183238106Sdes8 February 2007: Wouter 6184238106Sdes - added tcp test. 6185238106Sdes - replay storage. 6186238106Sdes - testcode/fake_event work. 6187238106Sdes 6188238106Sdes7 February 2007: Wouter 6189238106Sdes - return answer with the same ID as query was sent with. 6190238106Sdes - created udp forwarder test. I've done some effort to make it perform 6191238106Sdes quickly. After servers are created, no big sleep statements but 6192238106Sdes it checks the logfiles to see if servers have come up. Takes 0.14s. 6193238106Sdes - set addrlen value when calling recvfrom. 6194238106Sdes - comparison of addrs more portable. 6195238106Sdes - LIBEVENT option for testbed to set libevent directory. 6196238106Sdes - work on tcp input. 6197238106Sdes 6198238106Sdes6 February 2007: Wouter 6199238106Sdes - reviewed code and improved in places. 6200238106Sdes 6201238106Sdes5 February 2007: Wouter 6202238106Sdes - Picked up stdc99 and other define tests from ldns. Improved 6203238106Sdes POSIX define test to include getaddrinfo. 6204238106Sdes - defined constants for netevent callback error code. 6205238106Sdes - unit test for strisip6. 6206238106Sdes 6207238106Sdes2 February 2007: Wouter 6208238106Sdes - Created udp4 and udp6 port arrays to provide service for both 6209238106Sdes address families. 6210238106Sdes - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets. 6211238106Sdes - listens on both ip4 and ip6 ports to provide correct return address. 6212238106Sdes - worker fwder address filled correctly. 6213238106Sdes - fixup timer code. 6214238106Sdes - forwards udp queries and sends answer. 6215238106Sdes 6216238106Sdes1 February 2007: Wouter 6217238106Sdes - outside network more UDP work. 6218238106Sdes - moved * closer to type. 6219238106Sdes - comm_timer object and events. 6220238106Sdes 6221238106Sdes31 January 2007: Wouter 6222238106Sdes - Added makedist.sh script to make release tarball. 6223238106Sdes - Removed listen callback layer, did not add anything. 6224238106Sdes - Added UDP recv to netevent, worker callback for udp. 6225238106Sdes - netevent communication reply storage structure. 6226238106Sdes - minimal query header sanity checking for worker. 6227238106Sdes - copied over rbtree implementation from NSD (BSD licensed too). 6228238106Sdes - outgoing network query service work. 6229238106Sdes 6230238106Sdes30 January 2007: Wouter 6231238106Sdes - links in example/ldns-testpkts.c and .h for premade packet support. 6232238106Sdes - added callback argument to listen_dnsport and daemon/worker. 6233238106Sdes 6234238106Sdes29 January 2007: Wouter 6235238106Sdes - unbound.8 a short manpage. 6236238106Sdes 6237238106Sdes26 January 2007: Wouter 6238238106Sdes - fixed memleak. 6239238106Sdes - make lint works on BSD and Linux (openssl defines). 6240238106Sdes - make tags works. 6241238106Sdes - testbound program start. 6242238106Sdes 6243238106Sdes25 January 2007: Wouter 6244238106Sdes - fixed lint so it may work on BSD. 6245238106Sdes - put license into header of every file. 6246238106Sdes - created verbosity flag. 6247238106Sdes - fixed libevent configure flag. 6248238106Sdes - detects event_base_free() in new libevent 1.2 version. 6249238106Sdes - getopt in daemon. fatal_exit() and verbose() logging funcs. 6250238106Sdes - created log_assert, that throws assertions to the logfile. 6251238106Sdes - listen_dnsport service. Binds ports. 6252238106Sdes 6253238106Sdes24 January 2007: Wouter 6254238106Sdes - cleaned up configure.ac. 6255238106Sdes 6256238106Sdes23 January 2007: Wouter 6257238106Sdes - added libevent to configure to link with. 6258238106Sdes - util/netevent setup work. 6259238106Sdes - configure searches for libevent. 6260238106Sdes - search for libs at end of configure (when other headers and types 6261238106Sdes have been found). 6262238106Sdes - doxygen works with ATTR_UNUSED(). 6263238106Sdes - util/netevent implementation. 6264238106Sdes 6265238106Sdes22 January 2007: Wouter 6266238106Sdes - Designed header file for network communication. 6267238106Sdes 6268238106Sdes16 January 2007: Wouter 6269238106Sdes - added readme.svn and readme.tests. 6270238106Sdes 6271238106Sdes4 January 2007: Wouter 6272238106Sdes - Testbed script (run on multiple platforms the test set). 6273238106Sdes Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5. 6274238106Sdes - added unit test tpkg. 6275238106Sdes 6276238106Sdes3 January 2007: Wouter 6277238106Sdes - committed first set of files into subversion repository. 6278238106Sdes svn co svn+ssh://unbound.net/svn/unbound 6279238106Sdes You need a ssh login. There is no https access yet. 6280238106Sdes - Added LICENSE, the BSD license. 6281238106Sdes - Added doc/README with compile help. 6282238106Sdes - main program stub and quiet makefile. 6283238106Sdes - minimal logging service (to stderr). 6284238106Sdes - added postcommit hook that serves emails. 6285238106Sdes - added first test 00-lint. postcommit also checks if build succeeds. 6286238106Sdes - 01-doc: doxygen doc target added for html docs. And stringent test 6287238106Sdes on documented files, functions and parameters. 6288238106Sdes 6289238106Sdes15 December 2006: Wouter 6290238106Sdes - Created Makefile.in and configure.ac. 6291