=============
Features:
---------
- Added generic EDNS code for registering known EDNS option codes,
bypassing the cache response stage and uniquifying mesh states. Four
EDNS option lists were added to module_qstate
(module_qstate.edns_opts_*) to store EDNS options from/to front/back side.
- Added two flags to module_qstate (no_cache_lookup, no_cache_store)
that control the modules' cache interactions.
- Added code for registering inplace callback functions. The registered
functions can be called just before replying with local data or Chaos,
replying from cache, replying with SERVFAIL, replying with a resolved
query, sending a query to a nameserver. The functions can inspect the
available data and maybe change response/query related data (i.e. append
EDNS options).
- Updated Python module for the above.
- Updated Python documentation.
- Added views functionality.
- Added qname-minimisation-strict config option.
- Patch that resolves CNAMEs entered in local-data conf statements that
point to data on the internet.
- serve-expired config option: serve expired responses with TTL 0.
- .gitattributes line for githubs code language display.
- log-identity: config option to set sys log identity.
- Added stub-ssl-upstream and forward-ssl-upstream options.
- Added local-zones and local-data bulk addition and removal
functionality in unbound-control (local_zones, local_zones_remove,
local_datas and local_datas_remove).
- g.root-servers.net has AAAA address.
Bug Fixes:
----------
- Fix#836: unbound could echo back EDNS options in an error response.
- Fix#838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
- Fix#839: Memory grows unexpectedly with large RPZ files.
- Fix#840: infinite loop in unbound_munin_ plugin on unowned lockfile.
- Fix#841: big local-zone's make it consume large amounts of memory.
- Fix dnstap relaying "random" messages instead of resolver/forwarder
responses.
- Fix Nits for 1.5.10.
- Fix#1117: spelling errors, from Robert Edmonds.
- iana portlist update.
- fix memoryleak logfile when in debug mode.
- Re-fix #839 from view commit overwrite.
- Fixup const void cast warning.
- Removed patch comments from acllist.c and msgencode.c
- Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf
- Fix#1125: unbound could reuse an answer packet incorrectly for
clients with different EDNS parameters.
- Fix#1118: libunbound.pc sets strange Libs, Libs.private values.
- Added Requires line to libunbound.pc
- Fix#1130: whitespace in example.conf.in more consistent.
- suppress compile warning in lex files.
- init lzt variable, for older gcc compiler warnings.
- fix --enable-dsa to work, instead of copying ecdsa enable.
- Fix DNSSEC validation of query type ANY with DNAME answers.
- Fixup query_info local_alias init.
- Ported tests for local_cname unit test to testbound framework.
- Fix#1134: unbound-control set_option -- val-override-date: -1 works
immediately to ignore datetime, or back to 0 to enable it again. The --
is to ignore the '-1' as an option flag.
- Patch for server.num.zero_ttl stats for count of expired replies.
- Fix failure to build on arm64 with no sbrk.
- Set OpenSSL security level to 0 when using aNULL ciphers.
- configure detects ssl security level API function in the autoconf
manner. Every function on its own, so that other libraries (eg.
LibreSSL) can develop their API without hindrance.
- Fix#1154: segfault when reading config with duplicate zones.
- Note that for harden-below-nxdomain the nxdomain must be secure, this
means nsec3 with optout is insufficient.
- Fix#1155: test status code of unbound-control in 04-checkconf, not
the status code from the tee command.
- Fix#1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
Underneath" for the harden-below-nxdomain option.
- patch from Dag-Erling Smorgrav that removes code that relies on sbrk().
- Make access-control-tag-data RDATA absolute. This makes the RDATA
origin consistent between local-data and access-control-tag-data.
- Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
subdomain of the NSEC owner.
- QNAME minimisation uses QTYPE=A, therefore always check cache for this
type in harden-below-nxdomain functionality.
- Added unit test for QNAME minimisation + harden below nxdomain synergy.
- Fix that with openssl 1.1 control-use-cert: no uses less cpu, by using
no encryption over the unix socket.
- hyphen as minus fix.
- Fix#1170: document that 'inform' local-zone uses local-data.
- Fix#1173: differ local-zone type deny from unset tag_actions element.
- Add DSA support for OpenSSL 1.1.0
- Fix remote control without cert for LibreSSL
- Fix downcast warnings from visual studio in sldns code
- Create a pkg-config file for libunbound in contrib.
- TCP Fast open.
- Finegrained localzone control with define-tag, access-control-tag,
access-control-tag-action, access-control-tag-data, local-zone-tag, and
local-zone-override. And added types always_transparent, always_refuse,
always_nxdomain with that.
- If more than half of tcp connections are in use, a shorter timeout
is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
- [bugzilla: 787 ] Fix#787: outgoing-interface netblock/64 ipv6
option to use linux freebind to use 64bits of entropy for every query
with random local part.
- For #787: prefer-ip6 option for unbound.conf prefers to send
upstream queries to ipv6 servers.
- Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
- keep debug symbols in windows build.
Bug Fixes:
----------
- [bugzilla: 778 ] Fix unbound 1.5.9: -h segfault (null deref).
- Fix unbound-anchor.exe file location defaults to Program Files with
(x86) appended.
- Fix to not ignore return value of chown() in daemon startup.
- Better help text from -h.
- [bugzilla: 773 ] Fix Non-standard Python location build failure with
pyunbound.
- Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
- Revert fix for NetworkService account on windows due to breakage it
causes.
- Fix that windows install will not overwrite existing service.conf
file (and ignore gui config choices if it exists).
- And delete service.conf.shipped on uninstall.
- In unbound.conf directory: dir immediately changes to that
directory, so that include: file below that is relative to that
directory. With chroot, make the directory an absolute path inside chroot.
- do not delete service.conf on windows uninstall.
- document directory immediate fix and allow EXECUTABLE syntax in it
on windows.
- Fix directory: fix for unbound-checkconf, it restores cwd.
- Use QTYPE=A for QNAME minimisation.
- Keep track of number of time-outs when performing QNAME
minimisation. Stop minimising when number of time-outs for a QNAME/QTYPE
pair is more than three.
- [bugzilla: 775 ] Fix unbound-host and unbound-anchor crash on
windows, ignore null delete for wsaevent.
- Fix spelling in freebind option man page text.
- Fix windows link of ssl with crypt32.
- [bugzilla: 779 ] Fix Union casting is non-portable.
- [bugzilla: 780 ] Fix MAP_ANON not defined in HP-UX 11.31.
- [bugzilla: 781 ] Fix prealloc() is an HP-UX system library call.
- Decrease dp attempts at each QNAME minimisation iteration
- [bugzilla: 784 ] Fix Build configure assumess that having getpwnam
means there is endpwent function available.
- Updated repository with newer flex and bison output.
- Fix static compile on windows missing gdi32.
- Fix dynamic link of anchor-update.exe on windows.
- Fix detect of mingw for MXE package build.
- Fixes for 64bit windows compile.
- [bugzilla: 788 ] Fix for nettle 3.0: Failed to build with Nettle >=
3.0 and --with-libunbound-only --with-nettle.
- Fixed unbound.doxygen for 1.8.11.
- [bugzilla: 798 ] Fix Client-side TCP fast open fails (Linux).
- [bugzilla: 801 ] Fix missing error condition handling in
daemon_create_workers().
- [bugzilla: 802 ] Fix workaround for function parameters that are
"unused" without log_assert.
- [bugzilla: 803 ] Fix confusing (and incorrect) code comment in
daemon_cleanup().
- [bugzilla: 806 ] Fix wrong comment removed.
- use sendmsg instead of sendto for TFO.
- [bugzilla: 807 ] Fix workaround for possible some "unused" function
parameters in test code.
- Note that OPENPGPKEY type is RFC 7929.
- [bugzilla: 804 ] Fix#804: unbound stops responding after outage.
Fixes queries that attempt to wait for an empty list of subqueries.
- Fix for #804: lower num_target_queries for iterator also for failed
lookups.
- [bugzilla: 820 ] Fix set sldns_str2wire_rr_buf() dual meaning len
parameter in each iteration in find_tag_datas().
- [bugzilla: 777 ] Fix OpenSSL 1.1.0 compatibility.
- RFC 7958 is now out, updated docs for unbound-anchor.
- Fix for compile without warnings with openssl 1.1.0.
- [bugzilla: 826 ] Fix refuse_non_local could result in a broken response.
- iana portlist update.
- Fix compile with openssl 1.1.0 with api=1.1.0.
- [bugzilla: 829 ] Fix doc of sldns_wire2str_rdata_buf() return value
has an off-by-one typo.
- Fix incomplete prototypes reported by Dag-Erling Smørgrav.
- [bugzilla: 828 ] Fix missing type in access-control-tag-action
redirect results in NXDOMAIN.
- Take configured minimum TTL into consideration when reducing TTL to
original TTL from RRSIG.
- [bugzilla: 831 ] Fix workaround for spurious fread_chk warning
against petal.c
- Silenced flex-generated sign-unsigned warning print with gcc
diagnostic pragma.
- Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len.
- fix potential memory leak in daemon/remote.c and nullpointer
dereference in validator/autotrust.
- [bugzilla: 883 ] Fix error for duplicate local zone entry.
- [bugzilla: 835 ] Fix --disable-dsa with nettle verify.
=============
Features:
---------
- generic edns option parse and store code.
- Updated L root IPv6 address.
- User defined pluggable event API for libunbound
- ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for binding
to an IP address while the interface or address is down.
- OpenSSL 1.1.0 portability, --disable-dsa configure option.
- disable-dnssec-lame-check config option.
Bug Fixes:
----------
- [bugzilla: 745 ] Fix unbound.py - idn2dname throws UnicodeError when idnname contains trailing dot.
- configure tests for the weak attribute support by the compiler.
- [bugzilla: 747 ] Fix assert in outnet_serviced_query_stop.
- Updated configure and ltmain.sh.
- Fixup of compile fix for pluggable event API.
- Fixup backend2str for libev.
- Fix libev usage of dispatch return value.
- No side effects in tolower() call, in case it is a macro.
- Fix warnings in ifdef corner case, older or unknown libevent.
- Fix ip-transparent for ipv6 on FreeBSD.
- Fix ip-transparent for tcp on freebsd.
- [bugzilla: 746 ] Fix unbound sets CD bit on all forwards.
If no trust anchors, it'll not set CD bit when forwarding to another server.
If a trust anchor, no CD bit on the first attempt to a forwarder,
but CD bit thereafter on repeated attempts to get DNSSEC.
- Limit number of QNAME minimisation iterations.
- Validate QNAME minimised NXDOMAIN responses.
- If QNAME minimisation is enabled, do cache lookup for QTYPE NS in harden-below-nxdomain.
- Fix compile of getentropy_linux for SLES11 servicepack 4.
- Fix dnstap-log-resolver-response-messages.
- Fix test for openssl to use HMAC_Update for 1.1.0.
- ERR_remove_state deprecated since openssl 1.0.0.
- OPENSSL_config is deprecated, removing.
- Document permit-small-holddown for 5011 debug.
- [bugzilla: 749 ] Fix unbound-checkconf gets SIGSEGV when use against a malformatted conf file.
- [bugzilla: 753 ] Fix document dump_requestlist is for first thread.
- Fix some malformed reponses to edns queries get fallback to nonedns.
- [bugzilla: 759 ] Fix 0x20 capsforid no longer checks type PTR, for compatibility with cisco dns guard. This lowers false positives.
- Fix sldns with static checking fixes copied from getdns.
- Fix memory leak in out-of-memory conditions of local zone add.
- [bugzilla: 761 ] Fix DNSSEC LAME false positive resolving nic.club.
- [bugzilla: 766 ] Fix dns64 should synthesize results on timeout/errors.
- No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC signed zones.
- [bugzilla: 767 ] Fix Reference to an expired Internet-Draft in harden-below-nxdomain documentation.
- remove memory leak from lame-check patch.
- [bugzilla: 770 ] Fix Small subgroup attack on DH used in unix pipe on localhost if unbound control uses a unix local named pipe.
- Document write permission to directory of trust anchor needed.
- [bugzilla: 768 ] Fix Unbound Service Sometimes Can Not Shutdown Completely, WER Report Shown Up. Close handle before closing WSA.
- Fix time in case answer comes from cache in ub_resolve_event().
- Fix windows service to be created run with limited rights, as a network service account.
- [bugzilla: 752 ] Fix retry resource temporarily unavailable on control pipe.
- iana ports fetched via https.
- iana portlist update.
=============
Features:
---------
- ip-transparent option for FreeBSD with IP_BINDANY socket option.
- insecure-lan-zones: yesno config option.
- RR Type CSYNC support RFC 7477, in debug printout and config input.
- RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
- [bugzilla: 731 ] tcp-mss, outgoing-tcp-mss options for unbound.conf
- Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
by default, and can be unblocked with "nodefault" localzone config.
- ub_ctx_set_stub() function for libunbound to config stub zones.
Bug Fixes:
----------
- Fix that NSEC3 negative cache is used when there is no salt.
- sorted ubsyms.def file with exported libunbound functions.
- Print understandable debug log when unusable DS record is seen.
- load gost algorithm if digest is seen before key algorithm.
- Fix that "make install" fails due to "text file busy" error.
- Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
- wait for sendto to drain socket buffers when they are full.
- Neater cmdline_verbose increment patch from Edgar Pettijohn.
- Made NetBSD sendmsg test nonfatal, in case of false positives.
- [bugzilla: 741 ] Fix: log message for dnstap socket connection is
more clear.
- [bugzilla: 734 ] Fix: chown the pidfile if it resides inside the
chroot.
- Fix cmsg alignment for argument to sendmsg on NetBSD.
- Fix that unbound complains about unimplemented IP_PKTINFO for
sendmsg on NetBSD (for interface-automatic).
- [bugzilla: 738 ] Fix: Swig should not be invoked with CPPFLAGS.
- Squelch 'cannot assign requested address' log messages unless
verbosity is high, it was spammed after network down.
- Fix to simplify empty string checking.
- [bugzilla: 734 ] Fix: Do not log an error when the PID file cannot
be chown'ed.
- Fix test if -pthreads unused to use better grep for portability.
- Fix mingw crosscompile for recent mingw.
- Update aclocal, autoconf output with new versions (1.15, 2.4.6).
- Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
for Linux glibc 2.20.
- Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
source code, so it applies cleanly again. Removed unused variable
warnings.
- [bugzilla: 729 ] Fix: omit use of escape sequences in echo since
they are not portable (unbound-control-setup).
- remove NULL-checks before free, patch from Michael McConville.
- updated ax_pthread.m4 to version 21 with clang support, this removes
a warning from compilation.
- OSX portability, detect if sbrk is deprecated.
- OSX clang, stop -pthread unused during link stage warnings.
- OSX clang new flto check.
- iana portlist update.
=============
Features:
- Fix#594. libunbound: optionally use libnettle for crypto.
Added --with-nettle for use with --with-libunbound-only.
- Implemented qname minimisation
Bug Fixes:
- Fix#712: unbound-anchor appears to not fsync root.key.
- Fix#714: Document config to block private-address for IPv4
mapped IPv6 addresses.
- portability, replace snprintf if return value broken
- portability fixes.
- detect libexpat without xml_StopParser function.
- isblank() compat implementation.
- patch from Doug Hogan for SSL_OP_NO_SSLvx options.
- Fix#716: nodata proof with empty non-terminals and wildcards.
- Fix#718: Fix unbound-control-setup with support for env
without HEREDOC bash support.
- ACX_SSL_CHECKS no longer adds -ldl needlessly.
- Change example.conf: ftp.internic.net to https://www.internic.net
- Fix for lenient accept of reverse order DNAME and CNAME.
- spelling fixes from Igor Sobrado Delgado.
- Fix that malformed EDNS query gets a response without malformed EDNS.
- Added assert on rrset cache correctness.
- Fix#720: add windows scripts to zip bundle,
and fix unbound-control-setup windows batch file.
- Fix for #724: conf syntax to read files from run dir (on Windows).
And fix PCA prompt for unbound-service-install.exe.
And add Changelog to windows binary dist.
- .gitignore for git users.
- iana portlist update.
- Removed unneeded whitespace from example.conf.
- Do not minimise forwarded requests.
=============
Features:
* Default for ssl-port is port 853, the temporary port assignment for
secure domain name system traffic. If you used to rely on the older default
of port 443, you have to put a clause in unbound.conf for that. The new
value is likely going to be the standardised port number for this traffic.
* ANY responses include DNAME records if present,
as per Evan Hunt's remark in dnsop.
Bug Fixes:
* Fix segfault in the dns64 module in the formaterror error path.
* Fix manpage to suggest using SIGTERM to terminate the server.
* iana portlist update.
Unbound 1.5.5
=============
Features:
* Change default of harden-algo-downgrade to off.
This is lenient for algorithm rollover.
* Added permit-small-holddown config to debug fast 5011 rollover.
* Allow certificate chain files to allow for intermediate certificates.
* Enable ECDHE for servers. Where available, use SSL_CTX_set_ecdh_auto()
for TLS-wrapped server configurations to enable ECDHE. Otherwise,
manually offer curve p256. Client connections should automatically
use ECDHE when available.
* [bugzilla: 699 ] Feature --enable-pie option to that builds PIE binary.
* [bugzilla: 700 ] Feature --enable-relro-now option that enables full
read-only relocation.
* [bugzilla: 702 ] New IPs for for h.root-servers.net.
Bug Fixes:
* [bugzilla: 681 ] Fix setting forwarders with unbound-control forward
implicitly turns on forward-first.
* [bugzilla: 690 ] Fix that reload fails when so-reuseport is yes
after changing num-threads.
* please afl-gcc (llvm) for uninitialised variable warning.
* Fix mktime in unbound-anchor not using UTC.
* Fix 5011 anchor update timer after reload.
* 5011 implementation does not insist on all algorithms,
when harden-algo-downgrade is turned off.
* Document in the manual more text about configuring locally served zones.
* Document that local-zone nodefault matches exactly and transparent can
be used to release a subzone.
* [bugzilla: 694 ] Fix that configure script does not detect LibreSSL 2.2.2
* Fix deadlock for local data add and zone add when unbound-control
list_local_data printout is interrupted.
* [bugzilla: 697 ] Fix get PY_MAJOR_VERSION failure at configure for
python 2.4 to 2.6.
* changed windows setup compression to be more transparent.
* Fix config globbed include chroot treatment, this fixes reload of globs.
* [bugzilla: 705 ] Fix ub_ctx_set_fwd() return value mishandled on windows.
* Fix minor error in unbound.conf.5.in.
* Fix unbound.conf(5) access-control description for precedence and default.
* Fix unbound-control flush that does not succeed in removing data.
* MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution failures.
* iana portlist update.
Features:
- [bugzilla: 644 ] harden-algo-downgrade option, if turned off,
fixes the reported excessive validation failure when multiple
algorithms are present. If set to 'no', it allows the weakest
algorithm to validate the zone.
- stats reports tcp usage, of incoming-num-tcp buffers.
- contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
scripts.
- Add ip-transparent config option for bind to non-local addresses.
- Synthesize ANY responses from cache. Does not search exhaustively,
but MX,A,AAAA,SOA,NS also CNAME.
- unbound-control list_insecure command shows the negative trust
anchors currently configured.
- ratelimit feature, ratelimit: 1000, can be used to turn it on. It
ratelimits recursion effort per zone. For particular names you can
configure exceptions in unbound.conf.
- Ratelimit does not apply to prefetched queries, and
ratelimit-factor is default 10. Repeated normal queries get resolved
and with prefetch stay in the cache.
- unbound-control ratelimit_list lists high rate domains.
- caps-whitelist in unbound.conf allows whitelist of loadbalancers
that cannot work with caps-for-id or its fallback.
- RFC 7553 RR type URI support, is now enabled by default.
- cache-max-negative-ttl config option, default 3600.
- Add local-zone type inform_deny, that logs query and drops answer.
Bug Fixes:
- Unbound exits with a fatal error when the auto-trust-anchor-file
fails to be writable. This is seconds after startup. You can load a
readonly auto-trust-anchor-file with trust-anchor-file. The file has
to be writable to notice the trust anchor change, without it, a trust
anchor change will be unnoticed and the system will then become
inoperable.
- DLV is going to be decommissioned. Advice to stop using it, and
put text in the example configuration and man page to that effect.
- Patch from Brad Smith that syncs compat/getentropy_linux with
OpenBSD's version (2015-03-04).
- 0x20 fallback improved: servfail responses do not count as missing
comparisons (except if all responses are errors), inability to find
nameservers does not fail equality comparisons, many nameservers does
not try to compare more than max-sent-count, parse failures start 0x20
fallback procedure.
- store caps_response with best response in case downgrade response
happens to be the last one.
- Document that incoming-num-tcp increase is good for large servers.
- Fix lintian warning in unbound-checkconf man page.
- Updated default keylength in unbound-control-setup to 3k.
- Fixup compile on cygwin, more portable openssl thread id.
- Use reallocarray for integer overflow protection.
- Fixed to add integer overflow checks on allocation (defense in depth).
- Fix segfault on user not found at startup.
- [bugzilla: 657 ] Fix that libunbound(3) recommends deprecated
CRYPTO_set_id_callback.
- If unknown trust anchor algorithm, and libressl is used, error
message encourages upgrade of the libressl package.
- rename ldns subdirectory to sldns to avoid name collision.
- [bugzilla: 660 ] Fix interface-automatic broken in the presence of
asymmetric routing.
- Libunbound skips dos-line-endings from etc/hosts.
- Fix crash in dnstap: Do not try to log TCP responses after timeout.
- Fix that get_option for cache-sizes does not print double newline.
- [bugzilla: 663 ] Fix that ssl handshake fails when using unix
socket because dh size is too small.
- [bugzilla: 664 ] libunbound python3 related fixes (from Tomas
Hozza); Use print_function also for Python2. libunbound examples:
produce sorted output. libunbound-Python: libldns is not used anymore.
Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
- Fix leaked dns64prefix configuration string.
- Removed contrib/unbound_unixsock.diff, because it has been
integrated, use control-interface: /path in unbound.conf.
- Change syntax of particular validator error to be easier for
machine parse, swap rrset and ip adres info so it looks like:
validation failure <www.example.nl. TXT IN>: signature crypto failed
from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
- Fix that unparseable error responses are ratelimited.
- SOA negative TTL is capped at minimumttl in its rdata section.
- [bugzilla: 674 ] Do not free pointers given by getenv.
- [bugzilla: 677 ] Fix CNAME corresponding to a DNAME was checked
incorrectly and was therefore always synthesized.
And fix DNAME responses from cache that failed internal chain test.
- iana portlist update.
Bug Fixes:
* [bugzilla: 647 ] Fix#647 crash in 1.5.2 because pwd.db no longer
accessible after reload.
* [bugzilla: 645 ] Fix#645 Portability to Solaris 10, use AF_LOCAL.
* [bugzilla: 646 ] Fix#646 Portability to Solaris, -lrt for
getentropy_solaris.
* Use the getrandom syscall introduced in Linux 3.17
Features:
* local-zone: example.com inform makes unbound log a message with
client IP for queries in that zone. Eg. for finding infected hosts.
* patch from Stephane Lapie that adds to the python API, that
exposes struct delegpt, and adds the find_delegation function.
* Updated contrib warmup.cmd/sh to support two modes - load from
pre-defined list of domains or (with filename as argument) load from
user-specified list of domains, and updated contrib
unbound_cache.sh/cmd to support loading/save/reload cache to/from
default path or (with secondary argument) arbitrary path/filename
* patch for remote control over local sockets. Use control-interface:
/path/sock and control-use-cert: no.
* unbound-checkconf -f prints chroot with pidfile path.
* infra-cache-min-rtt patch from Florian Riehm, for expected long
uplink roundtrip times.
Bug Fixes:
* config.guess and config.sub update from libtoolize.
* getauxval test for ppc64 linux compatibility.
* make strip works for unbound-host and unbound-anchor.
* print query name when max target count is exceeded.
* patch from Stuart Henderson that fixes DESTDIR in
unbound-control-setup for installs where config is not in the prefix
location.
* [bugzilla: 634 ] Fix#634: fix fail to start on Linux LTS 3.14.X,
ignores missing IP_MTU_DISCOVER OMIT option.
* Patch to contrib/unbound_munin_ that uses type ABSOLUTE.
Allows munin.conf: [idleserver.example.net]
unbound_munin_hits.graph_period minute
* Fix pyunbound ord call, portable for python 2 and 3.
* Fix unintended use of gcc extension for incomplete enum types,
compile with pedantic c99 compliance.
* Fix pyunbound byte string representation for python3.
* Fix 0x20 capsforid fallback to omit gratuitous NS and additional
section changes.
* Fix validation failure in case upstream forwarder (ISC BIND) does
not have the same trust anchors and decides to insert unsigned NS
record in authority section.
* Fix scrubber with harden-glue turned off to reject NS (and other
not-address) records.
* iana portlist update.
* [bugzilla: 643 ] Fix doc/example.conf.in: unnecessary whitespace.
Features:
Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, added to contrib/aaaa-filter-iterator.patch.
Bug Fixes:
* Fix that CD flag disables DNS64 processing, returning the DNSSEC signed AAAA denial.
* Fix compat/getentropy_win.c check if CryptGenRandom works and no immediate exit on windows.
* Fix crash on multiple thread random usage on systems without arc4random.
* Fix log at high verbosity and memory allocation failure.
* Fix libunbound undefined symbol errors for main.
* Patch from Robert Edmonds to build pyunbound python module differently. No versioninfo, with -shared and without $(LIBS).
* Patch from Robert Edmonds fixes hyphens in unbound-anchor man page.
* Removed 'increased limit open files' log message that is written to console. It is only written on verbosity 4 and higher. This keeps system bootup console cleaner.
* Patch from James Raftery, always print stats for rcodes 0..5.
* [bugzilla: 627 ] Fix SSL_CTX_load_verify_locations return code not properly checked.
* Fix makefile for build from noexec source tree.
* Add include to getentropy_linux.c, fixing debian build.
* [bugzilla: 632 ] Fix that unbound fails to build on AArch64, protects getentropy compat code from calling sysctl if it is has been removed.
* Fix CVE-2014-8602: denial of service by making resolver chase endless series of delegations.
Unbound 1.5.0
Features:
Alot of new features...
(See http://www.unbound.net/download.html)
Bug Fixes:
Alot of bug fixes...
(See http://www.unbound.net/download.html)
Features:
* separate ldns into core ldns inside ldns/ subdirectory. No more
configure --with-ldns is needed and unbound does not rely on libldns.
* Accept ip-address: as an alternative for interface: for
consistency with nsd.conf syntax.
* Fix ref#536: acl_deny_non_local and refuse_non_local added.
* so-reuseport: yesno option to distribute queries evenly over
threads on Linux (Thanks Robert Edmonds).
Reuseport is attempted, then fallback to without on failure.
* delay-close: msec option that delays closing ports for which
the UDP reply has timed out. Keeps the port open, only accepts
the correct reply. This correct reply is not used, but the port
is open so that no port-denied ICMPs are generated.
Bug Fixes:
* Fix#528: if very high logging (4 or more) segfault on allow_snoop.
* Fix#531: Set SO_REUSEADDR so that the wildcard interface and a
more specific interface port 53 can be used at the same time, and
one of the daemons is unbound.
* if configured --with-libunbound-only fix make install.
* Patch from Neel Goyal to fix callback in libunbound.
* Patch from Neel Goyal to fix async id assignment if callback
is called by libunbound in the mesh attach.
* Fix bug#537: compile python plugin without ldns library.
* Windows port, adjust %lld to %I64d, and warning in win_event.c.
* Fix#544: Fixed +i causes segfault when running with module conf
"iterator".
* Fix#547: no trustanchor written if filesystem full, fclose checked.
* unbound-event.h is installed if you configure --enable-event-api.
It contains low-level library calls, that use libevent's event_base
and a wireformat return packet in a buffer to perform async
resolution in the client's eventloop.
* speed up unbound, by reducing lock contention on localzones.lock.
* Fix parse (in ldns) of quoted parenthesized text strings.
* Detect libevent2 install automatically by configure and fixup
link with lib/event2 subdir.
* Fix#551: License change "Regents" to "Copyright holder", matching
the BSD license on opensource.org.
* Fix parse of #553(NSD) string in sldns, quotes without spaces.
* Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is
received. This is okay according 4035, but not after revising
existence in 4592. NSEC empty non-terminals exist and thus the
RCODE should have been NOERROR. If this occurs, and the RRsets
are secure, we set the RCODE to NOERROR and the security status
of the response is also considered secure.
* iana portlist updated.
* Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes
because of spelling..
Features:
* Implement max-udp-size config option, default 4096 with fix#524 for
nonEDNS0 queries.
* add unbound-control insecure_add and insecure_remove for the administration
of negative trust anchors.
* install copy of unbound-control.8 man page for unbound-control-setup.
* code improve for minimal responses, small speed increase.
* max include of 100.000 files (depth and globbed at one time).
This is to preserve system memory in bug cases, or endless cases.
* unbound.h header file has UNBOUND_VERSION_MAJOR define.
* get_option, set_option, unbound-checkconf -o and libunbound getoption() and
setoption() support cache-min-ttl and cache-max-ttl. Also log-time-ascii,
python-script, val-sig-skew-min and val-sig-skew-max. log-time-ascii takes
effect immediately. The others are mostly useful for libunbound users.
* configure --disable-flto option.
* streamtcp man page.
* Make reverse zones easier by documenting the nodefault statements
commented-out in the example config file.
Bug Fixes:
* committed libunbound version 4:1:2 for binary API updated in 1.4.20
* Fix for 2038, with time_t instead of uint32_t.
* Fix resolve of names that use a mix of public and private addresses.
* [bugzilla: 492 ] Fix endianness detection, revert to older lookup3.c
detection and put new detect lines after previous tests, to avoid
regressions but allow new detections to succeed.
And add detection for machine/endian.h to it.
* Fix queries leaking up for stubs and forwards, if the configured
nameservers all fail to answer.
* unbound-anchor review: BIO_write can return 0 successfully if it has
successfully appended a zero length string.
* Fix so that for a configuration line of include: "*.conf" it is not an
error if there are no files matching the glob pattern.
* own implementation of compat/snprintf.c.
* [bugzilla: 491 ] pick program name (0th argument) as syslog identity.
* Fixup snprintf return value usage, fixed libunbound_get_option.
* Robust checks on dname validity from rdata for dname compare.
* iana portlist update.
* Fix round-robin doesn't work with some Windows clients.
* [bugzilla: 500 ] use on non-initialised values on socket bind failures.
* [bugzilla: 499 ] use-after-free in out-of-memory handling code.
* Explain bogus and secure flags in libunbound more.
* Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply patch to it
to not fail when -Werror is also specified, from the autoconf-archives.
* Fixup manpage syntax.
* Fix for const string literals in C++ for libunbound.
* Squelch sendto-permission denied errors when the network is not connected,
to avoid spamming syslog.
* libunbound documentation on how to avoid openssl race conditions.
* [bugzilla: 512 ] NSS returned arrays out of setup function to be statics.
* [bugzilla: 516 ] dnssec lameness detection for answers that are improper.
* [bugzilla: 519 ] ub_ctx_delete may hang in some scenarios (libunbound).
* [bugzilla: 520 ] Errors found by static analysis
Features:
* add libunbound.ttl at end of result structure, version bump for libunbound.
Code compiled with 1.4.19 is binary compatible with the 1.4.20 library.
If code uses the ttl it needs the 1.4.20 version.
Bug Fixes:
* Change of D.ROOT-SERVERS.NET A address in default root hints.
* Fix openssl lock free on exit.
* unbound-anchors checks the emailAddress of the signer of the root.xml file,
default is dnssec@iana.org. It also checks that the signer has the correct
key usage for a digital signature.
* printout name of zone with duplicate fwd and hint errors.
* includes and have_ssl fixes for nss.
* detect endianness in lookup3 on BSD.
* iana portlist updated.
Features:
* RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled.
The contrib/patch_rsamd5_enable.diff patch enables RSAMD5 validation
otherwise it is treated as insecure. The MD5 hash is considered weak for
some purposes, if you want to sign your zone, then RSASHA256 is an
uncontested hash.
* unbound-control -q option is quiet
* include: directive in config file accepts wildcards.
Suggested use: include: "/etc/unbound.d/conf.d/*"
Bug Fixes:
* Fix openssl race condition, initializes openssl locks.
* Improved forward-first and stub-first documentation.
* Fix that enables modules to register twice for the same serviced_query,
without race conditions or administration issues.
* Fix forward-first option where it sets the RD flag wrongly.
* added manpage links for libunbound calls.
* Add documentation to libunbound for default nonuse of resolv.conf.
* Fix timeouts so that when a server has been offline for a while and is
probed to see it works, it becomes fully available for server selection again.
* Fallback to 1472 and 1232, one fragment size without headers.
* [bugzilla: 465 ] Nicer comments outgoing-port-avoid.
* chdir to / after chroot call (suggested by Camiel Dobbelaar).
* updated contrib/unbound.spec.
* ignore trusted-keys globs that have no files (from Paul Wouters).
* fix text in unbound-anchor man page.
* fix build of pythonmod in objdir.
* make clean and makerealclean remove generated python and docs.
* Fix validation for responses with both CNAME and wildcard expanded CNAME
records in answer section.
* [bugzilla: 477 ] Fix unbound-anchor segfault if EDNS is blocked.
* Fix unbound-control forward disables configured stubs below it.
* [bugzilla: 481 ] Fix python example0.
* iana portlist updated.
Features:
* implement log-time-ascii on windows.
* --with-libunbound-only build option, only builds the library and not the daemon and other tools.
* --with-nss build option (for now, --with-libunbound-only), uses libNSS for crypto operations.
* disable RSAMD5 if in FIPS mode (for openssl and for libnss).
* Add flush_bogus option for unbound-control.
Bug Fixes:
* Fix libunbound report of errors when in background mode.
* fix bogus nodata cname chain not reported as bogus by validator
* [bugzilla: 454 ] Fix for ACX_CHECK_COMPILER_FLAG from configure.ac, if CFLAGS is specified at configure time then '-g -O2' is not appended to CFLAGS, so that the user can override them.
* FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.
* fix missing break for GOST DS hash function.
* implemented forward_first for the root.
* code review: return value of cache_store can be ignored for better performance in out of memory conditions.
* patch for unbound_munin_ script to handle arbitrary thread count by Sven Ulland.
* Fix validation of qtype DS queries that result in no data for non-optout NSEC3 zones.
* fix edns-buffer-size and msg-buffer-size manpage documentation.
* fix error handling of alloc failure during rrsig verification.
* The key-cache bad key ttl is now 60 seconds.
* [bugzilla: 452 ] fix crash on assert in mesh_state_attachment. Fixes DS NS search to not generate duplicate sub queries.
* silence warning from swig-generated code (md set but not used in swig initmodule, due to ifdefs in swig-generated code).
* Fix debian-bugs-658021: Please enable hardened build flags.
* update iana ports list
Features:
* unbound-control forward_add, forward_remove, stub_add, stub_remove can modify stubs and forwards for running unbound they can also add and remove domain-insecure for the zone. This is to support reconfiguration of a DNSSEC validator on a computer that changes networks and has to enable new network config for the new location.
* new approach to NS fetches for DS lookup that works with cornercases, and is more robust and considers forwarders.
* contrib/validation-reporter follows rotated log file
* Applied patch for rrset-roundrobin and minimal-responses features (new options, enable in unbound.conf to use).
* ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older openssl.
* Patch for access to full DNS packet data in unbound python module
* forward-first option. Tries without forward if a query fails. Also stub-first option that is similar.
Bug Fixes:
* Fix possible uninitialised variable in windows pipe implementation.
* Fix alignment problem in util/random on sparc64/freebsd.
* Fix for accept spinning reported by OpenBSD.
* Fix validation of nodata for DS query in NSEC zones
* [bugzilla: 444 ] Fix that setusercontext was called too late
* [bugzilla: 443 ] Fix --with-chroot-dir not honoured by configure.
* [bugzilla: 442 ] Fix that Makefile depends on pythonmod headers even using --without-pythonmodule.
* Fix to locate nameservers for DS lookup with NS fetches.
* Applied line-buffer patch from Augie Schwer to validation.reporter.sh.
* flush_infra cleans timeouted servers from the cache too.
* Fix from code review, if EINPROGRESS not defined chain if statement differently.
* [bugzilla: 434 ] Fix windows port to check registry for config file location for unbound-control.exe, and unbound-checkconf.exe.
* Fix to squelch 'network unreachable' errors from tcp connect in logs, high verbosity will show them.
* Fix prefetch and sticky NS ghost domain. It picks nameservers that 'would be valid in the future', and if this makes the NS timeout, it updates that NS by asking delegation from the parent again. If child NS has longer TTL, that TTL does not get refreshed from the lookup to the child nameserver.
* RT#2955 Fix for cygwin compilation.
* Slightly smaller critical region in one case in infra cache.
* Fix timeouts to keep track of query type, A, AAAA and other, if another has caused timeout blacklist, different type can still probe.
unit test fix for nomem_cnametopos.rpl race condition.
* fix memory leak in errorcase for DSA signatures.
* workaround for openssl 0.9.8 ecdsa sha2 and evp problem.
* fix for windows, rename() is not posix compliant on windows.
* iana portlist updated
Features:
* applied patch to support outgoing-interface with ub_ctx_set_option.
Bug Fixes:
* Fix validation failures (like: validation failure xx: no NSEC3 closest
encloser from yy for DS zz. while building chain of trust, because of
a bug in the TTL-fix in 1.4.15, it picked the wrong rdata for an NSEC3.
Now it does not change rdata, and fixes TTL.
* Fix version-number in libtool to be version-info so it produces
libunbound.so.2 like it should.
* Fixes for port to OpenIndiana OS with gcc 4.6.
* Fix to write key files completely to a temporary file, and if that
succeeds, replace the real key file. So failures leave a useful file.
Unbound 1.4.15
Bug Fixes:
* Fix for memory leak (about 20 bytes when a tcp or udp send operation
towards authority servers failed, takes about 50.000 such failures to
leak one Mb, such failures are also usually logged).
* Fix to randomize hash function, based on 28c3 congress.
* [bugzilla: 425 ] unbound reports wrong TTL in reply, it reports a TTL
that would be permissible by the RFCs but it is not the TTL in the cache.
* [bugzilla: 429 ] add ub_version() call to libunbound. API version increase,
with (binary) backwards compatibility for the previous version.
* Fix bug where canonical_compare of RRSIG did not downcase the signer-name.
This is mostly harmless because RRSIGs do not have to be sorted in
canonical order, usually.
* uninitialised variable in reprobe for rtt blocked domains fixed.
* iana portlist updated.
Features:
* Makefile changed for BSD make compatibility.
* dns over ssl support as a client, ssl-upstream yes turns it on.
It performs an SSL transaction for every DNS query.
* dns over ssl support as a server, ssl-service-pem and ssl-service-key files
can be given and then TCP queries are serviced wrapped in SSL.
* lame-ttl and lame-size options no longer exist, it is integrated with the
host info. They are ignored (with verbose warning) if encountered
to keep the config file backwards compatible.
* TCP-upstream calculates tcp-ping so server selection works if there are
alternatives.
* Unbound probes at EDNS1480 if there an EDNS0 timeout.
Bug Fixes:
* Fix for VU#209659 CVE-2011-4528: Unbound denial of service vulnerabilities
from nonstandard redirection and denial of existence
http://www.unbound.net/downloads/CVE-2011-4528.txt
* Fix for tcp-upstream and ssl-upstream for if a laptop sleeps,
causes SERVFAILs. Also fixed for UDP (but less likely).
* Fix quartile time estimate, it was too low.
* Fix double free in unbound-host.
* fix -flto detection on Lion for llvm-gcc.
* [bugzilla: 416 ] Infra cache stores information about ping and lameness
per IP, zone.
* [bugzilla: 415 ] Fix resolve of partners.extranet.microsoft.com with a fix
for the server selection for choosing out of a (particular) list of bad
choices.
* Fix make_new_space function so that the incoming query is not overwritten
if a jostled out query causes a waiting query to be resumed that then fails
and sends an error message.
* fix unbound-anchor for broken strptime on OSX lion, detected in configure.
* Detect if GOST really works, openssl1.0 on OSX fails.
* Implement ipv6%interface notation for scope_id usage.
* better documentation for inform_super.
* Fix for out-of-memory condition in libunbound.
* Fix --enable-allsymbols, it depended on link specifics of the target platform, or fptr_wlist assertion failures could occur.
* updated contrib/unbound_munin_ to family=auto so that it works with
munin-node-configure automatically.
* Fix classification of NS set in answer section, where there is a
parent-child server, and the answer has the AA flag for dir.slb.com.
* [bugzilla: 408 ] accept patch from Steve Snyder that comments out unused
functions in lookup3.c.
* fix various compiler warnings.
* max sent count. EDNS1480 only for rtt < 5000. No promiscuous fetch if
sentcount > 3, stop query if sentcount > 16. Count is reset when referral
or CNAME happens. This makes unbound better at managing large NS sets,
they are explored when there is continued interest (in the form of queries).
* remove uninit warning from cachedump code.
* Fix parse error on negative SOA RRSIGs if badly ordered in the packet.
* fix infra cache comparison.
* Fix to constrain signer_name to be a parent of the lookupname.
* robust checks for next-closer NSEC3s.
* iana portlist updated.
(Ok'ed by wiz@)
Features:
* Note that Unbound implements RFC6303 (since version 1.4.7).
tcp-upstream yes/no option (works with set_option) for tunnels.
* The format of answers to the qtype ANY with a CNAME have changed, so that there can be proper validated DNSSEC answers for them. This is for queries with qtype ANY where the domain name has a CNAME. Now an answer is returned, where before it resulted in SERVFAIL due to validation failure. When DNSSEC validation is disabled, the contents of the response have changed: the CNAME is not followed, and the correct contents of the RRsets at the initial name are included (where previously only partial contents of the initial names could have been included but the CNAME was followed). The qtype ANY is a query for debug where the resolver is to fill in relevant data that happens to be at hand from the cache.
Bug Fixes:
* Fix validation of qtype ANY responses with CNAMEs. Unbound responds with the RR types that are available at the name for qtype ANY and validates those RR types. It does not test for completeness (i.e. with NSEC or NSEC3 query), and it does not follow the CNAME or DNAME to another name (with even more data for the already large response)
* Documented the options that work with control set_option command.
* Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
* Fix validation of . DS query.
* Fix wildcard expansion no-data reply under an optout NSEC3 zone is validated as insecure.
* Fix python site-packages path to /usr/lib64.
* fix memory and fd leak after out-of-memory condition.
* contrib. patch fixes load of python modules.
* contrib. patch that fixes a memory leak in the unbound python module, in string conversions.
* Fix num-threads 0 does not segfault.
* Fix autoconf 2.68 warnings
* iana portlist updated
Bug Fixes:
* removed ldns-src tarball inside the unbound tarball.
* [bugzilla: 395 ]
fix that id bits of other query may leak out under conditions
* fix replyaddr count wrong after jostled queries, which leads to eventual starvation where the daemon has no replyaddrs left to use.
* fix that the listening socket is not closed when too many remote control connections are made at the same time.
* version number in example config file.
* fix that --enable-static-exe does not complain about it unknown.
* iana portlist updated
1.4.11:
Features:
* log-queries: yesno option, default is no, prints querylog.
* ignore-cd-flag: yesno to provide dnssec to legacy servers.
* Use -flto compiler flag for link time optimization, if supported.
* unbound-control has version number in the header, and uses port number registered with IANA, 8953.
Bug Fixes:
* Fix Makefile for U in environment, since wrong U is more common than deansification necessity.
* defense in depth against the assertion failure bug fixed in 1.4.10, an error is printed to log instead of an assertion failure.
* [bugzilla: 386 ]
--enable-allsymbols option links all binaries to libunbound and reduces install size significantly.
* Fix TTL of SOA so negative TTL is separately cached from normal TTL.
* configure created with newer autoconf 2.66.
* [bugzilla: 378 ]
Fix that configure checks for ldns_get_random presence.
* queries with CD flag set cause DNSSEC validation, but the answer is not withheld if it is bogus. Thus, unbound will retry if it is bad and curb the TTL if it is bad, thus protecting the cache for use by downstream validators.
* val-override-date: -1 ignores dates entirely, for NTP usage.
* harden-below-nxdomain: changed so that it activates when the cached nxdomain is dnssec secure. This avoids backwards incompatibility because those old servers do not have dnssec.
* statistics-interval prints the number of jostled queries to log.
* IPv6 service address for d.root-servers.net (2001:500:2D::D).
* updated ldns tarball to 1.6.10rc2 snapshot
* iana portlist updated.
Bug Fixes:
* Added explicit note on unbound-anchor usage: Please note usage of
unbound-anchor root anchor is at your own risk and under the terms of our
LICENSE (see that file in the source).
* Fix remove private address does not throw away entire response. [bugzilla: 361 ]
* Fix, time.elapsed variable not reset with stats_noreset.
* Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
* give config parse error for multiple names on a stub or forward zone.
* updated ldns tarball to 1.6.9(snapshot).
* iana portlist updated.
Features:
* harden-below-nxdomain config option, default off (because very old software
may be incompatible). We could enable it by default in the future.
From draft-vixie-dnsext-resimprove-00.
* typetransparent localzone: does not block other RR types.
* so-sndbuf option for very busy servers, a bit like so-rcvbuf.
Bug Fixes:
* Fix so a changed NS RRset does not get moved name stuck on old server,
for type NS the TTL is not increased.
* Fix prefetch so it does not get stuck on old server for moved names.
* Fix insecure CNAME sequence marked as secure, reported by Bert Hubert.
* faster lruhash get_mem routine.
* [bugzilla: 346 ] remove ITAR scripts from contrib,
the service is discontinued, use the root.
* Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
* algorithm compromise protection using the algorithms signalled in the DS
record. Also, trust anchors, DLV, and RFC5011 receive this, and thus,
if you have multiple algorithms in your trust-anchor-file then it will now
behave different than before. Also, 5011 rollover for algorithms needs to be
double-signature until the old algorithm is revoked.
* squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them)
* fix validation in this case: CNAME to nodata for co-hosted opt-in
NSEC3 insecure delegation, was bogus, fixed to be insecure.
* Fix our 'BDS' license (typo reported by Xavier Belanger).
* [bugzilla: 338 ] print address when socket creation fails.
* Fix storage of EDNS failures in the infra cache.
* silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
* unbound-anchor compiles with openssl 0.9.7.
* Be lenient and accept imgw.pl malformed packet (like BIND).
* the included ldns tarball is updated (to 1.6.8)
* iana portlist updated.
unbound 1.47:
Features:
* unbound-anchor app, unbound requires libexpat (xml parser library).
It creates or updates a root.key file. Use it before you start the validator
(e.g. at system boot time).
* dump_infra and flush_infra commands for unbound-control.
Bug Fixes:
* GOST code enabled by default (RFC 5933).
* Configure detects libev-4.00.
* do not synthesize a CNAME message from cache for qtype DS.
* Use central entropy to seed threads.
* Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
* Fix validation failure for parent and child on same server with an insecure
childzone and a CNAME from parent to child.
* Change of timeout code. No more lost and backoff in blockage. At 12sec timeout
(and at least 2x lost before) one probe per IP is allowed only. At 120sec,
the IP is blocked. After 15min, a 120sec entry has a single retry packet.
* no timeout backoff if meanwhile a query succeeded.
* Configure errors if ldns is not found.
* Windows 7 fix for the installer.
* Fix bug where fallback_tcp causes wrong roundtrip and edns observation to be
noted in cache. Fix bug where EDNSprobe halted exponential backoff if EDNS
status unknown.
* interface automatic works for some people with ip6 disabled. Therefore the
error check is removed, so they can use the option.
* Fix TCP so it uses a random outgoing-interface.
* Fix bug when DLV below a trust-anchor that uses NSEC3 optout where the zone
has a secure delegation hosted on the same server did not verify as secure
(it was insecure by mistake).
* Fix alloc_reg_release for longer uptime in out of memory conditions.
* [bugzilla: 329 ] in example.conf show correct ipv4 link-local 169.254/16.
* compliance with draft-ietf-dnsop-default-local-zones-14,
removed reverse ipv6 orchid prefix from builtin list.
* Algorithm rollover operational reality intrudes, for trust-anchor and
5011-store, if one key matches it's good enough.
* Fix reported validation error in out of memory condition.
* Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
* increased mesh-max-activation from 1000 to 3000 for crazy domains like
_tcp.slb.com with 262 servers.
* [bugzilla: 327 ] Fix for cannot access stub zones until the root is primed.
* openbsd-lint fixes
* [bugzilla: 321 ] Fix resolution of rs.ripe.net artifacts with 0x20.
Delegpt structures checked for duplicates always.
No more nameserver lookups generated when depth is full anyway.
* [bugzilla: 322 ] Fix, configure does not respect CFLAGS on Solaris.
Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line if use
sun-cc, but some systems need different flags.
* Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP changes,
uses m4_bpatsubst now.
* make test (or make check) should be more portable and run the unit test and
testbound scripts. (make longtest has special requirements).
* More pleasant remote control command parsing.
* Fix name of rrset printed that failed validation.
* Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
* Fix validation in case a trust anchor enters into a zone with
unsupported algorithms.
* iana portlist updated.
* updated ldns tarball.
Features:
* Builtin root hints contain AAAA for I.ROOT-SERVERS.NET.
* unbound.h has extern "C" statement for easier include in c++.
* added feature to print configure date, target and options with -h.
* added feature to print event backend system details with -h.
* (ports and works on Minix 3.1.7). On Minix, add /usr/gnu/bin to PATH,
use ./configure AR=/usr/gnu/bin/gar and gmake.
* GOST enabled if SSL is recent and ldns has GOST enabled too.
Bug Fixes:
* Fix TCPreply on systems with no writev, if just 1 byte could be sent.
* Fix to use one pointer less for iterator query state store_parent_NS.
* Max referral count from 30 to 130, because 128 one character domains is valid DNS.
* added documentation for the histogram printout to syslog.
* Fix assertion failure reported by Kai Storbeck from XS4ALL, the assertion was wrong.
* updated ldns tarball.
* iana portlist updated.
* Unbound reports libev or libevent correctly in logs in verbose mode.
* Fix handling of corner case reply from lame server, follows rfc2308.
* Fix jostle list bug found by Vince (luoce at cnnic), it caused the qps in
overload situations to be about 5 qps for the class of shortly serviced
queries.
* Fix the max number of reply-address count to be applied for duplicate queries,
and not for new query list entries.
* Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex must be
signed with all algorithms from the DS rrset at the parent.
* Fix validation of qtype DNSKEY when a key-cache entry exists but no rr-cache
entry is used (it expired or prefetch), it then goes back up to the DS or
trust-anchor to validate the DNSKEY.
* log if a server is skipped because it is on the donotquery list, at verbosity
4, to enable diagnosis why no queries to 127.0.0.1.
* failure to chown the pidfile is not fatal any more.
* Neat function prototypes, unshadowed local declarations.
* Fix integer underflow in prefetch ttl creation from cache.
This fixes a potential negative prefetch ttl.
* Changed the defaults for num-queries-per-thread/outgoing-range.
Features:
* unbound-control get_option domain-insecure shows config file items.
* Autotrust anchor file can be initialized with a ZSK key as well
(if the domain's DNSKEY set is signed with that ZSK).
* Conforms to draft-ietf-dnsop-default-local-zones-13. Added default
reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa,
113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa.
* Contribution from Migiel de Vos (Surfnet): nagios patch for unbound-host,
in contrib/ (in the source tarball). Makes unbound-host suitable for
monitoring dnssec(-chain) status.
* GOST disabled-by-default, the algorithm number is allocated but the RFC
is still has to pass AUTH48 at the IETF.
Bug Fixes:
* Fix validation failure for qtype ANY caused by a RRSIG parse failure.
The validator error message was 'no signatures from ...'.
* Squelch log message: sendto failed permission denied for 255.255.255.255,
it is visible in VERB_DETAIL (verbosity 2).
* Fix fetch from blacklisted dnssec lame servers as last resort.
The server's IP address is then given in validator errors as well.
* Fix local-zone type redirect that did not use the query name for the
answer rrset.
* Compile fix using Sun Studio 12 compiler on Solaris 5.9, use CPPFLAGS
during configure process.
* Fix if libev is installed on the base system (not libevent),
detect it from the event.h header file and link with -lev.
* Fix configlexer.lex gets config.h, and configyyrename.h added by make,
no more double include.
* More strict scrubber (Thanks to George Barwood for the idea):
NS set must be pertinent to the query.
* [bugzilla: 307 ] In 0x20 backoff fix fallback so the number of outstanding
queries does not become -1 and block the request. Fixed handling of
recursion-lame in combination with 0x20 fallback. Fix so RRsets are
compared canonicalized and sorted if the immediate comparison fails,
this makes the 0x20 option work around round-robin sites.
* Fix retry sequence if prime hints are recursion-lame.
* Fix so harden-referral-path does not result in failures due to max-depth.
You can increase the max-depth by adding numbers (' 0') after the
target-fetch-policy, this increases the depth to which is checked.
* Fix detection of GOST support in ldns (reported by Chris Smith).
* Fix for dnssec lameness detection to use the key cache.
* infra cache entries that are expired are wiped clean.
Previously it was possible to not expire host data (if accessed often).
* Fix dnssec-missing detection that was turned off by server selection.
* [bugzilla: 308 ] Fix spelling error in variable name in parser and lexer.
* Fix various compiler warnings from the clang llvm compiler.
* Fix comments in iter_utils:dp_is_useless.
* EDNS timeout code will not fire if EDNS status already known.
* EDNS failure not stored if EDNS status known to work.
* Parent-child disagreement approach altered. Older fixes are removed in
place of a more exhaustive search for misconfigured data available via
the parent of a delegation. This is designed to be throttled by cache
entries, with TTL from the parent if possible. Additionally the
loop-counter is used. It also tests for NS RRset differences between
parent and child. The fetch of misconfigured data should be more
reliable and thorough. It should work reliably even with no or only
partial data in cache. Data received from the child (as always) is
deemed more authoritative than information received from the delegation
parent. The search for misconfigured data is not performed normally.
* Fix AD flag handling, it could in some cases mistakenly copy the AD flag
from upstream servers.
* Ignore Z flag in incoming messages too.
* alloc_special_obtain out of memory is not a fatal error any more,
enabling unbound to continue longer in out of memory conditions.
* Parentside names are dispreferred but not said to be dnssec-lame.
* Fix parentside and querytargets modulestate, for dump_requestlist.
* unbound-control-setup makes keys -rw-r--- so not all users permitted.
* libtoolize 2.2.6b, autoconf 2.65 applied to configure.
* Fix compile warning if compiled without threads.
* iana portlist updated.
* included ldns tarball updated.
* Fix bug where a long loop could be entered, now cycle detection has
a loop-counter and maximum search amount.
Features:
* Experimental ECC-GOST algorithm support.
* unbound-host disables use-syslog from config file.
* Include less in config.h and include per code file for ldns, ssl.
Bug Fixes:
* [bugzilla: 305 ] (regarding pkt_dname_tolower).
* Fix chain of trust with CNAME, for the DS processing proof.
* Fix validation of queries with wildcard names (*.example).
* Fix EDNS probe for .de DNSSEC testbed failure (backoff).
* unbound control flushed items are not counted when flushed again.
* iana portlist updated.
* [bugzilla: 301 ] (regarding unbound-checkconf).
* Fixed random numbers for port, interface and server selection.
* Refer to the listing in unbound-control man page in the extended \
statistics entry in the unbound.conf man page.
* Fix interface-automatic for OpenBSD: msg.controllen was too small.
* check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
* for NSEC3 check if signatures are cached.
* Reordered configure checks so fork and -lnsl -lsocket checks are earlier.
* ldns tarball updated.
* Fix python use when multithreaded.
* Fix solaris python compile.
* spelling fix in validation error involving cnames.
- Fix a memory alignment issue, that can be triggered remote on (some)
64bit systems
- Fix daemonize on Solaris 10 to correctly detach from terminal
- Extend unbound-control with new functions
- Better VERB_DETAIL output
- Improve latency of DNSSEC requeries by optionally prefetching the key
earlier in the validation process
- Prefetch option for popular queries before they expire
- Fix re-query pattern on invalid DNSKEY or DS records to reduce traffic
to a few packets / zone instead of a few packets / record
- Fixed bug where NSEC3 signature was not checked. This meant that
a DS could be spoofed away by a carefully crafted packet.
A downgrade attack on existing secure delegations.
- updated iana port list.
