unbound/libunbound-devel-mini.changes

-------------------------------------------------------------------
Mon Feb 22 15:22:05 UTC 2016 - mrueckert@suse.de

- add libunbound-devel-mini-rpmlintrc as source

-------------------------------------------------------------------
Wed Feb 17 15:55:34 UTC 2016 - mrueckert@suse.de

- revert the previous change which would not solve the problem as
  the library package requires the unbound-anchor package
  instead introduce a libunbound-devel-mini package which holds the
  shared library and devel files with a minimal build requires.

-------------------------------------------------------------------
Thu Feb  4 13:01:35 UTC 2016 - meissner@suse.com

- split off a libunbound package with less buildrequires to
  allow shorter buildcycles when built by gnutls. bsc#964346

-------------------------------------------------------------------
Thu Dec 10 11:48:46 UTC 2015 - michael@stroeder.com

- update to 1.5.7

Features
  * Fix #594. libunbound: optionally use libnettle for crypto.
  Contributed by Luca Bruno.  Added --with-nettle for use with
  --with-libunbound-only.
  * Implemented qname minimisation

Bug Fixes
  * Fix #712: unbound-anchor appears to not fsync root.key.
  * Fix #714: Document config to block private-address for IPv4
    mapped IPv6 addresses.
  * portability, replace snprintf if return value broken
  * portability fixes.
  * detect libexpat without xml_StopParser function.
  * isblank() compat implementation.
  * patch from Doug Hogan for SSL_OP_NO_SSLvx options.
  * Fix #716: nodata proof with empty non-terminals and wildcards.
  * Fix #718: Fix unbound-control-setup with support for env
    without HEREDOC bash support.
  * ACX_SSL_CHECKS no longer adds -ldl needlessly.
  * Change example.conf: ftp.internic.net to https://www.internic.net
  * Fix for lenient accept of reverse order DNAME and CNAME.
  * spelling fixes from Igor Sobrado Delgado.
  * Fix that malformed EDNS query gets a response without malformed EDNS.
  * Added assert on rrset cache correctness.
  * Fix #720: add windows scripts to zip bundle,
    and fix unbound-control-setup windows batch file.
  * Fix for #724: conf syntax to read files from run dir (on Windows).
    And fix PCA prompt for unbound-service-install.exe.
    And add Changelog to windows binary dist.
  * .gitignore for git users.
  * iana portlist update.
  * Removed unneeded whitespace from example.conf.
  * Do not minimise forwarded requests.

-------------------------------------------------------------------
Thu Oct 15 19:31:43 UTC 2015 - michael@stroeder.com

- update to 1.5.6
  Features
  - Default for ssl-port is port 853, the temporary port assignment for
    secure domain name system traffic. If you used to rely on the older
    default of port 443, you have to put a clause in unbound.conf for
    that. The new value is likely going to be the standardised port number
    for this traffic.
  - ANY responses include DNAME records if present, as per Evan Hunt's
    remark in dnsop.

  Bug Fixes
  - Fix segfault in the dns64 module in the formaterror error path.
  - Fix manpage to suggest using SIGTERM to terminate the server.
  - iana portlist update.

-------------------------------------------------------------------
Sat Oct 10 09:31:40 UTC 2015 - michael@stroeder.com

- ignore absence of the systemd-tmpfiles command

-------------------------------------------------------------------
Tue Oct  6 14:21:00 UTC 2015 - mrueckert@suse.de

- update to 1.5.5
  Features
  - Change default of harden-algo-downgrade to off. This is lenient
    for algorithm rollover.
  - Added permit-small-holddown config to debug fast 5011 rollover.
  - Allow certificate chain files to allow for intermediate
    certificates. (thanks Daniel Kahn Gillmor)
  - Enable ECDHE for servers. Where available, use
    SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations
    to enable ECDHE. Otherwise, manually offer curve p256. Client
    connections should automatically use ECDHE when available.
    (thanks Daniel Kahn Gillmor)
  - Feature --enable-pie option to that builds PIE binary.
    [bugzilla: 699 ]
  - Feature --enable-relro-now option that enables full read-only
    relocation.  [bugzilla: 700 ]
  - New IPs for for h.root-servers.net.  [bugzilla: 702 ]
  Bug Fixes
  - Fix setting forwarders with unbound-control forward implicitly
    turns on forward-first.  [bugzilla: 681 ]
  - Fix that reload fails when so-reuseport is yes after changing
    num-threads.  [bugzilla: 690 ]
  - please afl-gcc (llvm) for uninitialised variable warning.
  - Fix mktime in unbound-anchor not using UTC.
  - Fix 5011 anchor update timer after reload.
  - 5011 implementation does not insist on all algorithms, when
    harden-algo-downgrade is turned off.
  - Document in the manual more text about configuring locally
    served zones.
  - Document that local-zone nodefault matches exactly and
    transparent can be used to release a subzone.
  - Fix that configure script does not detect LibreSSL 2.2.2
    [bugzilla: 694 ]
  - Fix deadlock for local data add and zone add when
    unbound-control list_local_data printout is interrupted.
  - Fix get PY_MAJOR_VERSION failure at configure for python 2.4 to
    2.6.  [bugzilla: 697 ]
  - changed windows setup compression to be more transparent.
  - Fix config globbed include chroot treatment, this fixes reload
    of globs (patch from Dag-Erling Smørgrav).
  - Fix ub_ctx_set_fwd() return value mishandled on windows.
    [bugzilla: 705 ]
  - Fix minor error in unbound.conf.5.in.
  - Fix unbound.conf(5) access-control description for precedence
    and default.
  - Fix unbound-control flush that does not succeed in removing
    data.
  - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution
    failures.
  - iana portlist update.
- remove manual hacks for relro,now and pie and replace them with
  official configure options.

-------------------------------------------------------------------
Fri Sep  4 13:37:38 UTC 2015 - mrueckert@suse.de

- enable event api
- enable dnstap support

-------------------------------------------------------------------
Thu Jul  9 10:16:32 UTC 2015 - michael@stroeder.com

- update to 1.5.4

Features
  - [bugzilla: 644 ] harden-algo-downgrade option, if turned off,
    fixes the reported excessive validation failure when multiple
    algorithms are present. If set to 'no', it allows the weakest
    algorithm to validate the zone.
  - stats reports tcp usage, of incoming-num-tcp buffers.
  - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
    scripts. Contributed by Yuri Voinov.
  - Add ip-transparent config option for bind to non-local addresses.
  - Synthesize ANY responses from cache. Does not search exhaustively,
    but MX,A,AAAA,SOA,NS also CNAME.
  - unbound-control list_insecure command shows the negative trust
    anchors currently configured, patch from Jelte Jansen.
  - ratelimit feature, ratelimit: 1000, can be used to turn it on. It
    ratelimits recursion effort per zone. For particular names you can
    configure exceptions in unbound.conf.
  - Ratelimit does not apply to prefetched queries, and
    ratelimit-factor is default 10. Repeated normal queries get resolved
    and with prefetch stay in the cache.
  - unbound-control ratelimit_list lists high rate domains.
  - caps-whitelist in unbound.conf allows whitelist of loadbalancers
    that cannot work with caps-for-id or its fallback.
  - RFC 7553 RR type URI support, is now enabled by default.
  - cache-max-negative-ttl config option, default 3600.
  - Add local-zone type inform_deny, that logs query and drops answer.

Bug Fixes
  - Unbound exits with a fatal error when the auto-trust-anchor-file
    fails to be writable. This is seconds after startup. You can load a
    readonly auto-trust-anchor-file with trust-anchor-file. The file has
    to be writable to notice the trust anchor change, without it, a trust
    anchor change will be unnoticed and the system will then become
    inoperable.
  - DLV is going to be decommissioned. Advice to stop using it, and
    put text in the example configuration and man page to that effect.
  - Patch from Brad Smith that syncs compat/getentropy_linux with
    OpenBSD's version (2015-03-04).
  - 0x20 fallback improved: servfail responses do not count as missing
    comparisons (except if all responses are errors), inability to find
    nameservers does not fail equality comparisons, many nameservers does
    not try to compare more than max-sent-count, parse failures start 0x20
    fallback procedure.
  - store caps_response with best response in case downgrade response
    happens to be the last one.
  - Document that incoming-num-tcp increase is good for large servers.
  - Fix lintian warning in unbound-checkconf man page (from Andreas
    Schulze).
  - Updated default keylength in unbound-control-setup to 3k.
  - Fixup compile on cygwin, more portable openssl thread id.
  - Use reallocarray for integer overflow protection, patch submitted
    by Loganaden Velvindron.
  - Fixed to add integer overflow checks on allocation (defense in depth).
  - Fix segfault on user not found at startup (from Maciej Soltysiak).
  - [bugzilla: 657 ] Fix that libunbound(3) recommends deprecated
    CRYPTO_set_id_callback.
  - If unknown trust anchor algorithm, and libressl is used, error
    message encourages upgrade of the libressl package.
  - rename ldns subdirectory to sldns to avoid name collision.
  - [bugzilla: 660 ] Fix interface-automatic broken in the presence of
    asymmetric routing.
  - Libunbound skips dos-line-endings from etc/hosts.
  - Fix crash in dnstap: Do not try to log TCP responses after timeout.
  - Fix that get_option for cache-sizes does not print double newline.
  - [bugzilla: 663 ] Fix that ssl handshake fails when using unix
    socket because dh size is too small.
  - [bugzilla: 664 ] libunbound python3 related fixes (from Tomas
    Hozza); Use print_function also for Python2. libunbound examples:
    produce sorted output. libunbound-Python: libldns is not used anymore.
    Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
  - Fix leaked dns64prefix configuration string.
  - Removed contrib/unbound_unixsock.diff, because it has been
    integrated, use control-interface: /path in unbound.conf.
  - Change syntax of particular validator error to be easier for
    machine parse, swap rrset and ip adres info so it looks like:
    validation failure <www.example.nl. TXT IN>: signature crypto failed
    from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
  - Fix that unparseable error responses are ratelimited.
  - SOA negative TTL is capped at minimumttl in its rdata section.
  - [bugzilla: 674 ] Do not free pointers given by getenv.
  - [bugzilla: 677 ] Fix CNAME corresponding to a DNAME was checked
    incorrectly and was therefore always synthesized (thanks to Valentin
    Dietrich). And fix DNAME responses from cache that failed internal
    chain test.
  - iana portlist update.

-------------------------------------------------------------------
Fri Apr 24 13:53:53 UTC 2015 - michael@stroeder.com

- update to 1.5.3
- Bug Fixes
    [bugzilla: 647 ]
    Fix #647 crash in 1.5.2 because pwd.db no longer accessible after reload.
    [bugzilla: 645 ]
    Fix #645 Portability to Solaris 10, use AF_LOCAL.
    [bugzilla: 646 ]
    Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
    Use the getrandom syscall introduced in Linux 3.17 (from Heiner Kallweit).

-------------------------------------------------------------------
Thu Feb 19 23:35:58 UTC 2015 - mrueckert@suse.de

- update to 1.5.2
  - Features
    - local-zone: example.com inform makes unbound log a message
      with client IP for queries in that zone. Eg. for finding
      infected hosts.
    - patch from Stephane Lapie that adds to the python API, that
      exposes struct delegpt, and adds the find_delegation
      function.
    - Updated contrib warmup.cmd/sh to support two modes - load
      from pre-defined list of domains or (with filename as
      argument) load from user-specified list of domains, and
      updated contrib unbound_cache.sh/cmd to support
      loading/save/reload cache to/from default path or (with
      secondary argument) arbitrary path/filename, from Yuri
      Voinov.
    - patch for remote control over local sockets, from Dag-Erling
      Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and
      control-use-cert: no.
    - unbound-checkconf -f prints chroot with pidfile path.
    - infra-cache-min-rtt patch from Florian Riehm, for expected
      long uplink roundtrip times.
  - Bug Fixes
    - config.guess and config.sub update from libtoolize.
    - getauxval test for ppc64 linux compatibility.
    - make strip works for unbound-host and unbound-anchor.
    - print query name when max target count is exceeded.
    - patch from Stuart Henderson that fixes DESTDIR in
      unbound-control-setup for installs where config is not in the
      prefix location.
    - [bugzilla: 634 ] Fix #634: fix fail to start on Linux LTS
      3.14.X, ignores missing IP_MTU_DISCOVER OMIT option (fix from
      Remi Gacogne).
    - Patch from Philip Paeps to contrib/unbound_munin_ that uses
      type ABSOLUTE. Allows munin.conf: [idleserver.example.net]
      unbound_munin_hits.graph_period minute
    - Fix pyunbound ord call, portable for python 2 and 3.
    - Fix unintended use of gcc extension for incomplete enum
      types, compile with pedantic c99 compliance (from Daniel
      Dickman).
    - Fix pyunbound byte string representation for python3.
    - Fix 0x20 capsforid fallback to omit gratuitous NS and
      additional section changes.
    - Fix validation failure in case upstream forwarder (ISC BIND)
      does not have the same trust anchors and decides to insert
      unsigned NS record in authority section.
    - Fix scrubber with harden-glue turned off to reject NS (and
      other not-address) records.
    - iana portlist update.
    - [bugzilla: 643 ] Fix doc/example.conf.in: unnecessary
      whitespace.

-------------------------------------------------------------------
Mon Dec  8 16:12:23 UTC 2014 - mrueckert@suse.de

- update to 1.5.1 (boo# 908990)
  Features
  - Patch from Stephane Lapie for ASAHI Net that implements
    aaaa-filter, added to contrib/aaaa-filter-iterator.patch.
  Bug Fixes
  - Fix that CD flag disables DNS64 processing, returning the
    DNSSEC signed AAAA denial.
  - Fix compat/getentropy_win.c check if CryptGenRandom works and
    no immediate exit on windows.
  - Fix crash on multiple thread random usage on systems without
    arc4random.
  - Fix log at high verbosity and memory allocation failure.
  - Fix libunbound undefined symbol errors for main.
  - Patch from Robert Edmonds to build pyunbound python module
    differently. No versioninfo, with -shared and without $(LIBS).
  - Patch from Robert Edmonds fixes hyphens in unbound-anchor man
    page.
  - Removed 'increased limit open files' log message that is
    written to console. It is only written on verbosity 4 and
    higher. This keeps system bootup console cleaner.
  - Patch from James Raftery, always print stats for rcodes 0..5.
  - [bugzilla: 627 ] Fix SSL_CTX_load_verify_locations return code
    not properly checked.
  - Fix makefile for build from noexec source tree.
  - Add include to getentropy_linux.c, fixing debian build.
  - [bugzilla: 632 ] Fix that unbound fails to build on AArch64,
    protects getentropy compat code from calling sysctl if it is
    has been removed.
  - Fix CVE-2014-8602: denial of service by making resolver chase
    endless series of delegations.
- changes in 1.5.0
  Features
  - This release has DNS64, DNSTAP, better random numbers and
    ub_ctx_add_ta_autr(), num.query.tcpout=value, flush_negative,
    unblock-lan-zones conf.
  - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root
    hints (patch from Anand Buddhdev).
  - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation
    option for DNS fragmentation defense.
  - unbound-control stats prints num.query.tcpout with number of
    TCP outgoing queries made in the previous statistics interval.
  - Patch from Jeremie Courreges-Anglas to use arc4random_uniform
    if available on the OS, it gets entropy from the OS.
  - Add unbound-control flush_negative that flushed nxdomains,
    nodata, and errors from the cache. For dnssec-trigger and
    NetworkManager, fixes cases where network changes have
    localdata that was already negatively cached from the previous
    network.
  - Contrib windows scripts from Yuri Voinov added to src/contrib:
    create_unbound_ad_servers.cmd: enters anti-ad server lists.
    unbound_cache.cmd: saves and loads the cache. Also warmup.cmd
    (and .sh): warm up the DNS cache with your MRU domains.
  - Added unbound-control-setup.cmd from Yuri Voinov to the windows
    unbound distribution set. It requires openssl installed in
    %PATH%.
  - Implement draft-ietf-dnsop-rfc6598-rfc6303-01.
  - Feature, unblock-lan-zones: yesno that you can use to make
    unbound perform 10.0.0.0/8 and other reverse lookups normally,
    for use if unbound is running service for localhost on localhost.
  - unbound-host -D enabled dnssec and reads root trust anchor from
    the default root key file that was compiled in.
  - Add AAAA for B root server to default root hints.
  - unbound-control status reports if so-reuseport was successful.
  - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X.
  - arc4random in compat/ and getentropy, explicit_bzero, chacha
    for dependencies, from OpenBSD. arc4_lock and sha512 in compat.
    This makes arc4random available on all platforms, except when
    compiled with LIBNSS (it uses libNSS crypto random).
  - Patch from Dag-Erling Smorgrav that implements that: unbound
    -dd does not fork in the background and also logs to stderr.
  - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault.
    Initial commit of the patch from the FreeBSD base (with its
    fixes). This adds a module (for module-config in unbound.conf)
    dns64 that performs DNS64 processing, see README.DNS64.
  - Patch add msg, rrset, infra and key cache sizes to stats
    command from Maciej Soltysiak.
  - DNSTAP support, with a patch from Farsight Security, written by
    Robert Edmonds. The --enable-dnstap needs libfstrm and
    protobuf-c. It is BSD licensed (see dnstap/dnstap.c). Also
    --with-libfstrm and --with-protobuf-c configure options.
  - type CDS and CDNSKEY types.
  - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept
    queue is longer and more tcp connections can be handled.
  - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically
    tracked trust anchor to libunbound.
  Bug Fixes
  - Fix print filename of encompassing config file on read failure.
  - Patch from Stuart Henderson to build unbound-host man from
    .1.in.
  - [bugzilla: 569] Fix do_tcp is do-tcp in unbound.conf man page.
  - [bugzilla: 572] Fix unit test failure for systems with
    different /etc/ services.
  - iana portlist updated.
  - [bugzilla: 574] Fix make test fails on Ubuntu 14.04. Disabled
    remote-control in testbound scripts.
  - Documented that dump_requestlist only prints queries from
    thread 0.
  - [bugzilla: 567] Fix unbound lists if forward zone is secure or
    insecure with +i annotation in output of list_forwards, also
    for list_stubs (for NetworkManager integration). And remove ':'
    from output of stub and forward lists, this is easier to parse.
  - [bugzilla: 554] Fix use unsigned long to print 64bit statistics
    counters on 64bit systems.
  - [bugzilla: 558] Fix failed prefetch lookup does not remove
    cached response but delays next prefetch (in lieu of caching a
    SERVFAIL).
  - [bugzilla: 545] Fix improved logging, the ip address of the
    error is printed on the same log-line as the error.
  - [bugzilla: 502] Fix explain that do-ip6 disable does not stop
    AAAA lookups, but it stops the use of the ipv6 transport layer
    for DNS traffic.
  - Fix compile with libevent2 on FreeBSD.
  - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier.
  - Fixup out-of-directory compile with unbound-control-setup.sh.in.
  - Code cleanup patch from Dag-Erling Smorgrav, with compiler
    issue fixes from FreeBSD's copy of Unbound, he notes: Generate
    unbound-control-setup.sh at build time so it respects prefix
    and sysconfdir from the configure script.  Also fix the umask
    to match the comment, and the comment to match the umask. Add
    const and static where needed. Use unions instead of playing
    pointer poker. Move declarations that are needed in multiple
    source files into a shared header. Move sldns_bgetc() from
    parse.c to buffer.c where it belongs. Introduce a new header
    file, worker.h, which declares the callbacks that all workers
    must define. Remove those declarations from libworker.h.
    Include the correct headers in the correct places. Fix a few
    dummy callbacks that don't match their prototype. Fix some
    casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. Remove a
    useless printf which breaks reproducible builds. Get rid of
    CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're no longer
    used. Add unbound-control-setup.sh to the list of generated
    files. The prototype for libworker_event_done_cb() needs to be
    moved from libunbound/libworker.h to libunbound/worker.h.
  - Fix caps-for-id fallback, and added fallback attempt when
    servers drop 0x20 perturbed queries.
  - [bugzilla: 593] Fix segfault or crash upon rotating logfile.
  - fake-rfc2553 patch (thanks Benjamin Baier).
  - LibreSSL provides compat items, check for that in configure.
  - [bugzilla: 596] Bail out of unbound-control list_local_zones
    when ssl write fails.
  - Fix endian.h include for OpenBSD.
  - [bugzilla: 603] Fix unbound-checkconf -o option should skip
    verification checks.
  - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings.
  - Update unbound manpage with more explanation (from Florian Obser).
  - Fix tcp timer waiting list removal code.
  - patches to also build with Python 3.x (from Pavel Simerda).
  - improve python configuration detection to build on Fedora 22.
  - Fix swig and python examples for Python 3.x.
  - Fix for mingw compile with openssl-1.0.1i.
  - [bugzilla: 612] Fix create service with service.conf in present
    directory and auto load it.
  - [bugzilla: 613] Allow tab ws in var length last rdfs (in ldns
    str2wire).
  - [bugzilla: 614] Fix man page variable substitution bug.
  - Whitespaces after $ORIGIN are not part of the origin dname
    (ldns).
  - $TTL's value starts at position 5 (ldns).
  - Fix unbound-checkconf check for module config with dns64
    module.
  - Fix unbound capsforid fallback, it ignores TTLs in comparison.
  - [bugzilla: 617] Fix in ldns in unbound, lowercase WKS services.
  - Fix ctype invocation casts.
  - Disabled use of SSLv3 in remote-control and ssl-upstream.
  - Redefine internal minievent symbols to unique symbols that
    helps linking on platforms where the linker leaks names across
    modules.
  - Fix bug where forward or stub addresses with same address but
    different port number were not tried.

-------------------------------------------------------------------
Mon Nov 10 00:45:00 UTC 2014 - Led <ledest@gmail.com>

- fix bashisms in pre script

-------------------------------------------------------------------
Fri Sep  5 13:32:55 UTC 2014 - darin@darins.net

- cleanup .spec
- removed unused packes 

-------------------------------------------------------------------
Tue Sep  2 13:21:55 UTC 2014 - darin@darins.net

- disable %check until https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=602 is fixed

-------------------------------------------------------------------
Wed Aug 20 13:34:00 UTC 2014 - darin@darins.net

- Added firewall service file 

-------------------------------------------------------------------
Wed Aug 13 20:00:21 UTC 2014 - darin@darins.net

- upadte to 1.4.22
- use /run for pid to clear dir-or-file-in-var-run in factory

-------------------------------------------------------------------
Sat Dec 28 13:32:06 UTC 2013 - mrueckert@suse.de

- fixed the execstartpre for unbound so we actually call
  unbound-anchor now.

-------------------------------------------------------------------
Sat Dec 28 13:29:56 UTC 2013 - mrueckert@suse.de

- fixed a few rpmlint warnings
  - added unbound-rpmlintrc: files duplicate on those man page
    links
  - changed symlink to /usr/sbin/service
  - improved descriptions

-------------------------------------------------------------------
Sat Dec 28 04:02:56 UTC 2013 - mrueckert@suse.de

- update to 1.4.21
  merged lots of stuff from the fedora package
  - added python/munin/shlib/anchor subpackages
- currently the package only supports systemd

-------------------------------------------------------------------
Wed May 21 03:50:15 CEST 2008 - mrueckert@suse.de

- initial package