diff --git a/libunbound-devel-mini.changes b/libunbound-devel-mini.changes index 6e61c97..77cb453 100644 --- a/libunbound-devel-mini.changes +++ b/libunbound-devel-mini.changes @@ -1,3 +1,126 @@ +------------------------------------------------------------------- +Sun Apr 22 19:26:03 UTC 2018 - michael@stroeder.com + +- Commented configuration directive dlv-anchor-file: in unbound.conf + (see bsc#1055060). The DLV key file is deliberately still + shipped in the package so users could easily re-enable this. + +------------------------------------------------------------------- +Wed Apr 4 11:54:01 UTC 2018 - michael@stroeder.com + +- update to 1.7.0 + +Features +- auth-zone provides a way to configure RFC7706 from unbound.conf, + eg. with auth-zone: name: "." for-downstream: no for-upstream: yes + fallback-enabled: yes and masters or a zonefile with data. +- Aggressive use of NSEC implementation. Use cached NSEC records to + generate NXDOMAIN, NODATA and positive wildcard answers. +- Accept tls-upstream in unbound.conf, the ssl-upstream keyword is + also recognized and means the same. Also for tls-port, + tls-service-key, tls-service-pem, stub-tls-upstream and + forward-tls-upstream. +- [dnscrypt] introduce dnscrypt-provider-cert-rotated option, + from Manu Bretelle. + This option allows handling multiple cert/key pairs while only + distributing some of them. + In order to reliably match a client magic with a given key without + strong assumption as to how those were generated, we need both key and + cert. Likewise, in order to know which ES version should be used. + On the other hand, when rotating a cert, it can be desirable to only + serve the new cert but still be able to handle clients that are still + using the old certs's public key. + The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not + publish the cert as part of the DNS's provider_name's TXT answer. +- Update B root ipv4 address. +- make ip-transparent option work on OpenBSD. +- Fix #2801: Install libunbound.pc. +- ltrace.conf file for libunbound in contrib. +- Fix #3598: Fix swig build issue on rhel6 based system. + configure --disable-swig-version-check stops the swig version check. + +Bug Fixes +- Fix #1749: With harden-referral-path: performance drops, due to + circular dependency in NS and DS lookups. +- [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert + duplicates +- Better documentation for cache-max-negative-ttl. +- Fixed libunbound manual typo. +- Fix #1949: [dnscrypt] make provider name mismatch more obvious. +- Fix #2031: Double included headers +- Document that errno is left informative on libunbound config read + fail. +- iana port update. +- Fix #1913: ub_ctx_config is under circumstances thread-safe. +- Fix #2362: TLS1.3/openssl-1.1.1 not working. +- Fix #2034 - Autoconf and -flto. +- Fix #2141 - for libsodium detect lack of entropy in chroot, print + a message and exit. +- Fix #2492: Documentation libunbound. +- Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is + set for stub zone. It no longer searches for DNSSEC information. +- Fix #3299 - forward CNAME daisy chain is not working +- Fix link failure on OmniOS. +- Check whether --with-libunbound-only is set when using --with-nettle + or --with-nss. +- Fix qname-minimisation documentation (A QTYPE, not NS) +- Fix that DS queries with referral replies are answered straight + away, without a repeat query picking the DS from cache. + The correct reply should have been an answer, the reply is fixed + by the scrubber to have the answer in the answer section. +- Fix that expiration date checks don't fail with clang -O2. +- Fix queries being leaked above stub when refetching glue. +- Copy query and correctly set flags on REFUSED answers when cache + snooping is not allowed. +- make depend: code dependencies updated in Makefile. +- Fix #3397: Fix that cachedb could return a partial CNAME chain. +- Fix #3397: Fix that when the cache contains an unsigned DNAME in + the middle of a cname chain, a result without the DNAME could + be returned. +- Fix that unbound-checkconf -f flag works with auto-trust-anchor-file + for startup scripts to get the full pathname(s) of anchor file(s). +- Print fatal errors about remote control setup before log init, + so that it is printed to console. +- Use NSEC with longest ce to prove wildcard absence. +- Only use *.ce to prove wildcard absence, no longer names. +- Fix unfreed locks in log and arc4random at exit of unbound. +- Fix lock race condition in dns cache dname synthesis. +- Fix #3451: dnstap not building when you have a separate build dir. + And removed protoc warning, set dnstap.proto syntax to proto2. +- Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) +- Unit test for auth zone https url download. +- tls-cert-bundle option in unbound.conf enables TLS authentication. +- Fixes for clang static analyzer, the missing ; in + edns-subnet/addrtree.c after the assert made clang analyzer + produce a failure to analyze it. +- Fix #3505: Documentation for default local zones references + wrong RFC. +- Fix #3494: local-zone noview can be used to break out of the view + to the global local zone contents, for queries for that zone. +- Fix for more maintainable code in localzone. +- more robust cachedump rrset routine. +- Save wildcard RRset from answer with original owner for use in + aggressive NSEC. +- Fixup contrib/fastrpz.patch so that it applies. +- Fix compile without threads, and remove unused variable. +- Fix compile with staticexe and python module. +- Fix nettle compile. +- Fix to check define of DSA for when openssl is without deprecated. +- iana port update. +- Fix #3582: Squelch address already in use log when reuseaddr option + causes same port to be used twice for tcp connections. +- Reverted fix for #3512, this may not be the best way forward; + although it could be changed at a later time, to stay similar to + other implementations. +- Fix for windows compile. +- Fixed contrib/fastrpz.patch, even though this already applied + cleanly for me, now also for others. +- patch to log creates keytag queries, from A. Schulze. +- patch suggested by Debian lintian: allow to -> allow one to, from + A. Schulze. +- Attempt to remove warning about trailing whitespace. +- Added documentation for aggressive-nsec: yes. + ------------------------------------------------------------------- Fri Jan 19 10:34:41 UTC 2018 - michael@stroeder.com diff --git a/libunbound-devel-mini.spec b/libunbound-devel-mini.spec index d401a04..a73ebde 100644 --- a/libunbound-devel-mini.spec +++ b/libunbound-devel-mini.spec @@ -24,7 +24,7 @@ # Name: libunbound-devel-mini -Version: 1.6.8 +Version: 1.7.0 Release: 0 # # diff --git a/unbound-1.6.8.tar.gz b/unbound-1.6.8.tar.gz deleted file mode 100644 index 92fc2e3..0000000 --- a/unbound-1.6.8.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:e3b428e33f56a45417107448418865fe08d58e0e7fea199b855515f60884dd49 -size 5467536 diff --git a/unbound-1.7.0.tar.gz b/unbound-1.7.0.tar.gz new file mode 100644 index 0000000..047a5a7 --- /dev/null +++ b/unbound-1.7.0.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:94dd9071fb13d8ccd122a3ac67c4524a3324d0e771fc7a8a7c49af8abfb926a2 +size 5538228 diff --git a/unbound.changes b/unbound.changes index a137aa2..81cd5dc 100644 --- a/unbound.changes +++ b/unbound.changes @@ -1,3 +1,126 @@ +------------------------------------------------------------------- +Sun Apr 22 19:26:03 UTC 2018 - michael@stroeder.com + +- Commented configuration directive dlv-anchor-file: in unbound.conf + (see bsc#1055060). The DLV key file is deliberately still + shipped in the package so users could easily re-enable this. + +------------------------------------------------------------------- +Wed Apr 4 11:54:01 UTC 2018 - michael@stroeder.com + +- update to 1.7.0 + +Features +- auth-zone provides a way to configure RFC7706 from unbound.conf, + eg. with auth-zone: name: "." for-downstream: no for-upstream: yes + fallback-enabled: yes and masters or a zonefile with data. +- Aggressive use of NSEC implementation. Use cached NSEC records to + generate NXDOMAIN, NODATA and positive wildcard answers. +- Accept tls-upstream in unbound.conf, the ssl-upstream keyword is + also recognized and means the same. Also for tls-port, + tls-service-key, tls-service-pem, stub-tls-upstream and + forward-tls-upstream. +- [dnscrypt] introduce dnscrypt-provider-cert-rotated option, + from Manu Bretelle. + This option allows handling multiple cert/key pairs while only + distributing some of them. + In order to reliably match a client magic with a given key without + strong assumption as to how those were generated, we need both key and + cert. Likewise, in order to know which ES version should be used. + On the other hand, when rotating a cert, it can be desirable to only + serve the new cert but still be able to handle clients that are still + using the old certs's public key. + The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not + publish the cert as part of the DNS's provider_name's TXT answer. +- Update B root ipv4 address. +- make ip-transparent option work on OpenBSD. +- Fix #2801: Install libunbound.pc. +- ltrace.conf file for libunbound in contrib. +- Fix #3598: Fix swig build issue on rhel6 based system. + configure --disable-swig-version-check stops the swig version check. + +Bug Fixes +- Fix #1749: With harden-referral-path: performance drops, due to + circular dependency in NS and DS lookups. +- [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert + duplicates +- Better documentation for cache-max-negative-ttl. +- Fixed libunbound manual typo. +- Fix #1949: [dnscrypt] make provider name mismatch more obvious. +- Fix #2031: Double included headers +- Document that errno is left informative on libunbound config read + fail. +- iana port update. +- Fix #1913: ub_ctx_config is under circumstances thread-safe. +- Fix #2362: TLS1.3/openssl-1.1.1 not working. +- Fix #2034 - Autoconf and -flto. +- Fix #2141 - for libsodium detect lack of entropy in chroot, print + a message and exit. +- Fix #2492: Documentation libunbound. +- Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is + set for stub zone. It no longer searches for DNSSEC information. +- Fix #3299 - forward CNAME daisy chain is not working +- Fix link failure on OmniOS. +- Check whether --with-libunbound-only is set when using --with-nettle + or --with-nss. +- Fix qname-minimisation documentation (A QTYPE, not NS) +- Fix that DS queries with referral replies are answered straight + away, without a repeat query picking the DS from cache. + The correct reply should have been an answer, the reply is fixed + by the scrubber to have the answer in the answer section. +- Fix that expiration date checks don't fail with clang -O2. +- Fix queries being leaked above stub when refetching glue. +- Copy query and correctly set flags on REFUSED answers when cache + snooping is not allowed. +- make depend: code dependencies updated in Makefile. +- Fix #3397: Fix that cachedb could return a partial CNAME chain. +- Fix #3397: Fix that when the cache contains an unsigned DNAME in + the middle of a cname chain, a result without the DNAME could + be returned. +- Fix that unbound-checkconf -f flag works with auto-trust-anchor-file + for startup scripts to get the full pathname(s) of anchor file(s). +- Print fatal errors about remote control setup before log init, + so that it is printed to console. +- Use NSEC with longest ce to prove wildcard absence. +- Only use *.ce to prove wildcard absence, no longer names. +- Fix unfreed locks in log and arc4random at exit of unbound. +- Fix lock race condition in dns cache dname synthesis. +- Fix #3451: dnstap not building when you have a separate build dir. + And removed protoc warning, set dnstap.proto syntax to proto2. +- Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) +- Unit test for auth zone https url download. +- tls-cert-bundle option in unbound.conf enables TLS authentication. +- Fixes for clang static analyzer, the missing ; in + edns-subnet/addrtree.c after the assert made clang analyzer + produce a failure to analyze it. +- Fix #3505: Documentation for default local zones references + wrong RFC. +- Fix #3494: local-zone noview can be used to break out of the view + to the global local zone contents, for queries for that zone. +- Fix for more maintainable code in localzone. +- more robust cachedump rrset routine. +- Save wildcard RRset from answer with original owner for use in + aggressive NSEC. +- Fixup contrib/fastrpz.patch so that it applies. +- Fix compile without threads, and remove unused variable. +- Fix compile with staticexe and python module. +- Fix nettle compile. +- Fix to check define of DSA for when openssl is without deprecated. +- iana port update. +- Fix #3582: Squelch address already in use log when reuseaddr option + causes same port to be used twice for tcp connections. +- Reverted fix for #3512, this may not be the best way forward; + although it could be changed at a later time, to stay similar to + other implementations. +- Fix for windows compile. +- Fixed contrib/fastrpz.patch, even though this already applied + cleanly for me, now also for others. +- patch to log creates keytag queries, from A. Schulze. +- patch suggested by Debian lintian: allow to -> allow one to, from + A. Schulze. +- Attempt to remove warning about trailing whitespace. +- Added documentation for aggressive-nsec: yes. + ------------------------------------------------------------------- Fri Jan 19 10:34:41 UTC 2018 - michael@stroeder.com diff --git a/unbound.conf b/unbound.conf index 38b0730..89e3829 100644 --- a/unbound.conf +++ b/unbound.conf @@ -346,7 +346,7 @@ server: # File with DLV trusted keys. Same format as trust-anchor-file. # There can be only one DLV configured, it is trusted from root down. # Downloaded from https://secure.isc.org/ops/dlv/dlv.isc.org.key - dlv-anchor-file: "/etc/unbound/dlv.isc.org.key" + # dlv-anchor-file: "/etc/unbound/dlv.isc.org.key" # File with trusted keys for validation. Specify more than one file # with several entries, one file per entry. diff --git a/unbound.spec b/unbound.spec index 9b792e8..5cffef9 100644 --- a/unbound.spec +++ b/unbound.spec @@ -58,7 +58,7 @@ %endif Name: unbound -Version: 1.6.8 +Version: 1.7.0 Release: 0 # # @@ -409,6 +409,7 @@ systemd-tmpfiles --create %{_tmpfilesdir}/unbound.conf || : %{_includedir}/unbound.h %{_includedir}/unbound-event.h %{_libdir}/libunbound.so +%{_libdir}/pkgconfig/libunbound.pc %{_mandir}/man3/libunbound.3* %{_mandir}/man3/ub_*.3*