fb979ebd11
- RPM group fix. Do not suppress user/group creation problems. Replace %__ type macro indirections. OBS-URL: https://build.opensuse.org/request/show/515240 OBS-URL: https://build.opensuse.org/package/show/server:dns/unbound?expand=0&rev=60
1162 lines
55 KiB
Plaintext
1162 lines
55 KiB
Plaintext
-------------------------------------------------------------------
|
||
Tue Aug 8 19:02:38 UTC 2017 - jengelh@inai.de
|
||
|
||
- RPM group fix. Do not suppress user/group creation problems.
|
||
Replace %__ type macro indirections.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Jun 27 11:13:31 UTC 2017 - michael@stroeder.com
|
||
|
||
- update to 1.6.4
|
||
|
||
Features:
|
||
- Implemented trust anchor signaling using key tag query.
|
||
- unbound-checkconf -o allows query of dnstap config variables.
|
||
Also unbound-control get_option. Also for dnscrypt.
|
||
- unbound.h exports the shm stats structures. They use
|
||
type long long and no ifdefs, and ub_ before the typenames.
|
||
- Implemented opportunistic IPsec support module (ipsecmod).
|
||
- Added redirect-bogus.patch to contrib directory.
|
||
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
|
||
- renumbering B-Root's IPv6 address to 2001:500:200::b.
|
||
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
|
||
- Fix #1277: disable domain ratelimit by setting value to 0.
|
||
- Added fastrpz patch to contrib
|
||
|
||
Bug Fixes:
|
||
- Added ECS unit test (from Manu Bretelle).
|
||
- ECS documentation fix (from Manu Bretelle).
|
||
- Fix #1252: more indentation inconsistencies.
|
||
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
|
||
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
|
||
- iana portlist update
|
||
- Based on #1257: check parse limit before t increment in sldns RR
|
||
string parse routine.
|
||
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
|
||
and fix that 64bit getting installed in C:\Program Files (x86).
|
||
- Fix #1259: "--disable-ecdsa" argument overwritten
|
||
by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
|
||
- iana portlist update
|
||
- Added test for leak of stub information.
|
||
- Fix sldns wire2str printout of RR type CAA tags.
|
||
- Fix sldns int16_data parse.
|
||
- Fix sldns parse and printout of TSIG RRs.
|
||
- sldns SMIMEA and AVC definitions, same as getdns definitions.
|
||
- Fix tcp-mss failure printout text.
|
||
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
|
||
connect limited tcp connections. With the option tcp connections
|
||
can share the same source port (for different destinations).
|
||
- Add 'c' to getopt() in testbound.
|
||
- Adjust servfail by iterator to not store in cache when serve-expired
|
||
is enabled, to avoid overwriting useful information there.
|
||
- Fix queries for nameservers under a stub leaking to the internet.
|
||
- document trust-anchor-signaling in example config file.
|
||
- updated configure, dependencies and flex output.
|
||
- better module memory lookup, fix of unbound-control shm names for
|
||
module memory printout of statistics.
|
||
- Fix type AVC sldns rrdef.
|
||
- Some whitespace fixup.
|
||
- Fix #1265: contrib/unbound.service contains hardcoded path.
|
||
- Fix #1265 to use /bin/kill.
|
||
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
|
||
and compatibility with BoringSSL.
|
||
- Fix #1268: SIGSEGV after log_reopen.
|
||
- exec_prefix is by default equal to prefix.
|
||
- printout localzone for duplicate local-zone warnings.
|
||
- Fix assertion for low buffer size and big edns payload when worker
|
||
overrides udpsize.
|
||
- Support for openssl EVP_DigestVerify.
|
||
- Fix #1269: inconsistent use of built-in local zones with views.
|
||
- Add defaults for new local-zone trees added to views using
|
||
unbound-control.
|
||
- Fix #1273: cachedb.c doesn't compile with -Wextra.
|
||
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
|
||
- Also use global local-zones when there is a matching view that does
|
||
not have any local-zone specified.
|
||
- Fix fastopen EPIPE fallthrough to perform connect.
|
||
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
|
||
(from Manu Bretelle).
|
||
- Fix #1275: cached data in cachedb is never used.
|
||
- Fix that unbound-control can set val_clean_additional and
|
||
val_permissive_mode.
|
||
- Add dnscrypt XChaCha20 tests.
|
||
- Detect chacha for dnscrypt at configure time.
|
||
- dnscrypt unit tests with chacha.
|
||
- Added domain name based ECS whitelist.
|
||
- Fix #1278: Incomplete wildcard proof.
|
||
- Fix #1279: Memory leak on reload when python module is enabled.
|
||
- Fix #1280: Unbound fails assert when response from authoritative
|
||
contains malformed qname. When 0x20 caps-for-id is enabled, when
|
||
assertions are not enabled the malformed qname is handled correctly.
|
||
- More fixes in depth for buffer checks in 0x20 qname checks.
|
||
- Fix stub zone queries leaking to the internet for
|
||
harden-referral-path ns checks.
|
||
- Fix query for refetch_glue of stub leaking to internet.
|
||
- Fix #1301: memory leak in respip and tests.
|
||
- Free callback in edns-subnetmod on exit and restart.
|
||
- Fix memory leak in sldns_buffer_new_frm_data.
|
||
- Fix memory leak in dnscrypt config read.
|
||
- Fix dnscrypt chacha cert support ifdefs.
|
||
- Fix dnscrypt chacha cert unit test escapes in grep.
|
||
- Fix to unlock view in view test.
|
||
- Fix warning in pythonmod under clang compiler.
|
||
- Fix lintian typo.
|
||
- Fix #1316: heap read buffer overflow in parse_edns_options.
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Jun 14 10:22:38 UTC 2017 - michael@stroeder.com
|
||
|
||
- update to 1.6.3
|
||
|
||
Bug Fixes
|
||
- Fix #1280: Unbound fails assert when response from authoritative
|
||
contains malformed qname. When 0x20 caps-for-id is enabled, when
|
||
assertions are not enabled the malformed qname is handled correctly.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Apr 24 15:54:02 UTC 2017 - michael@stroeder.com
|
||
|
||
- update to 1.6.2
|
||
|
||
Features
|
||
- Add trustanchor.unbound CH TXT that gets a response with a number
|
||
of TXT RRs with a string like "example.com. 2345 1234" with
|
||
the trust anchors and their keytags.
|
||
- Patch for view functionality for local-data-ptr from Björn Ketelaars.
|
||
- Response actions based on IP address from Jinmei Tatuya (Infoblox).
|
||
- Patch from Luiz Fernando Softov for Stats Shared Memory.
|
||
- unbound-control stats_shm command prints stats using shared memory,
|
||
which uses less cpu.
|
||
- --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and
|
||
DS records. NSEC3 is not disabled.
|
||
- #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then
|
||
enabled in the config file from Manu Bretelle.
|
||
- Merge EDNS Client subnet implementation from feature branch into main
|
||
branch, using new EDNS processing framework.
|
||
- harden-algo-downgrade: no also makes unbound more lenient about
|
||
digest algorithms in DS records.
|
||
|
||
Bug fixes
|
||
- sldns has ED25519 and ED448 algorithm number and name for display.
|
||
- sldns updated for vfixed and buffer resize indication from getdns.
|
||
- iana portlist update
|
||
- Fix #1224: Fix that defaults should not fall back to "Program Files
|
||
(x86) if Unbound is 64bit by default on windows.
|
||
- Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to
|
||
redirect.
|
||
- make depend, autoconf, doxygen and lint fixed up.
|
||
- include sys/time.h for new shm code on NetBSD.
|
||
- Fix #1227: Fix that Unbound control allows weak ciphersuits.
|
||
- Fix #1226: provide official 32bit binary for windows.
|
||
- For #1227: if we have sha256, set the cipher list to have no
|
||
known vulns.
|
||
- Fix testpkts.c, check if DO bit is set, not only if there is an OPT
|
||
record.
|
||
- Fix #1229: Systemd service sandboxing in contrib/unbound.service.
|
||
- Fix #1230: swig version 2.0.1 is required for pythonmod, with
|
||
1.3.40 it crashes when running repeatly unbound-control reload.
|
||
- fix enum conversion warnings
|
||
- fake-sha1 test option; print warning if used. To make unit tests.
|
||
- unbound-control list local zone and data commands listed in the
|
||
help output.
|
||
- Fix #1234: shortening DNAME loop produces duplicate DNAME records
|
||
in ANSWER section.
|
||
- testbound understands Deckard MATCH rcode question answer commands.
|
||
- Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead
|
||
of YXDOMAIN + query loop, reported by Petr Spacek.
|
||
- Fix that SHM is not inited if not enabled.
|
||
- Fix that looped DNAMEs do not cause unbound to spend effort.
|
||
- trustanchor tags are sorted. reusable routine to fetch taglist.
|
||
- Fix #1237 - Wrong resolving in chain, for norec queries that get
|
||
SERVFAIL returned.
|
||
- make depend, autoconf, remove warnings about statement before var.
|
||
- lru_demote and lruhash_insert_or_retrieve functions for getdns.
|
||
- fixup for lruhash (whitespace and header file comment).
|
||
- dnscrypt tests.
|
||
- Fix doxygen for dnscrypt files.
|
||
- Fix #1238: segmentation fault when adding through the remote
|
||
interface a per-view local zone to a view with no previous
|
||
(configured) local zones.
|
||
- Fix #1229: Systemd service sandboxing, options in wrong sections.
|
||
- Fix #1239: configure fails to find python distutils if python
|
||
prints warning.
|
||
- Fix to prevent non-referal query from being cached as referal when the
|
||
no_cache_store flag was set.
|
||
- Remove (now unused) event2 include from dnscrypt code.
|
||
- Fix #1217: Add metrics to unbound-control interface showing
|
||
crypted, cert request, plaintext and malformed queries (from
|
||
Manu Bretelle).
|
||
- Do not add current time twice to TTL before ECS cache store.
|
||
- Do not touch rrset cache after ECS cache message generation.
|
||
- Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode.
|
||
- Fix #1244: document that use of chroot requires trust anchor file to
|
||
be under chroot.
|
||
- Small fixup for documentation.
|
||
- Fix respip for braces when locks arent used.
|
||
- Fix pythonmod for cb changes.
|
||
- Generalise inplace callback (de)registration
|
||
- (de)register inplace callbacks for module id
|
||
- No unbound-control set_option for ECS options
|
||
- Deprecated client-subnet-opcode config option
|
||
- Introduced client-subnet-always-forward config option
|
||
- Changed max-client-subnet-ipv6 default to 56 (as in RFC)
|
||
- Removed extern ECS config options
|
||
- module_restart_next now calls clear on all following modules
|
||
- Also create ECS module qstate on module_event_pass event
|
||
- remove malloc from inplace_cb_register
|
||
- Unlock view in respip unit test
|
||
- Some whitespace fixup.
|
||
- Remove ECS option after REFUSED answer.
|
||
- Fix small memory leak in edns_opt_copy_alloc.
|
||
- Respip dereference after NULL check.
|
||
- Zero initialize addrtree allocation.
|
||
- Use correct identifier for SHM destroy.
|
||
- Display ECS module memory usage.
|
||
- Fix #1247: unbound does not shorten source prefix length when
|
||
forwarding ECS.
|
||
- Properly check for allocation failure in local_data_find_tag_datas.
|
||
- Fix #1249: unbound doesn't return FORMERR to bogus ECS.
|
||
- Set SHM ECS memory usage to 0 when module not loaded.
|
||
- subnet mem value is available in shm, also when not enabled,
|
||
to make the struct easier to memmap by other applications,
|
||
independent of the configuration of unbound.
|
||
- Fix #1250: inconsistent indentation in services/listen_dnsport.c.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Feb 21 21:34:22 UTC 2017 - michael@stroeder.com
|
||
|
||
- update to 1.6.1
|
||
|
||
Features
|
||
* configure --enable-systemd and lets unbound use systemd sockets if you
|
||
enable use-systemd: yes in unbound.conf. Also there are
|
||
contrib/unbound.socket and contrib/unbound.service: systemd files for
|
||
unbound, install them in /usr/lib/systemd/system. Contributed by Sami
|
||
Kerola and Pavel Odintsov.
|
||
* [bugzilla: 1185 ]
|
||
Source IP rate limiting, patch from Larissa Feng.
|
||
* [bugzilla: 1184 ]
|
||
Log DNS replies. This includes the same logging information that DNS
|
||
queries and response code and response size, patch from Larissa Feng.
|
||
* Include root trust anchor id 20326 in unbound-anchor.
|
||
* 64bit is default for windows builds.
|
||
|
||
Bug Fixes
|
||
* [bugzilla: 1176 ]
|
||
Fix stack size too small for Alpine Linux.
|
||
* Fix unbound-control and ipv6 only.
|
||
[bugzilla: 1182 ]
|
||
* Fix Resource leak (socket), at startup.
|
||
[bugzilla: 1178 ]
|
||
* Fix attempt to fix setup error at end, pop result values at end of
|
||
install.
|
||
* iana portlist update
|
||
* Fix inet_ntop and inet_pton warnings in windows compile.
|
||
* [bugzilla: 1191 ]
|
||
Fix remove comment about view deletion.
|
||
* [bugzilla: 1188 ]
|
||
Fix unresolved symbol 'fake_dsa' in libunbound.so when built with Nettle
|
||
* [bugzilla: 1190 ]
|
||
Fix to not echo back EDNS options in local-zone error response.
|
||
* [bugzilla: 1194 ]
|
||
Fix if cross build fails when $host isn't `uname` for getentropy.
|
||
* Fix reload chdir failure when also chrooted to that directory.
|
||
* Fix to return formerr for queries for meta-types, to avoid packet
|
||
amplification if this meta-type is sent on to upstream.
|
||
* [bugzilla: 1201 ]
|
||
Fix missing unlock in answer_from_cache error condition.
|
||
* [bugzilla: 1202 ]
|
||
Fix code comment that packed_rrset_data is not always 'packed'.
|
||
* Fix to also block meta types 128 through to 248 with formerr.
|
||
* [bugzilla: 1206 ]
|
||
Fix that some view-related commands are missing from 'unbound-control -h'
|
||
* Fix to rename ub_callback_t to ub_callback_type, because POSIX
|
||
reserves _t typedefs.
|
||
* Fix to rename internally used types from _t to _type, because _t type
|
||
names are reserved by POSIX.
|
||
* Increase MAX_MODULE to 16.
|
||
* [bugzilla: 1211 ]
|
||
Fix can't enable interface-automatic if no IPv6 with more helpful
|
||
error message.
|
||
* fix root_anchor test for updated icannbundle.pem lower certificates.
|
||
* Fix compile on solaris of the fix to use $host detect.
|
||
* Fix for type name change and fix warning on windows compile.
|
||
* Fix pythonmod for typedef changes.
|
||
* Fix dnstap for warning of set but not used.
|
||
* Fix autoconf of systemd check for lack of pkg-config.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 15 16:28:44 UTC 2016 - michael@stroeder.com
|
||
|
||
- update to 1.6.0
|
||
|
||
Features
|
||
* Added generic EDNS code for registering known EDNS option codes,
|
||
bypassing the cache response stage and uniquifying mesh states. Four
|
||
EDNS option lists were added to module_qstate
|
||
(module_qstate.edns_opts_*) to store EDNS options from/to front/back side.
|
||
* Added two flags to module_qstate (no_cache_lookup, no_cache_store)
|
||
that control the modules' cache interactions.
|
||
* Added code for registering inplace callback functions. The registered
|
||
functions can be called just before replying with local data or Chaos,
|
||
replying from cache, replying with SERVFAIL, replying with a resolved
|
||
query, sending a query to a nameserver. The functions can inspect the
|
||
available data and maybe change response/query related data (i.e. append
|
||
EDNS options).
|
||
* Updated Python module for the above.
|
||
* Updated Python documentation.
|
||
* Added views functionality.
|
||
* Added qname-minimisation-strict config option.
|
||
* Patch that resolves CNAMEs entered in local-data conf statements that
|
||
point to data on the internet, from Jinmei Tatuya (Infoblox).
|
||
* serve-expired config option: serve expired responses with TTL 0.
|
||
* .gitattributes line for githubs code language display.
|
||
* log-identity: config option to set sys log identity, patch from "Robin
|
||
H. Johnson" (robbat2@gentoo.org).
|
||
* Added stub-ssl-upstream and forward-ssl-upstream options.
|
||
* Added local-zones and local-data bulk addition and removal
|
||
functionality in unbound-control (local_zones, local_zones_remove,
|
||
local_datas and local_datas_remove).
|
||
* g.root-servers.net has AAAA address.
|
||
|
||
Bug Fixes
|
||
* Fix #836: unbound could echo back EDNS options in an error response.
|
||
* Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
|
||
* Fix #839: Memory grows unexpectedly with large RPZ files.
|
||
* Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile.
|
||
* Fix #841: big local-zone's make it consume large amounts of memory.
|
||
* Fix dnstap relaying "random" messages instead of resolver/forwarder
|
||
responses, from Nikolay Edigaryev.
|
||
* Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.
|
||
* Fix #1117: spelling errors, from Robert Edmonds.
|
||
* iana portlist update.
|
||
* fix memoryleak logfile when in debug mode.
|
||
* Re-fix #839 from view commit overwrite.
|
||
* Fixup const void cast warning.
|
||
* Removed patch comments from acllist.c and msgencode.c
|
||
* Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, from
|
||
Jinmei Tatuya (Infoblox).
|
||
* Fix #1125: unbound could reuse an answer packet incorrectly for
|
||
clients with different EDNS parameters, from Jinmei Tatuya.
|
||
* Fix #1118: libunbound.pc sets strange Libs, Libs.private values.
|
||
* Added Requires line to libunbound.pc
|
||
* Fix #1130: whitespace in example.conf.in more consistent.
|
||
* suppress compile warning in lex files.
|
||
* init lzt variable, for older gcc compiler warnings.
|
||
* fix --enable-dsa to work, instead of copying ecdsa enable.
|
||
* Fix DNSSEC validation of query type ANY with DNAME answers.
|
||
* Fixup query_info local_alias init.
|
||
* Ported tests for local_cname unit test to testbound framework.
|
||
* Fix #1134: unbound-control set_option -- val-override-date: -1 works
|
||
immediately to ignore datetime, or back to 0 to enable it again. The --
|
||
is to ignore the '-1' as an option flag.
|
||
* Patch for server.num.zero_ttl stats for count of expired replies, from
|
||
Pavel Odintsov.
|
||
* Fix failure to build on arm64 with no sbrk.
|
||
* Set OpenSSL security level to 0 when using aNULL ciphers.
|
||
* configure detects ssl security level API function in the autoconf
|
||
manner. Every function on its own, so that other libraries (eg.
|
||
LibreSSL) can develop their API without hindrance.
|
||
* Fix #1154: segfault when reading config with duplicate zones.
|
||
* Note that for harden-below-nxdomain the nxdomain must be secure, this
|
||
means nsec3 with optout is insufficient.
|
||
* Fix #1155: test status code of unbound-control in 04-checkconf, not
|
||
the status code from the tee command.
|
||
* Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
|
||
Underneath" for the harden-below-nxdomain option.
|
||
* patch from Dag-Erling Smorgrav that removes code that relies on sbrk().
|
||
* Make access-control-tag-data RDATA absolute. This makes the RDATA
|
||
origin consistent between local-data and access-control-tag-data.
|
||
* Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
|
||
subdomain of the NSEC owner.
|
||
* QNAME minimisation uses QTYPE=A, therefore always check cache for this
|
||
type in harden-below-nxdomain functionality.
|
||
* Added unit test for QNAME minimisation + harden below nxdomain synergy.
|
||
* Fix that with openssl 1.1 control-use-cert: no uses less cpu, by using
|
||
no encryption over the unix socket.
|
||
* hyphen as minus fix, by Andreas Schulze
|
||
* Fix #1170: document that 'inform' local-zone uses local-data.
|
||
* Fix #1173: differ local-zone type deny from unset tag_actions element.
|
||
* Add DSA support for OpenSSL 1.1.0
|
||
* Fix remote control without cert for LibreSSL
|
||
* Fix downcast warnings from visual studio in sldns code.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 27 12:41:57 UTC 2016 - michael@stroeder.com
|
||
|
||
- update to 1.5.10
|
||
|
||
Features
|
||
* Create a pkg-config file for libunbound in contrib.
|
||
* TCP Fast open patch from Sara Dickinson.
|
||
* Finegrained localzone control with define-tag, access-control-tag,
|
||
access-control-tag-action, access-control-tag-data, local-zone-tag, and
|
||
local-zone-override. And added types always_transparent, always_refuse,
|
||
always_nxdomain with that.
|
||
* If more than half of tcp connections are in use, a shorter timeout
|
||
is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
|
||
* [bugzilla: 787 ] Fix #787: outgoing-interface netblock/64 ipv6
|
||
option to use linux freebind to use 64bits of entropy for every query
|
||
with random local part.
|
||
* For #787: prefer-ip6 option for unbound.conf prefers to send
|
||
upstream queries to ipv6 servers.
|
||
* Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
|
||
* keep debug symbols in windows build.
|
||
|
||
Bug Fixes
|
||
* [bugzilla: 778 ] Fix unbound 1.5.9: -h segfault (null deref).
|
||
* Fix unbound-anchor.exe file location defaults to Program Files with
|
||
(x86) appended.
|
||
* Fix to not ignore return value of chown() in daemon startup.
|
||
* Better help text from -h (from Ray Griffith).
|
||
* [bugzilla: 773 ] Fix Non-standard Python location build failure with
|
||
pyunbound.
|
||
* Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
|
||
* Revert fix for NetworkService account on windows due to breakage it
|
||
causes.
|
||
* Fix that windows install will not overwrite existing service.conf
|
||
file (and ignore gui config choices if it exists).
|
||
* And delete service.conf.shipped on uninstall.
|
||
* In unbound.conf directory: dir immediately changes to that
|
||
directory, so that include: file below that is relative to that
|
||
directory. With chroot, make the directory an absolute path inside chroot.
|
||
* do not delete service.conf on windows uninstall.
|
||
* document directory immediate fix and allow EXECUTABLE syntax in it
|
||
on windows.
|
||
* Fix directory: fix for unbound-checkconf, it restores cwd.
|
||
* Use QTYPE=A for QNAME minimisation.
|
||
* Keep track of number of time-outs when performing QNAME
|
||
minimisation. Stop minimising when number of time-outs for a QNAME/QTYPE
|
||
pair is more than three.
|
||
* [bugzilla: 775 ] Fix unbound-host and unbound-anchor crash on
|
||
windows, ignore null delete for wsaevent.
|
||
* Fix spelling in freebind option man page text.
|
||
* Fix windows link of ssl with crypt32.
|
||
* [bugzilla: 779 ] Fix Union casting is non-portable.
|
||
* [bugzilla: 780 ] Fix MAP_ANON not defined in HP-UX 11.31.
|
||
* [bugzilla: 781 ] Fix prealloc() is an HP-UX system library call.
|
||
* Decrease dp attempts at each QNAME minimisation iteration
|
||
* [bugzilla: 784 ] Fix Build configure assumess that having getpwnam
|
||
means there is endpwent function available.
|
||
* Updated repository with newer flex and bison output.
|
||
* Fix static compile on windows missing gdi32.
|
||
* Fix dynamic link of anchor-update.exe on windows.
|
||
* Fix detect of mingw for MXE package build.
|
||
* Fixes for 64bit windows compile.
|
||
* [bugzilla: 788 ] Fix for nettle 3.0: Failed to build with Nettle >=
|
||
3.0 and --with-libunbound-only --with-nettle.
|
||
* Fixed unbound.doxygen for 1.8.11.
|
||
* [bugzilla: 798 ] Fix Client-side TCP fast open fails (Linux).
|
||
* [bugzilla: 801 ] Fix missing error condition handling in
|
||
daemon_create_workers().
|
||
* [bugzilla: 802 ] Fix workaround for function parameters that are
|
||
"unused" without log_assert.
|
||
* [bugzilla: 803 ] Fix confusing (and incorrect) code comment in
|
||
daemon_cleanup().
|
||
* [bugzilla: 806 ] Fix wrong comment removed.
|
||
* use sendmsg instead of sendto for TFO.
|
||
* [bugzilla: 807 ] Fix workaround for possible some "unused" function
|
||
parameters in test code, from Jinmei Tatuya.
|
||
* Note that OPENPGPKEY type is RFC 7929.
|
||
* [bugzilla: 804 ] Fix #804: unbound stops responding after outage.
|
||
Fixes queries that attempt to wait for an empty list of subqueries.
|
||
* Fix for #804: lower num_target_queries for iterator also for failed
|
||
lookups.
|
||
* [bugzilla: 820 ] Fix set sldns_str2wire_rr_buf() dual meaning len
|
||
parameter in each iteration in find_tag_datas().
|
||
* [bugzilla: 777 ] Fix OpenSSL 1.1.0 compatibility, patch from
|
||
Sebastian A. Siewior.
|
||
* RFC 7958 is now out, updated docs for unbound-anchor.
|
||
* Fix for compile without warnings with openssl 1.1.0.
|
||
* [bugzilla: 826 ] Fix refuse_non_local could result in a broken response.
|
||
* iana portlist update.
|
||
* Fix compile with openssl 1.1.0 with api=1.1.0.
|
||
* [bugzilla: 829 ] Fix doc of sldns_wire2str_rdata_buf() return value
|
||
has an off-by-one typo, from Jinmei Tatuya (Infoblox).
|
||
* Fix incomplete prototypes reported by Dag-Erling Smørgrav.
|
||
* [bugzilla: 828 ] Fix missing type in access-control-tag-action
|
||
redirect results in NXDOMAIN.
|
||
* Take configured minimum TTL into consideration when reducing TTL to
|
||
original TTL from RRSIG.
|
||
* [bugzilla: 831 ] Fix workaround for spurious fread_chk warning
|
||
against petal.c
|
||
* Silenced flex-generated sign-unsigned warning print with gcc
|
||
diagnostic pragma.
|
||
* Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len.
|
||
* fix potential memory leak in daemon/remote.c and nullpointer
|
||
dereference in validator/autotrust.
|
||
* [bugzilla: 883 ] Fix error for duplicate local zone entry.
|
||
* [bugzilla: 835 ] Fix --disable-dsa with nettle verify.
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Jun 4 14:26:35 UTC 2016 - michael@stroeder.com
|
||
|
||
- update to 1.5.9
|
||
|
||
Features
|
||
* generic edns option parse and store code.
|
||
* Updated L root IPv6 address.
|
||
* User defined pluggable event API for libunbound
|
||
* ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for binding
|
||
to an IP address while the interface or address is down.
|
||
* OpenSSL 1.1.0 portability, --disable-dsa configure option.
|
||
* disable-dnssec-lame-check config option from Charles Walker.
|
||
|
||
Bug Fixes
|
||
* [bugzilla: 745 ]
|
||
* Fix unbound.py - idn2dname throws UnicodeError when idnname contains
|
||
trailing dot.
|
||
* configure tests for the weak attribute support by the compiler.
|
||
* [bugzilla: 747 ]
|
||
* Fix assert in outnet_serviced_query_stop.
|
||
* Updated configure and ltmain.sh.
|
||
* Fixup of compile fix for pluggable event API from P.Y. Adi Prasaja.
|
||
* Fixup backend2str for libev.
|
||
* Fix libev usage of dispatch return value.
|
||
* No side effects in tolower() call, in case it is a macro.
|
||
* Fix warnings in ifdef corner case, older or unknown libevent.
|
||
* Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma.
|
||
* Fix ip-transparent for tcp on freebsd.
|
||
* [bugzilla: 746 ]
|
||
* Fix unbound sets CD bit on all forwards. If no trust anchors, it'll not
|
||
set CD bit when forwarding to another server. If a trust anchor, no CD
|
||
bit on the first attempt to a forwarder, but CD bit thereafter on
|
||
repeated attempts to get DNSSEC.
|
||
* Limit number of QNAME minimisation iterations.
|
||
* Validate QNAME minimised NXDOMAIN responses.
|
||
* If QNAME minimisation is enabled, do cache lookup for QTYPE NS in
|
||
harden-below-nxdomain.
|
||
* Fix compile of getentropy_linux for SLES11 servicepack 4.
|
||
* Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev.
|
||
* Fix test for openssl to use HMAC_Update for 1.1.0.
|
||
* ERR_remove_state deprecated since openssl 1.0.0.
|
||
* OPENSSL_config is deprecated, removing.
|
||
* Document permit-small-holddown for 5011 debug.
|
||
* [bugzilla: 749 ]
|
||
* Fix unbound-checkconf gets SIGSEGV when use against a malformatted
|
||
conf file.
|
||
* [bugzilla: 753 ]
|
||
* Fix document dump_requestlist is for first thread.
|
||
* Fix some malformed reponses to edns queries get fallback to nonedns.
|
||
* [bugzilla: 759 ]
|
||
* Fix 0x20 capsforid no longer checks type PTR, for compatibility with
|
||
cisco dns guard. This lowers false positives.
|
||
* Fix sldns with static checking fixes copied from getdns.
|
||
* Fix memory leak in out-of-memory conditions of local zone add.
|
||
* [bugzilla: 761 ]
|
||
* Fix DNSSEC LAME false positive resolving nic.club.
|
||
* [bugzilla: 766 ]
|
||
* Fix dns64 should synthesize results on timeout/errors.
|
||
* No QNAME minimisation fall-back for NXDOMAIN answers from
|
||
DNSSEC signed zones.
|
||
* [bugzilla: 767 ]
|
||
* Fix Reference to an expired Internet-Draft in harden-below-nxdomain
|
||
documentation.
|
||
* remove memory leak from lame-check patch.
|
||
* [bugzilla: 770 ]
|
||
* Fix Small subgroup attack on DH used in unix pipe on localhost if
|
||
unbound control uses a unix local named pipe.
|
||
* Document write permission to directory of trust anchor needed.
|
||
* [bugzilla: 768 ]
|
||
* Fix Unbound Service Sometimes Can Not Shutdown Completely, WER Report
|
||
Shown Up. Close handle before closing WSA.
|
||
* Fix time in case answer comes from cache in ub_resolve_event().
|
||
* Fix windows service to be created run with limited rights, as a network
|
||
service account, from Mario Turschmann.
|
||
* [bugzilla: 752 ]
|
||
* Fix retry resource temporarily unavailable on control pipe.
|
||
* iana ports fetched via https.
|
||
* iana portlist update.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Feb 25 10:07:47 UTC 2016 - michael@stroeder.com
|
||
|
||
- update to 1.5.8
|
||
|
||
Features
|
||
* ip-transparent option for FreeBSD with IP_BINDANY socket option.
|
||
* insecure-lan-zones: yesno config option, patch from Dag-Erling
|
||
Smørgrav.
|
||
* RR Type CSYNC support RFC 7477, in debug printout and config input.
|
||
* RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
|
||
* [bugzilla: 731 ] tcp-mss, outgoing-tcp-mss options for unbound.conf,
|
||
patch from Daisuke Higashi.
|
||
* Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
|
||
by default, and can be unblocked with "nodefault" localzone config.
|
||
* ub_ctx_set_stub() function for libunbound to config stub zones.
|
||
|
||
Bug Fixes
|
||
* Fix that NSEC3 negative cache is used when there is no salt.
|
||
* sorted ubsyms.def file with exported libunbound functions.
|
||
* Print understandable debug log when unusable DS record is seen.
|
||
* load gost algorithm if digest is seen before key algorithm.
|
||
* Fix that "make install" fails due to "text file busy" error.
|
||
* Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
|
||
* wait for sendto to drain socket buffers when they are full.
|
||
* Neater cmdline_verbose increment patch from Edgar Pettijohn.
|
||
* Made netbsd sendmsg test nonfatal, in case of false positives.
|
||
* [bugzilla: 741 ] Fix: log message for dnstap socket connection is
|
||
more clear.
|
||
* [bugzilla: 734 ] Fix: chown the pidfile if it resides inside the
|
||
chroot.
|
||
* Fix cmsg alignment for argument to sendmsg on NetBSD.
|
||
* Fix that unbound complains about unimplemented IP_PKTINFO for
|
||
sendmsg on NetBSD (for interface-automatic).
|
||
* [bugzilla: 738 ] Fix: Swig should not be invoked with CPPFLAGS.
|
||
* Squelch 'cannot assign requested address' log messages unless
|
||
verbosity is high, it was spammed after network down.
|
||
* Fix to simplify empty string checking from Michael McConville.
|
||
* [bugzilla: 734 ] Fix: Do not log an error when the PID file cannot
|
||
be chown'ed. Patch from Simon Deziel.
|
||
* Fix test if -pthreads unused to use better grep for portability.
|
||
* Fix mingw crosscompile for recent mingw.
|
||
* Update aclocal, autoconf output with new versions (1.15, 2.4.6).
|
||
* Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
|
||
for Linux glibc 2.20.
|
||
* Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
|
||
source code, so it applies cleanly again. Removed unused variable
|
||
warnings.
|
||
* [bugzilla: 729 ] Fix: omit use of escape sequences in echo since
|
||
they are not portable (unbound-control-setup).
|
||
* remove NULL-checks before free, patch from Michael McConville.
|
||
* updated ax_pthread.m4 to version 21 with clang support, this removes
|
||
a warning from compilation.
|
||
* OSX portability, detect if sbrk is deprecated.
|
||
* OSX clang, stop -pthread unused during link stage warnings.
|
||
* OSX clang new flto check.
|
||
* iana portlist update.
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Feb 23 16:03:46 UTC 2016 - mrueckert@suse.de
|
||
|
||
- also conflict the shlib package
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Feb 22 15:22:05 UTC 2016 - mrueckert@suse.de
|
||
|
||
- add libunbound-devel-mini-rpmlintrc as source
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Feb 17 15:55:34 UTC 2016 - mrueckert@suse.de
|
||
|
||
- revert the previous change which would not solve the problem as
|
||
the library package requires the unbound-anchor package
|
||
instead introduce a libunbound-devel-mini package which holds the
|
||
shared library and devel files with a minimal build requires.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Feb 4 13:01:35 UTC 2016 - meissner@suse.com
|
||
|
||
- split off a libunbound package with less buildrequires to
|
||
allow shorter buildcycles when built by gnutls. bsc#964346
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Dec 10 11:48:46 UTC 2015 - michael@stroeder.com
|
||
|
||
- update to 1.5.7
|
||
|
||
Features
|
||
* Fix #594. libunbound: optionally use libnettle for crypto.
|
||
Contributed by Luca Bruno. Added --with-nettle for use with
|
||
--with-libunbound-only.
|
||
* Implemented qname minimisation
|
||
|
||
Bug Fixes
|
||
* Fix #712: unbound-anchor appears to not fsync root.key.
|
||
* Fix #714: Document config to block private-address for IPv4
|
||
mapped IPv6 addresses.
|
||
* portability, replace snprintf if return value broken
|
||
* portability fixes.
|
||
* detect libexpat without xml_StopParser function.
|
||
* isblank() compat implementation.
|
||
* patch from Doug Hogan for SSL_OP_NO_SSLvx options.
|
||
* Fix #716: nodata proof with empty non-terminals and wildcards.
|
||
* Fix #718: Fix unbound-control-setup with support for env
|
||
without HEREDOC bash support.
|
||
* ACX_SSL_CHECKS no longer adds -ldl needlessly.
|
||
* Change example.conf: ftp.internic.net to https://www.internic.net
|
||
* Fix for lenient accept of reverse order DNAME and CNAME.
|
||
* spelling fixes from Igor Sobrado Delgado.
|
||
* Fix that malformed EDNS query gets a response without malformed EDNS.
|
||
* Added assert on rrset cache correctness.
|
||
* Fix #720: add windows scripts to zip bundle,
|
||
and fix unbound-control-setup windows batch file.
|
||
* Fix for #724: conf syntax to read files from run dir (on Windows).
|
||
And fix PCA prompt for unbound-service-install.exe.
|
||
And add Changelog to windows binary dist.
|
||
* .gitignore for git users.
|
||
* iana portlist update.
|
||
* Removed unneeded whitespace from example.conf.
|
||
* Do not minimise forwarded requests.
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Oct 15 19:31:43 UTC 2015 - michael@stroeder.com
|
||
|
||
- update to 1.5.6
|
||
Features
|
||
- Default for ssl-port is port 853, the temporary port assignment for
|
||
secure domain name system traffic. If you used to rely on the older
|
||
default of port 443, you have to put a clause in unbound.conf for
|
||
that. The new value is likely going to be the standardised port number
|
||
for this traffic.
|
||
- ANY responses include DNAME records if present, as per Evan Hunt's
|
||
remark in dnsop.
|
||
|
||
Bug Fixes
|
||
- Fix segfault in the dns64 module in the formaterror error path.
|
||
- Fix manpage to suggest using SIGTERM to terminate the server.
|
||
- iana portlist update.
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Oct 10 09:31:40 UTC 2015 - michael@stroeder.com
|
||
|
||
- ignore absence of the systemd-tmpfiles command
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Oct 6 14:21:00 UTC 2015 - mrueckert@suse.de
|
||
|
||
- update to 1.5.5
|
||
Features
|
||
- Change default of harden-algo-downgrade to off. This is lenient
|
||
for algorithm rollover.
|
||
- Added permit-small-holddown config to debug fast 5011 rollover.
|
||
- Allow certificate chain files to allow for intermediate
|
||
certificates. (thanks Daniel Kahn Gillmor)
|
||
- Enable ECDHE for servers. Where available, use
|
||
SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations
|
||
to enable ECDHE. Otherwise, manually offer curve p256. Client
|
||
connections should automatically use ECDHE when available.
|
||
(thanks Daniel Kahn Gillmor)
|
||
- Feature --enable-pie option to that builds PIE binary.
|
||
[bugzilla: 699 ]
|
||
- Feature --enable-relro-now option that enables full read-only
|
||
relocation. [bugzilla: 700 ]
|
||
- New IPs for for h.root-servers.net. [bugzilla: 702 ]
|
||
Bug Fixes
|
||
- Fix setting forwarders with unbound-control forward implicitly
|
||
turns on forward-first. [bugzilla: 681 ]
|
||
- Fix that reload fails when so-reuseport is yes after changing
|
||
num-threads. [bugzilla: 690 ]
|
||
- please afl-gcc (llvm) for uninitialised variable warning.
|
||
- Fix mktime in unbound-anchor not using UTC.
|
||
- Fix 5011 anchor update timer after reload.
|
||
- 5011 implementation does not insist on all algorithms, when
|
||
harden-algo-downgrade is turned off.
|
||
- Document in the manual more text about configuring locally
|
||
served zones.
|
||
- Document that local-zone nodefault matches exactly and
|
||
transparent can be used to release a subzone.
|
||
- Fix that configure script does not detect LibreSSL 2.2.2
|
||
[bugzilla: 694 ]
|
||
- Fix deadlock for local data add and zone add when
|
||
unbound-control list_local_data printout is interrupted.
|
||
- Fix get PY_MAJOR_VERSION failure at configure for python 2.4 to
|
||
2.6. [bugzilla: 697 ]
|
||
- changed windows setup compression to be more transparent.
|
||
- Fix config globbed include chroot treatment, this fixes reload
|
||
of globs (patch from Dag-Erling Smørgrav).
|
||
- Fix ub_ctx_set_fwd() return value mishandled on windows.
|
||
[bugzilla: 705 ]
|
||
- Fix minor error in unbound.conf.5.in.
|
||
- Fix unbound.conf(5) access-control description for precedence
|
||
and default.
|
||
- Fix unbound-control flush that does not succeed in removing
|
||
data.
|
||
- MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution
|
||
failures.
|
||
- iana portlist update.
|
||
- remove manual hacks for relro,now and pie and replace them with
|
||
official configure options.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 4 13:37:38 UTC 2015 - mrueckert@suse.de
|
||
|
||
- enable event api
|
||
- enable dnstap support
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Jul 9 10:16:32 UTC 2015 - michael@stroeder.com
|
||
|
||
- update to 1.5.4
|
||
|
||
Features
|
||
- [bugzilla: 644 ] harden-algo-downgrade option, if turned off,
|
||
fixes the reported excessive validation failure when multiple
|
||
algorithms are present. If set to 'no', it allows the weakest
|
||
algorithm to validate the zone.
|
||
- stats reports tcp usage, of incoming-num-tcp buffers.
|
||
- contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
|
||
scripts. Contributed by Yuri Voinov.
|
||
- Add ip-transparent config option for bind to non-local addresses.
|
||
- Synthesize ANY responses from cache. Does not search exhaustively,
|
||
but MX,A,AAAA,SOA,NS also CNAME.
|
||
- unbound-control list_insecure command shows the negative trust
|
||
anchors currently configured, patch from Jelte Jansen.
|
||
- ratelimit feature, ratelimit: 1000, can be used to turn it on. It
|
||
ratelimits recursion effort per zone. For particular names you can
|
||
configure exceptions in unbound.conf.
|
||
- Ratelimit does not apply to prefetched queries, and
|
||
ratelimit-factor is default 10. Repeated normal queries get resolved
|
||
and with prefetch stay in the cache.
|
||
- unbound-control ratelimit_list lists high rate domains.
|
||
- caps-whitelist in unbound.conf allows whitelist of loadbalancers
|
||
that cannot work with caps-for-id or its fallback.
|
||
- RFC 7553 RR type URI support, is now enabled by default.
|
||
- cache-max-negative-ttl config option, default 3600.
|
||
- Add local-zone type inform_deny, that logs query and drops answer.
|
||
|
||
Bug Fixes
|
||
- Unbound exits with a fatal error when the auto-trust-anchor-file
|
||
fails to be writable. This is seconds after startup. You can load a
|
||
readonly auto-trust-anchor-file with trust-anchor-file. The file has
|
||
to be writable to notice the trust anchor change, without it, a trust
|
||
anchor change will be unnoticed and the system will then become
|
||
inoperable.
|
||
- DLV is going to be decommissioned. Advice to stop using it, and
|
||
put text in the example configuration and man page to that effect.
|
||
- Patch from Brad Smith that syncs compat/getentropy_linux with
|
||
OpenBSD's version (2015-03-04).
|
||
- 0x20 fallback improved: servfail responses do not count as missing
|
||
comparisons (except if all responses are errors), inability to find
|
||
nameservers does not fail equality comparisons, many nameservers does
|
||
not try to compare more than max-sent-count, parse failures start 0x20
|
||
fallback procedure.
|
||
- store caps_response with best response in case downgrade response
|
||
happens to be the last one.
|
||
- Document that incoming-num-tcp increase is good for large servers.
|
||
- Fix lintian warning in unbound-checkconf man page (from Andreas
|
||
Schulze).
|
||
- Updated default keylength in unbound-control-setup to 3k.
|
||
- Fixup compile on cygwin, more portable openssl thread id.
|
||
- Use reallocarray for integer overflow protection, patch submitted
|
||
by Loganaden Velvindron.
|
||
- Fixed to add integer overflow checks on allocation (defense in depth).
|
||
- Fix segfault on user not found at startup (from Maciej Soltysiak).
|
||
- [bugzilla: 657 ] Fix that libunbound(3) recommends deprecated
|
||
CRYPTO_set_id_callback.
|
||
- If unknown trust anchor algorithm, and libressl is used, error
|
||
message encourages upgrade of the libressl package.
|
||
- rename ldns subdirectory to sldns to avoid name collision.
|
||
- [bugzilla: 660 ] Fix interface-automatic broken in the presence of
|
||
asymmetric routing.
|
||
- Libunbound skips dos-line-endings from etc/hosts.
|
||
- Fix crash in dnstap: Do not try to log TCP responses after timeout.
|
||
- Fix that get_option for cache-sizes does not print double newline.
|
||
- [bugzilla: 663 ] Fix that ssl handshake fails when using unix
|
||
socket because dh size is too small.
|
||
- [bugzilla: 664 ] libunbound python3 related fixes (from Tomas
|
||
Hozza); Use print_function also for Python2. libunbound examples:
|
||
produce sorted output. libunbound-Python: libldns is not used anymore.
|
||
Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
|
||
- Fix leaked dns64prefix configuration string.
|
||
- Removed contrib/unbound_unixsock.diff, because it has been
|
||
integrated, use control-interface: /path in unbound.conf.
|
||
- Change syntax of particular validator error to be easier for
|
||
machine parse, swap rrset and ip adres info so it looks like:
|
||
validation failure <www.example.nl. TXT IN>: signature crypto failed
|
||
from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
|
||
- Fix that unparseable error responses are ratelimited.
|
||
- SOA negative TTL is capped at minimumttl in its rdata section.
|
||
- [bugzilla: 674 ] Do not free pointers given by getenv.
|
||
- [bugzilla: 677 ] Fix CNAME corresponding to a DNAME was checked
|
||
incorrectly and was therefore always synthesized (thanks to Valentin
|
||
Dietrich). And fix DNAME responses from cache that failed internal
|
||
chain test.
|
||
- iana portlist update.
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Apr 24 13:53:53 UTC 2015 - michael@stroeder.com
|
||
|
||
- update to 1.5.3
|
||
- Bug Fixes
|
||
[bugzilla: 647 ]
|
||
Fix #647 crash in 1.5.2 because pwd.db no longer accessible after reload.
|
||
[bugzilla: 645 ]
|
||
Fix #645 Portability to Solaris 10, use AF_LOCAL.
|
||
[bugzilla: 646 ]
|
||
Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
|
||
Use the getrandom syscall introduced in Linux 3.17 (from Heiner Kallweit).
|
||
|
||
-------------------------------------------------------------------
|
||
Thu Feb 19 23:35:58 UTC 2015 - mrueckert@suse.de
|
||
|
||
- update to 1.5.2
|
||
- Features
|
||
- local-zone: example.com inform makes unbound log a message
|
||
with client IP for queries in that zone. Eg. for finding
|
||
infected hosts.
|
||
- patch from Stephane Lapie that adds to the python API, that
|
||
exposes struct delegpt, and adds the find_delegation
|
||
function.
|
||
- Updated contrib warmup.cmd/sh to support two modes - load
|
||
from pre-defined list of domains or (with filename as
|
||
argument) load from user-specified list of domains, and
|
||
updated contrib unbound_cache.sh/cmd to support
|
||
loading/save/reload cache to/from default path or (with
|
||
secondary argument) arbitrary path/filename, from Yuri
|
||
Voinov.
|
||
- patch for remote control over local sockets, from Dag-Erling
|
||
Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and
|
||
control-use-cert: no.
|
||
- unbound-checkconf -f prints chroot with pidfile path.
|
||
- infra-cache-min-rtt patch from Florian Riehm, for expected
|
||
long uplink roundtrip times.
|
||
- Bug Fixes
|
||
- config.guess and config.sub update from libtoolize.
|
||
- getauxval test for ppc64 linux compatibility.
|
||
- make strip works for unbound-host and unbound-anchor.
|
||
- print query name when max target count is exceeded.
|
||
- patch from Stuart Henderson that fixes DESTDIR in
|
||
unbound-control-setup for installs where config is not in the
|
||
prefix location.
|
||
- [bugzilla: 634 ] Fix #634: fix fail to start on Linux LTS
|
||
3.14.X, ignores missing IP_MTU_DISCOVER OMIT option (fix from
|
||
Remi Gacogne).
|
||
- Patch from Philip Paeps to contrib/unbound_munin_ that uses
|
||
type ABSOLUTE. Allows munin.conf: [idleserver.example.net]
|
||
unbound_munin_hits.graph_period minute
|
||
- Fix pyunbound ord call, portable for python 2 and 3.
|
||
- Fix unintended use of gcc extension for incomplete enum
|
||
types, compile with pedantic c99 compliance (from Daniel
|
||
Dickman).
|
||
- Fix pyunbound byte string representation for python3.
|
||
- Fix 0x20 capsforid fallback to omit gratuitous NS and
|
||
additional section changes.
|
||
- Fix validation failure in case upstream forwarder (ISC BIND)
|
||
does not have the same trust anchors and decides to insert
|
||
unsigned NS record in authority section.
|
||
- Fix scrubber with harden-glue turned off to reject NS (and
|
||
other not-address) records.
|
||
- iana portlist update.
|
||
- [bugzilla: 643 ] Fix doc/example.conf.in: unnecessary
|
||
whitespace.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Dec 8 16:12:23 UTC 2014 - mrueckert@suse.de
|
||
|
||
- update to 1.5.1 (boo# 908990)
|
||
Features
|
||
- Patch from Stephane Lapie for ASAHI Net that implements
|
||
aaaa-filter, added to contrib/aaaa-filter-iterator.patch.
|
||
Bug Fixes
|
||
- Fix that CD flag disables DNS64 processing, returning the
|
||
DNSSEC signed AAAA denial.
|
||
- Fix compat/getentropy_win.c check if CryptGenRandom works and
|
||
no immediate exit on windows.
|
||
- Fix crash on multiple thread random usage on systems without
|
||
arc4random.
|
||
- Fix log at high verbosity and memory allocation failure.
|
||
- Fix libunbound undefined symbol errors for main.
|
||
- Patch from Robert Edmonds to build pyunbound python module
|
||
differently. No versioninfo, with -shared and without $(LIBS).
|
||
- Patch from Robert Edmonds fixes hyphens in unbound-anchor man
|
||
page.
|
||
- Removed 'increased limit open files' log message that is
|
||
written to console. It is only written on verbosity 4 and
|
||
higher. This keeps system bootup console cleaner.
|
||
- Patch from James Raftery, always print stats for rcodes 0..5.
|
||
- [bugzilla: 627 ] Fix SSL_CTX_load_verify_locations return code
|
||
not properly checked.
|
||
- Fix makefile for build from noexec source tree.
|
||
- Add include to getentropy_linux.c, fixing debian build.
|
||
- [bugzilla: 632 ] Fix that unbound fails to build on AArch64,
|
||
protects getentropy compat code from calling sysctl if it is
|
||
has been removed.
|
||
- Fix CVE-2014-8602: denial of service by making resolver chase
|
||
endless series of delegations.
|
||
- changes in 1.5.0
|
||
Features
|
||
- This release has DNS64, DNSTAP, better random numbers and
|
||
ub_ctx_add_ta_autr(), num.query.tcpout=value, flush_negative,
|
||
unblock-lan-zones conf.
|
||
- C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root
|
||
hints (patch from Anand Buddhdev).
|
||
- Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation
|
||
option for DNS fragmentation defense.
|
||
- unbound-control stats prints num.query.tcpout with number of
|
||
TCP outgoing queries made in the previous statistics interval.
|
||
- Patch from Jeremie Courreges-Anglas to use arc4random_uniform
|
||
if available on the OS, it gets entropy from the OS.
|
||
- Add unbound-control flush_negative that flushed nxdomains,
|
||
nodata, and errors from the cache. For dnssec-trigger and
|
||
NetworkManager, fixes cases where network changes have
|
||
localdata that was already negatively cached from the previous
|
||
network.
|
||
- Contrib windows scripts from Yuri Voinov added to src/contrib:
|
||
create_unbound_ad_servers.cmd: enters anti-ad server lists.
|
||
unbound_cache.cmd: saves and loads the cache. Also warmup.cmd
|
||
(and .sh): warm up the DNS cache with your MRU domains.
|
||
- Added unbound-control-setup.cmd from Yuri Voinov to the windows
|
||
unbound distribution set. It requires openssl installed in
|
||
%PATH%.
|
||
- Implement draft-ietf-dnsop-rfc6598-rfc6303-01.
|
||
- Feature, unblock-lan-zones: yesno that you can use to make
|
||
unbound perform 10.0.0.0/8 and other reverse lookups normally,
|
||
for use if unbound is running service for localhost on localhost.
|
||
- unbound-host -D enabled dnssec and reads root trust anchor from
|
||
the default root key file that was compiled in.
|
||
- Add AAAA for B root server to default root hints.
|
||
- unbound-control status reports if so-reuseport was successful.
|
||
- so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X.
|
||
- arc4random in compat/ and getentropy, explicit_bzero, chacha
|
||
for dependencies, from OpenBSD. arc4_lock and sha512 in compat.
|
||
This makes arc4random available on all platforms, except when
|
||
compiled with LIBNSS (it uses libNSS crypto random).
|
||
- Patch from Dag-Erling Smorgrav that implements that: unbound
|
||
-dd does not fork in the background and also logs to stderr.
|
||
- DNS64 from Viagenie (BSD Licensed), written by Simon Perrault.
|
||
Initial commit of the patch from the FreeBSD base (with its
|
||
fixes). This adds a module (for module-config in unbound.conf)
|
||
dns64 that performs DNS64 processing, see README.DNS64.
|
||
- Patch add msg, rrset, infra and key cache sizes to stats
|
||
command from Maciej Soltysiak.
|
||
- DNSTAP support, with a patch from Farsight Security, written by
|
||
Robert Edmonds. The --enable-dnstap needs libfstrm and
|
||
protobuf-c. It is BSD licensed (see dnstap/dnstap.c). Also
|
||
--with-libfstrm and --with-protobuf-c configure options.
|
||
- type CDS and CDNSKEY types.
|
||
- Updated the TCP_BACLOG from 5 to 256, so that the tcp accept
|
||
queue is longer and more tcp connections can be handled.
|
||
- Add ub_ctx_add_ta_autr function to add a RFC5011 automatically
|
||
tracked trust anchor to libunbound.
|
||
Bug Fixes
|
||
- Fix print filename of encompassing config file on read failure.
|
||
- Patch from Stuart Henderson to build unbound-host man from
|
||
.1.in.
|
||
- [bugzilla: 569] Fix do_tcp is do-tcp in unbound.conf man page.
|
||
- [bugzilla: 572] Fix unit test failure for systems with
|
||
different /etc/ services.
|
||
- iana portlist updated.
|
||
- [bugzilla: 574] Fix make test fails on Ubuntu 14.04. Disabled
|
||
remote-control in testbound scripts.
|
||
- Documented that dump_requestlist only prints queries from
|
||
thread 0.
|
||
- [bugzilla: 567] Fix unbound lists if forward zone is secure or
|
||
insecure with +i annotation in output of list_forwards, also
|
||
for list_stubs (for NetworkManager integration). And remove ':'
|
||
from output of stub and forward lists, this is easier to parse.
|
||
- [bugzilla: 554] Fix use unsigned long to print 64bit statistics
|
||
counters on 64bit systems.
|
||
- [bugzilla: 558] Fix failed prefetch lookup does not remove
|
||
cached response but delays next prefetch (in lieu of caching a
|
||
SERVFAIL).
|
||
- [bugzilla: 545] Fix improved logging, the ip address of the
|
||
error is printed on the same log-line as the error.
|
||
- [bugzilla: 502] Fix explain that do-ip6 disable does not stop
|
||
AAAA lookups, but it stops the use of the ipv6 transport layer
|
||
for DNS traffic.
|
||
- Fix compile with libevent2 on FreeBSD.
|
||
- Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier.
|
||
- Fixup out-of-directory compile with unbound-control-setup.sh.in.
|
||
- Code cleanup patch from Dag-Erling Smorgrav, with compiler
|
||
issue fixes from FreeBSD's copy of Unbound, he notes: Generate
|
||
unbound-control-setup.sh at build time so it respects prefix
|
||
and sysconfdir from the configure script. Also fix the umask
|
||
to match the comment, and the comment to match the umask. Add
|
||
const and static where needed. Use unions instead of playing
|
||
pointer poker. Move declarations that are needed in multiple
|
||
source files into a shared header. Move sldns_bgetc() from
|
||
parse.c to buffer.c where it belongs. Introduce a new header
|
||
file, worker.h, which declares the callbacks that all workers
|
||
must define. Remove those declarations from libworker.h.
|
||
Include the correct headers in the correct places. Fix a few
|
||
dummy callbacks that don't match their prototype. Fix some
|
||
casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. Remove a
|
||
useless printf which breaks reproducible builds. Get rid of
|
||
CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're no longer
|
||
used. Add unbound-control-setup.sh to the list of generated
|
||
files. The prototype for libworker_event_done_cb() needs to be
|
||
moved from libunbound/libworker.h to libunbound/worker.h.
|
||
- Fix caps-for-id fallback, and added fallback attempt when
|
||
servers drop 0x20 perturbed queries.
|
||
- [bugzilla: 593] Fix segfault or crash upon rotating logfile.
|
||
- fake-rfc2553 patch (thanks Benjamin Baier).
|
||
- LibreSSL provides compat items, check for that in configure.
|
||
- [bugzilla: 596] Bail out of unbound-control list_local_zones
|
||
when ssl write fails.
|
||
- Fix endian.h include for OpenBSD.
|
||
- [bugzilla: 603] Fix unbound-checkconf -o option should skip
|
||
verification checks.
|
||
- Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings.
|
||
- Update unbound manpage with more explanation (from Florian Obser).
|
||
- Fix tcp timer waiting list removal code.
|
||
- patches to also build with Python 3.x (from Pavel Simerda).
|
||
- improve python configuration detection to build on Fedora 22.
|
||
- Fix swig and python examples for Python 3.x.
|
||
- Fix for mingw compile with openssl-1.0.1i.
|
||
- [bugzilla: 612] Fix create service with service.conf in present
|
||
directory and auto load it.
|
||
- [bugzilla: 613] Allow tab ws in var length last rdfs (in ldns
|
||
str2wire).
|
||
- [bugzilla: 614] Fix man page variable substitution bug.
|
||
- Whitespaces after $ORIGIN are not part of the origin dname
|
||
(ldns).
|
||
- $TTL's value starts at position 5 (ldns).
|
||
- Fix unbound-checkconf check for module config with dns64
|
||
module.
|
||
- Fix unbound capsforid fallback, it ignores TTLs in comparison.
|
||
- [bugzilla: 617] Fix in ldns in unbound, lowercase WKS services.
|
||
- Fix ctype invocation casts.
|
||
- Disabled use of SSLv3 in remote-control and ssl-upstream.
|
||
- Redefine internal minievent symbols to unique symbols that
|
||
helps linking on platforms where the linker leaks names across
|
||
modules.
|
||
- Fix bug where forward or stub addresses with same address but
|
||
different port number were not tried.
|
||
|
||
-------------------------------------------------------------------
|
||
Mon Nov 10 00:45:00 UTC 2014 - Led <ledest@gmail.com>
|
||
|
||
- fix bashisms in pre script
|
||
|
||
-------------------------------------------------------------------
|
||
Fri Sep 5 13:32:55 UTC 2014 - darin@darins.net
|
||
|
||
- cleanup .spec
|
||
- removed unused packes
|
||
|
||
-------------------------------------------------------------------
|
||
Tue Sep 2 13:21:55 UTC 2014 - darin@darins.net
|
||
|
||
- disable %check until https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=602 is fixed
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 20 13:34:00 UTC 2014 - darin@darins.net
|
||
|
||
- Added firewall service file
|
||
|
||
-------------------------------------------------------------------
|
||
Wed Aug 13 20:00:21 UTC 2014 - darin@darins.net
|
||
|
||
- upadte to 1.4.22
|
||
- use /run for pid to clear dir-or-file-in-var-run in factory
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Dec 28 13:32:06 UTC 2013 - mrueckert@suse.de
|
||
|
||
- fixed the execstartpre for unbound so we actually call
|
||
unbound-anchor now.
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Dec 28 13:29:56 UTC 2013 - mrueckert@suse.de
|
||
|
||
- fixed a few rpmlint warnings
|
||
- added unbound-rpmlintrc: files duplicate on those man page
|
||
links
|
||
- changed symlink to /usr/sbin/service
|
||
- improved descriptions
|
||
|
||
-------------------------------------------------------------------
|
||
Sat Dec 28 04:02:56 UTC 2013 - mrueckert@suse.de
|
||
|
||
- update to 1.4.21
|
||
merged lots of stuff from the fedora package
|
||
- added python/munin/shlib/anchor subpackages
|
||
- currently the package only supports systemd
|
||
|
||
-------------------------------------------------------------------
|
||
Wed May 21 03:50:15 CEST 2008 - mrueckert@suse.de
|
||
|
||
- initial package
|
||
|