Commit Graph
8538 Commits
Author SHA1 Message Date
W.C.A. Wijngaards 48d0aea60a - auth-load-thread, unit test for auth_load_http. 2026-08-11 16:50:24 +02:00
W.C.A. Wijngaards 17bbcac979 - auth-load-thread, fix buffer free in http processing. 2026-08-11 16:50:00 +02:00
W.C.A. Wijngaards fd8ebbb19c Merge branch 'master' into auth-load-thread 2026-08-11 16:23:20 +02:00
W.C.A. Wijngaards 2adbbea365 - auth-load-thread, print thread details in log at high verbosity, 8. 2026-08-11 16:23:03 +02:00
W.C.A. Wijngaards 8ee0bca833 - Fix stat_values.tdir test to have less test failures. 2026-08-11 10:07:38 +02:00
W.C.A. Wijngaards c58e6add2b - Fix #1492 from zacek: Data race in log_init() on
key_created/log_lock when calling ub_ctx_create()
  concurrently from multiple threads.
2026-08-11 09:42:30 +02:00
W.C.A. Wijngaards 156c00a727 Merge branch 'master' into auth-load-thread 2026-08-10 16:42:59 +02:00
W.C.A. Wijngaards d753f95956 - auth-load-thread, print time taken during auth load processing. 2026-08-10 16:42:04 +02:00
W.C.A. Wijngaards 93a56205cf - Fix #1489 from jplesnik: Replace removed Python 2 C API
macros for SWIG 4.5.0 compatibility.
2026-08-07 08:57:32 +02:00
W.C.A. Wijngaards 709f622658 Note issue number in Changlog entry. 2026-08-06 17:15:55 +02:00
akhanin-dnsfandGitHub 307fc6f062 - Fix bounds check in packed_rr_to_string, it checked the (#1488)
assembled rr length against the output string length
  dest_len, instead of against the size of the rr buffer it
  writes into. Callers in cachedump.c and remote.c pass a
  dest_len larger than that buffer.
- Unit test for packed_rr_to_string.
2026-08-06 17:04:05 +02:00
W.C.A. Wijngaards 8b33c5d7ff - Fix #1487: regression in 1.26.0, ipsecmod is now always
partly enabled.
2026-08-06 09:46:18 +02:00
W.C.A. Wijngaards 36bd52afb9 Fix typo in Changelog. 2026-08-06 09:08:33 +02:00
W.C.A. Wijngaards b7d13ff12b - Fix ##1485: the list_forwards command omits port numbers.
The list_forwards and list_stubs commands for
  unbound-control print port and tls auth name.
2026-08-06 09:08:17 +02:00
W.C.A. Wijngaards bdfcfb861f - Fix to set makedist.sh to not wget config.sub and
config.guess from git repo. The fetch times out, and the
  version from libtoolize is much more recent now than
  that it was when the wget was added.
2026-08-04 10:04:34 +02:00
W.C.A. Wijngaards b444deffd2 Note 1.26.0 release. 2026-08-04 10:01:59 +02:00
W.C.A. Wijngaards ff28b7e5cf - For #1483: The failure reason when an NSEC NXDOMAIN is
encountered when looking for an insecure delegation, is
  fixed to mention the NSEC records, instead of nonexistent
  NSEC3 records, that it attempted.
2026-07-31 09:53:47 +02:00
W.C.A. Wijngaards 79b84bbc91 - Fix #1482: DNS-over-QUIC doesn't work with simple config.
That fixes interface-automatic for use with doq service.
2026-07-30 08:24:42 +02:00
W.C.A. Wijngaards cbfc3b0342 - Tag for 1.26.0rc1. The repo continues with version 1.26.1. 2026-07-28 09:45:59 +02:00
W.C.A. Wijngaards a45da353d3 - Fix to call OPENSSL_cleanup on exit when that is defined. release-1.26.0rc1 release-1.26.0 2026-07-24 17:04:38 +02:00
W.C.A. Wijngaards c21e3ee929 Changelog note for #1479
- Merge #1479 from psumbera: Fix pthread detection on
  Solaris 11.4.
2026-07-24 15:35:55 +02:00
8a38bed262 Fix pthread detection on Solaris 11.4 (#1479)
AX_PTHREAD requires _REENTRANT to confirm that pthread support is enabled.
Solaris 11.4 headers no longer use the macro, and GCC 16 therefore no
longer defines it for -pthread.

Detect XPG7 support in the target headers and require _REENTRANT only on
older Solaris releases. The existing pthread compile and link test remains
the final capability check.

This follows the canonical Autoconf Archive change:
https://github.com/autoconf-archive/autoconf-archive/pull/341

Regenerate configure with Autoconf 2.71.

Tested on Solaris 11.4 with GCC 15.2 and GCC 16.1. The Autoconf Archive
change was also tested on Solaris 11.3.

Co-authored-by: Rainer Orth <ro@CeBiTec.Uni-Bielefeld.DE>
2026-07-24 15:34:18 +02:00
W.C.A. Wijngaards 7cc7a43ff6 Changelog note for #1481.
- Fix #1481: Fix to use tls-port after referral if
  tls-upstream is set.
2026-07-24 15:32:20 +02:00
W.C.A. Wijngaards 9bd8df0149 - Fix to use tls-port after referral if tls-upstream is set. 2026-07-24 15:31:06 +02:00
W.C.A. Wijngaards 8f7411057f - Fix sign of comparison warning in shared ports setup. 2026-07-24 14:44:44 +02:00
W.C.A. Wijngaards ca1fe4f82a - Fix to guard access to shared ports interface array during
set up, for analyzer.
2026-07-24 14:38:46 +02:00
W.C.A. Wijngaards e183c2c506 - Fix unused variable warnings in shared_ports_fetch_random
and shared_ports_return_port when compiled without threads.
2026-07-24 14:37:17 +02:00
W.C.A. Wijngaards 52b18fc6f5 Changelog entry for #1480
- Merge #1480 from petrvaganoff: authzone: fix memory leak in
  xfer_set_masters() error path.
2026-07-24 12:25:34 +02:00
Petr VaganovandGitHub e6d00725c2 authzone: fix memory leak in xfer_set_masters() error path (#1480)
Added memory deallocation for the `file` and `host` fields of the
`auth_master` node in the event of a URL/allocation error, and
unlinked the partially created node from the masters list by
resetting the link that pointed to it.

Signed-off-by: Petr Vaganov <petrvaganoff@gmail.com>
2026-07-24 12:24:49 +02:00
W.C.A. Wijngaards e597711824 - Fix lock test protect for auth zone change.
- Fix to lock shared_ports structure during initialisation.
- Fix to lock anchor structure when file is set for it in
2026-07-24 12:13:09 +02:00
W.C.A. Wijngaards e1e646c6fc - Fix to allow test fake sha1 on systems with possible sha1
support.
- Fix to use sha256 for unbound-anchor unit test.
- Fix unbound-anchor check for return value of
  X509_NAME_get_text_by_NID of the emailaddress.
2026-07-24 11:50:15 +02:00
W.C.A. Wijngaards fc3b5b4f63 - Update generated man pages. 2026-07-24 10:03:41 +02:00
W.C.A. Wijngaards 1e904a3ce5 - set code repository version to 1.26.0. 2026-07-24 09:45:49 +02:00
W.C.A. Wijngaards 79e100a7fb - Fix #1477: respip + dns64: dns64 uses A records modified by
respip instead of original A records. Adds local-zone types
  block_a_wdata and block_aaaa_wdata, that are like block_a
  and block_aaaa, and uses local-data if present.
2026-07-24 09:29:17 +02:00
W.C.A. Wijngaards a65d3d7283 - Unit test for block_a and block_aaaa. 2026-07-24 09:03:45 +02:00
W.C.A. Wijngaards 3b8766aa43 Changelog note for #1433
- Merge #1433 from jisakiel: Add new static zone type
  block_aaaa to suppress AAAA queries.
2026-07-24 08:53:30 +02:00
c8b3c89a39 Add new static zone type block_aaaa to suppress AAAA queries (#1433)
Following d5b9a790f lead for block_a - this would allow suppressing AAAA queries instead for sticking to IPV4.

Co-authored-by: Jisakiel <jisakiel@users.noreply.github.com>
2026-07-24 08:52:20 +02:00
W.C.A. Wijngaards a05d460e66 - Fix mesh cycle detection for configuration with respip CNAME
loop and tagged clients. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
2026-07-23 16:28:45 +02:00
W.C.A. Wijngaards 5eb362a6c0 - Fix that the aggressive negative cache does not insert NSEC
records with overreaching next owner name. Also the result
  is not above the trust anchor's bailiwick. Also RRSIGS are
  not considered valid when an NSEC next owner name is not
  under the signer zone name. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
2026-07-23 16:17:59 +02:00
W.C.A. Wijngaards 0735cb28d1 - Fix that for NSEC3 proofs the NSEC3 zone, as the b32.name is
checked to be the same as the signer name. Also RRSIGs are
  not considered valid when an NSEC3 is not b32.signerzone.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
2026-07-23 15:54:59 +02:00
W.C.A. Wijngaards 737c28e836 Changelog entry for #1478
- Merge #1478 from petrvaganoff: pythonmod: add check return
  value after ftell().
2026-07-23 10:22:53 +02:00
Petr VaganovandGitHub 1bab2dfafa pythonmod: add check return value after ftell() (#1478)
Variable 'flen', which might receive a negative value at pythonmod.c:493
by calling function 'ftell', is used without checking at pythonmod.c:508
by calling function 'fread'.

Found by the static analyzer Svace (ISP RAS).

Signed-off-by: Petr Vaganov <petrvaganoff@gmail.com>
2026-07-23 10:22:02 +02:00
W.C.A. Wijngaards 22e2c5b6d1 - Updated credits for Xuanchao Xie in 22 july changelog. 2026-07-23 10:01:10 +02:00
W.C.A. Wijngaards 914dbfea4e - iana portlist update. 2026-07-22 14:12:34 +02:00
W.C.A. Wijngaards cf5e6e89a5 - Fix error in log printout in fix for CVE-2026-50248, when the
primary name is bogus.
2026-07-22 12:16:49 +02:00
W.C.A. Wijngaards 4941edf275 - Unit test for CVE-2026-56416. 2026-07-22 12:06:00 +02:00
W.C.A. Wijngaards b08723ef97 - Unit test for CVE-2026-55973. 2026-07-22 12:04:35 +02:00
W.C.A. Wijngaards c163fbc505 - Unit test for CVE-2026-55717. 2026-07-22 12:03:48 +02:00
W.C.A. Wijngaards eed3f1ab38 - Unit test for CVE-2026-50248. 2026-07-22 12:00:19 +02:00
W.C.A. Wijngaards 63501f51bb - Unit test for CVE-2026-50243. 2026-07-22 11:59:36 +02:00