WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-10-14 12:35:11 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,604 Commits 29 Branches 216 Tags
auth-load-thread
Commit Graph
1150 Commits
Author SHA1 Message Date
W.C.A. Wijngaards cd0a585fbe Merge branch 'master' into auth-load-thread 2026-10-13 15:56:17 +02:00
W.C.A. Wijngaards 18d8676e9c - Fix dns64 synthesis and cache with subnet module enabled. 
The subnet module stopped a cache store, that caused later
  dns64 replies to have a nodata answer for the AAAA.
 2026-10-13 09:51:19 +02:00
W.C.A. Wijngaards 7c624d1dcd - auth-load-thread, fix pick up of active transfer after full list. 
Add unit test for list of auth transfers.
 2026-10-09 15:55:21 +02:00
W.C.A. Wijngaards f62214e714 - auth-load-thread, account write threads, unit test for zonefile write. 2026-10-07 11:10:16 +02:00
W.C.A. Wijngaards 3d53f08bd8 - auth-load-thread, write to zonefile with thread. 2026-10-06 14:39:41 +02:00
W.C.A. Wijngaards 0dcd4cd2e8 - auth-load-thread, fix unit test for auth load rpz threads check. 2026-10-06 11:45:57 +02:00
W.C.A. Wijngaards b449d6f713 - auth-load-thread, documentation for auth-task-threads and tests disable 
when there is no threading.
 2026-10-06 11:44:29 +02:00
W.C.A. Wijngaards 6932ae18f5 - auth-load-thread, swap rpz contents, not config. Test for auth load rpz. 2026-10-06 11:29:54 +02:00
W.C.A. Wijngaards cb027ae649 Merge branch 'master' into auth-load-thread 2026-10-05 09:02:28 +02:00
W.C.A. Wijngaards a7fc80d8c5 - Unit test for CVE-2026-85501. 2026-09-16 10:47:44 +02:00
W.C.A. Wijngaards 5d89e0c2a7 - Unit test for CVE-2026-82717. 2026-09-16 10:44:49 +02:00
W.C.A. Wijngaards a6586ced92 Merge branch 'branch-1.26.1' 2026-09-16 10:26:54 +02:00
W.C.A. Wijngaards 13b6717f17 - Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch 
Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
  Xiang Li from Nankai University, AOSP Lab for the report. In
  addition, thanks to Qifan Zhang from Palo Alto Networks for a
  complimentary report.
 2026-09-16 09:30:25 +02:00
W.C.A. Wijngaards 565651cd02 - Fix CVE-2026-77955, Possible ZONEMD verification bypass window. 
Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
  for the report. In addition, thanks to Qifan Zhang from Palo Alto
  Networks for also reporting this issue.
 2026-09-16 09:26:00 +02:00
W.C.A. Wijngaards b8577a9c04 - Fix to construct the delegation point during DS NS find 
as a child side delegation point if that was the response.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-10 11:09:39 +02:00
W.C.A. Wijngaards bd210d124b - Fix that when a partial EDNS option is in a query, the 
response is a more RFC conformant FORMERR, since the EDNS
  option is malformed. Also fix to have an EDNS size for
  the reply error encoding for failed EDNS parse of the query.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 17:20:35 +02:00
W.C.A. Wijngaards 11900cc2b0 - Fix that when extended EDNS RCODE does not fit, at short 
udpsize, the reply is truncated with TC and fix for the
  rcode in that short reply to be a sensible rcode.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 15:27:10 +02:00
W.C.A. Wijngaards c04a5efb07 - Fix to reorder SVCB and HTTPS svcparams for unknown RR form 
zonefile input. If it can not be parsed it is leniently
  accepted, much like as a secondary it leniently accepts it.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 10:59:08 +02:00
W.C.A. Wijngaards 292cf6526b - Fix to match NSEC3 hash length to the NSEC3 algorithm, 
this stops negative cache overdeletion. It also contrains
  the hash label length and checks if the NSEC nextowner
  is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University,
  AOSP Lab).
 2026-09-03 08:38:46 +02:00
W.C.A. Wijngaards 32ff948a5b - Fix notify for auth-zone during initial start up. It 
performs the transfer and not only lookup.
 2026-08-26 16:50:33 +02:00
W.C.A. Wijngaards 2ec2afd6b0 - Fix #132: Add harden-cname-follow: yes config option, that 
can be used to disable cname scrubbing. That can be useful
  for when the traffic is on localhost only.
 2026-08-24 16:06:17 +02:00
W.C.A. Wijngaards 48d0aea60a - auth-load-thread, unit test for auth_load_http. 2026-08-11 16:50:24 +02:00
W.C.A. Wijngaards fd8ebbb19c Merge branch 'master' into auth-load-thread 2026-08-11 16:23:20 +02:00
W.C.A. Wijngaards 2adbbea365 - auth-load-thread, print thread details in log at high verbosity, 8. 2026-08-11 16:23:03 +02:00
W.C.A. Wijngaards 8ee0bca833 - Fix stat_values.tdir test to have less test failures. 2026-08-11 10:07:38 +02:00
W.C.A. Wijngaards 156c00a727 Merge branch 'master' into auth-load-thread 2026-08-10 16:42:59 +02:00
W.C.A. Wijngaards ff28b7e5cf - For #1483: The failure reason when an NSEC NXDOMAIN is 
encountered when looking for an insecure delegation, is
  fixed to mention the NSEC records, instead of nonexistent
  NSEC3 records, that it attempted.
 2026-07-31 09:53:47 +02:00
W.C.A. Wijngaards 52b18fc6f5 Changelog entry for #1480 
- Merge #1480 from petrvaganoff: authzone: fix memory leak in
  xfer_set_masters() error path.
 2026-07-24 12:25:34 +02:00
W.C.A. Wijngaards e1e646c6fc - Fix to allow test fake sha1 on systems with possible sha1 
support.
- Fix to use sha256 for unbound-anchor unit test.
- Fix unbound-anchor check for return value of
  X509_NAME_get_text_by_NID of the emailaddress.
 2026-07-24 11:50:15 +02:00
W.C.A. Wijngaards 79e100a7fb - Fix #1477: respip + dns64: dns64 uses A records modified by 
respip instead of original A records. Adds local-zone types
  block_a_wdata and block_aaaa_wdata, that are like block_a
  and block_aaaa, and uses local-data if present.
 2026-07-24 09:29:17 +02:00
W.C.A. Wijngaards a65d3d7283 - Unit test for block_a and block_aaaa. 2026-07-24 09:03:45 +02:00
W.C.A. Wijngaards a05d460e66 - Fix mesh cycle detection for configuration with respip CNAME 
loop and tagged clients. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-23 16:28:45 +02:00
W.C.A. Wijngaards 5eb362a6c0 - Fix that the aggressive negative cache does not insert NSEC 
records with overreaching next owner name. Also the result
  is not above the trust anchor's bailiwick. Also RRSIGS are
  not considered valid when an NSEC next owner name is not
  under the signer zone name. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-07-23 16:17:59 +02:00
W.C.A. Wijngaards 4941edf275 - Unit test for CVE-2026-56416. 2026-07-22 12:06:00 +02:00
W.C.A. Wijngaards b08723ef97 - Unit test for CVE-2026-55973. 2026-07-22 12:04:35 +02:00
W.C.A. Wijngaards c163fbc505 - Unit test for CVE-2026-55717. 2026-07-22 12:03:48 +02:00
W.C.A. Wijngaards eed3f1ab38 - Unit test for CVE-2026-50248. 2026-07-22 12:00:19 +02:00
W.C.A. Wijngaards 63501f51bb - Unit test for CVE-2026-50243. 2026-07-22 11:59:36 +02:00
W.C.A. Wijngaards 1ae2570bda - Unit test for CVE-2026-46582. 2026-07-22 11:58:18 +02:00
W.C.A. Wijngaards 9ad825b267 - Unit test for CVE-2026-50045. 2026-07-22 11:57:13 +02:00
W.C.A. Wijngaards 3d5e6c0692 - Unit test for CVE-2026-44690. 2026-07-22 11:56:08 +02:00
W.C.A. Wijngaards 23e19ca6fc - Unit test for CVE-2026-44687. 2026-07-22 11:55:09 +02:00
W.C.A. Wijngaards 9f757aa9f3 - Unit test for CVE-2026-42955. 2026-07-22 11:54:00 +02:00
W.C.A. Wijngaards 91ac449bcd Merge branch 'branch-1.25.2' 2026-07-22 11:33:54 +02:00
W.C.A. Wijngaards e180b06298 - Fix CVE-2026-50251, Attacker supplied 0.0.0.0/:: glue triggers 
defensive full-cache flush. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-22 10:15:02 +02:00
W.C.A. Wijngaards 13ec8d0f26 - Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also clamp 
the TTL of A/AAAA records disallowing a one-time 'ghost domain'
  delegation renewal via glue records. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-07-22 10:11:04 +02:00
W.C.A. Wijngaards f54e0791ba - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report. In addition,
  thanks to Trung Nguyen (@everping) of CyStack, for also reporting
  this issue.
 2026-07-22 10:09:50 +02:00
W.C.A. Wijngaards ad9b12a863 - Fix unit test for malformed svcb for test on Windows. 2026-07-09 09:52:09 +02:00
W.C.A. Wijngaards 0a5cde80f1 - auth-load-thread, auth-task-threads: num config option that enables and 
disables the auth load thread.
 2026-07-03 14:03:15 +02:00
W.C.A. Wijngaards 55ae8da032 - auth-load-thread, basic test and fixes so it works. 2026-07-02 11:10:06 +02:00