WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,080 Commits 29 Branches 215 Tags
branch-1.24.1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Yorgos Thessalonikefs a33f0638e1 - Fix CVE-2025-11411 (possible domain hijacking attack), reported by Yuxiao Wu, 
Yunyi Zhang, Baojun Liu and Haixin Duan from Tsinghua University.
 2025-10-22 10:54:57 +02:00
Yorgos Thessalonikefs bbeee42e25 - Set version to 1.24.1. 2025-10-22 10:50:18 +02:00
Yorgos Thessalonikefs 2dd821c257 - Too many quotes for the EDE message debug printout. 2025-09-17 11:27:16 +02:00
Yorgos Thessalonikefs c3a8d5251f - Small debug output improvement when attaching an EDE. 2025-09-15 12:06:49 +02:00
Yorgos Thessalonikefs dd6200065f - Update man pages. 2025-09-08 14:50:27 +02:00
Yorgos Thessalonikefs a72177e73c - Update documentation for using "SET ... EX" in Redis. 
- Document max buffer sizes for Redis commands.
 2025-09-08 14:49:12 +02:00
Yorgos Thessalonikefs 44da5eee66 - Limit the number of consecutive reads on an HTTP/2 session. 
Thanks to Gal Bar Nahum for exposing the possibility of infinite
  reads on the session.
 2025-08-29 15:35:32 +02:00
Yorgos Thessalonikefs 46823f7bc3 - Update man page templates from rst. 2025-07-12 17:37:54 +02:00
Yorgos Thessalonikefs dd3ac53ff1 - For #1289: add num.valops in the unbound-control man page. 2025-07-12 17:35:16 +02:00
Yorgos Thessalonikefs 1a6052fcac - For #1289: test num.valops in existing stat_values.tdir. 2025-07-12 17:33:43 +02:00
Yorgos Thessalonikefs 6689f0b4da Changelog entry for #1289: 
- Merge #1289 from Roland van Rijswijk-Deij: Add extra statistic to
  track the number of signature validation operations.
  Adds 'num.valops' to extended statistics.
 2025-07-12 16:35:02 +02:00
Yorgos Thessalonikefs 4200d23882 - For #1247, replay test (added tcp_transport to 
outnet_serviced_query).
 2025-06-25 14:02:47 +02:00
Yorgos Thessalonikefs e2814fe165 - For #1247, turn off fetch-policy for delegation when looking into 
parent side name servers that may not update the addresses and hit
  NXNS limits.
 2025-06-25 13:59:17 +02:00
Yorgos Thessalonikefs ca153f4657 - Fix #1247: forward-first: ssl handshake failed on root nameservers. 2025-06-25 13:56:50 +02:00
Yorgos Thessalonikefs ee607c0f72 Changelog entry for #1293: 
- Fix #1293: EDE 6 is attached to insecure cached answers when client
  sends the CD bit.
 2025-06-20 14:11:22 +02:00
Yorgos Thessalonikefs 2d90d5d729 - Fix #1293: EDE 6 is attached to insecure cached answers when client sends 
the CD bit.
 2025-06-20 14:09:30 +02:00
Yorgos Thessalonikefs 9201c75013 - Fix for consistent use of local zone CNAME alias for configured auth 
zones. Now it also applies to downstream configured auth zones.
 2025-06-17 15:03:29 +02:00
Yorgos Thessalonikefs 81f3de4da2 - Small man page corrections for the 'disable-dnssec-lame-check' option. 2025-06-03 14:12:27 +02:00
Yorgos Thessalonikefs 342a0f48e3 - Add more checks about respip in unbound-checkconf. 
Also fixes #310: unbound-checkconf not reporting RPZ configuration
  error.
 2025-05-20 16:21:02 +02:00
Yorgos Thessalonikefs 71ac59e6f4 Changelog entry for #1285: 
- Merge #1285:  RST man pages.
 2025-05-20 12:23:32 +02:00
Yorgos ThessalonikefsandGitHub 6662f71732 RST man pages (#1285) 
Introduce restructuredText man pages to sync the online and source code man page documentation.
The templated man pages (*.in) are still part of the repo but generated with docutils from their .rst counterpart.
Documentation on how to generate those (mainly for core developers) are in README.man.
 2025-05-20 12:20:20 +02:00
Yorgos Thessalonikefs 9152c914af - Fix #1282: log-destaddr fail on long ipv6 addresses. 2025-05-13 11:02:58 +02:00
Yorgos Thessalonikefs a35ac5d82e - Fix #1284: NULL pointer deref in az_find_nsec_cover() (latent bug) 
by adding a log_assert() to safeguard future development.
 2025-05-13 11:00:23 +02:00
Yorgos Thessalonikefs 8e1deede08 Changelog entry for #1280: 
- Merge #1280: Fix auth nsec3 code. Fixes NSEC3 code to not break on
  broken auth zones that include unsigned out of zone (above apex)
  data. Could lead to hang while trying to prove a wildcard answer.
 2025-05-12 14:29:11 +02:00
Yorgos ThessalonikefsandGitHub 4e23523d1a Fix auth nsec3 code (#1280) 
- Fix NSEC3 code to not break on broken auth zones that include unsigned
  out of zone (above apex) data. Could lead to hang while trying to
  prove a wildcard answer.
  Reported by Dmitrii Kuvaiskii from Amazon Web Services.

- Tests for NSEC3 auth zones with out of zone data.
 2025-05-12 14:26:47 +02:00
Yorgos Thessalonikefs 5dd14e2644 - Sync unbound and unbound-checkconf log output for unknown modules. 2025-05-05 14:47:12 +02:00
Yorgos Thessalonikefs b50faccb1d Changelog entry for #1276: 
- Merge #1276: Auto-configure '-slabs' values.
 2025-04-29 15:23:07 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		fcc21885e4 Auto-configure '-slabs' values (#1276) 
- Auto-configure '-slabs' values to a power of 2 value close to num-threads
  by default for multi-threaded environments.

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-04-29 15:21:47 +02:00
Yorgos Thessalonikefs 0f95fae445 Changelog entry for #1275: 
- Merge #1275: Use macros for the fr_check_changed* functions.
 2025-04-28 15:50:03 +02:00
Yorgos ThessalonikefsandGitHub e5bbc36ae0 Use macros for the fr_check_changed* functions (#1275) 2025-04-28 15:48:45 +02:00
Yorgos Thessalonikefs 30c13d0351 Changelog entry for #1265: 
- Merge #1265: Fix WSAPoll.
 2025-04-11 15:10:46 +02:00
Yorgos Thessalonikefs d6e8ac1289 Fix WSAPoll (#1265) 
* Fix calling WSAPoll.

* fast_reload: explicitly set tcp_wouldblock on Windows when there is no
  command to read from the fast_reload thread.

* For poll(), also check for ENOMEM (Linux).

* Remove ifdefs for ENOMEM.
* Some systems return EAGAIN for poll.
 2025-04-11 15:09:07 +02:00
Yorgos Thessalonikefs 9c99b404a1 Changelog entry for #1265: 
- Merge #1265: Fix WSAPoll.
 2025-04-11 15:07:25 +02:00
Yorgos ThessalonikefsandGitHub 75e8fd7539 Fix WSAPoll (#1265) 
* Fix calling WSAPoll.

* fast_reload: explicitly set tcp_wouldblock on Windows when there is no
  command to read from the fast_reload thread.

* For poll(), also check for ENOMEM (Linux).

* Remove ifdefs for ENOMEM.
* Some systems return EAGAIN for poll.
 2025-04-11 15:05:52 +02:00
Yorgos Thessalonikefs f9d740dfdc - Update to the manpage for the fast_reload part. 2025-04-08 15:34:51 +02:00
Yorgos Thessalonikefs e94e140f49 - More explicit text about memory usage during fast_reload. 2025-04-07 16:56:38 +02:00
Yorgos Thessalonikefs db6505eb8b Changelog entry for #902: 
- Merge #902: DNS Error Reporting (RFC 9567). Introduces new
  configuration option 'dns-error-reporting' and new statistics for
  'num.dns_error_reports'.
 2025-04-07 10:28:37 +02:00
Yorgos Thessalonikefs 349721a39d Changelog entry for #1019: 
- Merge #1019: Redis read-only replica support.
  Introduces new 'redis-replica-*' options for the Redis cache backend.
 2025-04-04 10:58:59 +02:00
Yorgos ThessalonikefsGitHubWouter WijngaardsW.C.A. Wijngaards
 		90243a694a Redis read-only replica support (#1019) 
* Set version to 1.19.1 for point release.

* Initial work for Redis read-only replica support.

* Test for Redis replica.

* Documentation for the Redis replica timeouts.

* redis replica, rewrite set_timeout()

* clean merge.

* Add new options for fast reload.

* Apply suggestions from code review

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>

* some more typos

---------

Co-authored-by: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-04-04 10:20:47 +02:00
Yorgos Thessalonikefs 8b38fe5ab6 - For #1262, ifdef is no longer needed. 2025-04-02 11:53:50 +02:00
Yorgos Thessalonikefs fcdb0bbf91 Changelog entry for #1262: 
- Merge #1262 from markyang92, fix build with
  'gcc-15 -Wbuiltin-declaration-mismatch' error in compat/malloc.c.
 2025-04-02 11:52:04 +02:00
Yorgos ThessalonikefsandGitHub b738b354bd Merge pull request #1262 from markyang92/master 
fix build with gcc-15 -Wbuiltin-declaration-mismatch error in compat/malloc.c
 2025-04-02 11:49:49 +02:00
Yorgos Thessalonikefs 23273d76a5 - For #1255, for ios try the latest expat version again. 2025-03-26 16:51:46 +01:00
Yorgos Thessalonikefs 94a84d3387 - For #1255, for ios disable building tests that require C++11. 2025-03-26 16:40:10 +01:00
Yorgos Thessalonikefs d91c857e22 - For #1255, for ios use an older expat version that does not require 
C++11 language features.
 2025-03-26 16:15:16 +01:00
Yorgos Thessalonikefs d03e4b1884 - Fix #1255: Multiple pinnings to vulnerable copies of libexpat. 2025-03-26 14:58:54 +01:00
Yorgos Thessalonikefs 71bb60e586 - Fix 'unbound-control flush_negative' when reporting removed data; 
reported by David 'eqvinox' Lamparter.
 2025-03-16 09:02:20 +01:00
Yorgos Thessalonikefs c5c5486261 - Fix hash calculation for cachedb to ignore case. Previously, cached 
records there were only relevant for same case queries (if not
  already in Unbound's internal cache).
 2025-02-24 14:47:13 +01:00
Yorgos Thessalonikefs 1894c0a150 Changelog entry for #1241: 
- Merge #1241: Fix infra-keep-probing for low infra-cache-max-rtt
  values.
 2025-02-19 13:46:01 +01:00
Yorgos ThessalonikefsandGitHub edb20a2ad2 Merge pull request #1241 from NLnetLabs/bugfix/keep-probing-max-rtt 
Fix infra-keep-probing for low infra-cache-max-rtt values
 2025-02-19 13:44:40 +01:00
Yorgos Thessalonikefs bcf162abd7 - The maximum value of a probe rto was not aligned with the 
(configurable) infra-cache-max-rtt value. That could result in
  infra-keep-probing not working if an infra-cache-max-rtt value was chosen
  that was below 12000 ms. This fix still uses a default value of 12000
  ms for the probe but caps it to the infra-cache-max-rtt if that is
  lower.
 2025-02-19 12:14:59 +01:00
Yorgos Thessalonikefs 5e1f35b59b - Fix static analysis report about unhandled EOF on error conditions 
when reading anchor key files.
 2025-02-19 11:24:49 +01:00
Yorgos Thessalonikefs 72828ff81c - Consider reconfigurations when calculating the still_useful_timeout 
for servers in the infrastructure cache.
 2025-02-17 15:21:18 +01:00
Yorgos Thessalonikefs 35dbbcb2f5 - Make the default value of module-config "validator iterator" 
regardless of compilation options. --enable-subnet would implicitly
  change the value to enable the subnetcache module by default in the
  past.
 2025-01-29 12:08:28 +01:00
Yorgos Thessalonikefs 911509fd59 Changelog entry for #1220: 
- Merge #1220 from Petr Menšík, Add unbound members group access to
  control key.
 2025-01-24 16:56:09 +01:00
Yorgos ThessalonikefsandGitHub b48958c983 Merge pull request #1220 from InfrastructureServices/unbound-control-group-key 
Add unbound members group access to control key
 2025-01-24 16:53:12 +01:00
Yorgos Thessalonikefs cc55beefc8 Changelog entry for #1224: 
- Merge #1224 from Theo Buehler: Do not use DSA API unless USE_DSA is
  set.
 2025-01-21 17:35:00 +01:00
Yorgos ThessalonikefsandGitHub a2bf32bb4e Merge pull request #1224 from botovq/improve-use-dsa 
Do not use DSA API unless USE_DSA is set
 2025-01-21 17:33:48 +01:00
Yorgos Thessalonikefs f822042cd0 - Do not open unencrypted channels next to encrypted ones on the same 
port.
 2025-01-21 15:26:40 +01:00
Yorgos Thessalonikefs 048c193243 - Use the same interface listening port discovery code for all needed 
protocols.
- Port to string only when needed before getaddrinfo().
 2025-01-21 10:04:30 +01:00
Yorgos Thessalonikefs d62fff2c7c - Create the quic SSL listening context only when needed. 2025-01-20 15:49:37 +01:00
Yorgos Thessalonikefs 3f839cebc3 Changelog entry for #1222: 
- Merge #1222: Unique DoT and DoH SSL contexts to allow for different
  ALPN.
 2025-01-20 15:45:11 +01:00
Yorgos ThessalonikefsandGitHub e4483bbbd1 Unique DoT and DoH SSL contexts to allow for different ALPN (#1222) 2025-01-20 15:43:44 +01:00
Yorgos Thessalonikefs 1d428f2d54 Changelog entry for #1221: 
- Merge #1221: Consider auth zones when checking for forwarders.
 2025-01-17 10:19:26 +01:00
Yorgos ThessalonikefsandGitHub 9882a395ab Merge pull request #1221 from NLnetLabs/bugfix/consider-auth-zones-when-forwarding 
Consider auth zones when checking for forwarders
 2025-01-17 10:18:32 +01:00
Yorgos Thessalonikefs 394588818f - Use correct RFC number for resolver.arpa. 2025-01-15 10:55:31 +01:00
Yorgos Thessalonikefs f52b2a6ea2 - Add resolver.arpa and service.arpa to the default locally served 
zones.
 2025-01-14 17:18:32 +01:00
Yorgos Thessalonikefs b2fec3be11 - Take configured auth zones into consideration when checking if a 
request needs to be forwarded.
 2025-01-14 16:38:53 +01:00
Yorgos Thessalonikefs c3b5bff311 - Fix typo. 2025-01-13 12:32:16 +01:00
Yorgos Thessalonikefs 62a0e03801 - Fix #1213: Misleading error message on default access control causing 
refuse.
 2025-01-13 11:33:24 +01:00
Yorgos Thessalonikefs 716f3df385 Changelog entry for #1214: 
- Merge #1214: Use TCP_NODELAY on TLS sockets to speed up the TLS
  handshake.
 2025-01-10 13:54:49 +01:00
Yorgos ThessalonikefsandGitHub 7e4f7ec5be Merge pull request #1214 from NLnetLabs/bugfix/tls-handshake 
Use TCP_NODELAY on TLS sockets to speed up the TLS handshake.
 2025-01-10 13:53:46 +01:00
Yorgos Thessalonikefs 7559d26c93 - Use TCP_NODELAY on TLS sockets to speed up the TLS handshake. 2025-01-10 12:11:59 +01:00
Yorgos Thessalonikefs eb36c880de Changelog entry for #1174: 
- Merge #1174: Serve expired cache update fixes. Fixes a regression bug
  with serve-expired that appeared in 1.22.0 and would not allow the
  iterator to update the cache with not-yet-validated entries resulting
  in increased outgoing traffic.
 2024-12-31 16:30:35 +01:00
Yorgos ThessalonikefsandGitHub fff9f62a1e Serve expired cache update fixes (#1174) 
- Fixes a regression bug with serve-expired that appeared in 1.22.0
  and would not allow the iterator to update the cache with
  not-yet-validated entries resulting in increased outgoing traffic.

- Treat serve_expired_norec_ttl as a backoff timer for failed updates of expired records.
- Try to use expired answers instead of SERVFAIL if serve-expired is
  enabled even without serve-expired-client-timeout.
- Add suggestion to refresh the cached norec_ttl and expired_ttl when a
  response cannot update the usable expired entry.
 2024-12-31 16:28:12 +01:00
Yorgos Thessalonikefs e57e537c85 - For #1207: [FR] Support for RESINFO RRType 261 (RFC9606), add 
LDNS_RR_TYPE_RESINFO similar to LDNS_RR_TYPE_TXT.
 2024-12-20 15:04:34 +01:00
Yorgos Thessalonikefs 71d821fde9 Changelog entry for #1204: 
- Merge #1204: ci: set persist-credentials: false for actions/checkout
  per zizmor suggestion.
 2024-12-13 13:43:29 +01:00
Yorgos ThessalonikefsandGitHub df5ab5624d Merge pull request #1204 from NLnetLabs/zizmor-improvements 2024-12-13 13:42:31 +01:00
Yorgos Thessalonikefs ded4c82ced - Fix typo in log_servfail.tdir test. 2024-12-03 16:03:05 +01:00
Yorgos Thessalonikefs e82a691efe Changelog entry for #1187: 
- Merge #1187: Create the SSL_CTX for QUIC before chroot and privilege
  drop.
 2024-12-03 14:21:34 +01:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		61d7250b96 Create the SSL_CTX for QUIC before chroot and privilege drop (#1187) 
Fixes #1185 by creating the SSL_CTX for QUIC before chroot and
privilege drop, just like the other SSL_CTX creations.

---------

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2024-12-03 14:20:33 +01:00
Yorgos Thessalonikefs b4a9c8bb05 - Safeguard alias loop while looking in the cache for expired answers. 2024-12-03 14:10:17 +01:00
Yorgos Thessalonikefs be92752368 - Merge #1198: Fix log-servfail with serve expired and no useful cache 
contents.
 2024-12-03 14:05:12 +01:00
Yorgos ThessalonikefsandGitHub 1512945c79 Merge pull request #1198 from NLnetLabs/bugfix/log-servfail-serve-expired 
Fix log-servfail with serve expired and no useful cache contents
 2024-12-03 14:02:03 +01:00
Yorgos Thessalonikefs 9de159b96b - For #1175, the default value of serve-expired-ttl is set to 86400 
(1 day) as suggested by RFC8767.
 2024-12-03 13:09:51 +01:00
Yorgos Thessalonikefs bd2e66de1e Changelog entry for #1189, #1197: 
- Merge #1189: Fix the dname_str method to cause conversion errors
  when the domain name length is 255.
- Merge #1197: dname_str() fixes.
 2024-12-03 11:58:06 +01:00
Yorgos ThessalonikefsandGitHub 9770e855d2 Merge pull request #1197 from NLnetLabs/dname_str-more-tests 
dname_str() fixes
 2024-12-03 11:55:41 +01:00
Yorgos Thessalonikefs c124f67f33 - For #1193, introduce log-servfail.tdir and cleanup the log-servfail 
setting from other tests.
 2024-12-02 12:30:11 +01:00
Yorgos Thessalonikefs c55490c1e6 - Fix #1193: log-servfail fails to log host SERVFAIL responses in 
Unbound 1.19.2 on Ubuntu 24.04.1 LTS, by not considering cached
  failures when trying to reply with expired data.
 2024-12-02 12:28:11 +01:00
Yorgos Thessalonikefs f46acec35f - For #1189, homogenize the input buffer size for dname_str(). 2024-12-02 11:53:56 +01:00
Yorgos Thessalonikefs 1cd2fb3b9d - For #1189, add unit tests for dname_str() and debug check the input 
buffer size.
 2024-12-02 10:03:35 +01:00
Yorgos Thessalonikefs 9e3c50ec9e - For #1175, update serve-expired tests. 2024-11-22 16:14:02 +01:00
Yorgos Thessalonikefs eefdbb341f - Fix #1175: serve-expired does not adhere to secure-by-default 
principle. The default value of serve-expired-client-timeout
  is set to 1800 as suggested by RFC8767.
 2024-11-22 15:32:34 +01:00
Yorgos Thessalonikefs e75da7d954 - Fix comparison to help static analyzer. 2024-11-20 10:53:45 +01:00
Yorgos Thessalonikefs 9a3a1bc221 Changelog entry for #1169: 
- Merge #1169 from Sergey Kacheev, fix: lock-free counters for
  auth_zone up/down queries.
 2024-11-19 17:01:34 +01:00
Yorgos ThessalonikefsandGitHub c1e9d7be7f Merge pull request #1169 from sakateka/lock-free-az-counters 
fix: lock-free counters for auth_zone up/down queries
 2024-11-19 17:00:01 +01:00
Yorgos Thessalonikefs 733d5f7161 - Complete fix for max-global-quota to 200. 2024-11-08 17:34:28 +01:00
Yorgos Thessalonikefs fe288a9b06 - More descriptive text for 'harden-algo-downgrade'. 2024-11-08 13:56:04 +01:00
Yorgos Thessalonikefs fd1a1d5fa0 - Increase the default of max-global-quota to 200 from 128 after 
operational feedback. Still keeping the possible amplification
  factor (CAMP related issues) in the hundreds.
 2024-11-06 16:28:37 +01:00
Yorgos Thessalonikefs 3c4b87636a Changelog entry for: 
- Fix SETEX check during Redis (re)initialization.
 2024-11-05 12:20:25 +01:00