WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,293 Commits 29 Branches 215 Tags
branch-1.25.1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
W.C.A. Wijngaards 75b6dba593 - Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-20 10:22:52 +02:00
W.C.A. Wijngaards 138fb48eac Changelog entry. 
- Fix CVE-2026-44390, Unbounded name compression in certain cases
  causes degradation of service. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:22:10 +02:00
W.C.A. Wijngaards dae7a37974 - Fix CVE-2026-44390, Unbounded name compression in certain cases 
causes degradation of service. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:21:26 +02:00
W.C.A. Wijngaards 8ae4b4545d - Fix CVE-2026-42960, Possible cache poisoning attack while following 
delegation. Thanks to TaoFei Guo from Peking University, Yang Luo
  and JianJun Chen, Tsinghua University, for the report.
 2026-05-20 10:20:45 +02:00
W.C.A. Wijngaards c343fff3a4 - Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 
hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-05-20 10:20:02 +02:00
W.C.A. Wijngaards a794c87578 - Fix CVE-2026-42534, Jostle logic bypass degrades resolution 
performance. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-05-20 10:19:08 +02:00
W.C.A. Wijngaards ef5ca84360 - Fix CVE-2026-41292, Parsing a long list of incoming EDNS options 
degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan
  Zhang from Palo Alto Networks, for the report.
 2026-05-20 10:18:23 +02:00
W.C.A. Wijngaards 8d8fa42266 - Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to Qifan 
Zhang, Palo Alto Networks, for the report.
 2026-05-20 10:16:18 +02:00
W.C.A. Wijngaards a587535c5d - Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew 
Griffiths from 'calif.io' for the report.
 2026-05-20 10:15:30 +02:00
W.C.A. Wijngaards 94d5babaee - Fix CVE-2026-42959, Crash during DNSSEC validation of malicious 
content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-20 10:14:32 +02:00
W.C.A. Wijngaards fe946ba4e9 - Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, 
cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:13:55 +02:00
W.C.A. Wijngaards 6a31e470f8 - Fix CVE-2026-33278, Possible remote code execution during DNSSEC 
validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-20 10:13:08 +02:00
W.C.A. Wijngaards e577695aeb Set version to 1.25.1 for release. 2026-05-20 10:11:15 +02:00
W.C.A. Wijngaards 25fe602024 - For #1441: Fix type of ipv6 addr struct. 2026-04-23 09:37:30 +02:00
W.C.A. Wijngaards df0e86de49 Changelog entry for #1441. 
- Merge #1441: Fix buffer overrun in
  doq_repinfo_retrieve_localaddr().
 2026-04-23 09:35:44 +02:00
W.C.A. Wijngaards 07c96792f2 - Fix doxygen comment syntax. 2026-04-21 13:44:55 +02:00
W.C.A. Wijngaards 84ab430e11 - Set version number to 1.25.0 of code repository. 2026-04-21 13:27:55 +02:00
W.C.A. Wijngaards 53499e4a88 - Fix handling of wildcard CNAMEs in the chain of trust. 
An improper wildcard in the chain of trust would send
  the retries to the wrong upstream. Also it could label
  the step in the chain of trust as secure, when it was not.
  Thanks to Qifan Zhang, Palo Alto Networks for the report.
 2026-04-21 13:24:40 +02:00
W.C.A. Wijngaards 8a25a97687 - Fix that a DNAME with an unsigned CNAME is checked for 
the correct match. This stops that for certain zone
  configurations an unchecked unsigned CNAME could get
  secure status. Thanks to Qifan Zhang, Palo Alto Networks
  for the report.
 2026-04-21 13:19:13 +02:00
W.C.A. Wijngaards c112bcf2fd - Fix that signatures are not allowed with revoked dnskeys. 
Thanks to Qifan Zhang, Palo Alto Networks for the report.
 2026-04-21 13:07:34 +02:00
W.C.A. Wijngaards 9de549c498 - Fix that upstream TLS connections are not reused as TLS 
connections for a different name, at the same IP. This
  checks that the tls name is correct when reusing the
  upstream connections. Thanks to TaoFei Guo from Peking
  University and JianJun Chen from Tsinghua University for
  the report.
 2026-04-21 11:59:05 +02:00
W.C.A. Wijngaards 84c645e7b3 - Fix for missing bounds check for decompressing dnames 
for downloaded authority zones. This fixes that the server
  could end up with malformed zone content after receiving
  truncated packet contents from an AXFR. In addition, the
  domain names in the SOA rdata are checked before the
  authority code picks up the zone serial.
  Thanks to Halil Oktay for the report.
 2026-04-21 10:32:37 +02:00
W.C.A. Wijngaards 197a425c7d - Fix for iterator RCODE handling of YXDOMAIN. This fixes 
that the server only accepts YXDOMAIN answers that contain
  a DNAME record. This stops bad answers, and checks that
  the authoritative server gives correct replies.
  Thanks to Qifan Zhang, Palo Alto Networks for the report.
 2026-04-21 10:09:02 +02:00
W.C.A. Wijngaards 311054728d - Fix EDNS extended RCODE reflection. This fixes that 
the server does not echo extended rcode values after class
  chaos queries. Thanks to Qifan Zhang, Palo Alto Networks
  for the report.
 2026-04-21 09:58:19 +02:00
W.C.A. Wijngaards 6d74856212 - Fix for the Jiggle Attack. The server is fixed to answer 
with errors for error cases, and does not stay silent.
  In addition, the error replies do not contain parts of the
  incoming query. This is more conformant, stops reflection
  and stops it as a covert channel. Thanks to Yuqi Qiu and
  Xiang Li, Nankai University (AOSP Lab) for the report.
  In addition, thanks to Qifan Zhang, Palo Alto Networks, for
  noting the fingerprinting possibility, that is also fixed
  with this.
 2026-04-21 09:54:17 +02:00
W.C.A. Wijngaards d489e6027e - Add test case for malformed SVCB records. Thanks to 
Qifan Zhang, Palo Alto Networks for the additional test.
 2026-04-21 09:41:53 +02:00
W.C.A. Wijngaards e1d146d6b0 - Fix test with https zone for libressl. 2026-04-20 16:10:33 +02:00
W.C.A. Wijngaards eb2fe8df8d - Fix unused variable warning when compiled without ssl. 2026-04-20 12:24:55 +02:00
W.C.A. Wijngaards 86a8be75f0 - Fix compile warnings for thread setname routine, and test compile. 2026-04-20 12:24:28 +02:00
W.C.A. Wijngaards 52fc5ee374 - Fix pthread_setname detection to fail on warnings. 2026-04-17 17:13:14 +02:00
W.C.A. Wijngaards 82359c8fb1 - Update generated configure, with autoconf. 2026-04-17 17:00:09 +02:00
W.C.A. Wijngaards c996671a1f - Update generated man pages. 2026-04-17 16:32:02 +02:00
W.C.A. Wijngaards af209a12ea - Fix subnet store of servfail to not leak memory. 2026-04-17 13:48:38 +02:00
W.C.A. Wijngaards 84ac7e1b58 - Fix ttl comparisons in rdata_copy for 32bit signed or unsigned. 2026-04-17 13:27:41 +02:00
W.C.A. Wijngaards 24d502763c - Fix to increase size of the buffer for the win_svc reportev log 
function.
 2026-04-17 11:05:31 +02:00
W.C.A. Wijngaards 99c61c19ac - Fix compat/gmtime_r old style definition syntax. 2026-04-17 11:05:15 +02:00
W.C.A. Wijngaards cb05e9d525 - Fix compat/chacha_private sigma and tau definitions to use 
nonstring attribute.
 2026-04-17 11:04:51 +02:00
W.C.A. Wijngaards abddd4e270 - Update github ci cross platform to use 
cross-platform-actions/action@v1.0.0.
- Fix github ci to speed up with parralel build, for windows ci.
 2026-04-17 10:41:24 +02:00
W.C.A. Wijngaards 656b412492 - Update github ci to use actions/checkout@v6. 2026-04-17 10:13:06 +02:00
W.C.A. Wijngaards f15a46fcd4 - Fix to compile the shm code when there is no shmget. 2026-04-17 09:42:35 +02:00
W.C.A. Wijngaards 8d434bf744 - Fix setup of ssl context copy, to check for the tls service 
pem option for stat calls.
 2026-04-17 09:34:06 +02:00
W.C.A. Wijngaards 13b269d398 - Fix setup of ssl context copy of the tls service pem option, 
from a clang analyzer warning.
 2026-04-17 09:29:10 +02:00
W.C.A. Wijngaards b97bd3a1fc - Fix configure, autoconf for #1406. 2026-04-16 10:55:57 +02:00
W.C.A. Wijngaards db1fe8b475 - Fix to shorten RRSIG count in scrubber, this protects against 
an overly large number of RRSIGs. It can be configured with
  `iter-scrub-rrsig: 8`, it has default 8. Thanks to Yuxiao Wu,
  Tsinghua University for the report.
 2026-04-15 11:41:28 +02:00
W.C.A. Wijngaards f4f964f4fb - Fix RFC7766 compliance when client sends EOF over TCP. It stops 
pending replies and closes. Thanks to Yuxiao Wu, Tsinghua
  University for the report.
 2026-04-15 11:29:07 +02:00
W.C.A. Wijngaards a2272860de - iana portlist updated. 2026-04-14 15:36:33 +02:00
W.C.A. Wijngaards 95083d4377 - Fix clang analyzer warning for subnetmod, when return_msg is 
NULL for update cache, like when it stores servfail status.
 2026-04-14 15:36:00 +02:00
W.C.A. Wijngaards 5ce0bf5281 - Fix #1017: memory corruption related core dumps. 
When alloc_reg_obtain has an empty list, return a new allocation.
 2026-04-14 15:34:59 +02:00
W.C.A. Wijngaards 330d5211c9 - Fix for EDNS client subnet so that it does not store SERVFAIL in 
the global cache after a failed lookup, such as timeouts. A failure
  entry is stored in the subnet cache, for the query name, for a
  couple of seconds. Queries can continue to use the subnet cache
  during that time.
 2026-04-10 15:45:28 +02:00
W.C.A. Wijngaards c5f14dc880 Changelog comment for #1408 
- Merge #1408: Fix shared memory stats with threads.
 2026-03-30 16:15:32 +02:00
W.C.A. Wijngaards 2e9b880718 - Fix defense in depth for service callback with empty packet. 2026-03-27 15:42:45 +01:00
W.C.A. Wijngaards a0ec6cd946 - Fix test code to allow empty hex answer packets from testbound. 2026-03-27 15:39:27 +01:00
W.C.A. Wijngaards ea36979c40 - Fix to allow the control-interface config to use ip@port notation. 2026-03-27 14:29:15 +01:00
W.C.A. Wijngaards 315077b9e6 - Fix to check for invalid http content length and chunk size, 
and to check the RR rdata field lengths when decompressing and
  inserting RRs from an authority zone transfer. This stops
  large memory use and heap buffer-overflow read errors. Thanks
  to Haruto Kimura (Stella) for the report.
 2026-03-24 08:45:52 +01:00
W.C.A. Wijngaards 535d899bef - Fix for testcode pktview to check buffer size and log errors. 2026-03-20 15:57:46 +01:00
W.C.A. Wijngaards 8656cfd4c8 - Fix to add tls-service-key to memory printout for fast_reload. 2026-03-13 16:49:34 +01:00
W.C.A. Wijngaards 8f44ddb7de - Fix detection of http listening port in fast_reload. 2026-03-13 16:37:41 +01:00
W.C.A. Wijngaards 4484dc3954 - For #278: fast_reload can reload tls-service-key, tls-service-pem 
and tls-cert-bundle changes. It checks the modification time of
  the tls-service-key and tls-service-pem files for update.
 2026-03-13 16:25:42 +01:00
W.C.A. Wijngaards eb3bba0724 - iana portlist updated. 2026-03-13 12:05:33 +01:00
W.C.A. Wijngaards 2eff1d8ab5 - Fix #278: DoT: complete unbound restart required on certificate 
renew. Fix so that a reload checks if the files have changed, and
  if so, reload the contexts. Also for DoH, DoQ and outgoing DoT.
 2026-03-13 11:42:34 +01:00
W.C.A. Wijngaards 18029fc44f Changelog comment for #1418 
- Merge #1418: Apply cache TTL policy to DNAME and synthesized
  CNAME on wire path.
 2026-03-09 13:54:37 +01:00
W.C.A. Wijngaards 9af29c3ed1 - Fix compile failure in unbound-checkconf for older gcc compiler. 2026-03-09 09:18:43 +01:00
W.C.A. Wijngaards 92ab54641e Changelog entry for #1415 
- Merge #1415: Add lock unlock for view in memory error handling.
 2026-03-06 08:58:33 +01:00
W.C.A. Wijngaards 1bd7c8dfee - Update generated man pages. 2026-03-05 12:15:54 +01:00
W.C.A. Wijngaards 8f96ae7acf - Fix for DNS Rebinding Bypass via SVCB/HTTPS Records in Unbound. 
Thanks to Kunta Chu, School of Software, Tsinghua University,
  Taofei Guo, Peking University, and Jianjun Chen, Institute for
  Network Sciences and Cyberspace, Tsinghua University for the
  report. The private-address option is fixed to also elide
  SVCB and HTTPS records that match the filter.
 2026-03-05 09:47:13 +01:00
W.C.A. Wijngaards a296b248b0 - For #1411: Fix that the lookup for DNAME uses flag. Fix assertion 
in expired calc debug routine.
 2026-03-03 17:44:31 +01:00
W.C.A. Wijngaards 1ef131299a For #1411, fix up doc/Changelog. 2026-03-03 08:55:56 +01:00
W.C.A. Wijngaards 94b04d6d46 - Update generated man pages. 2026-02-27 14:33:55 +01:00
W.C.A. Wijngaards f1a65eb4e8 For #1409: Changelog entry and more text. 2026-02-27 13:55:25 +01:00
W.C.A. Wijngaards bff3d762ff - Fix validator to set unchecked when validation recursion 
requests are passed. The edns subnet module checks if validation
  is needed for a cache response, and set the validator to protect
  the cache with validation for non-subnet lookups.
 2026-02-25 10:59:33 +01:00
W.C.A. Wijngaards 1d36696462 - Fix to make the cachedb_val_expired.crpl succeed. 2026-02-23 12:52:10 +01:00
W.C.A. Wijngaards aa4e2a9e69 - Fix to have cachedb not return expired bogus data as non-bogus. 2026-02-23 12:45:14 +01:00
W.C.A. Wijngaards 8e04d04949 - For #1405: local-zone always_refuse also blocks queries of type DS. 2026-02-17 15:36:08 +01:00
W.C.A. Wijngaards c5627dbd52 - Fix to remove unused conditional from cookie timestamp at 
worker env.
 2026-02-17 11:15:15 +01:00
W.C.A. Wijngaards 014ed9c5ff - Fix that cachedb aggressive negative responses have the RA flag set. 2026-02-16 16:35:37 +01:00
W.C.A. Wijngaards 1a9a4e4ca1 - Fix #1403: Inconsistency between do-nat64 and do-not-query-address 
during retries.
 2026-02-11 16:01:30 +01:00
W.C.A. Wijngaards f7f638e18f - Update generated man pages. 2026-02-09 16:11:17 +01:00
W.C.A. Wijngaards c956aea93d Changelog note and documentation for #1401. 
- Merge #1401: Add a new build-time option for system TLS.
  The --enable-system-tls flag enables the
  tls-use-system-policy-versions setting by default.
 2026-02-09 16:05:28 +01:00
W.C.A. Wijngaards 567c70dada Fix attribution of fix. 2026-02-04 14:17:56 +01:00
W.C.A. Wijngaards 8b4b2a88f7 - Fix local privilege escalation on Windows. Thanks to Hao Huang 
for the report. The OpenSSL init calls are set to not load
  the openssl.cnf file when compiled for Windows.
 2026-02-04 11:54:11 +01:00
W.C.A. Wijngaards daa016e3e4 - Add test for allow-notify with a host name. 2026-01-27 13:49:33 +01:00
W.C.A. Wijngaards 039f69e735 - Fix to not skip allow-notify hostname lookups when there are only 
urls.
 2026-01-26 16:16:38 +01:00
W.C.A. Wijngaards b39009e487 Merge branch 'master' of github.com:NLnetLabs/unbound 2026-01-26 15:17:26 +01:00
W.C.A. Wijngaards 933769ee73 - Fix that allow-notify entries with hostnames are copied after IPv4 
and IPv6 lookup.
 2026-01-26 15:16:43 +01:00
W.C.A. Wijngaards 9b123d1b78 - Fix http test tool petal to not print errors when there is no 
error.
 2026-01-22 14:19:35 +01:00
W.C.A. Wijngaards 37b71261a2 - Fix that fast reload copies the iter_scrub_ns, iter_scrub_cname 
and max_global_quota options.
 2026-01-22 09:42:56 +01:00
W.C.A. Wijngaards 4426db4d3d - Merge #1388: QNX Porting support for unbound. 2026-01-21 13:13:01 +01:00
W.C.A. Wijngaards 67d2eae28c - Merge #1392: Include "V" (version) option in synopsis. 2026-01-19 09:09:47 +01:00
W.C.A. Wijngaards cc6dbc9f38 - Fix documentation for requestlist.overwritten and 
requestlist.exceeded, it explains which query was dropped.
 2026-01-15 09:35:04 +01:00
W.C.A. Wijngaards 4198343dbe Compile fixup for #1381. 2026-01-08 14:19:06 +01:00
W.C.A. Wijngaards 08600d68e8 Changelog note for #1381, and man page explanation. 
- Merge #1381: Do not initialize quic_table unless it is enabled.
 2026-01-08 14:16:54 +01:00
W.C.A. Wijngaards b0b634558b - Fix edns subnet, that scope zero queries, when there is a 
subquery without subnet, and the forward-no-cache or
  stub-no-cache option is set, it is not stored in cache due to
  the forward or stub option.
This has the changelog entry and test.
 2026-01-06 09:33:00 +01:00
W.C.A. Wijngaards 8546247292 - Fix edns subnet, that scope zero queries, when there is a 
subquery without subnet, and the forward-no-cache or
  stub-no-cache option is set, it is not stored in cache due to
  the forward or stub option.
 2026-01-06 09:32:21 +01:00
W.C.A. Wijngaards c0522043f0 - Fix http2 drop handling to clear the postpone_drop state so that 
other streams on the http2 session are not affected by a drop,
  and can clean up properly if also dropped. Fix http2 send reply
  so that when there is a send failure is does not recurse into
  the mesh functions and also does not drop the connection due to
  the condition of one stream.
 2025-12-03 14:41:10 +01:00
W.C.A. Wijngaards b858801feb - Fix to remove http2 stream mesh state when mesh new request is 
dropping the new request.
 2025-12-02 15:31:53 +01:00
W.C.A. Wijngaards 588db09928 - Fix header comment about EDE reference in validator/val_sigcrypt.h. 2025-12-01 16:04:41 +01:00
W.C.A. Wijngaards 5c66c48a1b - Fix to add EDNS CO flag to testbound and debug message log. 2025-12-01 15:29:41 +01:00
W.C.A. Wijngaards 0f43b0ea6c Changelog note for #1375, and lock for lockchecks and ifdef for compile fix. 
- Merge #1375: Copy DNSTAP changes from daemon to workers after
  fast_reload.
 2025-11-13 15:45:27 +01:00
W.C.A. Wijngaards a31b9d50e2 Changelog note for #1374 
- Merge #1374: Mesh reply counters.
  This adds the statistics num.queries.replyaddr_limit and
  requestlist.current.replies.
 2025-11-13 09:34:45 +01:00
W.C.A. Wijngaards 98f4257890 - iana portlist updated. 2025-11-12 11:49:21 +01:00