WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
7,864 Commits 29 Branches 215 Tags
features/unjostable-configured-upstreams
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Yorgos Thessalonikefs 34d0b93c71 - This sleplt in the precious commit. 2024-12-06 16:16:58 +01:00
Yorgos Thessalonikefs f0e6c4fa2c - Draft the idea of unjostable queries if upstreams are explicitly configured. 2024-12-06 16:05:59 +01:00
Yorgos Thessalonikefs ded4c82ced - Fix typo in log_servfail.tdir test. 2024-12-03 16:03:05 +01:00
Yorgos Thessalonikefs e82a691efe Changelog entry for #1187: 
- Merge #1187: Create the SSL_CTX for QUIC before chroot and privilege
  drop.
 2024-12-03 14:21:34 +01:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		61d7250b96 Create the SSL_CTX for QUIC before chroot and privilege drop (#1187) 
Fixes #1185 by creating the SSL_CTX for QUIC before chroot and
privilege drop, just like the other SSL_CTX creations.

---------

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2024-12-03 14:20:33 +01:00
Yorgos Thessalonikefs b4a9c8bb05 - Safeguard alias loop while looking in the cache for expired answers. 2024-12-03 14:10:17 +01:00
Yorgos Thessalonikefs be92752368 - Merge #1198: Fix log-servfail with serve expired and no useful cache 
contents.
 2024-12-03 14:05:12 +01:00
Yorgos ThessalonikefsandGitHub 1512945c79 Merge pull request #1198 from NLnetLabs/bugfix/log-servfail-serve-expired 
Fix log-servfail with serve expired and no useful cache contents
 2024-12-03 14:02:03 +01:00
Yorgos Thessalonikefs 9de159b96b - For #1175, the default value of serve-expired-ttl is set to 86400 
(1 day) as suggested by RFC8767.
 2024-12-03 13:09:51 +01:00
Yorgos Thessalonikefs bd2e66de1e Changelog entry for #1189, #1197: 
- Merge #1189: Fix the dname_str method to cause conversion errors
  when the domain name length is 255.
- Merge #1197: dname_str() fixes.
 2024-12-03 11:58:06 +01:00
Yorgos ThessalonikefsandGitHub 9770e855d2 Merge pull request #1197 from NLnetLabs/dname_str-more-tests 
dname_str() fixes
 2024-12-03 11:55:41 +01:00
Yorgos Thessalonikefs c124f67f33 - For #1193, introduce log-servfail.tdir and cleanup the log-servfail 
setting from other tests.
 2024-12-02 12:30:11 +01:00
Yorgos Thessalonikefs c55490c1e6 - Fix #1193: log-servfail fails to log host SERVFAIL responses in 
Unbound 1.19.2 on Ubuntu 24.04.1 LTS, by not considering cached
  failures when trying to reply with expired data.
 2024-12-02 12:28:11 +01:00
Yorgos Thessalonikefs f46acec35f - For #1189, homogenize the input buffer size for dname_str(). 2024-12-02 11:53:56 +01:00
Yorgos Thessalonikefs 1cd2fb3b9d - For #1189, add unit tests for dname_str() and debug check the input 
buffer size.
 2024-12-02 10:03:35 +01:00
Yorgos Thessalonikefs 9e3c50ec9e - For #1175, update serve-expired tests. 2024-11-22 16:14:02 +01:00
Yorgos Thessalonikefs eefdbb341f - Fix #1175: serve-expired does not adhere to secure-by-default 
principle. The default value of serve-expired-client-timeout
  is set to 1800 as suggested by RFC8767.
 2024-11-22 15:32:34 +01:00
Yorgos Thessalonikefs e75da7d954 - Fix comparison to help static analyzer. 2024-11-20 10:53:45 +01:00
Yorgos Thessalonikefs 9a3a1bc221 Changelog entry for #1169: 
- Merge #1169 from Sergey Kacheev, fix: lock-free counters for
  auth_zone up/down queries.
 2024-11-19 17:01:34 +01:00
Yorgos ThessalonikefsandGitHub c1e9d7be7f Merge pull request #1169 from sakateka/lock-free-az-counters 
fix: lock-free counters for auth_zone up/down queries
 2024-11-19 17:00:01 +01:00
Yorgos Thessalonikefs 733d5f7161 - Complete fix for max-global-quota to 200. 2024-11-08 17:34:28 +01:00
Yorgos Thessalonikefs fe288a9b06 - More descriptive text for 'harden-algo-downgrade'. 2024-11-08 13:56:04 +01:00
Yorgos Thessalonikefs fd1a1d5fa0 - Increase the default of max-global-quota to 200 from 128 after 
operational feedback. Still keeping the possible amplification
  factor (CAMP related issues) in the hundreds.
 2024-11-06 16:28:37 +01:00
Yorgos Thessalonikefs 3c4b87636a Changelog entry for: 
- Fix SETEX check during Redis (re)initialization.
 2024-11-05 12:20:25 +01:00
Yorgos Thessalonikefs 36d8c6e778 - Fix SETEX check during Redis (re)initialization. 2024-11-05 12:18:55 +01:00
Yorgos Thessalonikefs 11b8157a98 Changelog entry for #1157: 
- Merge #1157 from Liang Zhu, Fix heap corruption when calling
  ub_ctx_delete in Windows.
 2024-11-01 16:27:06 +01:00
Yorgos Thessalonikefs d34fb3ed77 Changelog entry for #1170: 
- Merge #1170 from Melroy van den Berg, Fix chroot manpage
  description.
 2024-11-01 16:12:07 +01:00
Yorgos Thessalonikefs 8a6a4bd7f3 - Add test case for #1159. 
- Some clean up for stat_values.test.
 2024-11-01 15:57:52 +01:00
Yorgos Thessalonikefs d23523e528 - Merge #1159: Stats for discard-timeout and wait-limit. 2024-11-01 15:54:24 +01:00
Yorgos Thessalonikefs f5580f0a63 - Fix #1163: Typos in unbound.conf documentation. 2024-10-25 21:25:16 +02:00
Yorgos Thessalonikefs f8e45ed696 - Fix for dnsoverquic and dnstap to use the correct dnstap 
environment.
 2024-10-16 11:02:31 +02:00
Yorgos Thessalonikefs a1b25f0296 - The fix for CVE-2024-8508 was part of 1.21.1, a security point release 
on 1.21.0. The code repository continues with this fix and the version
  number 1.22.0.
 2024-10-03 18:19:01 +02:00
Yorgos Thessalonikefs 490585bf29 Merge branch 'release-1.21.1' 2024-10-03 18:14:01 +02:00
Yorgos Thessalonikefs b7c61d7cc2 - Fix CVE-2024-8508, unbounded name compression could lead to denial of 
service.
 2024-10-03 17:41:20 +02:00
Yorgos Thessalonikefs 01883fb017 - Set version to 1.21.1 2024-10-03 14:11:57 +02:00
Yorgos Thessalonikefs d88eeb4c32 Changelog entry for #1143: 
- Merge #1143: Fix cache update when serve expired is used. Expired
  records are favored over resolution and validation failures when
  serve-expired is used.
 2024-09-24 16:49:34 +02:00
Yorgos ThessalonikefsandGitHub 2e398d51ba Fix cache update when serve expired is used (#1143) 
- Fix cache update when serve expired is used in order to not evict
  still usable expired records. Modules are forbidden to update the
  cache if their answer is DNSSEC unchecked or bogus and a valid
  (expired) entry already exists. Bogus replies from the validator are
  also discarded in favor of existing (expired) valid replies.

- serve-expired-ttl-reset should try to keep expired records in the
  cache in case they are reset.
 2024-09-24 16:47:04 +02:00
Yorgos Thessalonikefs 24ebca7df6 - More clear text for prefetch and minimal-responses in the 
unbound.conf man page.
 2024-09-24 15:10:21 +02:00
Yorgos Thessalonikefs 7f4a61e6fc - Attempt to further fix doh_downstream_buffer_size.tdir flakiness. 2024-09-24 12:21:03 +02:00
Yorgos Thessalonikefs db719d404f - Fix doxygen warnings by commenting out CLANG_ASSISTED_PARSING, 
CLANG_ADD_INC_PATHS, CLANG_OPTIONS and CLANG_DATABASE_PATH; they were
  already disabled.
 2024-09-23 15:31:32 +02:00
Yorgos Thessalonikefs 6bf2b2ac56 - Fix and add comments in testdata/val_negcache_ttl.rpl. 2024-09-11 12:16:02 +02:00
Yorgos Thessalonikefs d3fdbba877 - Fix comment to not trigger doxygen unknown command. 2024-09-06 16:03:20 +02:00
Yorgos Thessalonikefs c36ce2a390 - Fix alloc-size and calloc-transposed-args compiler warnings. 2024-09-06 16:01:30 +02:00
Yorgos Thessalonikefs c717debace - For #935 and #1104, clarify RPZ order and semantics. 2024-07-24 01:54:02 +02:00
Yorgos Thessalonikefs 7d4d21764a - Cleanup ede.tdir test. 2024-07-23 20:22:25 +02:00
Yorgos Thessalonikefs 3512eaec48 - Fix #1106: ratelimit-below-domain logs the wrong FROM address. 2024-07-23 09:07:06 +02:00
Yorgos Thessalonikefs 7083d58c6b - For #1102: clearer text for using interface-* options for the 
loopback interface.
 2024-07-12 16:29:44 +02:00
Yorgos Thessalonikefs 51425b2388 - Add RPZ tag tests in acl_interface.tdir. 2024-07-12 15:38:12 +02:00
Yorgos Thessalonikefs ea3e327006 - Update list of known EDE codes. 2024-07-09 15:58:30 +02:00
Yorgos Thessalonikefs 02f4446833 - Don't check for message TTL changes if the RRsets remain the same. 2024-07-05 19:58:19 +02:00
Yorgos Thessalonikefs 96f8a94c19 - Fix for repeated use of a DNAME record: first overallocate and then 
move the exact size of the init value to avoid false positive heap
  overflow reads from address sanitizers.
 2024-07-03 10:08:44 +02:00
Yorgos Thessalonikefs 70f73a33b3 - Explicitly set the RD bit for the mesh query flags when prefetching. 
These queries have no waiting client but they need to be treated as
  recursive.
 2024-06-26 15:51:58 +02:00
Yorgos Thessalonikefs b67fbb69e7 - Fix pkg-config availability check in dnstap/dnstap.m4 and 
systemd.m4.
- autoconf.
 2024-06-21 14:34:12 +02:00
Yorgos Thessalonikefs 902c79608c - Fix #1092: Ubuntu 22.04 Jammy fails to compile unbound 1.20.0; by 
adding helpful text for the Python interpreter version and allowing
  the default pkg-config unavailability error message to be shown.
- autoconf.
 2024-06-19 15:27:50 +02:00
Yorgos Thessalonikefs ad12109191 - Merge #1080: AddressSanitizer detection in tdir tests and memory leak 
fixes.
 2024-06-04 17:34:58 +02:00
Yorgos Thessalonikefs f611220eb8 - Skip unbound-dnstap-socket unit test when not compiled with 
--enable-debug.
 2024-06-04 16:59:58 +02:00
Yorgos Thessalonikefs ac609fcbfc - Fix memory leak on exit for unbound-dnstap-socket; creates false negatives 
during testing.
 2024-05-31 12:11:17 +02:00
Yorgos Thessalonikefs 486985fbdf - Fix memory leak when reload_keep_cache is used and num-threads changes. 2024-05-31 12:09:35 +02:00
Yorgos Thessalonikefs caab100207 - Enable AddressSanitizer error detection in tdir tests. 2024-05-31 12:08:43 +02:00
Yorgos Thessalonikefs 5fc4673901 - Update patch to remove 'command' shell builtin and update error 
text.
 2024-05-27 17:17:48 +02:00
Yorgos Thessalonikefs f5a2160ba3 - Fix unused variable warning on compilation with no thread support. 2024-05-27 14:56:52 +02:00
Yorgos Thessalonikefs b30c869a59 Changelog entry for #1059: 
- Fix #1059: Intermittent DNS blocking failure with local-zone and
  always_nxdomain. Addition of local_zones dynamically via
  unbound-control was not finding the zone's parent correctly.
 2024-05-24 15:24:52 +02:00
Yorgos ThessalonikefsandGitHub 6f030e9672 Proper parent identification for dynamically entered local zones (#1076) 
- Fix #1059: Intermittent DNS blocking failure with local-zone and
  always_nxdomain. Addition of local_zones dynamically via
  unbound-control was not finding the zone's parent correctly.
 2024-05-24 15:21:40 +02:00
Yorgos Thessalonikefs 2e70506763 Changelog entry for #1069: 
- Merge #1069: Fix unbound-control stdin commands for multi-process
  Unbounds.
 2024-05-17 10:31:20 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		7f184c8ca8 Fix unbound-control stdin commands for multi-process Unbounds (#1069) 
- Fix unbound-control commands that read stdin in multi-process
  operation (local_zones_remove, local_zones, local_datas_remove,
  local_datas, view_local_datas_remove, view_local_datas). They will
  be properly distributed to all processes. dump_cache and load_cache
  are no longer supported in multi-process operation.

 - Remove testdata/remote-threaded.tdir. testdata/09-unbound-control.tdir
  now checks both single and multi process/thread operation.

---------

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2024-05-17 10:25:24 +02:00
Yorgos Thessalonikefs 739a88ceed Changelog entry for #1070: 
- Merge #1070: Fix rtt assignement for low values of
  infra-cache-max-rtt.
 2024-05-16 13:43:24 +02:00
Yorgos ThessalonikefsandGitHub 3ff5c7a74d Fix rtt assignement for low values of infra-cache-max-rtt (#1070) 
* Fix rtt assignement for still useful servers when a low value for
  infra-cache-max-rtt is configured.
 2024-05-16 13:42:32 +02:00
Yorgos Thessalonikefs 1048c4a28c - Add missing common functions to tdir tests. 2024-05-15 11:20:36 +02:00
Yorgos Thessalonikefs 63a6b7b255 - Cleanup unnecessary strdup calls for EDE strings. 2024-04-29 10:15:19 +02:00
Yorgos Thessalonikefs cd4a017e96 - Fix #876: [FR] can unbound-checkconf be silenced when configuration 
is valid?
 2024-04-26 14:50:39 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		9b9bba9f02 Update locking management for iter_fwd and iter_hints methods. (#1054) 
fast reload, move most of the locking management to iter_fwd and
iter_hints methods. The caller still has the ability to handle its
own locking, if desired, for atomic operations on sets of different
structs.

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2024-04-25 11:05:58 +02:00
Yorgos Thessalonikefs 62dad42152 - Merge #1053: Remove child delegations from cache when grandchild 
delegations are returned from parent.
 2024-04-23 14:24:07 +02:00
Yorgos Thessalonikefs 3ec74d1e3a - When a granchild delegation is returned, remove any cached child delegations 
up to parent to not cause delegation invalidation because of an
  expired child delegation that would never be updated. Most likely to
  happen without qname-minimisation. Reported by Roland van Rijswijk-Deij.
 2024-04-22 15:46:06 +02:00
Yorgos Thessalonikefs 0dbcb45d28 Changelog entry for #1049: 
- Merge #1049 from Petr Menšík: Py_NoSiteFlag is not needed since
  Python 3.8
 2024-04-15 14:49:14 +02:00
Yorgos ThessalonikefsandGitHub d71f257215 Merge pull request #1049 from InfrastructureServices/python3.12-Py_NoSiteFlag-warning 
Py_NoSiteFlag is not needed since Python 3.8
 2024-04-15 14:47:45 +02:00
Yorgos Thessalonikefs a30221c5bb - Merge #1043 from xiaoxiaoafeifei: Add loongarch support; updates 
config.guess(2024-01-01) and config.sub(2024-01-01), verified
  with upstream.
 2024-04-09 17:00:59 +02:00
Yorgos Thessalonikefs 8575d5b35c - Fix #595: unbound-anchor cannot deal with full disk; it will now 
first write out to a temp file before replacing the original one,
  like Unbound already does for auto-trust-anchor-file.
 2024-04-08 14:15:03 +02:00
Yorgos Thessalonikefs 708d5229ae - Merge #1027: Introduce 'cache-min-negative-ttl' option. 2024-04-05 11:44:37 +02:00
Yorgos Thessalonikefs fb4a7d65d7 - Fix #369: dnstap showing extra responses; for client responses 
right from the cache when replying with expired data or
  prefetching.
 2024-04-03 15:18:13 +02:00
Yorgos Thessalonikefs 91e8e0e511 - Fix #1035: Potential Bug while parsing port from the "stub-host" 
string; also affected forward-zones and remote-control host
  directives.
 2024-04-03 13:37:57 +02:00
Yorgos Thessalonikefs 07561964fc - For #831: Format text, use exclamation icon and explicit label 
names.
 2024-03-25 22:02:08 +01:00
Yorgos Thessalonikefs ce8c1ce5b0 Changelog entry for #831 
- Merge #831 from Pierre4012: Improve Windows NSIS installer
  script (setup.nsi).
 2024-03-25 16:46:25 +01:00
Yorgos Thessalonikefs 792089f523 Merge branch 'features/makedist-persist-windir' 2024-03-15 17:22:00 +01:00
Yorgos Thessalonikefs 34636caa2d - For windows build, persist the openssl and expat directories for 
repeated builds while debugging.
 2024-03-15 16:59:46 +01:00
Yorgos Thessalonikefs bc47f50926 Changelog entry for #1028: 
- Merge #1028: Clearer documentation for tcp-idle-timeout and
  edns-tcp-keepalive-timeout.
 2024-03-12 14:52:57 +01:00
Yorgos ThessalonikefsandGitHub e36b5a099c Clearer documentation for tcp-idle-timeout and edns-tcp-keepalive-timeout (#1028) 
* - Clearer documentation for tcp-idle-timeout and
  edns-tcp-keepalive-timeout.

* - Address review comment.
 2024-03-12 14:52:00 +01:00
Yorgos Thessalonikefs 025881d0e9 - Introduce 'cache-min-negative-ttl' option to bound the minimum TTL for 
negative answers overriding 'cache-min-ttl'.
 2024-03-12 11:24:59 +01:00
Yorgos Thessalonikefs 53766917ef - Update doc/unbound.doxygen with 'doxygen -u'. Fixes option 
deprecation warnings and updates with newer defaults.
 2024-03-08 16:13:36 +01:00
Yorgos Thessalonikefs 33bdf44a04 - Document the suspend argument for process_ds_response(). 2024-02-23 14:34:33 +01:00
Yorgos Thessalonikefs c6746499c1 Changelog entry for #1010: 
- Merge #1010: Mention REFUSED has the TC bit set with unmatched
  allow_cookie acl in the manpage. It also fixes the code to match the
  documentation about clients with a valid cookie that bypass the
  ratelimit regardless of the allow_cookie acl.
 2024-02-20 15:33:18 +01:00
Yorgos Thessalonikefs b496714caa - autoconf. 2024-02-07 10:51:16 +01:00
Yorgos Thessalonikefs 3f5175584b - For #1006: fix logic error introduced by previous fix. 2024-02-07 10:49:28 +01:00
Yorgos Thessalonikefs 11fff226f3 - autoheader, autoconf. 2024-02-07 10:42:39 +01:00
Yorgos Thessalonikefs 93490a0fc1 - Fix #1006: Can't find protobuf-c package since #999. 2024-02-07 10:38:52 +01:00
Yorgos Thessalonikefs 3522451600 - Update message TTL when using cached RRSETs. It could result in 
non-expired messages with expired RRSETs (non-usable messages by
  Unbound).
 2024-01-23 10:10:37 +01:00
Yorgos Thessalonikefs fe03bacd6c - Update error printout for duplicate trust anchors to include the 
trust anchor name (relates to #920).
 2024-01-22 15:54:36 +01:00
Yorgos Thessalonikefs 6c82f4ae9b - Update example.conf with cookie options. 2023-12-22 11:42:20 +01:00
Yorgos Thessalonikefs be6fd80a1c - Merge PR #973: Use the origin (DNAME) TTL for synthesized CNAMEs as per RFC 6672. 2023-12-08 09:23:26 +01:00
Yorgos Thessalonikefs 8517f49745 - Use the origin (DNAME) TTL for syntesized CNAMEs as per RFC 6672. 2023-12-06 23:40:01 +01:00
Yorgos Thessalonikefs a2f0186427 - Merge #968: Replace the obsolescent fgrep with grep -F in tests. 2023-11-27 16:47:13 +01:00