WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,513 Commits 29 Branches 215 Tags
master
Commit Graph
29 Commits
Author SHA1 Message Date
W.C.A. Wijngaards 8b33c5d7ff - Fix #1487: regression in 1.26.0, ipsecmod is now always 
partly enabled.
 2026-08-06 09:46:18 +02:00
Petr VaganovandGitHub 7133e0d32a ipsecmod: fix possible deref on null after reply_find_answer_rrset() (#1476) 
Return value of a function 'reply_find_answer_rrset' is dereferenced at
ipsecmod.c:438 without checking for NULL, but it is usually checked for
this function (10/12).

Found by the static analyzer Svace (ISP	RAS).

Signed-off-by: Petr Vaganov <petrvaganoff@gmail.com>
 2026-07-21 11:56:29 +02:00
Petr VaganovandGitHub a2fe5356b5 ipsecmod: fix deref on null in ipsecmod-whitelist after OOM (#1475) 
DEREF_OF_NULL.RET.STAT Return value of a function 'rbtree_create'
is dereferenced at ipsecmod-whitelist.c:105 without checking for
NULL, but it is usually checked for this function (5/6).

In ipsecmod_whitelist_apply_cfg(), the return value of rbtree_create()
is not checked for NULL before being used.

Found by the static analyzer Svace (ISP	RAS).

Signed-off-by: Petr Vaganov <petrvaganoff@gmail.com>
 2026-07-20 10:04:47 +02:00
W.C.A. Wijngaards d0a760a587 - Fix misconfigured ipsecmod hook causing path name 
similarity with other file. The ipsecmod is changed for
  exec of the hook. The ipsecmod hook, if a script, has to
  start now with a line like `#!/bin/sh`. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:45:53 +02:00
W.C.A. Wijngaards feeebc95f8 - Fix for #1344: Fix that respip and dns64 can be enabled at the 
same time, the client info is copied for attach_sub and add_sub
  calls. That makes respip work on dns64 synthesized answers, and
  also makes RPZ work with DNS64. The order for the modules is
  module-config: "respip dns64 validator iterator".
 2025-09-30 11:28:15 +02:00
W.C.A. Wijngaards d5e91d181b - Fix for the serve expired DNSSEC information fix, it would not allow 
current delegation information be updated in cache. The fix allows
  current delegation and validation recursion information to be
  updated, but as a consequence no longer has certain expired
  information around for later dnssec valid expired responses.
 2024-11-05 10:39:27 +01:00
W.C.A. Wijngaards a335e601e4 ipset-pf-support, move startup and destartup to the front of the module 
func block functions, modstack call deinit function names, and detect
module change when no startup functions are needed.
 2024-07-03 13:53:44 +02:00
W.C.A. Wijngaards ff653a7ef8 Call module init init again, and new function startup and destartup. 
NULL can be used if the function is not used. Open shared ports during
reload. Deinit is called during reload.
 2024-07-01 16:10:07 +02:00
W.C.A. Wijngaards 3953f827fb Merge branch 'master' of https://github.com/madroach/unbound into ipset-pf-support 2024-07-01 14:36:33 +02:00
W.C.A. Wijngaards f6753a0f10 - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. 2022-08-01 13:24:40 +02:00
Dimitris Apostolou c21d6af617 Fix typos 2021-11-13 16:56:15 +02:00
W.C.A. Wijngaards ecb8aed2f2 - Add that log-servfail prints an IP address and more information 
about one of the last failures for that query.
 2021-04-29 10:24:35 +02:00
George Thessalonikefs 7f25bb4730 - ipsecmod: Better logging for detecting a cycle when attaching the 
A/AAAA subquery.
 2021-02-24 13:59:31 +01:00
Christopher Zimmermann c96e4ca121 allow privileged initialisation of modules 2020-05-10 22:30:25 +02:00
W.C.A. Wijngaards f3c2d05728 - Fix ipsecmod compile. 2019-12-06 07:59:55 +01:00
W.C.A. Wijngaards 2a4e840be4 - Fix Unchecked NULL Pointer in dns64_inform_super() 
and ipsecmod_new(), reported by X41 D-Sec.
 2019-11-19 15:48:18 +01:00
W.C.A. Wijngaards 09845779d5 - Fix CVE-2019-18934, shell execution in ipsecmod. 2019-11-19 10:05:18 +01:00
Wouter Wijngaards 000e75581b Fixup that it does not set prefetch_ttl twice, but sets the new serve_expired_ttl member of the reply ttls. 
git-svn-id: file:///svn/unbound/trunk@4877 be551aaa-1e26-0410-a405-d3ace91eadb9
 2018-08-30 08:03:29 +00:00
Ralph Dolmans 2e5e31e8ac - Added serve-expired-ttl and serve-expired-ttl-reset options. 
git-svn-id: file:///svn/unbound/trunk@4876 be551aaa-1e26-0410-a405-d3ace91eadb9
 2018-08-28 14:21:56 +00:00
Wouter Wijngaards a40e8ae321 commentfix. 
git-svn-id: file:///svn/unbound/trunk@4170 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-17 13:26:26 +00:00
George Thessalonikefs 95544096bf - Use qstate's region for IPSECKEY rrset (ipsecmod). 
git-svn-id: file:///svn/unbound/trunk@4169 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-17 13:22:06 +00:00
Wouter Wijngaards 58fc4b8ea8 slightly more generic for rcodes that are not SERVFAIL. 
git-svn-id: file:///svn/unbound/trunk@4168 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-17 12:51:45 +00:00
Wouter Wijngaards cf2da96a28 don't accidentally increase repttl if it was small because of another (short-ttl) RRset in the reply. There would be cache replies trying to work with expired RRsets if this extra if wasn't there. 
git-svn-id: file:///svn/unbound/trunk@4167 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-17 12:43:48 +00:00
Wouter Wijngaards e1b6145e5c descript can have NULL _name for unknown types (even though only A, AAAA at this point), but the type_buf() routine works all the time. 
git-svn-id: file:///svn/unbound/trunk@4166 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-17 12:39:43 +00:00
Wouter Wijngaards 903fe8db7e but my fix for the comment was wrong, remove this part of the fix. 
git-svn-id: file:///svn/unbound/trunk@4165 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-17 12:20:58 +00:00
Wouter Wijngaards 39be1377e2 cast size_t to long for print as %ld. 
git-svn-id: file:///svn/unbound/trunk@4164 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-17 12:19:35 +00:00
Wouter Wijngaards de4c7bd317 fixup comment. 
git-svn-id: file:///svn/unbound/trunk@4163 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-17 12:13:45 +00:00
Wouter Wijngaards 305f6f0295 compiler warning fixes. 
git-svn-id: file:///svn/unbound/trunk@4160 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-16 13:25:49 +00:00
George Thessalonikefs 491b0a26e4 - Implemented opportunistic IPsec support module (ipsecmod). 
- Some whitespace fixup.


git-svn-id: file:///svn/unbound/trunk@4158 be551aaa-1e26-0410-a405-d3ace91eadb9
 2017-05-16 12:39:24 +00:00