WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,513 Commits 29 Branches 215 Tags
master
Commit Graph
8513 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
W.C.A. Wijngaards 1354624ba4 - Fix perform a full transfer every number of incremental 
transfers, to stop increasing memory usage, for auth-zone
  and rpz zones. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 15:51:03 +02:00
W.C.A. Wijngaards 153f8d5353 - Fix to add max-transfer-size and max-transfer-time that 
limit auth-zone and rpz transfer amount and time taken.
  Default is disabled. This hardens against unbounded
  transfers. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 15:45:03 +02:00
W.C.A. Wijngaards a1cecf7462 - Fix that for auth-zone and rpz zones the allow-notify 
addresses and netblocks are available from start, and
  fix the probe step skip.
 2026-06-12 11:48:14 +02:00
W.C.A. Wijngaards e2dac8a00a - Fix compile for OpenSSL 1.0.2 and before in server cleanup. 2026-06-11 17:31:19 +02:00
W.C.A. Wijngaards ecd41bef27 - Fix #1437: Fix compile with OpenSSL 4.0.1. 2026-06-11 17:31:01 +02:00
W.C.A. Wijngaards fd2131687a - Fix for #1306: configure checks if the ngtcp2_crypto_ossl 
header file is available, and prints an error otherwise.
 2026-06-11 11:43:46 +02:00
W.C.A. Wijngaards 316b9ab4fc - Fix for #1306: configure detects specifically the call to 
SSL_set_quic_tls_early_data_enabled and
  SSL_set_quic_early_data_enabled, so the correct one is used.
 2026-06-11 11:04:50 +02:00
W.C.A. Wijngaards d45daaf313 - Fix warnings with gcc in compat/inet_pton.c. 2026-06-10 16:43:41 +02:00
W.C.A. Wijngaards db1c6d6557 - Fix pythonmod script read for numeric overflow. 2026-06-10 11:24:02 +02:00
W.C.A. Wijngaards e7a713a525 - Fix unit test for ecs to check for malloc success. 2026-06-09 16:41:37 +02:00
Alex BandandGitHub 39e67508c9 change mailing list to forum 2026-06-08 21:48:04 +02:00
W.C.A. Wijngaards 3eab974ca2 - Fix that dns64 cleans up the allocated message if the adjust 
routines fail, and checks if there is a reply before cache
  store, also unbound checks if A and AAAA are malformed
  for auth-zones. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-03 14:56:20 +02:00
W.C.A. Wijngaards b1d1dcb3b6 - Fix that dump_cache has a larger buffer for records, 
and it checks that an owner name does not collide with BADRR
  on the input, and changes verbosity on the log of failure in
  rrset to string.  Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-03 14:51:16 +02:00
W.C.A. Wijngaards 10cb62aca2 - Fix that validation canonicalization of domain names 
in rdata checks for buffer bounds. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-03 14:48:06 +02:00
W.C.A. Wijngaards 6da73aba38 - Fix fast_reload for when a ZONEMD lookup is in progress. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-03 14:42:47 +02:00
W.C.A. Wijngaards 1b1b9626ee - Fix negative cache NSEC3 nodata proof, to use the correct 
message size. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-03 14:40:17 +02:00
W.C.A. Wijngaards 8bc074043a - Fix PROXYv2 header read and consume, it checks the header 
size. Thanks to Qifan Zhang, Palo Alto Networks for
  the report.
 2026-06-03 14:37:37 +02:00
W.C.A. Wijngaards 04a6322aa4 - Fix ipset module to use larger domain name buffers, and 
check buffer lengths. Thanks to Qifan Zhang, Palo Alto
  Networks for the report.
 2026-06-03 14:35:06 +02:00
W.C.A. Wijngaards 5748f518d1 - Fix that quotation and escaping works the same in auth-zone 
url content, as in the zonefile read. Thanks to Qifan Zhang,
  Palo Alto Networks for the report.
 2026-06-03 14:32:14 +02:00
W.C.A. Wijngaards d05eff4d54 - Fix parse of svcbparam ech, it had incorrect length. Thanks 
to Qifan Zhang, Palo Alto Networks for the report.
 2026-06-03 14:05:48 +02:00
Yorgos Thessalonikefs 4544eaa4cc - Fix const as reported by newest compiler warnings. 2026-06-03 14:00:04 +02:00
W.C.A. Wijngaards 5d0770d0ad - Fix negative cache to work with NSEC3 records without salt. 
Thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern
  Polytechnical University, for the report.
 2026-06-03 13:56:31 +02:00
W.C.A. Wijngaards 7f4beb846e - Fix that the processing of class responses does not have 
a heap use-after-free. That could happen if at least two
  distinct classes are configured for resolution. Thanks
  to Qifan Zhang, Palo Alto Networks for the report.
  In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia
  Liu, Northwestern Polytechnical University, for also
  reporting this.
 2026-06-03 12:14:30 +02:00
W.C.A. Wijngaards 8e8c04e1b9 - Fix unit test to check for new icannbundle.pem. 2026-05-29 12:10:40 +02:00
W.C.A. Wijngaards bf0da2ed21 - Update icannbundle.pem certificates in unbound-anchor. It 
has the public keys for 2009 to 2029 and for 2025 to 2045.
 2026-05-29 12:10:07 +02:00
W.C.A. Wijngaards 670ece06df - iana portlist updated. 2026-05-29 11:54:40 +02:00
W.C.A. Wijngaards 9e41903be8 - Fix header_seen detection for trust anchor files, so that it 
detects the id line.
 2026-05-29 11:54:03 +02:00
W.C.A. Wijngaards 57f92cc97e - Fix #1457: race condition causes segfault when starting 
threads.
 2026-05-28 09:34:04 +02:00
W.C.A. Wijngaards c0741ccc68 - Fix analyzer warning in mesh_new_client. 2026-05-27 16:03:15 +02:00
W.C.A. Wijngaards fb2745024a - Fix that validator caps number of ANY RRsets it can 
validate, and the wait timer is shortened. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-05-27 13:38:10 +02:00
W.C.A. Wijngaards 0c15ddd133 - Fix ipset module for name too long checks, race conditions 
on local name buffer, and for socket close race condition.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-27 13:34:32 +02:00
W.C.A. Wijngaards b53504049c - Fix that dns64 with subnetcache does not write ECS scoped 
answers to global cache. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-27 13:31:11 +02:00
W.C.A. Wijngaards a5324e58eb - Fix, in depth, for respip rewrite of dns64 responses. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-27 13:28:41 +02:00
W.C.A. Wijngaards 963cd68535 - Fix manual to document ratelimit, that it is for target 
nameservers for a domain, and keeps queries limited. Thanks
  to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-27 13:24:44 +02:00
W.C.A. Wijngaards 047df73887 - Fix to decrement the per-netblock tcp connection limits, so 
it keeps usable. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-05-27 13:20:35 +02:00
W.C.A. Wijngaards d2e1ea7d19 - Fix to reset the tcp-timeout before applying a load based 
reduction. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-05-27 13:17:35 +02:00
W.C.A. Wijngaards fbbe95ba5b - Fix that msgencode insert_query has the correct assertion, 
for a local_alias. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-05-27 12:20:04 +02:00
W.C.A. Wijngaards 758c649611 - Fix that the ratelimit is decremented on successful 
referrals. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-05-27 12:16:23 +02:00
W.C.A. Wijngaards a23f95f620 - Fix to limit the DSNS per-label walk in the iterator. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-27 12:12:39 +02:00
W.C.A. Wijngaards 5363570df0 - Fix for autotrust state-file line overflow, that can give 
hold-down bypass. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-05-27 12:09:01 +02:00
W.C.A. Wijngaards 368857a45b - Fix for mesh new client and mesh new callback to rollback the 
added address, tcp mesh state and callback when there is a failure
  to initialize. This fixes the mesh accounting of reply addresses.
  Thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern
  Polytechnical University, for the report
 2026-05-26 16:20:11 +02:00
W.C.A. Wijngaards 40b16d0565 - Fix for signed same-owner CNAME and ordinary RRset responses. 
Thanks to Xin Wang and Jiajia Liu, Northwestern Polytechnical
  University, for the report.
 2026-05-20 16:30:37 +02:00
W.C.A. Wijngaards 08e901a1ac - Fix cleaning up DoH session. The same query can be on multiple 
streams in a session. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-05-20 15:04:12 +02:00
W.C.A. Wijngaards bc703c9129 - Fix lame server detection, for selfpointed glue records. 
Thanks to Shuhan Zhang, Dan Li, and Baojun Liu from Tsinghua
  University for the report.
 2026-05-20 15:01:42 +02:00
W.C.A. Wijngaards 9ce52de6c1 - Fix in depth for serve-expired responses from cachedb, that it 
does not store bogus. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-05-20 14:58:26 +02:00
W.C.A. Wijngaards b3aa262477 Remove the debug file. 2026-05-20 12:43:08 +02:00
W.C.A. Wijngaards 25e112c674 - Unit test for CVE-2026-44390. 2026-05-20 12:42:04 +02:00
W.C.A. Wijngaards 0d2282d551 - Unit test for CVE-2026-42960. 2026-05-20 12:40:32 +02:00
W.C.A. Wijngaards b5f21f4165 - Unit test for CVE-2026-40622. 2026-05-20 12:37:17 +02:00
W.C.A. Wijngaards d357935f66 - Unit test for CVE-2026-42959. 2026-05-20 12:35:38 +02:00