WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,207 Commits 29 Branches 215 Tags
stats-shm-volley
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Yorgos ThessalonikefsandGitHub 3031271efc Merge pull request #1427 from NLnetLabs/stats-shm-volley-review 
stats-shm-volley review with typos and slightly more detailed text for comments.
 2026-03-30 16:07:55 +02:00
Yorgos Thessalonikefs d709481cf2 - stats-shm-volley review, typos and slightly more detailed text for comments. 2026-03-30 14:39:44 +02:00
Yorgos Thessalonikefs 16e1e6d375 - Fix #1404: Priming the root key fails after loading ipfire.org RPZ 
zones. Fixed by including the ZONEMD RRtype in the list of types to
  ignore for RPZ zones. Analysis and patch provided by ummeegge.
 2026-02-16 13:37:19 +01:00
Yorgos Thessalonikefs 1cdddf0fe9 - Fix #1389: [FR] replacement with ECC-GOST12 according to RFC9558. 
Patch contributed by Igor V. Ruzanov, available in
  contrib/gost12.patch.
 2026-02-06 14:39:23 +01:00
Yorgos Thessalonikefs faf40c97fc - Eagerly remove .skip mark files in between mini_tdir.sh runs in case 
there has been a change on the environment.
 2026-02-03 15:08:59 +01:00
Yorgos Thessalonikefs 57bff79627 - Update generated man pages. 2026-01-23 18:04:25 +01:00
Yorgos Thessalonikefs 1b5559d534 Changelog entry for #1396: 
- Merge #1396: Log Linux thread ID.
- On Linux systems log the system-wide unique thread ID instead of
  Unbound's internal thread counter.
- Introduce the 'log-thread-id' configuration option to manage logging
  the system-wide Linux thread ID for easier debugging with system
  tools.
 2026-01-23 17:46:14 +01:00
Yorgos ThessalonikefsandGitHub 9d271c5343 Merge pull request #1396 from NLnetLabs/features/thread-id 2026-01-23 17:42:30 +01:00
Yorgos Thessalonikefs 74cc49e6c4 - Introduce the 'log-thread-id' configuration option to manage logging 
the system-wide Linux thread ID for easier debugging with system
  tools.
 2026-01-23 17:15:14 +01:00
Yorgos Thessalonikefs d414ebf0c7 - On Linux systems log the system-wide unique thread ID instead of 
Unbound's internal thread counter.
 2026-01-23 17:08:55 +01:00
Yorgos Thessalonikefs f1b35bab4b Changelog entry for #1391: 
- Merge #1391 from Götz Görisch: Fix documentation to adhere to
  RFC5952.
 2026-01-06 18:21:34 +01:00
Yorgos ThessalonikefsandGitHub 84ed77238d Merge pull request #1391 from GoetzGoerisch/docs 
Fix documentation to adhere to RFC 5952
 2026-01-06 18:19:47 +01:00
Yorgos Thessalonikefs 44659cb3bf - Use the same EDE removal logic when encoding errors as when encoding 
replies.
 2025-12-31 16:22:15 +01:00
Yorgos Thessalonikefs a1ac2d0252 - Update the unbound-anchor man page to note write permissions of the 
generated file if it is to be used with Unbound's
  auto-trust-anchor-file option.
 2025-12-31 14:05:42 +01:00
Yorgos Thessalonikefs 5c7a26b615 - Mark "THROWAWAY" and "(DNSSEC) LAME" responses clearly as Unbound's 
categorization in the log output.
 2025-12-30 13:15:37 +01:00
Yorgos Thessalonikefs 09d352b917 - More specific wording in the unbound.conf man page for stub-first 
and forward-first options.
 2025-12-24 14:57:44 +01:00
Yorgos Thessalonikefs 83336477c6 - For #1375, there is no DNSTAP environment if it wasn't configured. 2025-11-28 15:20:21 +01:00
Yorgos Thessalonikefs e3e5eb66cf - Tag for 1.24.2 release. 
The repository continues with version 1.24.3.
 2025-11-26 13:54:25 +01:00
Yorgos Thessalonikefs 00d3b97dbb Merge branch 'branch-1.24.2' 2025-11-26 13:50:49 +01:00
Yorgos Thessalonikefs f6269baa60 - Additional fix for CVE-2025-11411 (possible domain hijacking attack), 
to include YXDOMAIN and non-referral nodata answers in the mitigation as
  well, reported by TaoFei Guo from Peking University, Yang Luo and JianJun
  Chen from Tsinghua University.
 2025-11-26 11:09:40 +01:00
Yorgos Thessalonikefs 19154c6e58 - Set version to 1.24.2. 2025-11-26 10:58:06 +01:00
Yorgos Thessalonikefs 024c921dbf - Fix #1366: Infra cache does not work correctly for NAT64, by 
moving the NAT64 synthesis from the iterator when selecting a target
  address, to the delegation point itself when adding target
  addresses.
 2025-11-01 15:10:27 +01:00
Yorgos Thessalonikefs 1a808e2978 - Fix typo; spotted by T3rm1. 2025-10-28 14:42:20 +01:00
Yorgos Thessalonikefs 56ded934de - Fix #1165, document the possible circular dependency when using 
host names instead of IP addresses for name servers in stub/forward
  zones and log a warning when spotted in the configuration.
 2025-10-27 14:01:10 +01:00
Yorgos Thessalonikefs 98952f11d1 Changelog entry for #1331: 
- Merge #1331 from Jitka Plesníková: Replace deprecated $function by
  new $action, for SWIG.
 2025-10-27 09:59:35 +01:00
Yorgos ThessalonikefsandGitHub cb4b3de62f Merge pull request #1331 from jplesnik/master 
Replace deprecated $function by new $action
 2025-10-27 09:57:59 +01:00
Yorgos Thessalonikefs c8dcfc0853 - For #1364, use OPENSSL_VERSION_TEXT instead of OPENSSL_VERSION_NUMBER 
for part of the configure script. OPENSSL_VERSION_TEXT is more
  consistent across versions.
 2025-10-24 15:43:22 +02:00
Yorgos Thessalonikefs 2bb28fdf12 - Fix unused attribute warning in redis.c when threads are not 
supported.
 2025-10-24 14:44:58 +02:00
Yorgos Thessalonikefs 6ad26909dd - Note Havard Eidnes for his suggestions on the mailing list. 2025-10-24 14:26:08 +02:00
Yorgos Thessalonikefs 9602973c86 - unbound.conf man page updates to include a preview of the section 
clauses and some reformatting around the use of "clause", "option"
  and "attributes".
 2025-10-24 14:23:53 +02:00
Yorgos Thessalonikefs 713b1783d4 - Tag for 1.24.1 release. 
The repository continues with version 1.24.2.
 2025-10-22 12:49:29 +02:00
Yorgos Thessalonikefs e06b7eb3f1 Merge branch 'branch-1.24.1' 2025-10-22 12:44:59 +02:00
Yorgos Thessalonikefs a33f0638e1 - Fix CVE-2025-11411 (possible domain hijacking attack), reported by Yuxiao Wu, 
Yunyi Zhang, Baojun Liu and Haixin Duan from Tsinghua University.
 2025-10-22 10:54:57 +02:00
Yorgos Thessalonikefs bbeee42e25 - Set version to 1.24.1. 2025-10-22 10:50:18 +02:00
Yorgos Thessalonikefs 1cb9595a42 - Update the unbound.conf online man page link and some text 
reformatting in README.md.
 2025-10-20 14:34:40 +02:00
Yorgos Thessalonikefs a4dd321fd8 - Remove extra gpg instructions from makedist.sh output. 2025-10-15 14:59:48 +02:00
Yorgos Thessalonikefs d23a28a693 - ci: don't fail fast for the analysis_port workflow. 2025-10-15 14:10:20 +02:00
Yorgos Thessalonikefs 21f02a0865 - Note clearly that 'wait-limit: 0' disables all wait limits. 
- 'wait-limit-cookie: 0' can now disable cookie validated wait
  limits.
 2025-10-03 16:44:44 +02:00
Yorgos Thessalonikefs e017d66fc1 - Note 'respip' and 'dns64' module order in the unbound.conf 
man page.
 2025-10-03 11:27:26 +02:00
Yorgos Thessalonikefs 0c01257d1d Changelog entry for #1351: 
- Merge #1351: ac_cv_func_malloc_0_nonnull for malloc(0) check.
 2025-09-29 13:14:07 +02:00
Yorgos ThessalonikefsandGitHub 1e2dc657a1 ac_cv_func_malloc_0_nonnull for malloc(0) check (#1351) 
- For #1339, use the standard variable ac_cv_func_malloc_0_nonnull for
  the malloc(0) check during configure; patch from Helmut Grohne.
 2025-09-29 13:12:27 +02:00
Yorgos Thessalonikefs 843124852f Changelog entry for #1349: 
- Merge #1349: Fix #1346: [FR] Please allow back TLS 1.2.
 2025-09-29 12:10:34 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		499a3a7a61 Fix #1346: [FR] Please allow back TLS 1.2. (#1349) 
* 'tls-use-system-policy-versions' is introduced to allow Unbound to use
  any system available TLS version when serving TLS.

* Apply suggestions from code review

---------

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-09-29 12:03:56 +02:00
Yorgos Thessalonikefs 35f6fd47fb - Test for nonstring attribute in configure and add 
nonstring attribute annotations.
 2025-09-26 16:23:55 +02:00
Yorgos Thessalonikefs 64645e1401 - Avoid calling mesh_detect_cycle_found() when there is no mesh state 
to begin with.
 2025-09-24 14:30:24 +02:00
Yorgos Thessalonikefs 421d317a64 - For #1350, same CAP_NET_ADMIN change for unbound_portable.service.in 
as well.
 2025-09-23 17:42:41 +02:00
Yorgos Thessalonikefs 0b8ed987de Changelog entry for #1350: 
- Merge #1350 from Maryse47: unbound.service.in: allow CAP_NET_ADMIN.
 2025-09-23 17:37:59 +02:00
Yorgos ThessalonikefsandGitHub 9511797487 Merge pull request #1350 from Maryse47/patch-1 
unbound.service.in: allow CAP_NET_ADMIN and drop CAP_NET_RAW (redundant now).
 2025-09-23 17:37:09 +02:00
Yorgos Thessalonikefs 0b7bb75152 - For #1352, align with the current Python<3 code. 2025-09-23 17:31:55 +02:00
Yorgos Thessalonikefs 88c688ec10 Changelog entry for #1352: 
- Merge #1352 from Petr Vaganov: pythonmod: fix HANDLE_LEAK on
  pythonmod_init.
 2025-09-23 17:15:16 +02:00
Yorgos ThessalonikefsandGitHub 69217cf675 Merge pull request #1352 from petrvaganoff/dev-52227 
pythonmod: fix HANDLE_LEAK on pythonmod_init
 2025-09-23 17:13:30 +02:00
Yorgos Thessalonikefs e471e15774 - unbound.conf manpage: explicitly mention RFC6891. 2025-09-19 15:49:07 +02:00
Yorgos Thessalonikefs ec3db03121 Changelog entry for #1337: 
- Merge #1337: 0 TTL cached replies and some TTL behavior changes.
 2025-09-19 15:01:30 +02:00
Yorgos Thessalonikefs e2bf773089 Merge branch 'features/no-ttl-zero-cacherep' 2025-09-19 14:56:04 +02:00
Yorgos Thessalonikefs 3017a0aa52 - Update README.man with clearer text. 2025-09-19 10:03:10 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		bc61034f60 code review: use proper roundrobin index 
Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-09-17 12:19:20 +02:00
Yorgos Thessalonikefs 2dd821c257 - Too many quotes for the EDE message debug printout. 2025-09-17 11:27:16 +02:00
Yorgos Thessalonikefs c3a8d5251f - Small debug output improvement when attaching an EDE. 2025-09-15 12:06:49 +02:00
Yorgos Thessalonikefs 73e408f1d0 A few changes for TTL processing: 
- Cached messages that reach 0 TTL are considered expired. This prevents
  Unbound itself from issuing replies with TTL 0 and possibly causing a
  thundering herd at the last second. Upstream replies of TTL 0 still
  get the usual pass-through but they are not considered for caching
  from Unbound or any of its caching modules.
- 'serve-expired-reply-ttl' is changed and is now capped by the original
  TTL value of the record to try and make some sense when replying
  with expired records.
- TTL decoding was updated to adhere to RFC8767 section 4 where a set
  high-order bit means the value is positive instead of 0.
 2025-09-15 10:03:35 +02:00
Yorgos Thessalonikefs d521135f66 Merge branch 'master' into features/no-ttl-zero-cacherep 2025-09-12 15:24:06 +02:00
Yorgos Thessalonikefs dd6200065f - Update man pages. 2025-09-08 14:50:27 +02:00
Yorgos Thessalonikefs a72177e73c - Update documentation for using "SET ... EX" in Redis. 
- Document max buffer sizes for Redis commands.
 2025-09-08 14:49:12 +02:00
Yorgos Thessalonikefs 44da5eee66 - Limit the number of consecutive reads on an HTTP/2 session. 
Thanks to Gal Bar Nahum for exposing the possibility of infinite
  reads on the session.
 2025-08-29 15:35:32 +02:00
Yorgos Thessalonikefs 46823f7bc3 - Update man page templates from rst. 2025-07-12 17:37:54 +02:00
Yorgos Thessalonikefs dd3ac53ff1 - For #1289: add num.valops in the unbound-control man page. 2025-07-12 17:35:16 +02:00
Yorgos Thessalonikefs 1a6052fcac - For #1289: test num.valops in existing stat_values.tdir. 2025-07-12 17:33:43 +02:00
Yorgos Thessalonikefs 6689f0b4da Changelog entry for #1289: 
- Merge #1289 from Roland van Rijswijk-Deij: Add extra statistic to
  track the number of signature validation operations.
  Adds 'num.valops' to extended statistics.
 2025-07-12 16:35:02 +02:00
Yorgos Thessalonikefs 4200d23882 - For #1247, replay test (added tcp_transport to 
outnet_serviced_query).
 2025-06-25 14:02:47 +02:00
Yorgos Thessalonikefs e2814fe165 - For #1247, turn off fetch-policy for delegation when looking into 
parent side name servers that may not update the addresses and hit
  NXNS limits.
 2025-06-25 13:59:17 +02:00
Yorgos Thessalonikefs ca153f4657 - Fix #1247: forward-first: ssl handshake failed on root nameservers. 2025-06-25 13:56:50 +02:00
Yorgos Thessalonikefs ee607c0f72 Changelog entry for #1293: 
- Fix #1293: EDE 6 is attached to insecure cached answers when client
  sends the CD bit.
 2025-06-20 14:11:22 +02:00
Yorgos Thessalonikefs 2d90d5d729 - Fix #1293: EDE 6 is attached to insecure cached answers when client sends 
the CD bit.
 2025-06-20 14:09:30 +02:00
Yorgos Thessalonikefs 9201c75013 - Fix for consistent use of local zone CNAME alias for configured auth 
zones. Now it also applies to downstream configured auth zones.
 2025-06-17 15:03:29 +02:00
Yorgos Thessalonikefs 81f3de4da2 - Small man page corrections for the 'disable-dnssec-lame-check' option. 2025-06-03 14:12:27 +02:00
Yorgos Thessalonikefs 342a0f48e3 - Add more checks about respip in unbound-checkconf. 
Also fixes #310: unbound-checkconf not reporting RPZ configuration
  error.
 2025-05-20 16:21:02 +02:00
Yorgos Thessalonikefs 71ac59e6f4 Changelog entry for #1285: 
- Merge #1285:  RST man pages.
 2025-05-20 12:23:32 +02:00
Yorgos ThessalonikefsandGitHub 6662f71732 RST man pages (#1285) 
Introduce restructuredText man pages to sync the online and source code man page documentation.
The templated man pages (*.in) are still part of the repo but generated with docutils from their .rst counterpart.
Documentation on how to generate those (mainly for core developers) are in README.man.
 2025-05-20 12:20:20 +02:00
Yorgos Thessalonikefs 9152c914af - Fix #1282: log-destaddr fail on long ipv6 addresses. 2025-05-13 11:02:58 +02:00
Yorgos Thessalonikefs a35ac5d82e - Fix #1284: NULL pointer deref in az_find_nsec_cover() (latent bug) 
by adding a log_assert() to safeguard future development.
 2025-05-13 11:00:23 +02:00
Yorgos Thessalonikefs 8e1deede08 Changelog entry for #1280: 
- Merge #1280: Fix auth nsec3 code. Fixes NSEC3 code to not break on
  broken auth zones that include unsigned out of zone (above apex)
  data. Could lead to hang while trying to prove a wildcard answer.
 2025-05-12 14:29:11 +02:00
Yorgos ThessalonikefsandGitHub 4e23523d1a Fix auth nsec3 code (#1280) 
- Fix NSEC3 code to not break on broken auth zones that include unsigned
  out of zone (above apex) data. Could lead to hang while trying to
  prove a wildcard answer.
  Reported by Dmitrii Kuvaiskii from Amazon Web Services.

- Tests for NSEC3 auth zones with out of zone data.
 2025-05-12 14:26:47 +02:00
Yorgos Thessalonikefs 5dd14e2644 - Sync unbound and unbound-checkconf log output for unknown modules. 2025-05-05 14:47:12 +02:00
Yorgos Thessalonikefs b50faccb1d Changelog entry for #1276: 
- Merge #1276: Auto-configure '-slabs' values.
 2025-04-29 15:23:07 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		fcc21885e4 Auto-configure '-slabs' values (#1276) 
- Auto-configure '-slabs' values to a power of 2 value close to num-threads
  by default for multi-threaded environments.

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-04-29 15:21:47 +02:00
Yorgos Thessalonikefs 0f95fae445 Changelog entry for #1275: 
- Merge #1275: Use macros for the fr_check_changed* functions.
 2025-04-28 15:50:03 +02:00
Yorgos ThessalonikefsandGitHub e5bbc36ae0 Use macros for the fr_check_changed* functions (#1275) 2025-04-28 15:48:45 +02:00
Yorgos Thessalonikefs 30c13d0351 Changelog entry for #1265: 
- Merge #1265: Fix WSAPoll.
 2025-04-11 15:10:46 +02:00
Yorgos Thessalonikefs d6e8ac1289 Fix WSAPoll (#1265) 
* Fix calling WSAPoll.

* fast_reload: explicitly set tcp_wouldblock on Windows when there is no
  command to read from the fast_reload thread.

* For poll(), also check for ENOMEM (Linux).

* Remove ifdefs for ENOMEM.
* Some systems return EAGAIN for poll.
 2025-04-11 15:09:07 +02:00
Yorgos Thessalonikefs 9c99b404a1 Changelog entry for #1265: 
- Merge #1265: Fix WSAPoll.
 2025-04-11 15:07:25 +02:00
Yorgos ThessalonikefsandGitHub 75e8fd7539 Fix WSAPoll (#1265) 
* Fix calling WSAPoll.

* fast_reload: explicitly set tcp_wouldblock on Windows when there is no
  command to read from the fast_reload thread.

* For poll(), also check for ENOMEM (Linux).

* Remove ifdefs for ENOMEM.
* Some systems return EAGAIN for poll.
 2025-04-11 15:05:52 +02:00
Yorgos Thessalonikefs f9d740dfdc - Update to the manpage for the fast_reload part. 2025-04-08 15:34:51 +02:00
Yorgos Thessalonikefs e94e140f49 - More explicit text about memory usage during fast_reload. 2025-04-07 16:56:38 +02:00
Yorgos Thessalonikefs db6505eb8b Changelog entry for #902: 
- Merge #902: DNS Error Reporting (RFC 9567). Introduces new
  configuration option 'dns-error-reporting' and new statistics for
  'num.dns_error_reports'.
 2025-04-07 10:28:37 +02:00
Yorgos Thessalonikefs 349721a39d Changelog entry for #1019: 
- Merge #1019: Redis read-only replica support.
  Introduces new 'redis-replica-*' options for the Redis cache backend.
 2025-04-04 10:58:59 +02:00
Yorgos ThessalonikefsGitHubWouter WijngaardsW.C.A. Wijngaards
 		90243a694a Redis read-only replica support (#1019) 
* Set version to 1.19.1 for point release.

* Initial work for Redis read-only replica support.

* Test for Redis replica.

* Documentation for the Redis replica timeouts.

* redis replica, rewrite set_timeout()

* clean merge.

* Add new options for fast reload.

* Apply suggestions from code review

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>

* some more typos

---------

Co-authored-by: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-04-04 10:20:47 +02:00
Yorgos Thessalonikefs 8b38fe5ab6 - For #1262, ifdef is no longer needed. 2025-04-02 11:53:50 +02:00
Yorgos Thessalonikefs fcdb0bbf91 Changelog entry for #1262: 
- Merge #1262 from markyang92, fix build with
  'gcc-15 -Wbuiltin-declaration-mismatch' error in compat/malloc.c.
 2025-04-02 11:52:04 +02:00
Yorgos ThessalonikefsandGitHub b738b354bd Merge pull request #1262 from markyang92/master 
fix build with gcc-15 -Wbuiltin-declaration-mismatch error in compat/malloc.c
 2025-04-02 11:49:49 +02:00
Yorgos Thessalonikefs 23273d76a5 - For #1255, for ios try the latest expat version again. 2025-03-26 16:51:46 +01:00
Yorgos Thessalonikefs 94a84d3387 - For #1255, for ios disable building tests that require C++11. 2025-03-26 16:40:10 +01:00