WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-13 21:37:43 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,221 Commits 29 Branches 215 Tags
5c6f56f8f1c917c19deca17dea15b95b76c47556
Commit Graph
8221 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Arunabha DasandGitHub 5c6f56f8f1 Apply cache TTL policy to DNAME and synthesized CNAME on wire path (#1418) 
When the scrubber synthesizes a CNAME from a DNAME (authority omits CNAME),
apply cache-min-ttl/cache-max-ttl to both DNAME and synthesized CNAME in
msg_parse so they stay equal and respect config (RFC 6672).

- iterator/iter_scrub.c: In synth_cname_rrset(), clamp TTL to [MIN_TTL,
  MAX_TTL] when !SERVE_ORIGINAL_TTL and write back to both synth CNAME
  and DNAME rrset. Removes FIXME.
 2026-03-09 13:53:52 +01:00
W.C.A. Wijngaards 9af29c3ed1 - Fix compile failure in unbound-checkconf for older gcc compiler. 2026-03-09 09:18:43 +01:00
Yorgos Thessalonikefs 76ef8c5803 - Constrain the explicit macros for remote.c:fr_atomic_copy_cfg(). 2026-03-06 17:27:21 +01:00
Yorgos Thessalonikefs 94ef1a8fee - Warn for unused 'nodefault' local-zone configuration in 
unbound-checkconf (related to #1416).
 2026-03-06 17:05:57 +01:00
Yorgos Thessalonikefs 683241a2f5 - Document the suggestion for a higher value for 'outgoing-range'; 
helps when the request list is full.
 2026-03-06 17:01:41 +01:00
W.C.A. Wijngaards 92ab54641e Changelog entry for #1415 
- Merge #1415: Add lock unlock for view in memory error handling.
 2026-03-06 08:58:33 +01:00
Andy WarnerandGitHub da3812953a Add lock unlock for view in memory error handling (#1415) 
view->lock would be skipped during an out of memory error bailout.
 2026-03-06 08:57:54 +01:00
W.C.A. Wijngaards 1bd7c8dfee - Update generated man pages. 2026-03-05 12:15:54 +01:00
W.C.A. Wijngaards 8f96ae7acf - Fix for DNS Rebinding Bypass via SVCB/HTTPS Records in Unbound. 
Thanks to Kunta Chu, School of Software, Tsinghua University,
  Taofei Guo, Peking University, and Jianjun Chen, Institute for
  Network Sciences and Cyberspace, Tsinghua University for the
  report. The private-address option is fixed to also elide
  SVCB and HTTPS records that match the filter.
 2026-03-05 09:47:13 +01:00
Yorgos Thessalonikefs c4f8e60c85 - For #1411: Introduce a failing case in the rpl test so that it only 
passes with the fix in place.
 2026-03-04 13:22:42 +01:00
W.C.A. Wijngaards a296b248b0 - For #1411: Fix that the lookup for DNAME uses flag. Fix assertion 
in expired calc debug routine.
 2026-03-03 17:44:31 +01:00
W.C.A. Wijngaards 1ef131299a For #1411, fix up doc/Changelog. 2026-03-03 08:55:56 +01:00
Arunabha DasandGitHub 5b58a872ef Allow synthesized DNAME TTL=0 to be served from cache within grace period (#1411) 
* Allow synthesized DNAME TTL=0 to be served from cache within grace period

Addresses doc/TODO: cache TTL=0 packets properly for synthesis.
- rrset_cache_lookup: allow TTL=0 DNAME within 1s grace for synthesis
- synth_dname_msg: support PACKED_RRSET_UPSTREAM_0TTL, return TTL=0 to client

Reduces recursion when authoritative servers return DNAME with TTL=0 (RFC 2308).
Client response still correctly returns TTL=0.

Note: Test with proper TTL=0 DNSSEC RRSIGs omitted - requires ldns-signzone
to generate valid signatures for TTL=0 RRsets.

* Add iter_dname_ttl0.rpl replay test for DNAME TTL=0
Tests signed DNAME with TTL=0 and RRSIG Original TTL=0 (RFC 4034).
Verifies end-to-end handling of TTL=0 DNAME responses.
 2026-03-03 08:51:31 +01:00
W.C.A. Wijngaards 94b04d6d46 - Update generated man pages. 2026-02-27 14:33:55 +01:00
W.C.A. Wijngaards f1a65eb4e8 For #1409: Changelog entry and more text. 2026-02-27 13:55:25 +01:00
Daisuke HIGASHIandGitHub 38e1e3eec3 Documentation CNAME in redirect-type local-zone (#1409) 2026-02-27 13:37:56 +01:00
W.C.A. Wijngaards bff3d762ff - Fix validator to set unchecked when validation recursion 
requests are passed. The edns subnet module checks if validation
  is needed for a cache response, and set the validator to protect
  the cache with validation for non-subnet lookups.
 2026-02-25 10:59:33 +01:00
Yorgos Thessalonikefs fb322f3e87 - Fixed some typos reported in #1395 by rezky_nightky. 2026-02-23 16:17:40 +01:00
Yorgos Thessalonikefs 2feee13735 - Fix to disallow cache lookup/store in external cachedb when a 
forwarder/stub forbids it with the no-cache option.
 2026-02-23 14:35:50 +01:00
W.C.A. Wijngaards 1d36696462 - Fix to make the cachedb_val_expired.crpl succeed. 2026-02-23 12:52:10 +01:00
W.C.A. Wijngaards aa4e2a9e69 - Fix to have cachedb not return expired bogus data as non-bogus. 2026-02-23 12:45:14 +01:00
W.C.A. Wijngaards 8e04d04949 - For #1405: local-zone always_refuse also blocks queries of type DS. 2026-02-17 15:36:08 +01:00
W.C.A. Wijngaards c5627dbd52 - Fix to remove unused conditional from cookie timestamp at 
worker env.
 2026-02-17 11:15:15 +01:00
W.C.A. Wijngaards 014ed9c5ff - Fix that cachedb aggressive negative responses have the RA flag set. 2026-02-16 16:35:37 +01:00
Yorgos Thessalonikefs 16e1e6d375 - Fix #1404: Priming the root key fails after loading ipfire.org RPZ 
zones. Fixed by including the ZONEMD RRtype in the list of types to
  ignore for RPZ zones. Analysis and patch provided by ummeegge.
 2026-02-16 13:37:19 +01:00
W.C.A. Wijngaards 1a9a4e4ca1 - Fix #1403: Inconsistency between do-nat64 and do-not-query-address 
during retries.
 2026-02-11 16:01:30 +01:00
W.C.A. Wijngaards f7f638e18f - Update generated man pages. 2026-02-09 16:11:17 +01:00
W.C.A. Wijngaards c956aea93d Changelog note and documentation for #1401. 
- Merge #1401: Add a new build-time option for system TLS.
  The --enable-system-tls flag enables the
  tls-use-system-policy-versions setting by default.
 2026-02-09 16:05:28 +01:00
Petr MenšíkandGitHub 4556a4f490 Add a new build-time option for system TLS (#1401) 
We want to use crypto-policy provided configuration always in our
builds. Allow changing the default of tls-use-system-policy-versions at
build time by a simple configure parameter.
 2026-02-09 15:57:16 +01:00
Yorgos Thessalonikefs 1cdddf0fe9 - Fix #1389: [FR] replacement with ECC-GOST12 according to RFC9558. 
Patch contributed by Igor V. Ruzanov, available in
  contrib/gost12.patch.
 2026-02-06 14:39:23 +01:00
W.C.A. Wijngaards 567c70dada Fix attribution of fix. 2026-02-04 14:17:56 +01:00
W.C.A. Wijngaards 8b4b2a88f7 - Fix local privilege escalation on Windows. Thanks to Hao Huang 
for the report. The OpenSSL init calls are set to not load
  the openssl.cnf file when compiled for Windows.
 2026-02-04 11:54:11 +01:00
Yorgos Thessalonikefs faf40c97fc - Eagerly remove .skip mark files in between mini_tdir.sh runs in case 
there has been a change on the environment.
 2026-02-03 15:08:59 +01:00
W.C.A. Wijngaards daa016e3e4 - Add test for allow-notify with a host name. 2026-01-27 13:49:33 +01:00
W.C.A. Wijngaards 039f69e735 - Fix to not skip allow-notify hostname lookups when there are only 
urls.
 2026-01-26 16:16:38 +01:00
W.C.A. Wijngaards b39009e487 Merge branch 'master' of github.com:NLnetLabs/unbound 2026-01-26 15:17:26 +01:00
W.C.A. Wijngaards 933769ee73 - Fix that allow-notify entries with hostnames are copied after IPv4 
and IPv6 lookup.
 2026-01-26 15:16:43 +01:00
Yorgos Thessalonikefs 57bff79627 - Update generated man pages. 2026-01-23 18:04:25 +01:00
Yorgos Thessalonikefs 1b5559d534 Changelog entry for #1396: 
- Merge #1396: Log Linux thread ID.
- On Linux systems log the system-wide unique thread ID instead of
  Unbound's internal thread counter.
- Introduce the 'log-thread-id' configuration option to manage logging
  the system-wide Linux thread ID for easier debugging with system
  tools.
 2026-01-23 17:46:14 +01:00
Yorgos ThessalonikefsandGitHub 9d271c5343 Merge pull request #1396 from NLnetLabs/features/thread-id 2026-01-23 17:42:30 +01:00
Yorgos Thessalonikefs 74cc49e6c4 - Introduce the 'log-thread-id' configuration option to manage logging 
the system-wide Linux thread ID for easier debugging with system
  tools.
 2026-01-23 17:15:14 +01:00
Yorgos Thessalonikefs d414ebf0c7 - On Linux systems log the system-wide unique thread ID instead of 
Unbound's internal thread counter.
 2026-01-23 17:08:55 +01:00
W.C.A. Wijngaards 9b123d1b78 - Fix http test tool petal to not print errors when there is no 
error.
 2026-01-22 14:19:35 +01:00
W.C.A. Wijngaards 37b71261a2 - Fix that fast reload copies the iter_scrub_ns, iter_scrub_cname 
and max_global_quota options.
 2026-01-22 09:42:56 +01:00
W.C.A. Wijngaards 4426db4d3d - Merge #1388: QNX Porting support for unbound. 2026-01-21 13:13:01 +01:00
nnarayanamurthyandGitHub fe10bc7682 QNX Porting support for unbound branch-1.24.1 (#1388) 
* qnx Porting support for version release-1.24.1

* updating __QNXNTO__ with __QNX__
 2026-01-21 13:12:13 +01:00
W.C.A. Wijngaards 67d2eae28c - Merge #1392: Include "V" (version) option in synopsis. 2026-01-19 09:09:47 +01:00
David H. GutteridgeandGitHub 9010a7075e Include "V" (version) option in synopsis (#1392) 2026-01-19 09:09:12 +01:00
W.C.A. Wijngaards cc6dbc9f38 - Fix documentation for requestlist.overwritten and 
requestlist.exceeded, it explains which query was dropped.
 2026-01-15 09:35:04 +01:00
W.C.A. Wijngaards 4198343dbe Compile fixup for #1381. 2026-01-08 14:19:06 +01:00