WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-22 01:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,242 Commits 30 Branches 216 Tags
7977ef28f5218cbf9a9c2cfeeaeeb076ff35aa12
Commit Graph
1079 Commits
Author SHA1 Message Date
Willem Toorop 7977ef28f5 distribute can send out responses tsig signed 2025-11-01 14:32:09 +01:00
Willem Toorop 3963af8d0b configurable ranges and tsig to allow responses 
Configurable with the "allow-response:" option in the "server:" section.
Usage:
	allow-response: <IP netblock> <tsig key-name | NOKEY | BLOCKED>
 2025-11-01 12:52:48 +01:00
Willem Toorop 2217c9b96e Merge branch 'master' into update-with-branches/poisonlicious 2025-10-30 09:48:57 +01:00
Willem Toorop 6592c73d56 Merge branch 'xfr-tsig' into update-with-branches/poisonlicious 2025-10-30 09:45:11 +01:00
Yorgos Thessalonikefs e06b7eb3f1 Merge branch 'branch-1.24.1' 2025-10-22 12:44:59 +02:00
Yorgos Thessalonikefs a33f0638e1 - Fix CVE-2025-11411 (possible domain hijacking attack), reported by Yuxiao Wu, 
Yunyi Zhang, Baojun Liu and Haixin Duan from Tsinghua University.
 2025-10-22 10:54:57 +02:00
W.C.A. Wijngaards 8687d69131 Merge branch 'master' into xfr-tsig 2025-10-01 15:52:40 +02:00
W.C.A. Wijngaards c622a71a28 - xfr-tsig, flip buffer after tsig_sign_reply, but not for error_encode. 2025-10-01 15:52:15 +02:00
W.C.A. Wijngaards 5e2fdff8e5 - Fix fr_atomic_copy_cfg. 2025-09-29 12:08:30 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		499a3a7a61 Fix #1346: [FR] Please allow back TLS 1.2. (#1349) 
* 'tls-use-system-policy-versions' is introduced to allow Unbound to use
  any system available TLS version when serving TLS.

* Apply suggestions from code review

---------

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-09-29 12:03:56 +02:00
Yorgos Thessalonikefs 73e408f1d0 A few changes for TTL processing: 
- Cached messages that reach 0 TTL are considered expired. This prevents
  Unbound itself from issuing replies with TTL 0 and possibly causing a
  thundering herd at the last second. Upstream replies of TTL 0 still
  get the usual pass-through but they are not considered for caching
  from Unbound or any of its caching modules.
- 'serve-expired-reply-ttl' is changed and is now capped by the original
  TTL value of the record to try and make some sense when replying
  with expired records.
- TTL decoding was updated to adhere to RFC8767 section 4 where a set
  high-order bit means the value is positive instead of 0.
 2025-09-15 10:03:35 +02:00
W.C.A. Wijngaards 1ae8be6847 - xfr-tsig, fast reload support for tsig keys. 2025-09-12 15:38:39 +02:00
Yorgos Thessalonikefs d521135f66 Merge branch 'master' into features/no-ttl-zero-cacherep 2025-09-12 15:24:06 +02:00
W.C.A. Wijngaards f0268d3e83 - xfr-tsig, log TSIG key name with zone and notify information. Clear tsig 
data before making a new one.
 2025-09-12 14:58:49 +02:00
W.C.A. Wijngaards 64e102aacb - xfr-tsig, fix notify tsig answer, fix parse edns allows TSIG, 
unit test for auth zone with notify with tsig and notify answer with tsig.
 2025-09-11 16:21:38 +02:00
W.C.A. Wijngaards 4a2dc1df48 Merge branch 'master' into xfr-tsig 2025-09-05 15:00:31 +02:00
W.C.A. Wijngaards c57c39833e - Fix for #1324: Fix to free edns options scratch in ratelimit case. 2025-09-01 09:28:29 +02:00
W.C.A. Wijngaards 74bc8c9e77 - Fix setup_listen_sslctx warning for nettle compile. 2025-08-28 14:19:52 +02:00
W.C.A. Wijngaards 533291dce9 - Fix unbound-control dump_cache for double unlock of lruhash table. 2025-08-27 16:55:38 +02:00
W.C.A. Wijngaards 4a3a4f474f Merge branch 'master' into xfr-tsig 2025-08-27 16:30:03 +02:00
W.C.A. Wijngaards f2f36a2733 - Fix that the zone acquired timestamp is set after the 
zonefile is read.
 2025-08-22 14:06:51 +02:00
W.C.A. Wijngaards 78d9bcacb6 - Fix #1319: [FR] zone status for Unbound auth-zones. 2025-08-22 12:40:00 +02:00
W.C.A. Wijngaards 1341905de8 - Fix to check for extraneous command arguments for unbound-control, 
when the command takes no arguments but there are arguments present.
 2025-08-21 09:47:24 +02:00
W.C.A. Wijngaards af1d430759 - xfr-tsig, log rcode for received notifies. 2025-08-20 15:55:29 +02:00
W.C.A. Wijngaards 54175a4180 Merge branch 'master' into xfr-tsig 2025-08-19 15:27:43 +02:00
W.C.A. Wijngaards 888d5ce9f9 - xfr-tsig, TSIG for SOA probe, notify, and on xfr first packet. 2025-08-19 15:27:16 +02:00
W.C.A. Wijngaards 8fd4b91afc - Fix cache_lookup subnet print to not print messages without rrsets 
and perform in-depth check on node in the addrtree.
 2025-08-15 16:04:23 +02:00
W.C.A. Wijngaards 13bb78a740 - Fix cache_lookup subnet printout to wipe zero part of the prefix. 2025-08-15 14:06:54 +02:00
W.C.A. Wijngaards 81345fe1e3 - unbound-control cache_lookup +t allows tld and root names. And 
subnet cache contents are printed.
 2025-08-15 13:03:00 +02:00
W.C.A. Wijngaards 991108af8d - Fix to decouple file descriptor activity and cache lookups in 
dump_cache.
 2025-08-14 12:20:10 +02:00
W.C.A. Wijngaards 4f790bd65e - Fix to increase responsiveness of dump_cache. 2025-08-14 11:25:40 +02:00
W.C.A. Wijngaards d122ae6490 - Fix to unlock cache_lookup message for malformed records. 2025-08-13 12:02:41 +02:00
W.C.A. Wijngaards 651a71fa76 - Fix to remove debug from cache_lookup. 2025-08-13 11:59:53 +02:00
W.C.A. Wijngaards fad747308f - unbound-control cache_lookup <domains> prints the cached rrsets 
and messages for those.
 2025-08-13 11:31:42 +02:00
W.C.A. Wijngaards 19b289feec - Fix that unbound-control dump_cache releases the cache locks 
every so often, so that the server stays responsive.
 2025-08-12 11:59:48 +02:00
W.C.A. Wijngaards b1bb4a4592 - xfr-tsig, check that tsig keys exist at startup and in unbound-checkconf. 2025-07-31 17:02:55 +02:00
W.C.A. Wijngaards 6634b8bcc5 - xfr-tsig, primary-tsig: addr tsig and allow-notify-tsig: addr tsig. 2025-07-31 14:43:43 +02:00
W.C.A. Wijngaards baee7885bd Merge branch 'master' into xfr-tsig 2025-07-23 16:23:58 +02:00
Willem Toorop b5a2de1292 allow-response: config option 2025-07-20 13:30:29 +02:00
Willem Toorop 5ed0840dc2 Poisonlicious PoC with new tsig code 2025-07-19 15:19:00 +02:00
Willem Toorop 433bb1c7bc Merge branch 'updated-with-master/xfr-tsig' into hackathon/poisonlicious-new-tsig-code 2025-07-19 15:02:30 +02:00
Willem Toorop f3b960e72b Merge branch 'master' into xfr-tsig-update 2025-07-19 14:42:44 +02:00
Willem Toorop 5bd31c9569 A typo and a reorder (without impact) 2025-07-19 14:35:38 +02:00
Willem Toorop 4f245e0e5b Merge branch 'master' into hackathon/poisonlicious-update 2025-07-19 14:23:50 +02:00
W.C.A. Wijngaards b58af78b63 - Fix to not set rlimits in the unit tests. 2025-07-17 11:40:31 +02:00
Roland van Rijswijk-DeijGitHubWouter Wijngaards
 		44ac818f87 Add extra statistic to track the number of signature validation operations (#1289) 
* Add extra statistic to track the number of signature validation operations performed by the validator module

* Move validation operation statistic to mesh as suggested

* Fix NULL pointer dereference in case the mesh is not used (and is `NULL`)

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>

* Fix NULL pointer dereference on qstate and qstate->env in unit test situation

---------

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-07-12 16:29:38 +02:00
W.C.A. Wijngaards e4069e5619 Merge branch 'master' into xfr-tsig 2025-07-11 15:27:40 +02:00
Jose Luis DuranandGitHub 41c55ffac1 Fix typos (#1299) 2025-07-02 10:50:49 +02:00
W.C.A. Wijngaards bb4ddab77a Merge branch 'master' into xfr-tsig 2025-06-17 16:55:18 +02:00
Yorgos Thessalonikefs 9201c75013 - Fix for consistent use of local zone CNAME alias for configured auth 
zones. Now it also applies to downstream configured auth zones.
 2025-06-17 15:03:29 +02:00