WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-25 19:24:56 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,242 Commits 30 Branches 216 Tags
7977ef28f5218cbf9a9c2cfeeaeeb076ff35aa12
Commit Graph
2189 Commits
Author SHA1 Message Date
Willem Toorop 7977ef28f5 distribute can send out responses tsig signed 2025-11-01 14:32:09 +01:00
Willem Toorop c86c267b8b Forgot to include util/allow_response_list.[ch] 2025-11-01 13:12:35 +01:00
Willem Toorop 3963af8d0b configurable ranges and tsig to allow responses 
Configurable with the "allow-response:" option in the "server:" section.
Usage:
	allow-response: <IP netblock> <tsig key-name | NOKEY | BLOCKED>
 2025-11-01 12:52:48 +01:00
Willem Toorop 3d6a4c7d6e Const string for tsig lookups 2025-10-31 15:45:34 +01:00
Willem Toorop 2217c9b96e Merge branch 'master' into update-with-branches/poisonlicious 2025-10-30 09:48:57 +01:00
Willem Toorop 6592c73d56 Merge branch 'xfr-tsig' into update-with-branches/poisonlicious 2025-10-30 09:45:11 +01:00
Yorgos Thessalonikefs e06b7eb3f1 Merge branch 'branch-1.24.1' 2025-10-22 12:44:59 +02:00
Yorgos Thessalonikefs a33f0638e1 - Fix CVE-2025-11411 (possible domain hijacking attack), reported by Yuxiao Wu, 
Yunyi Zhang, Baojun Liu and Haixin Duan from Tsinghua University.
 2025-10-22 10:54:57 +02:00
W.C.A. Wijngaards adaf5dab49 - Fix that https is set up as enabled when the port is listed in 
interface-automatic-ports. Also for the set up of quic it is
  enabled when listed there.
 2025-10-02 10:16:06 +02:00
W.C.A. Wijngaards 8687d69131 Merge branch 'master' into xfr-tsig 2025-10-01 15:52:40 +02:00
W.C.A. Wijngaards feeebc95f8 - Fix for #1344: Fix that respip and dns64 can be enabled at the 
same time, the client info is copied for attach_sub and add_sub
  calls. That makes respip work on dns64 synthesized answers, and
  also makes RPZ work with DNS64. The order for the modules is
  module-config: "respip dns64 validator iterator".
 2025-09-30 11:28:15 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		499a3a7a61 Fix #1346: [FR] Please allow back TLS 1.2. (#1349) 
* 'tls-use-system-policy-versions' is introduced to allow Unbound to use
  any system available TLS version when serving TLS.

* Apply suggestions from code review

---------

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-09-29 12:03:56 +02:00
Yorgos Thessalonikefs 35f6fd47fb - Test for nonstring attribute in configure and add 
nonstring attribute annotations.
 2025-09-26 16:23:55 +02:00
Yorgos Thessalonikefs e2bf773089 Merge branch 'features/no-ttl-zero-cacherep' 2025-09-19 14:56:04 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		bc61034f60 code review: use proper roundrobin index 
Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2025-09-17 12:19:20 +02:00
Yorgos Thessalonikefs 2dd821c257 - Too many quotes for the EDE message debug printout. 2025-09-17 11:27:16 +02:00
Yorgos Thessalonikefs c3a8d5251f - Small debug output improvement when attaching an EDE. 2025-09-15 12:06:49 +02:00
Yorgos Thessalonikefs 73e408f1d0 A few changes for TTL processing: 
- Cached messages that reach 0 TTL are considered expired. This prevents
  Unbound itself from issuing replies with TTL 0 and possibly causing a
  thundering herd at the last second. Upstream replies of TTL 0 still
  get the usual pass-through but they are not considered for caching
  from Unbound or any of its caching modules.
- 'serve-expired-reply-ttl' is changed and is now capped by the original
  TTL value of the record to try and make some sense when replying
  with expired records.
- TTL decoding was updated to adhere to RFC8767 section 4 where a set
  high-order bit means the value is positive instead of 0.
 2025-09-15 10:03:35 +02:00
W.C.A. Wijngaards 1ae8be6847 - xfr-tsig, fast reload support for tsig keys. 2025-09-12 15:38:39 +02:00
Yorgos Thessalonikefs d521135f66 Merge branch 'master' into features/no-ttl-zero-cacherep 2025-09-12 15:24:06 +02:00
W.C.A. Wijngaards 64e102aacb - xfr-tsig, fix notify tsig answer, fix parse edns allows TSIG, 
unit test for auth zone with notify with tsig and notify answer with tsig.
 2025-09-11 16:21:38 +02:00
W.C.A. Wijngaards e3c1981a6a - xfr-tsig, fix algorithm name write in xfr reply tsig and unit test 
that works with output that works with dig and NSD.
 2025-09-09 14:36:33 +02:00
W.C.A. Wijngaards 4a2dc1df48 Merge branch 'master' into xfr-tsig 2025-09-05 15:00:31 +02:00
W.C.A. Wijngaards 5c79fd9a0b - xfr-tsig, tsig_parse_verify_reply_xfr and tsig_sign_reply_xfr. 2025-09-05 14:55:36 +02:00
W.C.A. Wijngaards 85e916e7e0 - Fix indentation in tcp-mss option parsing. 2025-09-02 17:12:14 +02:00
W.C.A. Wijngaards af96824642 - Fix #1324: Memory leak in 'msgparse.c' in 
'parse_edns_options_from_query(...)'.
 2025-09-02 17:10:42 +02:00
Yorgos Thessalonikefs 44da5eee66 - Limit the number of consecutive reads on an HTTP/2 session. 
Thanks to Gal Bar Nahum for exposing the possibility of infinite
  reads on the session.
 2025-08-29 15:35:32 +02:00
W.C.A. Wijngaards 4a3a4f474f Merge branch 'master' into xfr-tsig 2025-08-27 16:30:03 +02:00
W.C.A. Wijngaards ebfa09e04f - For #1318: Fix compile warnings for DoH compile on windows. 2025-08-22 10:04:00 +02:00
W.C.A. Wijngaards da72734240 - xfr-tsig, tsig_get_mem function. 2025-08-19 16:46:12 +02:00
W.C.A. Wijngaards 54175a4180 Merge branch 'master' into xfr-tsig 2025-08-19 15:27:43 +02:00
W.C.A. Wijngaards 888d5ce9f9 - xfr-tsig, TSIG for SOA probe, notify, and on xfr first packet. 2025-08-19 15:27:16 +02:00
W.C.A. Wijngaards 752a3f7f52 - Fix to whitespace in dname_str. 2025-08-07 16:19:10 +02:00
W.C.A. Wijngaards 08d59c9a78 - Fix dname_str for printout of long names. Thanks to Jan Komissar 
for the fix.
 2025-08-07 09:45:02 +02:00
W.C.A. Wijngaards 3d7e847a5e - Fix to use assertions for consistency checks in #1309 reclaimed 2025-08-05 16:20:01 +02:00
W.C.A. Wijngaards da6b735ed9 - Fix #1309: incorrectly reclaimed tcp handler can cause data 
corruption and segfault.
 2025-08-05 15:46:54 +02:00
W.C.A. Wijngaards b1bb4a4592 - xfr-tsig, check that tsig keys exist at startup and in unbound-checkconf. 2025-07-31 17:02:55 +02:00
W.C.A. Wijngaards 6634b8bcc5 - xfr-tsig, primary-tsig: addr tsig and allow-notify-tsig: addr tsig. 2025-07-31 14:43:43 +02:00
W.C.A. Wijngaards baee7885bd Merge branch 'master' into xfr-tsig 2025-07-23 16:23:58 +02:00
Willem Toorop b5a2de1292 allow-response: config option 2025-07-20 13:30:29 +02:00
Willem Toorop 433bb1c7bc Merge branch 'updated-with-master/xfr-tsig' into hackathon/poisonlicious-new-tsig-code 2025-07-19 15:02:30 +02:00
Willem Toorop f3b960e72b Merge branch 'master' into xfr-tsig-update 2025-07-19 14:42:44 +02:00
Willem Toorop 4f245e0e5b Merge branch 'master' into hackathon/poisonlicious-update 2025-07-19 14:23:50 +02:00
W.C.A. Wijngaards 910288c0d1 - iana portlist updated. 2025-07-17 14:50:29 +02:00
W.C.A. Wijngaards b6e52c0a52 - Fix #1303: [FR] Disable TLSv1.2. 2025-07-17 14:50:13 +02:00
W.C.A. Wijngaards 9fe92d1119 - Fix detection of SSL_CTX_set_tmp_ecdh function. 2025-07-11 15:47:59 +02:00
W.C.A. Wijngaards e4069e5619 Merge branch 'master' into xfr-tsig 2025-07-11 15:27:40 +02:00
W.C.A. Wijngaards a3ec9a974f - xfr-tsig, member comments for struct tsig_calc_state_crypto. 2025-07-11 15:18:11 +02:00
W.C.A. Wijngaards 479b954118 - xfr-tsig, implemented tsig_calc_state_crypto. 2025-07-11 10:08:48 +02:00
W.C.A. Wijngaards 1de9d6ec66 - Fix layout of comm_point_udp_ancil_callback. 2025-07-03 15:57:49 +02:00