WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-27 20:24:55 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,387 Commits 30 Branches 216 Tags
a45e54555dc2fcdb13f2209c08ef756bac3a631d
Commit Graph
8387 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
W.C.A. Wijngaards a45e54555d - Fix that dnscrypt configuration does not crash, due to 
inconsistency between secret and public keys. Also
  duplicate files are skipped. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-06-16 10:40:10 +02:00
W.C.A. Wijngaards 4693c00c9f - Fix that after malloc failure in RPZ load a half built 
list does not crash later. The newly created RRset is
  linked after creation has succeeded. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-16 10:35:41 +02:00
W.C.A. Wijngaards 8fe23e0297 - Fix that for a zonefile only zone, if that file does not 
exist on server start, the server continues to start with
  a warning log message. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:26:25 +02:00
W.C.A. Wijngaards 8557788699 - Fix that after malloc failure a half-built local_alias does 
not crash the server. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:12:19 +02:00
W.C.A. Wijngaards 81a19ebeb3 - Fix that a signed wildcard NSEC, is checked before use, 
so it does not allow insecure DS proofs inappropriately.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-16 10:09:00 +02:00
W.C.A. Wijngaards 299df5ec77 - Fix that dns64 does not ignore the forward-no-cache and 
`stub-no-cache` options. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 09:52:46 +02:00
W.C.A. Wijngaards 6f9b6db7be - Fix that auth-zone, and RPZ zones, do not allow out-of-zone 
records. These are records that are not under the zone apex.
  The out-of-zone records are dropped from the zone contents.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-16 09:48:10 +02:00
W.C.A. Wijngaards 96f15b9160 - Fix that a half-written trust anchor file does not crash 
the server at runtime. It unlinks a wrong file from the list.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-16 09:45:10 +02:00
W.C.A. Wijngaards 159384c2a9 - Fix that when SVCB records cannot be written out, and 
are written in unknown format, that the zone read allows
  such unknown format SVCB records. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-16 09:36:33 +02:00
W.C.A. Wijngaards 621fc91453 - Fix to disallow $INCLUDE for secondary zones. Start up 
of server continues if a secondary zone fails to load.
  Failed loads clear the zone data, so there is no partial
  zone. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-16 09:30:52 +02:00
W.C.A. Wijngaards 543c49f76c - Fix that dns64 bypasses rpz-passthru rule during 
synthesis. This restricted more than necessary. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:50:42 +02:00
W.C.A. Wijngaards d0a760a587 - Fix misconfigured ipsecmod hook causing path name 
similarity with other file. The ipsecmod is changed for
  exec of the hook. The ipsecmod hook, if a script, has to
  start now with a line like `#!/bin/sh`. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:45:53 +02:00
W.C.A. Wijngaards f68cca4097 - Fix DNAME synthesis from cache that keeps use of 0TTL 
entries in a sliding window. It did not surpass RRSIG
  expiry. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 16:39:34 +02:00
W.C.A. Wijngaards 3129357874 - Fix log of an aliased qname, to not use freed region 
memory. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 16:34:17 +02:00
W.C.A. Wijngaards fc09352df6 - Fix that fast_reload does not terminate the server for 
errors in config, for key files. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-15 16:31:37 +02:00
W.C.A. Wijngaards 06da5d45a3 - Fix integer overflow for very high values of 
`sock-queue-timeout`. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-15 16:28:30 +02:00
W.C.A. Wijngaards 69524cadad - Fix erroneous DNS error report values after bogus AAAA 
query caused error information that was not cleared by
  a successful A subquery. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-15 16:26:35 +02:00
W.C.A. Wijngaards 98e95d80e6 - Fix integer overflow in infra-cache-max-rtt calculation. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:22:50 +02:00
W.C.A. Wijngaards 2f8aa8a43a - Fix for fast_reload that removes an auth zone while its 
lookups are in progress, for a primary name. Also after the
  change, it no longer picks up the old results. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:18:56 +02:00
W.C.A. Wijngaards 56e60e37ae - Fix that fast_reload when a zonemd verification lookup 
it in progress with subnet loaded, deregisters the
  callback. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 16:16:50 +02:00
W.C.A. Wijngaards 8f5348ab47 - Fix that misconfigured iter-scrub-ns: 0 causes request 
failures. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 16:04:24 +02:00
W.C.A. Wijngaards c5d693b21c - Fix buffer overflow when configured with lower than 
default size and http transfer. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-15 16:01:51 +02:00
W.C.A. Wijngaards 27e3ac55b9 - Fix assertion failure for long HTTP header that fills 
buffer. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 15:54:37 +02:00
W.C.A. Wijngaards 7879218773 Fix comment. 2026-06-15 15:53:00 +02:00
W.C.A. Wijngaards 1354624ba4 - Fix perform a full transfer every number of incremental 
transfers, to stop increasing memory usage, for auth-zone
  and rpz zones. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 15:51:03 +02:00
W.C.A. Wijngaards 153f8d5353 - Fix to add max-transfer-size and max-transfer-time that 
limit auth-zone and rpz transfer amount and time taken.
  Default is disabled. This hardens against unbounded
  transfers. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 15:45:03 +02:00
W.C.A. Wijngaards a1cecf7462 - Fix that for auth-zone and rpz zones the allow-notify 
addresses and netblocks are available from start, and
  fix the probe step skip.
 2026-06-12 11:48:14 +02:00
W.C.A. Wijngaards e2dac8a00a - Fix compile for OpenSSL 1.0.2 and before in server cleanup. 2026-06-11 17:31:19 +02:00
W.C.A. Wijngaards ecd41bef27 - Fix #1437: Fix compile with OpenSSL 4.0.1. 2026-06-11 17:31:01 +02:00
W.C.A. Wijngaards fd2131687a - Fix for #1306: configure checks if the ngtcp2_crypto_ossl 
header file is available, and prints an error otherwise.
 2026-06-11 11:43:46 +02:00
W.C.A. Wijngaards 316b9ab4fc - Fix for #1306: configure detects specifically the call to 
SSL_set_quic_tls_early_data_enabled and
  SSL_set_quic_early_data_enabled, so the correct one is used.
 2026-06-11 11:04:50 +02:00
W.C.A. Wijngaards d45daaf313 - Fix warnings with gcc in compat/inet_pton.c. 2026-06-10 16:43:41 +02:00
W.C.A. Wijngaards db1c6d6557 - Fix pythonmod script read for numeric overflow. 2026-06-10 11:24:02 +02:00
W.C.A. Wijngaards e7a713a525 - Fix unit test for ecs to check for malloc success. 2026-06-09 16:41:37 +02:00
Alex BandandGitHub 39e67508c9 change mailing list to forum 2026-06-08 21:48:04 +02:00
W.C.A. Wijngaards 3eab974ca2 - Fix that dns64 cleans up the allocated message if the adjust 
routines fail, and checks if there is a reply before cache
  store, also unbound checks if A and AAAA are malformed
  for auth-zones. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-03 14:56:20 +02:00
W.C.A. Wijngaards b1d1dcb3b6 - Fix that dump_cache has a larger buffer for records, 
and it checks that an owner name does not collide with BADRR
  on the input, and changes verbosity on the log of failure in
  rrset to string.  Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-03 14:51:16 +02:00
W.C.A. Wijngaards 10cb62aca2 - Fix that validation canonicalization of domain names 
in rdata checks for buffer bounds. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-03 14:48:06 +02:00
W.C.A. Wijngaards 6da73aba38 - Fix fast_reload for when a ZONEMD lookup is in progress. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-03 14:42:47 +02:00
W.C.A. Wijngaards 1b1b9626ee - Fix negative cache NSEC3 nodata proof, to use the correct 
message size. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-03 14:40:17 +02:00
W.C.A. Wijngaards 8bc074043a - Fix PROXYv2 header read and consume, it checks the header 
size. Thanks to Qifan Zhang, Palo Alto Networks for
  the report.
 2026-06-03 14:37:37 +02:00
W.C.A. Wijngaards 04a6322aa4 - Fix ipset module to use larger domain name buffers, and 
check buffer lengths. Thanks to Qifan Zhang, Palo Alto
  Networks for the report.
 2026-06-03 14:35:06 +02:00
W.C.A. Wijngaards 5748f518d1 - Fix that quotation and escaping works the same in auth-zone 
url content, as in the zonefile read. Thanks to Qifan Zhang,
  Palo Alto Networks for the report.
 2026-06-03 14:32:14 +02:00
W.C.A. Wijngaards d05eff4d54 - Fix parse of svcbparam ech, it had incorrect length. Thanks 
to Qifan Zhang, Palo Alto Networks for the report.
 2026-06-03 14:05:48 +02:00
Yorgos Thessalonikefs 4544eaa4cc - Fix const as reported by newest compiler warnings. 2026-06-03 14:00:04 +02:00
W.C.A. Wijngaards 5d0770d0ad - Fix negative cache to work with NSEC3 records without salt. 
Thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern
  Polytechnical University, for the report.
 2026-06-03 13:56:31 +02:00
W.C.A. Wijngaards 7f4beb846e - Fix that the processing of class responses does not have 
a heap use-after-free. That could happen if at least two
  distinct classes are configured for resolution. Thanks
  to Qifan Zhang, Palo Alto Networks for the report.
  In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia
  Liu, Northwestern Polytechnical University, for also
  reporting this.
 2026-06-03 12:14:30 +02:00
W.C.A. Wijngaards 8e8c04e1b9 - Fix unit test to check for new icannbundle.pem. 2026-05-29 12:10:40 +02:00
W.C.A. Wijngaards bf0da2ed21 - Update icannbundle.pem certificates in unbound-anchor. It 
has the public keys for 2009 to 2029 and for 2025 to 2045.
 2026-05-29 12:10:07 +02:00
W.C.A. Wijngaards 670ece06df - iana portlist updated. 2026-05-29 11:54:40 +02:00