WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-22 09:44:56 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,544 Commits 30 Branches 216 Tags
b45c8b4b5395e33f806730d46e2aa71bb259e1de
Commit Graph
8544 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
W.C.A. Wijngaards b45c8b4b53 - The code repository continues with 1.26.2 under development, 
that includes the changes from before the 1.26.1 commits.
 2026-09-16 10:34:06 +02:00
W.C.A. Wijngaards a6586ced92 Merge branch 'branch-1.26.1' 2026-09-16 10:26:54 +02:00
W.C.A. Wijngaards 13b6717f17 - Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch 
Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
  Xiang Li from Nankai University, AOSP Lab for the report. In
  addition, thanks to Qifan Zhang from Palo Alto Networks for a
  complimentary report.
release-1.26.1 		2026-09-16 09:30:25 +02:00
W.C.A. Wijngaards 0d4a6a63dd - Fix CVE-2026-82717, CNAME synthesis could lead to heap corruption. 
Thanks to Ben Morris from Anthropic for the report.
 2026-09-16 09:29:32 +02:00
W.C.A. Wijngaards bd71e3b8a6 - Fix CVE-2026-77860, 'serve-expired' can bypass Unbound 'wait-limit'. 
Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the
  University of Science and Technology of China (USTC) for the
  report.
 2026-09-16 09:29:04 +02:00
W.C.A. Wijngaards 3a6ba0da81 - Unit test for CVE-2026-81642 fix. 2026-09-16 09:28:11 +02:00
W.C.A. Wijngaards 3d65973d38 - Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC 
canonicalization. Thanks to Vlatko Kosturjak with Marlink Cyber,
  for the report.
 2026-09-16 09:27:17 +02:00
W.C.A. Wijngaards 565651cd02 - Fix CVE-2026-77955, Possible ZONEMD verification bypass window. 
Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
  for the report. In addition, thanks to Qifan Zhang from Palo Alto
  Networks for also reporting this issue.
 2026-09-16 09:26:00 +02:00
W.C.A. Wijngaards 7914901915 - Fix CVE-2026-78227, Use-after-free in DoQ stream output buffer on 
reset re-transmission. Thanks to Yuqi Qiu and Xiang Li from Nankai
  University, AOSP Lab for the report.
 2026-09-16 09:25:05 +02:00
W.C.A. Wijngaards eba3d35ad4 - Fix CVE-2026-82720, Use-after-free in DoH stream cleanup code path. 
Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
  for the report.
 2026-09-16 09:24:29 +02:00
W.C.A. Wijngaards 8c2e0fd6cc - Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code 
Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang Li
  from Nankai University, AOSP Lab for the report.
 2026-09-16 09:18:49 +02:00
W.C.A. Wijngaards e619ead2db - Fix CVE-2026-80225, Possible degradation of service from continuous 
queries on the same TCP/DoT connection. Thanks to Qifan Zhang from
  Palo Alto Networks for the report.
 2026-09-16 09:16:29 +02:00
W.C.A. Wijngaards eb86d9bc50 Set version to 1.26.1 2026-09-16 09:11:14 +02:00
W.C.A. Wijngaards 3ad9b6aade - For #1507: TOCTOU race in store_rrsets() can return a 
CNAME chain whose target owns no address.
 2026-09-15 13:03:24 +02:00
W.C.A. Wijngaards 5ccee67af2 - Fix to error on missing close parenthesis for zone file 
read and for url content read. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-09-10 16:12:49 +02:00
W.C.A. Wijngaards b8577a9c04 - Fix to construct the delegation point during DS NS find 
as a child side delegation point if that was the response.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-10 11:09:39 +02:00
W.C.A. Wijngaards 18d9a5519e - Fix to elevate the diagnostic for no matches for a wildcard 
trusted-keys-file, make it more descriptive, and more man
  page content for it. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-09-08 16:01:08 +02:00
W.C.A. Wijngaards 2df646e05f - Fix to not change the action override in rpz_config, before 
the cname override has succeeded.
 2026-09-04 17:20:15 +02:00
W.C.A. Wijngaards bdfa4d4c5d - Fix to make rpz_config leave the rpz with correct set up 
on failure. The struct is not half configured on exit.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-04 17:06:34 +02:00
W.C.A. Wijngaards bd210d124b - Fix that when a partial EDNS option is in a query, the 
response is a more RFC conformant FORMERR, since the EDNS
  option is malformed. Also fix to have an EDNS size for
  the reply error encoding for failed EDNS parse of the query.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 17:20:35 +02:00
W.C.A. Wijngaards 11900cc2b0 - Fix that when extended EDNS RCODE does not fit, at short 
udpsize, the reply is truncated with TC and fix for the
  rcode in that short reply to be a sensible rcode.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 15:27:10 +02:00
W.C.A. Wijngaards c04a5efb07 - Fix to reorder SVCB and HTTPS svcparams for unknown RR form 
zonefile input. If it can not be parsed it is leniently
  accepted, much like as a secondary it leniently accepts it.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 10:59:08 +02:00
W.C.A. Wijngaards 1060760650 - Remove unused .travis.yml for ci integration. 2026-09-03 10:25:31 +02:00
W.C.A. Wijngaards f251a1157b - Remove unused .travis.yml for ci integration. 2026-09-03 10:24:51 +02:00
W.C.A. Wijngaards 292cf6526b - Fix to match NSEC3 hash length to the NSEC3 algorithm, 
this stops negative cache overdeletion. It also contrains
  the hash label length and checks if the NSEC nextowner
  is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University,
  AOSP Lab).
 2026-09-03 08:38:46 +02:00
W.C.A. Wijngaards ac935b9144 - Fix to not commit to have_zone at apply AXFR time for auth 
zone transfers, so that later failure rolls back to not.
  The have_zone value is set later when the SOA is retrieved.
  Also fix to clear the zone data when a transfer does not
  have a valid SOA record in the zone for it.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-02 11:42:31 +02:00
W.C.A. Wijngaards 9dd370ba04 - Fix LOC RR parse to avoid double to uint32 cast overflow. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-01 17:21:45 +02:00
W.C.A. Wijngaards a6ccb2f74d - Fix to allow block_a and other local-zone types in a view. 2026-09-01 08:48:27 +02:00
W.C.A. Wijngaards 32ff948a5b - Fix notify for auth-zone during initial start up. It 
performs the transfer and not only lookup.
 2026-08-26 16:50:33 +02:00
W.C.A. Wijngaards 2ec2afd6b0 - Fix #132: Add harden-cname-follow: yes config option, that 
can be used to disable cname scrubbing. That can be useful
  for when the traffic is on localhost only.
 2026-08-24 16:06:17 +02:00
W.C.A. Wijngaards 7fb79b0677 - Fix to defend against double event deletion, that could cause 
event corruption and use after free, for comm_timer_disable.
 2026-08-21 10:29:58 +02:00
W.C.A. Wijngaards 8ee0bca833 - Fix stat_values.tdir test to have less test failures. 2026-08-11 10:07:38 +02:00
W.C.A. Wijngaards c58e6add2b - Fix #1492 from zacek: Data race in log_init() on 
key_created/log_lock when calling ub_ctx_create()
  concurrently from multiple threads.
 2026-08-11 09:42:30 +02:00
W.C.A. Wijngaards 93a56205cf - Fix #1489 from jplesnik: Replace removed Python 2 C API 
macros for SWIG 4.5.0 compatibility.
 2026-08-07 08:57:32 +02:00
W.C.A. Wijngaards 709f622658 Note issue number in Changlog entry. 2026-08-06 17:15:55 +02:00
akhanin-dnsfandGitHub 307fc6f062 - Fix bounds check in packed_rr_to_string, it checked the (#1488) 
assembled rr length against the output string length
  dest_len, instead of against the size of the rr buffer it
  writes into. Callers in cachedump.c and remote.c pass a
  dest_len larger than that buffer.
- Unit test for packed_rr_to_string.
 2026-08-06 17:04:05 +02:00
W.C.A. Wijngaards 8b33c5d7ff - Fix #1487: regression in 1.26.0, ipsecmod is now always 
partly enabled.
 2026-08-06 09:46:18 +02:00
W.C.A. Wijngaards 36bd52afb9 Fix typo in Changelog. 2026-08-06 09:08:33 +02:00
W.C.A. Wijngaards b7d13ff12b - Fix ##1485: the list_forwards command omits port numbers. 
The list_forwards and list_stubs commands for
  unbound-control print port and tls auth name.
 2026-08-06 09:08:17 +02:00
W.C.A. Wijngaards bdfcfb861f - Fix to set makedist.sh to not wget config.sub and 
config.guess from git repo. The fetch times out, and the
  version from libtoolize is much more recent now than
  that it was when the wget was added.
 2026-08-04 10:04:34 +02:00
W.C.A. Wijngaards b444deffd2 Note 1.26.0 release. 2026-08-04 10:01:59 +02:00
W.C.A. Wijngaards ff28b7e5cf - For #1483: The failure reason when an NSEC NXDOMAIN is 
encountered when looking for an insecure delegation, is
  fixed to mention the NSEC records, instead of nonexistent
  NSEC3 records, that it attempted.
 2026-07-31 09:53:47 +02:00
W.C.A. Wijngaards 79b84bbc91 - Fix #1482: DNS-over-QUIC doesn't work with simple config. 
That fixes interface-automatic for use with doq service.
 2026-07-30 08:24:42 +02:00
W.C.A. Wijngaards cbfc3b0342 - Tag for 1.26.0rc1. The repo continues with version 1.26.1. 2026-07-28 09:45:59 +02:00
W.C.A. Wijngaards a45da353d3 - Fix to call OPENSSL_cleanup on exit when that is defined. release-1.26.0rc1 release-1.26.0 2026-07-24 17:04:38 +02:00
W.C.A. Wijngaards c21e3ee929 Changelog note for #1479 
- Merge #1479 from psumbera: Fix pthread detection on
  Solaris 11.4.
 2026-07-24 15:35:55 +02:00
Petr SumberaGitHubRainer Orth
 		8a38bed262 Fix pthread detection on Solaris 11.4 (#1479) 
AX_PTHREAD requires _REENTRANT to confirm that pthread support is enabled.
Solaris 11.4 headers no longer use the macro, and GCC 16 therefore no
longer defines it for -pthread.

Detect XPG7 support in the target headers and require _REENTRANT only on
older Solaris releases. The existing pthread compile and link test remains
the final capability check.

This follows the canonical Autoconf Archive change:
https://github.com/autoconf-archive/autoconf-archive/pull/341

Regenerate configure with Autoconf 2.71.

Tested on Solaris 11.4 with GCC 15.2 and GCC 16.1. The Autoconf Archive
change was also tested on Solaris 11.3.

Co-authored-by: Rainer Orth <ro@CeBiTec.Uni-Bielefeld.DE>
 2026-07-24 15:34:18 +02:00
W.C.A. Wijngaards 7cc7a43ff6 Changelog note for #1481. 
- Fix #1481: Fix to use tls-port after referral if
  tls-upstream is set.
 2026-07-24 15:32:20 +02:00
W.C.A. Wijngaards 9bd8df0149 - Fix to use tls-port after referral if tls-upstream is set. 2026-07-24 15:31:06 +02:00
W.C.A. Wijngaards 8f7411057f - Fix sign of comparison warning in shared ports setup. 2026-07-24 14:44:44 +02:00