WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-12 04:47:41 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,404 Commits 29 Branches 215 Tags
b5909d8d22e6cde8a0fd0cd8ba71c12a993bb9cf
Commit Graph
2183 Commits
Author SHA1 Message Date
W.C.A. Wijngaards a7debe7ff6 - Fix that after shared memory cannot be created, from 
`shm-enable`, the server does not crash. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-06-16 10:53:40 +02:00
W.C.A. Wijngaards 215e3920ef - Fix that after malloc failure in find_tag_datas, the 
local_alias is cleaned up. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-06-16 10:51:49 +02:00
W.C.A. Wijngaards a45e54555d - Fix that dnscrypt configuration does not crash, due to 
inconsistency between secret and public keys. Also
  duplicate files are skipped. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-06-16 10:40:10 +02:00
W.C.A. Wijngaards 8557788699 - Fix that after malloc failure a half-built local_alias does 
not crash the server. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:12:19 +02:00
W.C.A. Wijngaards 299df5ec77 - Fix that dns64 does not ignore the forward-no-cache and 
`stub-no-cache` options. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 09:52:46 +02:00
W.C.A. Wijngaards f68cca4097 - Fix DNAME synthesis from cache that keeps use of 0TTL 
entries in a sliding window. It did not surpass RRSIG
  expiry. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 16:39:34 +02:00
W.C.A. Wijngaards 98e95d80e6 - Fix integer overflow in infra-cache-max-rtt calculation. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:22:50 +02:00
W.C.A. Wijngaards 8f5348ab47 - Fix that misconfigured iter-scrub-ns: 0 causes request 
failures. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 16:04:24 +02:00
W.C.A. Wijngaards c5d693b21c - Fix buffer overflow when configured with lower than 
default size and http transfer. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-15 16:01:51 +02:00
W.C.A. Wijngaards 27e3ac55b9 - Fix assertion failure for long HTTP header that fills 
buffer. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 15:54:37 +02:00
W.C.A. Wijngaards 153f8d5353 - Fix to add max-transfer-size and max-transfer-time that 
limit auth-zone and rpz transfer amount and time taken.
  Default is disabled. This hardens against unbounded
  transfers. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 15:45:03 +02:00
W.C.A. Wijngaards ecd41bef27 - Fix #1437: Fix compile with OpenSSL 4.0.1. 2026-06-11 17:31:01 +02:00
W.C.A. Wijngaards b1d1dcb3b6 - Fix that dump_cache has a larger buffer for records, 
and it checks that an owner name does not collide with BADRR
  on the input, and changes verbosity on the log of failure in
  rrset to string.  Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-03 14:51:16 +02:00
W.C.A. Wijngaards 8bc074043a - Fix PROXYv2 header read and consume, it checks the header 
size. Thanks to Qifan Zhang, Palo Alto Networks for
  the report.
 2026-06-03 14:37:37 +02:00
Yorgos Thessalonikefs 4544eaa4cc - Fix const as reported by newest compiler warnings. 2026-06-03 14:00:04 +02:00
W.C.A. Wijngaards 670ece06df - iana portlist updated. 2026-05-29 11:54:40 +02:00
W.C.A. Wijngaards b53504049c - Fix that dns64 with subnetcache does not write ECS scoped 
answers to global cache. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-27 13:31:11 +02:00
W.C.A. Wijngaards 047df73887 - Fix to decrement the per-netblock tcp connection limits, so 
it keeps usable. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-05-27 13:20:35 +02:00
W.C.A. Wijngaards d2e1ea7d19 - Fix to reset the tcp-timeout before applying a load based 
reduction. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-05-27 13:17:35 +02:00
W.C.A. Wijngaards fbbe95ba5b - Fix that msgencode insert_query has the correct assertion, 
for a local_alias. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-05-27 12:20:04 +02:00
W.C.A. Wijngaards 758c649611 - Fix that the ratelimit is decremented on successful 
referrals. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-05-27 12:16:23 +02:00
W.C.A. Wijngaards 08e901a1ac - Fix cleaning up DoH session. The same query can be on multiple 
streams in a session. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-05-20 15:04:12 +02:00
W.C.A. Wijngaards 3692517a41 Merge branch 'branch-1.25.1' 2026-05-20 11:19:56 +02:00
W.C.A. Wijngaards dae7a37974 - Fix CVE-2026-44390, Unbounded name compression in certain cases 
causes degradation of service. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:21:26 +02:00
W.C.A. Wijngaards ef5ca84360 - Fix CVE-2026-41292, Parsing a long list of incoming EDNS options 
degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan
  Zhang from Palo Alto Networks, for the report.
 2026-05-20 10:18:23 +02:00
W.C.A. Wijngaards fe946ba4e9 - Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, 
cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:13:55 +02:00
W.C.A. Wijngaards 8ada1bd88d - Fix to relax assertions after the TTL 0 handling change. 
This relaxes an assertion in cachedb (it fails instead),
  and for packet_rrset_copy_region.
 2026-05-08 10:09:41 +02:00
W.C.A. Wijngaards 027e23a11d - iana portlist updated. 2026-05-01 11:25:49 +02:00
W.C.A. Wijngaards eb2fe8df8d - Fix unused variable warning when compiled without ssl. 2026-04-20 12:24:55 +02:00
Yorgos Thessalonikefs 06ff9f20d0 Merge branch 'features/pthread-setname' 2026-04-17 16:22:04 +02:00
W.C.A. Wijngaards 84ac7e1b58 - Fix ttl comparisons in rdata_copy for 32bit signed or unsigned. 2026-04-17 13:27:41 +02:00
W.C.A. Wijngaards f15a46fcd4 - Fix to compile the shm code when there is no shmget. 2026-04-17 09:42:35 +02:00
Yorgos ThessalonikefsGitHubWouter Wijngaards
 		42b19c20c1 Introduce new 'tls-protocols' configuration option (#1406) 
- Introduce new 'tls-protocols' configuration option that specifies
  which of the supported TLS protocols will be used.
  This change invalidates some previous changes:
- TLSv1.2 is again enabled by default, but can be selectively turned off if
  desired (related to #1303).
- The biefly introduced (not yet released) 'tls-use-system-versions'
  configuration option, that addressed #1346, is reverted in favor of
  'tls-protocols'.
- The briefly introduced (not yet released) '--enable-system-tls'
  configure option, related to #1401, is no longer needed with the new
  option and the current default.

- Review comment for checking out of memory condition

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
 2026-04-16 10:38:24 +02:00
W.C.A. Wijngaards db1fe8b475 - Fix to shorten RRSIG count in scrubber, this protects against 
an overly large number of RRSIGs. It can be configured with
  `iter-scrub-rrsig: 8`, it has default 8. Thanks to Yuxiao Wu,
  Tsinghua University for the report.
 2026-04-15 11:41:28 +02:00
W.C.A. Wijngaards a2272860de - iana portlist updated. 2026-04-14 15:36:33 +02:00
W.C.A. Wijngaards 5ce0bf5281 - Fix #1017: memory corruption related core dumps. 
When alloc_reg_obtain has an empty list, return a new allocation.
 2026-04-14 15:34:59 +02:00
W.C.A. Wijngaards 330d5211c9 - Fix for EDNS client subnet so that it does not store SERVFAIL in 
the global cache after a failed lookup, such as timeouts. A failure
  entry is stored in the subnet cache, for the query name, for a
  couple of seconds. Queries can continue to use the subnet cache
  during that time.
 2026-04-10 15:45:28 +02:00
Wouter WijngaardsGitHubYorgos Thessalonikefs
 		a2ace114de Fix shared memory stats with threads (#1408) 
* - stats-shm-volley, with mesh_time_median the additions add up to the correct
  average that is used.

* - stats-shm-volley, the stat interval is selected with offset.

* - stats-shm-volley, stat totals in separate struct. The first thread zeroes
  it, and the last thread copies it.

* - stats-shm-volley, the array is inited for a new round if one or more

* - stats-shm-volley, the array is inited for a new round if one or more
  threads are not responsive for stat collection.

* - stats-shm-volley review, typos and slightly more detailed text for comments.

---------

Co-authored-by: Yorgos Thessalonikefs <yorgos@nlnetlabs.nl>
 2026-03-30 16:13:11 +02:00
W.C.A. Wijngaards 315077b9e6 - Fix to check for invalid http content length and chunk size, 
and to check the RR rdata field lengths when decompressing and
  inserting RRs from an authority zone transfer. This stops
  large memory use and heap buffer-overflow read errors. Thanks
  to Haruto Kimura (Stella) for the report.
 2026-03-24 08:45:52 +01:00
W.C.A. Wijngaards eb3bba0724 - iana portlist updated. 2026-03-13 12:05:33 +01:00
W.C.A. Wijngaards 2eff1d8ab5 - Fix #278: DoT: complete unbound restart required on certificate 
renew. Fix so that a reload checks if the files have changed, and
  if so, reload the contexts. Also for DoH, DoQ and outgoing DoT.
 2026-03-13 11:42:34 +01:00
Yorgos Thessalonikefs 94ef1a8fee - Warn for unused 'nodefault' local-zone configuration in 
unbound-checkconf (related to #1416).
 2026-03-06 17:05:57 +01:00
W.C.A. Wijngaards a296b248b0 - For #1411: Fix that the lookup for DNAME uses flag. Fix assertion 
in expired calc debug routine.
 2026-03-03 17:44:31 +01:00
Petr MenšíkandGitHub 4556a4f490 Add a new build-time option for system TLS (#1401) 
We want to use crypto-policy provided configuration always in our
builds. Allow changing the default of tls-use-system-policy-versions at
build time by a simple configure parameter.
 2026-02-09 15:57:16 +01:00
Yorgos Thessalonikefs 18fec256b7 - Support pthread_setname_np, and variants, to set the name on spawned 
threads for easier debugging/monitoring.
 2026-02-06 14:17:04 +01:00
Yorgos ThessalonikefsandGitHub 9d271c5343 Merge pull request #1396 from NLnetLabs/features/thread-id 2026-01-23 17:42:30 +01:00
Yorgos Thessalonikefs 74cc49e6c4 - Introduce the 'log-thread-id' configuration option to manage logging 
the system-wide Linux thread ID for easier debugging with system
  tools.
 2026-01-23 17:15:14 +01:00
Yorgos Thessalonikefs d414ebf0c7 - On Linux systems log the system-wide unique thread ID instead of 
Unbound's internal thread counter.
 2026-01-23 17:08:55 +01:00
nnarayanamurthyandGitHub fe10bc7682 QNX Porting support for unbound branch-1.24.1 (#1388) 
* qnx Porting support for version release-1.24.1

* updating __QNXNTO__ with __QNX__
 2026-01-21 13:12:13 +01:00
W.C.A. Wijngaards 4198343dbe Compile fixup for #1381. 2026-01-08 14:19:06 +01:00