WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-10-18 06:17:20 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,587 Commits 29 Branches 216 Tags
bb408e503cda9506e7033cec2bc98affb9c76e4e
Commit Graph
1126 Commits
Author SHA1 Message Date
W.C.A. Wijngaards cb027ae649 Merge branch 'master' into auth-load-thread 2026-10-05 09:02:28 +02:00
Yorgos Thessalonikefs 8820254637 - Move NORMAL_UDP_SIZE around. 2026-09-22 12:01:42 +02:00
W.C.A. Wijngaards a6586ced92 Merge branch 'branch-1.26.1' 2026-09-16 10:26:54 +02:00
W.C.A. Wijngaards 13b6717f17 - Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch 
Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
  Xiang Li from Nankai University, AOSP Lab for the report. In
  addition, thanks to Qifan Zhang from Palo Alto Networks for a
  complimentary report.
 2026-09-16 09:30:25 +02:00
W.C.A. Wijngaards 3ad9b6aade - For #1507: TOCTOU race in store_rrsets() can return a 
CNAME chain whose target owns no address.
 2026-09-15 13:03:24 +02:00
W.C.A. Wijngaards bd210d124b - Fix that when a partial EDNS option is in a query, the 
response is a more RFC conformant FORMERR, since the EDNS
  option is malformed. Also fix to have an EDNS size for
  the reply error encoding for failed EDNS parse of the query.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 17:20:35 +02:00
W.C.A. Wijngaards 2ec2afd6b0 - Fix #132: Add harden-cname-follow: yes config option, that 
can be used to disable cname scrubbing. That can be useful
  for when the traffic is on localhost only.
 2026-08-24 16:06:17 +02:00
W.C.A. Wijngaards 156c00a727 Merge branch 'master' into auth-load-thread 2026-08-10 16:42:59 +02:00
W.C.A. Wijngaards b7d13ff12b - Fix ##1485: the list_forwards command omits port numbers. 
The list_forwards and list_stubs commands for
  unbound-control print port and tls auth name.
 2026-08-06 09:08:17 +02:00
W.C.A. Wijngaards a45da353d3 - Fix to call OPENSSL_cleanup on exit when that is defined. 2026-07-24 17:04:38 +02:00
W.C.A. Wijngaards a05d460e66 - Fix mesh cycle detection for configuration with respip CNAME 
loop and tagged clients. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-23 16:28:45 +02:00
W.C.A. Wijngaards 91ac449bcd Merge branch 'branch-1.25.2' 2026-07-22 11:33:54 +02:00
W.C.A. Wijngaards c29ff70f6a - Fix CVE-2026-55708, Privacy/configuration issue when adding local 
data in views through 'unbound-control'. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-07-22 10:17:10 +02:00
W.C.A. Wijngaards 804cff4c15 - Fix CVE-2026-50252, Possible cache poisoning attack by mapping 
source port population per thread. Thanks to Inbal Schussheim and
  Amit Klein, Hebrew University, for the report.
 2026-07-22 10:15:31 +02:00
W.C.A. Wijngaards f52a9e864b - Fix CVE-2026-44621, Libunbound applications configured with 
'unwanted-reply-threshold' could eventually be abruptly
  terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-07-22 10:11:26 +02:00
W.C.A. Wijngaards f54e0791ba - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report. In addition,
  thanks to Trung Nguyen (@everping) of CyStack, for also reporting
  this issue.
 2026-07-22 10:09:50 +02:00
W.C.A. Wijngaards 61d6c0e766 - auth-load-thread, implement active thread counter for auth load threads. 2026-07-07 17:21:16 +02:00
W.C.A. Wijngaards 0a5cde80f1 - auth-load-thread, auth-task-threads: num config option that enables and 
disables the auth load thread.
 2026-07-03 14:03:15 +02:00
W.C.A. Wijngaards 58ede90fdb Merge branch 'master' into auth-load-thread 2026-07-02 15:28:24 +02:00
W.C.A. Wijngaards ba4f8478e6 Add changelog note for #1087, remove copyright line as discussed, and 
compile fixes for newer local_zones_lookup, unused variable warnings
fixed, and also manual page description of the feature.
- Merge #1087: Overload `local_data_remove` to support removing
  specific records.
 2026-07-02 15:04:51 +02:00
R. Christian McDonaldandGitHub 374a18cc5b Overload local_data_remove to support removing specific records (#1087) 
Here we overload the `local_data_remove` control command to support
deleting specific records. Curently, this command deletes all records
for a given zone. The modification works by attempting to parse the
command argument first as a complete record and then as just a domain
name, if the first attempt failed.

This preserves the command's behavior, while also supporting removing
specific records from the zone tree.

Signed-off-by: R. Christian McDonald <rcm@rcm.sh>
 2026-07-02 14:55:54 +02:00
W.C.A. Wijngaards 7826b4f306 Merge branch 'master' into auth-load-thread 2026-06-29 16:00:01 +02:00
W.C.A. Wijngaards 153accb8de - auth-load-thread, put create_socketpair and sock_poll_timeout into 
util/net_help.h
 2026-06-26 15:22:08 +02:00
Petr VaganovandGitHub 6cbcea3ac7 daemon: fix DEREF_AFTER_NULL.EX.COND on worker_init (#1467) 
Found by the static analyzer Svace (ISP RAS).

After having been compared to a NULL value at worker.c:2216,
pointer 'worker->stat_timer' is passed in call to function
'worker_restart_timer' at worker.c:2319,where it is
dereferenced at worker.c:2029.

Fix that stat_timer creation failure in worker_init does
not continue with a NULL timer that causes a crash later.

Signed-off-by: Petr Vaganov <petrvaganoff@gmail.com>
 2026-06-26 13:42:29 +02:00
Dag-Erling SmørgravandGitHub fbe41cdef9 Add libunbound/remote.h (#1465) 
Add a shared header containing prototypes for functions that both ends
of a remote control connection need to implement.
 2026-06-25 11:14:37 +02:00
W.C.A. Wijngaards 6aa5cfc903 - Fix for #1457: fix thread setname for thread start of 
dnstap, and fast_reload.
 2026-06-19 08:37:23 +02:00
W.C.A. Wijngaards 55e9532d16 - Fix after malloc failure for stats, then it drains the pipe 
so the internal messaging stays correct. Also it does
  not exit the server if stats pipe communication fails.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 16:05:45 +02:00
W.C.A. Wijngaards fff6657cea - Fix that fast_reload does not terminate the server 
on malloc failure for dnstap, or if gethostname fails.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 16:02:21 +02:00
W.C.A. Wijngaards b806f16c8b - Fix to check the return value of auth_xfer_create 
during fast_reload auth-zone add and change processing.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:57:30 +02:00
W.C.A. Wijngaards c9715724ec - Fix that unbound-control auth_zone_reload stops the 
server answering from the zone after a failure to read.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:20:22 +02:00
W.C.A. Wijngaards aa09835c90 - Fix for neater solution to clear log thread id after 
worker init failure. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:48:17 +02:00
W.C.A. Wijngaards 621fc91453 - Fix to disallow $INCLUDE for secondary zones. Start up 
of server continues if a secondary zone fails to load.
  Failed loads clear the zone data, so there is no partial
  zone. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-16 09:30:52 +02:00
W.C.A. Wijngaards 543c49f76c - Fix that dns64 bypasses rpz-passthru rule during 
synthesis. This restricted more than necessary. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:50:42 +02:00
W.C.A. Wijngaards f68cca4097 - Fix DNAME synthesis from cache that keeps use of 0TTL 
entries in a sliding window. It did not surpass RRSIG
  expiry. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 16:39:34 +02:00
W.C.A. Wijngaards 3129357874 - Fix log of an aliased qname, to not use freed region 
memory. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 16:34:17 +02:00
W.C.A. Wijngaards fc09352df6 - Fix that fast_reload does not terminate the server for 
errors in config, for key files. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-15 16:31:37 +02:00
W.C.A. Wijngaards 06da5d45a3 - Fix integer overflow for very high values of 
`sock-queue-timeout`. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-15 16:28:30 +02:00
W.C.A. Wijngaards 56e60e37ae - Fix that fast_reload when a zonemd verification lookup 
it in progress with subnet loaded, deregisters the
  callback. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 16:16:50 +02:00
W.C.A. Wijngaards 1354624ba4 - Fix perform a full transfer every number of incremental 
transfers, to stop increasing memory usage, for auth-zone
  and rpz zones. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 15:51:03 +02:00
W.C.A. Wijngaards 153f8d5353 - Fix to add max-transfer-size and max-transfer-time that 
limit auth-zone and rpz transfer amount and time taken.
  Default is disabled. This hardens against unbounded
  transfers. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 15:45:03 +02:00
W.C.A. Wijngaards e2dac8a00a - Fix compile for OpenSSL 1.0.2 and before in server cleanup. 2026-06-11 17:31:19 +02:00
W.C.A. Wijngaards b1d1dcb3b6 - Fix that dump_cache has a larger buffer for records, 
and it checks that an owner name does not collide with BADRR
  on the input, and changes verbosity on the log of failure in
  rrset to string.  Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-03 14:51:16 +02:00
W.C.A. Wijngaards 6da73aba38 - Fix fast_reload for when a ZONEMD lookup is in progress. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-03 14:42:47 +02:00
Yorgos Thessalonikefs 4544eaa4cc - Fix const as reported by newest compiler warnings. 2026-06-03 14:00:04 +02:00
W.C.A. Wijngaards 57f92cc97e - Fix #1457: race condition causes segfault when starting 
threads.
 2026-05-28 09:34:04 +02:00
W.C.A. Wijngaards 758c649611 - Fix that the ratelimit is decremented on successful 
referrals. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-05-27 12:16:23 +02:00
W.C.A. Wijngaards 9c80bb9fb0 - Fix to clean up log ids after a failure to start a worker thread. 2026-05-07 14:42:29 +02:00
W.C.A. Wijngaards 311054728d - Fix EDNS extended RCODE reflection. This fixes that 
the server does not echo extended rcode values after class
  chaos queries. Thanks to Qifan Zhang, Palo Alto Networks
  for the report.
 2026-04-21 09:58:19 +02:00
W.C.A. Wijngaards 6d74856212 - Fix for the Jiggle Attack. The server is fixed to answer 
with errors for error cases, and does not stay silent.
  In addition, the error replies do not contain parts of the
  incoming query. This is more conformant, stops reflection
  and stops it as a covert channel. Thanks to Yuqi Qiu and
  Xiang Li, Nankai University (AOSP Lab) for the report.
  In addition, thanks to Qifan Zhang, Palo Alto Networks, for
  noting the fingerprinting possibility, that is also fixed
  with this.
 2026-04-21 09:54:17 +02:00
W.C.A. Wijngaards 86a8be75f0 - Fix compile warnings for thread setname routine, and test compile. 2026-04-20 12:24:28 +02:00