WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-10-18 14:27:18 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,587 Commits 29 Branches 216 Tags
bb408e503cda9506e7033cec2bc98affb9c76e4e
Commit Graph
2221 Commits
Author SHA1 Message Date
W.C.A. Wijngaards cb027ae649 Merge branch 'master' into auth-load-thread 2026-10-05 09:02:28 +02:00
Yorgos Thessalonikefs 8820254637 - Move NORMAL_UDP_SIZE around. 2026-09-22 12:01:42 +02:00
W.C.A. Wijngaards a6586ced92 Merge branch 'branch-1.26.1' 2026-09-16 10:26:54 +02:00
W.C.A. Wijngaards 13b6717f17 - Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch 
Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
  Xiang Li from Nankai University, AOSP Lab for the report. In
  addition, thanks to Qifan Zhang from Palo Alto Networks for a
  complimentary report.
 2026-09-16 09:30:25 +02:00
W.C.A. Wijngaards 0d4a6a63dd - Fix CVE-2026-82717, CNAME synthesis could lead to heap corruption. 
Thanks to Ben Morris from Anthropic for the report.
 2026-09-16 09:29:32 +02:00
W.C.A. Wijngaards eba3d35ad4 - Fix CVE-2026-82720, Use-after-free in DoH stream cleanup code path. 
Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
  for the report.
 2026-09-16 09:24:29 +02:00
W.C.A. Wijngaards e619ead2db - Fix CVE-2026-80225, Possible degradation of service from continuous 
queries on the same TCP/DoT connection. Thanks to Qifan Zhang from
  Palo Alto Networks for the report.
 2026-09-16 09:16:29 +02:00
W.C.A. Wijngaards bd210d124b - Fix that when a partial EDNS option is in a query, the 
response is a more RFC conformant FORMERR, since the EDNS
  option is malformed. Also fix to have an EDNS size for
  the reply error encoding for failed EDNS parse of the query.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 17:20:35 +02:00
W.C.A. Wijngaards 11900cc2b0 - Fix that when extended EDNS RCODE does not fit, at short 
udpsize, the reply is truncated with TC and fix for the
  rcode in that short reply to be a sensible rcode.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 15:27:10 +02:00
W.C.A. Wijngaards a6ccb2f74d - Fix to allow block_a and other local-zone types in a view. 2026-09-01 08:48:27 +02:00
W.C.A. Wijngaards 2ec2afd6b0 - Fix #132: Add harden-cname-follow: yes config option, that 
can be used to disable cname scrubbing. That can be useful
  for when the traffic is on localhost only.
 2026-08-24 16:06:17 +02:00
W.C.A. Wijngaards 7fb79b0677 - Fix to defend against double event deletion, that could cause 
event corruption and use after free, for comm_timer_disable.
 2026-08-21 10:29:58 +02:00
W.C.A. Wijngaards fd8ebbb19c Merge branch 'master' into auth-load-thread 2026-08-11 16:23:20 +02:00
W.C.A. Wijngaards c58e6add2b - Fix #1492 from zacek: Data race in log_init() on 
key_created/log_lock when calling ub_ctx_create()
  concurrently from multiple threads.
 2026-08-11 09:42:30 +02:00
W.C.A. Wijngaards 156c00a727 Merge branch 'master' into auth-load-thread 2026-08-10 16:42:59 +02:00
akhanin-dnsfandGitHub 307fc6f062 - Fix bounds check in packed_rr_to_string, it checked the (#1488) 
assembled rr length against the output string length
  dest_len, instead of against the size of the rr buffer it
  writes into. Callers in cachedump.c and remote.c pass a
  dest_len larger than that buffer.
- Unit test for packed_rr_to_string.
 2026-08-06 17:04:05 +02:00
W.C.A. Wijngaards 79e100a7fb - Fix #1477: respip + dns64: dns64 uses A records modified by 
respip instead of original A records. Adds local-zone types
  block_a_wdata and block_aaaa_wdata, that are like block_a
  and block_aaaa, and uses local-data if present.
 2026-07-24 09:29:17 +02:00
JisakielGitHubJisakiel
 		c8b3c89a39 Add new static zone type block_aaaa to suppress AAAA queries (#1433) 
Following d5b9a790f lead for block_a - this would allow suppressing AAAA queries instead for sticking to IPV4.

Co-authored-by: Jisakiel <jisakiel@users.noreply.github.com>
 2026-07-24 08:52:20 +02:00
W.C.A. Wijngaards 914dbfea4e - iana portlist update. 2026-07-22 14:12:34 +02:00
W.C.A. Wijngaards 91ac449bcd Merge branch 'branch-1.25.2' 2026-07-22 11:33:54 +02:00
W.C.A. Wijngaards 4b1635e194 - Fix CVE-2026-56416, Possible heap buffer overflow when validator 
canonicalizes RDATA that contains domain name. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:19:28 +02:00
W.C.A. Wijngaards 2ce2ca3691 - Fix CVE-2026-55717, 'serve-expired-client-timeout' and 'response-ip' 
CNAME redirect could lead to a crash. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report. In addition, thanks to Xin Wang,
  Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University,
  for also reporting this issue.
 2026-07-22 10:17:32 +02:00
W.C.A. Wijngaards 8a15ffee62 - Fix CVE-2026-54478, DNS Cookie bypass when combined with 
proxy-protocol use. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-07-22 10:16:42 +02:00
W.C.A. Wijngaards 364ac737f7 - Fix CVE-2026-50045, 'max-global-quota' reset by DNSSEC validation 
restarts. Thanks to Kunjie Shang, University of Science and
  Technology of China, for the report.
 2026-07-22 10:13:14 +02:00
W.C.A. Wijngaards f52a9e864b - Fix CVE-2026-44621, Libunbound applications configured with 
'unwanted-reply-threshold' could eventually be abruptly
  terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-07-22 10:11:26 +02:00
W.C.A. Wijngaards 27f22b8808 - Fix CVE-2026-41637, Degradation of resolution service from 
improperly accounted client-terminated DNS-over-QUIC queries. Thanks
  to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:10:24 +02:00
W.C.A. Wijngaards f54e0791ba - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report. In addition,
  thanks to Trung Nguyen (@everping) of CyStack, for also reporting
  this issue.
 2026-07-22 10:09:50 +02:00
W.C.A. Wijngaards f157c691bb - Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure 
in high concurrency DNS-over-QUIC environments. Thanks to Kunta
  Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University,
  for the report.
 2026-07-22 10:08:48 +02:00
W.C.A. Wijngaards fac7584830 - Fix #1474: DoQ responses are never padded - pad-responses 
does not apply to comm_doq (RFC 9250 §5.4 MUST).
 2026-07-20 10:14:26 +02:00
W.C.A. Wijngaards 0a5cde80f1 - auth-load-thread, auth-task-threads: num config option that enables and 
disables the auth load thread.
 2026-07-03 14:03:15 +02:00
W.C.A. Wijngaards 0efd3605cc Merge branch 'master' into auth-load-thread 2026-07-01 16:54:55 +02:00
W.C.A. Wijngaards f35561287a - iana portlist updated. 2026-06-30 12:38:33 +02:00
W.C.A. Wijngaards 380994219f - auth-load-thread, make and run auth load thread. 2026-06-26 17:11:12 +02:00
W.C.A. Wijngaards 153accb8de - auth-load-thread, put create_socketpair and sock_poll_timeout into 
util/net_help.h
 2026-06-26 15:22:08 +02:00
W.C.A. Wijngaards 4c5082ad05 - Fix that fast_reload does not terminate the server if 
random init for DNS cookies fails. The data is only random
  generated if cookies are enabled, and the random data
  is necessary. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-17 16:15:15 +02:00
W.C.A. Wijngaards 5fb892a097 - Fix that fast_reload does not terminate the server 
on config read failure after malloc failure. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 16:10:48 +02:00
W.C.A. Wijngaards 55e9532d16 - Fix after malloc failure for stats, then it drains the pipe 
so the internal messaging stays correct. Also it does
  not exit the server if stats pipe communication fails.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 16:05:45 +02:00
W.C.A. Wijngaards 5ae979bb6e - Fix that on malloc failure during accept of TCP, the 
socket is not left to cause a read event loop. It uses
  slow-accept to delay accepting new connections, if
  that fails it drops the new connections. When the tcp
  connection usage is full, it waits for 50msec, to allow
  existing queries to be resolved. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-17 15:37:04 +02:00
W.C.A. Wijngaards a7debe7ff6 - Fix that after shared memory cannot be created, from 
`shm-enable`, the server does not crash. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-06-16 10:53:40 +02:00
W.C.A. Wijngaards 215e3920ef - Fix that after malloc failure in find_tag_datas, the 
local_alias is cleaned up. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-06-16 10:51:49 +02:00
W.C.A. Wijngaards a45e54555d - Fix that dnscrypt configuration does not crash, due to 
inconsistency between secret and public keys. Also
  duplicate files are skipped. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-06-16 10:40:10 +02:00
W.C.A. Wijngaards 8557788699 - Fix that after malloc failure a half-built local_alias does 
not crash the server. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:12:19 +02:00
W.C.A. Wijngaards 299df5ec77 - Fix that dns64 does not ignore the forward-no-cache and 
`stub-no-cache` options. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 09:52:46 +02:00
W.C.A. Wijngaards f68cca4097 - Fix DNAME synthesis from cache that keeps use of 0TTL 
entries in a sliding window. It did not surpass RRSIG
  expiry. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 16:39:34 +02:00
W.C.A. Wijngaards 98e95d80e6 - Fix integer overflow in infra-cache-max-rtt calculation. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:22:50 +02:00
W.C.A. Wijngaards 8f5348ab47 - Fix that misconfigured iter-scrub-ns: 0 causes request 
failures. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 16:04:24 +02:00
W.C.A. Wijngaards c5d693b21c - Fix buffer overflow when configured with lower than 
default size and http transfer. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-15 16:01:51 +02:00
W.C.A. Wijngaards 27e3ac55b9 - Fix assertion failure for long HTTP header that fills 
buffer. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 15:54:37 +02:00
W.C.A. Wijngaards 153f8d5353 - Fix to add max-transfer-size and max-transfer-time that 
limit auth-zone and rpz transfer amount and time taken.
  Default is disabled. This hardens against unbounded
  transfers. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 15:45:03 +02:00
W.C.A. Wijngaards ecd41bef27 - Fix #1437: Fix compile with OpenSSL 4.0.1. 2026-06-11 17:31:01 +02:00