WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 48d0aea60a - auth-load-thread, unit test for auth_load_http. auth-load-thread W.C.A. Wijngaards 2026-08-11 16:50:24 +02:00
  • 17bbcac979 - auth-load-thread, fix buffer free in http processing. W.C.A. Wijngaards 2026-08-11 16:50:00 +02:00
  • fd8ebbb19c Merge branch 'master' into auth-load-thread W.C.A. Wijngaards 2026-08-11 16:23:20 +02:00
  • 2adbbea365 - auth-load-thread, print thread details in log at high verbosity, 8. W.C.A. Wijngaards 2026-08-11 16:23:03 +02:00
  • 8ee0bca833 - Fix stat_values.tdir test to have less test failures. master W.C.A. Wijngaards 2026-08-11 10:07:38 +02:00
  • c58e6add2b - Fix #1492 from zacek: Data race in log_init() on key_created/log_lock when calling ub_ctx_create() concurrently from multiple threads. W.C.A. Wijngaards 2026-08-11 09:42:30 +02:00
  • 156c00a727 Merge branch 'master' into auth-load-thread W.C.A. Wijngaards 2026-08-10 16:42:59 +02:00
  • d753f95956 - auth-load-thread, print time taken during auth load processing. W.C.A. Wijngaards 2026-08-10 16:42:04 +02:00
  • 93a56205cf - Fix #1489 from jplesnik: Replace removed Python 2 C API macros for SWIG 4.5.0 compatibility. W.C.A. Wijngaards 2026-08-07 08:57:32 +02:00
  • 709f622658 Note issue number in Changlog entry. W.C.A. Wijngaards 2026-08-06 17:15:55 +02:00
  • 307fc6f062 - Fix bounds check in packed_rr_to_string, it checked the (#1488) akhanin-dnsfandGitHub 2026-08-06 10:04:05 -05:00
  • 8b33c5d7ff - Fix #1487: regression in 1.26.0, ipsecmod is now always partly enabled. W.C.A. Wijngaards 2026-08-06 09:46:18 +02:00
  • 36bd52afb9 Fix typo in Changelog. W.C.A. Wijngaards 2026-08-06 09:08:33 +02:00
  • b7d13ff12b - Fix ##1485: the list_forwards command omits port numbers. The list_forwards and list_stubs commands for unbound-control print port and tls auth name. W.C.A. Wijngaards 2026-08-06 09:08:17 +02:00
  • bdfcfb861f - Fix to set makedist.sh to not wget config.sub and config.guess from git repo. The fetch times out, and the version from libtoolize is much more recent now than that it was when the wget was added. W.C.A. Wijngaards 2026-08-04 10:04:34 +02:00
  • b444deffd2 Note 1.26.0 release. W.C.A. Wijngaards 2026-08-04 10:01:59 +02:00
  • ff28b7e5cf - For #1483: The failure reason when an NSEC NXDOMAIN is encountered when looking for an insecure delegation, is fixed to mention the NSEC records, instead of nonexistent NSEC3 records, that it attempted. W.C.A. Wijngaards 2026-07-31 09:53:47 +02:00
  • 79b84bbc91 - Fix #1482: DNS-over-QUIC doesn't work with simple config. That fixes interface-automatic for use with doq service. W.C.A. Wijngaards 2026-07-30 08:24:42 +02:00
  • cbfc3b0342 - Tag for 1.26.0rc1. The repo continues with version 1.26.1. W.C.A. Wijngaards 2026-07-28 09:45:59 +02:00
  • a45da353d3 - Fix to call OPENSSL_cleanup on exit when that is defined. release-1.26.0rc1 release-1.26.0 branch-1.26.0 W.C.A. Wijngaards 2026-07-24 17:04:38 +02:00
  • c21e3ee929 Changelog note for #1479 - Merge #1479 from psumbera: Fix pthread detection on Solaris 11.4. W.C.A. Wijngaards 2026-07-24 15:35:55 +02:00
  • 8a38bed262 Fix pthread detection on Solaris 11.4 (#1479)
    Petr SumberaGitHubRainer Orth
         2026-07-24 15:34:18 +02:00
  • 7cc7a43ff6 Changelog note for #1481. - Fix #1481: Fix to use tls-port after referral if tls-upstream is set. W.C.A. Wijngaards 2026-07-24 15:32:20 +02:00
  • 9bd8df0149 - Fix to use tls-port after referral if tls-upstream is set. W.C.A. Wijngaards 2026-07-24 15:31:06 +02:00
  • 8f7411057f - Fix sign of comparison warning in shared ports setup. W.C.A. Wijngaards 2026-07-24 14:44:44 +02:00
  • ca1fe4f82a - Fix to guard access to shared ports interface array during set up, for analyzer. W.C.A. Wijngaards 2026-07-24 14:38:46 +02:00
  • e183c2c506 - Fix unused variable warnings in shared_ports_fetch_random and shared_ports_return_port when compiled without threads. W.C.A. Wijngaards 2026-07-24 14:37:17 +02:00
  • 52b18fc6f5 Changelog entry for #1480 - Merge #1480 from petrvaganoff: authzone: fix memory leak in xfer_set_masters() error path. W.C.A. Wijngaards 2026-07-24 12:25:34 +02:00
  • e6d00725c2 authzone: fix memory leak in xfer_set_masters() error path (#1480) Petr VaganovandGitHub 2026-07-24 17:24:49 +07:00
  • e597711824 - Fix lock test protect for auth zone change. - Fix to lock shared_ports structure during initialisation. - Fix to lock anchor structure when file is set for it in W.C.A. Wijngaards 2026-07-24 12:13:09 +02:00
  • e1e646c6fc - Fix to allow test fake sha1 on systems with possible sha1 support. - Fix to use sha256 for unbound-anchor unit test. - Fix unbound-anchor check for return value of X509_NAME_get_text_by_NID of the emailaddress. W.C.A. Wijngaards 2026-07-24 11:50:15 +02:00
  • fc3b5b4f63 - Update generated man pages. W.C.A. Wijngaards 2026-07-24 10:03:41 +02:00
  • 1e904a3ce5 - set code repository version to 1.26.0. W.C.A. Wijngaards 2026-07-24 09:45:49 +02:00
  • 79e100a7fb - Fix #1477: respip + dns64: dns64 uses A records modified by respip instead of original A records. Adds local-zone types block_a_wdata and block_aaaa_wdata, that are like block_a and block_aaaa, and uses local-data if present. W.C.A. Wijngaards 2026-07-24 09:29:17 +02:00
  • a65d3d7283 - Unit test for block_a and block_aaaa. W.C.A. Wijngaards 2026-07-24 09:03:45 +02:00
  • 3b8766aa43 Changelog note for #1433 - Merge #1433 from jisakiel: Add new static zone type block_aaaa to suppress AAAA queries. W.C.A. Wijngaards 2026-07-24 08:53:30 +02:00
  • c8b3c89a39 Add new static zone type block_aaaa to suppress AAAA queries (#1433)
    JisakielGitHubJisakiel
         2026-07-24 07:52:20 +01:00
  • a05d460e66 - Fix mesh cycle detection for configuration with respip CNAME loop and tagged clients. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-23 16:28:45 +02:00
  • 5eb362a6c0 - Fix that the aggressive negative cache does not insert NSEC records with overreaching next owner name. Also the result is not above the trust anchor's bailiwick. Also RRSIGS are not considered valid when an NSEC next owner name is not under the signer zone name. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-23 16:17:59 +02:00
  • 0735cb28d1 - Fix that for NSEC3 proofs the NSEC3 zone, as the b32.name is checked to be the same as the signer name. Also RRSIGs are not considered valid when an NSEC3 is not b32.signerzone. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-23 15:54:59 +02:00
  • 737c28e836 Changelog entry for #1478 - Merge #1478 from petrvaganoff: pythonmod: add check return value after ftell(). W.C.A. Wijngaards 2026-07-23 10:22:53 +02:00
  • 1bab2dfafa pythonmod: add check return value after ftell() (#1478) Petr VaganovandGitHub 2026-07-23 15:22:02 +07:00
  • 22e2c5b6d1 - Updated credits for Xuanchao Xie in 22 july changelog. W.C.A. Wijngaards 2026-07-23 10:01:10 +02:00
  • 914dbfea4e - iana portlist update. W.C.A. Wijngaards 2026-07-22 14:12:34 +02:00
  • cf5e6e89a5 - Fix error in log printout in fix for CVE-2026-50248, when the primary name is bogus. W.C.A. Wijngaards 2026-07-22 12:16:49 +02:00
  • 4941edf275 - Unit test for CVE-2026-56416. W.C.A. Wijngaards 2026-07-22 12:06:00 +02:00
  • b08723ef97 - Unit test for CVE-2026-55973. W.C.A. Wijngaards 2026-07-22 12:04:35 +02:00
  • c163fbc505 - Unit test for CVE-2026-55717. W.C.A. Wijngaards 2026-07-22 12:03:48 +02:00
  • eed3f1ab38 - Unit test for CVE-2026-50248. W.C.A. Wijngaards 2026-07-22 12:00:19 +02:00
  • 63501f51bb - Unit test for CVE-2026-50243. W.C.A. Wijngaards 2026-07-22 11:59:36 +02:00
  • 1ae2570bda - Unit test for CVE-2026-46582. W.C.A. Wijngaards 2026-07-22 11:58:18 +02:00
  • 9ad825b267 - Unit test for CVE-2026-50045. W.C.A. Wijngaards 2026-07-22 11:57:13 +02:00
  • 3d5e6c0692 - Unit test for CVE-2026-44690. W.C.A. Wijngaards 2026-07-22 11:56:08 +02:00
  • 23e19ca6fc - Unit test for CVE-2026-44687. W.C.A. Wijngaards 2026-07-22 11:55:09 +02:00
  • 9f757aa9f3 - Unit test for CVE-2026-42955. W.C.A. Wijngaards 2026-07-22 11:54:00 +02:00
  • 1df6c170ff Changelog entry for 1.25.2. - Set the repository to 1.25.3, it continues with the previous changes. W.C.A. Wijngaards 2026-07-22 11:38:48 +02:00
  • 7a95bedc26 Fix conflict merge fixup. W.C.A. Wijngaards 2026-07-22 11:36:06 +02:00
  • ae685bc33d Move repo to version 1.25.3. W.C.A. Wijngaards 2026-07-22 11:34:48 +02:00
  • 91ac449bcd Merge branch 'branch-1.25.2' W.C.A. Wijngaards 2026-07-22 11:33:54 +02:00
  • c33ad1b1a2 rerun autoconf. release-1.25.2 branch-1.25.2 W.C.A. Wijngaards 2026-07-22 10:21:21 +02:00
  • 84d9682dd0 - Fix CVE-2026-56444, Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration. Thanks to Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University, for also reporting this issue. In addition, thanks to Haruki Oyama (Waseda University), for also reporting this issue. W.C.A. Wijngaards 2026-07-22 10:19:50 +02:00
  • 4b1635e194 - Fix CVE-2026-56416, Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:19:28 +02:00
  • aac261cbb3 - Fix CVE-2026-55991, Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2. Thanks to Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xuanchao Xie, for also reporting this issue. W.C.A. Wijngaards 2026-07-22 10:19:02 +02:00
  • ae1b3810cc - Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured Unbound. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:18:41 +02:00
  • 96f8755520 - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:18:16 +02:00
  • 2ce2ca3691 - Fix CVE-2026-55717, 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash. Thanks to Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University, for also reporting this issue. W.C.A. Wijngaards 2026-07-22 10:17:32 +02:00
  • c29ff70f6a - Fix CVE-2026-55708, Privacy/configuration issue when adding local data in views through 'unbound-control'. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:17:10 +02:00
  • 8a15ffee62 - Fix CVE-2026-54478, DNS Cookie bypass when combined with proxy-protocol use. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:16:42 +02:00
  • 8c702de175 - Fix CVE-2026-52863, Memory corruption could lead to crash and denial of service. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:16:03 +02:00
  • 804cff4c15 - Fix CVE-2026-50252, Possible cache poisoning attack by mapping source port population per thread. Thanks to Inbal Schussheim and Amit Klein, Hebrew University, for the report. W.C.A. Wijngaards 2026-07-22 10:15:31 +02:00
  • e180b06298 - Fix CVE-2026-50251, Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:15:02 +02:00
  • 3530c81e29 - Fix CVE-2026-50248, BOGUS configured primary hostname accepted for XFR in auth/rpz zones. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:14:35 +02:00
  • 02b16de1ae - Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:14:04 +02:00
  • 1ad8d4c395 - Fix CVE-2026-50046, Possible heap use-after-free in an error path when a DoT forwarded query is jostled out. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:13:36 +02:00
  • 364ac737f7 - Fix CVE-2026-50045, 'max-global-quota' reset by DNSSEC validation restarts. Thanks to Kunjie Shang, University of Science and Technology of China, for the report. W.C.A. Wijngaards 2026-07-22 10:13:14 +02:00
  • f7637a4f18 - Fix CVE-2026-44690, Cross-zone wildcard cache poisoning via RRSIG.labels manipulation. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:12:38 +02:00
  • 1e1940383a - Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:12:03 +02:00
  • f52a9e864b - Fix CVE-2026-44621, Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:11:26 +02:00
  • 13ec8d0f26 - Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:11:04 +02:00
  • 27f22b8808 - Fix CVE-2026-41637, Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:10:24 +02:00
  • f54e0791ba - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks to Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Trung Nguyen (@everping) of CyStack, for also reporting this issue. W.C.A. Wijngaards 2026-07-22 10:09:50 +02:00
  • 01dfd2f466 - Fix CVE-2026-32665, Remote DNS-over-QUIC denial of service due to quic-size budget bypass. Thanks to N0zoM1z0 (https://github.com/N0zoM1z0) for the report. In addition, thanks to Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University, for also reporting this issue. In addition, thanks to Qifan Zhang, Palo Alto Networks, for also reporting this issue. In addition, thanks to Xuanchao Xie, for also reporting this issue. W.C.A. Wijngaards 2026-07-22 10:09:26 +02:00
  • f157c691bb - Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments. Thanks to Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University, for the report. W.C.A. Wijngaards 2026-07-22 10:08:48 +02:00
  • fea0ff550b - Fix CVE-2026-46582, A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path. Thanks to Qifan Zhang, Palo Alto Networks, for the report. W.C.A. Wijngaards 2026-07-22 10:07:52 +02:00
  • 87d59bfced Set version to 1.25.2 W.C.A. Wijngaards 2026-07-22 10:06:30 +02:00
  • 25b2543e5e Changelog note for #1476 - Merge #1476 from petrvaganoff: ipsecmod: fix possible deref on null after reply_find_answer_rrset(). W.C.A. Wijngaards 2026-07-21 11:57:14 +02:00
  • 7133e0d32a ipsecmod: fix possible deref on null after reply_find_answer_rrset() (#1476) Petr VaganovandGitHub 2026-07-21 16:56:29 +07:00
  • fac7584830 - Fix #1474: DoQ responses are never padded - pad-responses does not apply to comm_doq (RFC 9250 §5.4 MUST). W.C.A. Wijngaards 2026-07-20 10:14:26 +02:00
  • 87f9258fb4 Changelog entry for #1475 - Merge #1475 from petrvaganoff: ipsecmod: fix deref on null in ipsecmod-whitelist after OOM. W.C.A. Wijngaards 2026-07-20 10:05:45 +02:00
  • a2fe5356b5 ipsecmod: fix deref on null in ipsecmod-whitelist after OOM (#1475) Petr VaganovandGitHub 2026-07-20 15:04:47 +07:00
  • ad9b12a863 - Fix unit test for malformed svcb for test on Windows. W.C.A. Wijngaards 2026-07-09 09:52:09 +02:00
  • 61ca4111a1 Changelog note and explanation comment for #1383 - Merge #1383 from jdek: Fix randomness generation on macOS/iOS under chroot. W.C.A. Wijngaards 2026-07-09 09:21:56 +02:00
  • 71a971d70c - Fix randomness generation on macOS/iOS under chroot (#1383) J. DekkerandGitHub 2026-07-09 09:19:42 +02:00
  • 61d6c0e766 - auth-load-thread, implement active thread counter for auth load threads. W.C.A. Wijngaards 2026-07-07 17:21:16 +02:00
  • b4daa2d0fa - auth-load-thread, use define for constant for number of records before poll. W.C.A. Wijngaards 2026-07-07 16:26:42 +02:00
  • 425b701fb9 - auth-load-thread, fix memory leak on alloc failure when appending rrset copy for ixfr main zone data copy. W.C.A. Wijngaards 2026-07-03 16:39:28 +02:00
  • 0a5cde80f1 - auth-load-thread, auth-task-threads: num config option that enables and disables the auth load thread. W.C.A. Wijngaards 2026-07-03 14:03:15 +02:00
  • 58ede90fdb Merge branch 'master' into auth-load-thread W.C.A. Wijngaards 2026-07-02 15:28:24 +02:00
  • ba4f8478e6 Add changelog note for #1087, remove copyright line as discussed, and compile fixes for newer local_zones_lookup, unused variable warnings fixed, and also manual page description of the feature. - Merge #1087: Overload local_data_remove to support removing specific records. W.C.A. Wijngaards 2026-07-02 15:04:51 +02:00
  • 374a18cc5b Overload local_data_remove to support removing specific records (#1087) R. Christian McDonaldandGitHub 2026-07-02 08:55:54 -04:00