2 - Fix compile error on NetBSD in util/netevent.h.
5 - Tag for 1.18.0rc1 release.
8 - Set version number to 1.18.0.
10 21 August 2023: Wouter
11 - Debug Windows ci workflow.
12 - Fix windows ci workflow to install bison and flex.
13 - Fix for #925: unbound.service: Main process exited, code=killed,
14 status=11/SEGV. Fixes cachedb configuration handling.
15 - Fix #923: processQueryResponse() THROWAWAY should be mindful of
17 - Fix unit test for unbound-control to work when threads are disabled,
18 and fix cache dump check.
20 18 August 2023: Wouter
21 - Fix for iter_dec_attempts that could cause a hang, part of
22 capsforid and qname minimisation, depending on the settings.
23 - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg.
24 - Fix stat_values test to work with dig that enables DNS cookies.
26 17 August 2023: Wouter
27 - Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and
28 RFC9018. Create server cookies for clients that send client cookies.
29 This needs to be explicitly turned on in the config file with:
30 `answer-cookie: yes`. A `cookie-secret:` can be configured for
31 anycast setups. Without one, a random cookie secret is generated.
32 The acl option `allow_cookie` allows queries with either a valid
33 cookie or over a stateful transport. The statistics output has
34 `queries_cookie_valid` and `queries_cookie_client` and
35 `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:`
36 value determines a rate limit for queries with cookies, if desired.
37 - Fix regional_alloc_init for potential unaligned source of the copy.
38 - Fix ip_ratelimit test to work with dig that enables DNS cookies.
41 - Move a cache reply callback in worker.c closer to the cache reply
45 - Merge #911 from natalie-reece: Exclude EDE before other EDNS options
46 when there isn't enough space.
47 - For #911: Try to trim EXTRA-TEXT (and LDNS_EDE_OTHER options
48 altogether) before giving up on attaching EDE options.
49 - More braces and formatting for Fix for EDNS EDE size calculation to
51 - Fix to use the now cached EDE, if any, for CD_bit queries.
54 - Fix for EDNS EDE size calculation.
57 - Merge #790 from Tom Carpay: Add support for EDE caching in cachedb
61 - iana portlist update.
64 - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching.
67 - Fix unused variable compile warning for kernel timestamps in
71 - Merge #857 from eaglegai: fix potential memory leaks when errors
73 - For #857: fix mixed declarations and code.
74 - Merge #118 from mibere: Changed verbosity level for Redis init &
76 - Merge #390 from Frank Riley: Add missing callbacks to the python
78 - Cleaner failure code for callback functions in interface.i.
79 - Merge #889 from borisVanhoof: Free memory in error case + remove
81 - For #889: use netcat-openbsd instead of netcat-traditional.
82 - For #889: Account for num_detached_states before possible
83 mesh_state_delete when erroring out.
86 - Merge #909 from headshog: Numeric truncation when parsing TYPEXX and
87 CLASSXX representation.
88 - For #909: Fix return values.
89 - Merge #901 from Sergei Trofimovich: config: improve handling of
93 - For #909: Fix RR class comparison.
96 - More clear description of the different auth-zone behaviors on the
100 - Merge #880 from chipitsine: services/authzone.c: remove redundant
104 - Merge #664 from tilan7763: Add prefetch support for subnet cache
106 - For #664: Easier code flow for subnetcache prefetching.
107 - For #664: Add testcase.
108 - For #664: Rename subnet_prefetch tests to subnet_global_prefetch to
109 differentiate from the new subnet prefetch support.
112 - Merge #739: Add SVCB dohpath support.
113 - Code cleanup for sldns_str2wire_svcparam_key_lookup.
114 - Merge #802: add validation EDEs to queries where the CD bit is set.
115 - For #802: Cleanup comments and add RCODE check for CD bit test case.
116 - Skip the 00-lint test. splint is not maintained; it either does not
117 work or produces false positives. Static analysis is handled in the
121 - Fix #906: warning: ‘Py_SetProgramName’ is deprecated.
122 - Fix dereference of NULL variable warning in mesh_do_callback.
125 - More fixes for reference counting for python module and clean up
127 - Merge #827 from rcmcdonald91: Eliminate unnecessary Python reloading
128 which causes memory leaks.
131 - Fix python modules with multiple scripts, by incrementing reference
135 - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as
136 a new statistical counter.
137 - Remove warning about unknown cast-function-type warning pragma.
140 - Merge #903: contrib: add yocto compatible init script.
143 - Fix for issue #887 (Timeouts to forward servers on BSD based
145 - Probably fixes #516 (Stream reuse does not work on Windows) as well
148 - Properly handle all return values of worker_check_request during
150 - Do not check the incoming request more than once.
153 - Merge #896: Fix: #895: pythonmodule: add all site-packages
154 directories to sys.path.
155 - Fix #895: python + sysconfig gives ANOTHER path comparing to
157 - Fix for uncertain unit test for doh buffer size events.
160 - Fix unbound-dnstap-socket printout when no query is present.
161 - Fix unbound-dnstap-socket time fraction conversion for printout.
164 - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR.
165 - Fix to remove unused variables from RPZ clientip data structure.
168 - Fix #888: [FR] Use kernel timestamps for dnstap.
169 - Fix to print debug log for ancillary data with correct IP address.
172 - Fix warning in windows compile, in set_recvtimestamp.
175 - Fix #885: Error: util/configlexer.c: No such file or directory,
176 adds error messages explaining to install flex and bison.
177 - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h.
178 - Fix doxygen in addr_to_nat64 header definition.
181 - Merge #722 from David 'eqvinox' Lamparter: NAT64 support.
182 - For #722: minor fixes, formatting, refactoring.
185 - Fix RPZ IP responses with trigger rpz-drop on cache entries, that
188 26 April 2023: Philip
189 - Fix issue #860: Bad interaction with 0 TTL records and serve-expired
191 26 April 2023: Wouter
192 - Merge #882 from vvfedorenko: Features/dropqueuedpackets, with
193 sock-queue-timeout option that drops packets that have been in the
194 socket queue for too long. Added statistics num.queries_timed_out
195 and query.queue_time_us.max that track the socket queue timeouts.
196 - Fix for #882: small changes, date updated in Copyright for
197 util/timeval_func.c and util/timeval_func.h. Man page entries and
199 - Fix for #882: document variable to stop doxygen warning.
201 19 April 2023: Wouter
202 - Fix for #878: Invalid IP address in unbound.conf causes Segmentation
205 14 April 2023: Wouter
206 - Merge #875: change obsolete txt URL in unbound-anchor.c to point
207 to RFC 7958, and Fix #874.
209 13 April 2023: Wouter
210 - Fix build badge, from failing travis link to github ci action link.
213 - Fix for #870: Add test case for the qname minimisation and CNAME.
216 - Fix #870: NXDOMAIN instead of NOERROR rcode when asked for existing
219 24 March 2023: Philip
220 - Fix issue #676: Unencrypted query is sent when
221 forward-tls-upstream: yes is used without tls-cert-bundle
222 - Extra consistency check to make sure that when TLS is requested,
223 either we set up a TLS connection or we return an error.
225 21 March 2023: Philip
226 - Fix issue #851: reserved identifier violation
228 20 March 2023: Wouter
229 - iana portlist update.
231 17 March 2023: George
232 - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option
233 to ignore the unexpected eof while reading in openssl >= 3.
235 16 March 2023: Wouter
236 - Fix ssl.h include brackets, instead of quotes.
238 14 March 2023: Wouter
239 - Fix unbound-dnstap-socket test program to reply the finish frame
240 over a TLS connection correctly.
242 23 February 2023: Wouter
243 - Fix for #852: Completion of error handling.
245 21 February 2023: Philip
246 - Fix #825: Unexpected behavior with client-subnet-always-forward
249 10 February 2023: George
250 - Clean up iterator/iterator.c::error_response_cache() and allow for
251 better interaction with serve-expired, prefetch and cached error
254 9 February 2023: George
255 - Allow TTL refresh of expired error responses.
256 - Add testcase for refreshing expired error responses.
258 9 February 2023: Wouter
259 - Fix to ignore entirely empty responses, and try at another authority.
260 This turns completely empty responses, a type of noerror/nodata into
261 a servfail, but they do not conform to RFC2308, and the retry can
262 fetch improved content.
263 - Fix unit tests for spurious empty messages.
264 - Fix consistency of unit test without roundrobin answers for the
265 cnametooptout unit test.
266 - Fix to git ignore the library symbol file that configure can create.
268 8 February 2023: Wouter
269 - Fix #841: Unbound won't build with aaaa-filter-iterator.patch.
271 30 January 2023: George
272 - Add duration variable for speed_local.test.
274 26 January 2023: Wouter
275 - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes.
277 23 January 2023: George
278 - Fix #833: [FR] Ability to set the Redis password.
280 23 January 2023: Wouter
281 - Fix #835: [FR] Ability to use Redis unix sockets.
283 20 January 2023: Wouter
284 - Merge #819: Added new static zone type block_a to suppress all A
285 queries for specific zones.
287 19 January 2023: Wouter
288 - Set max-udp-size default to 1232. This is the same default value as
289 the default value for edns-buffer-size. It restricts client edns
290 buffer size choices, and makes unbound behave similar to other DNS
291 resolvers. The new choice, down from 4096 means it is harder to get
292 large responses from Unbound. Thanks to Xiang Li, from NISL Lab,
294 - Add harden-unknown-additional option. It removes
295 unknown records from the authority section and additional section.
296 Thanks to Xiang Li, from NISL Lab, Tsinghua University.
297 - Set default for harden-unknown-additional to no. So that it does
298 not hamper future protocol developments.
299 - Fix test for new default.
301 18 January 2023: Wouter
302 - Fix not following cleared RD flags potentially enables amplification
303 DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab,
304 Tsinghua University. The fix stops query loops, by refusing to send
305 RD=0 queries to a forwarder, they still get answered from cache.
307 13 January 2023: Wouter
308 - Merge #826: Аdd a metric about the maximum number of collisions in
310 - Improve documentation for #826, describe the large collisions amount.
312 9 January 2023: Wouter
313 - Fix python module install path detection.
314 - Fix python version detection in configure.
316 6 January 2023: Wouter
317 - Fix #823: Response change to NODATA for some ANY queries since
318 1.12, tested on 1.16.1.
319 - Fix wildcard in hyperlocal zone service degradation, reported
320 by Sergey Kacheev. This fix is included in 1.17.1rc2.
321 That became 1.17.1 on 12 Jan 2023, the code repo continues
322 with 1.17.2. 1.17.1 excludes fix #823, it is included forwards.
324 5 January 2023: Wouter
325 - Tag for 1.17.1 release.
327 2 January 2023: Wouter
328 - Fix windows compile for libunbound subprocess reap comm point closes.
329 - Update github workflows to use checkout v3.
331 14 December 2022: George
332 - Merge #569 from JINMEI Tatuya: add keep-cache option to
333 'unbound-control reload' to keep caches.
335 13 December 2022: George
336 - Expose 'statistics-inhibit-zero' as a configuration option; the
337 default value retains Unbound's behavior.
338 - Expose 'max-sent-count' as a configuration option; the
339 default value retains Unbound's behavior.
340 - Merge #461 from Christian Allred: Add max-query-restarts option.
341 Exposes an internal configuration but the default value retains
344 13 December 2022: Wouter
345 - Merge #808: Wrap Makefile script's directory variables in quotes.
346 - Fix to wrap Makefile scripts directory in quotes for uninstall.
348 1 December 2022: Wouter
349 - Fix #773: When used with systemd-networkd, unbound does not start
350 until systemd-networkd-wait-online.service times out.
352 30 November 2022: George
353 - Add SVCB and HTTPS to the types removed by 'unbound-control flush'.
354 - Clear documentation for interactivity between the subnet module and
355 the serve-expired and prefetch configuration options.
357 30 November 2022: Wouter
358 - Fix #782: Segmentation fault in stats.c:404.
360 28 November 2022: Wouter
361 - Fix for the ignore of tcp events for closed comm points, preserve
362 the use after free protection features.
364 23 November 2022: Philip
365 - Merge #720 from jonathangray: fix use after free when
366 WSACreateEvent() fails.
368 22 November 2022: George
369 - Ignore expired error responses.
371 11 November 2022: Wouter
372 - Fix #779: [doc] Missing documention in ub_resolve_event() for
373 callback parameter was_ratelimited.
375 9 November 2022: George
376 - Complementary fix for distutils.sysconfig deprecation in Python 3.10
377 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2.
379 8 November 2022: Wouter
380 - Fix to ignore tcp events for closed comm points.
381 - Fix to make sure to not read again after a tcp comm point is closed.
382 - Fix #775: libunbound: subprocess reap causes parent process reap
384 - iana portlist update.
386 21 October 2022: George
387 - Merge #767 from jonathangray: consistently use IPv4/IPv6 in
390 21 October 2022: Wouter
391 - Fix that cachedb does not store failures in the external cache.
393 18 October 2022: George
394 - Clarify the use of MAX_SENT_COUNT in the iterator code.
396 17 October 2022: Wouter
397 - testcode/dohclient sets log identity to its name.
399 14 October 2022: Wouter
400 - Merge #768 from fobser: Arithmetic on a pointer to void is a GNU
402 - In unit test, print python script name list correctly.
404 13 October 2022: Wouter
405 - Tag for 1.17.0 release. The code repository continues with 1.17.1.
407 11 October 2022: George
408 - Fix PROXYv2 header read for TCP connections when no proxied addresses
411 7 October 2022: Wouter
412 - Tag for 1.17.0rc1 release.
414 7 October 2022: George
415 - Fix to stop possible loops in the tcp reuse code (write_wait list
416 and tcp_wait list). Based on analysis and patch from Prad Seniappan
417 and Karthik Umashankar.
418 - Fix unit test to properly test the reuse_write_wait_pop function.
420 6 October 2022: Wouter
421 - Fix to stop responses with TC flag from resulting in partial
422 responses. It retries to fetch the data elsewhere, or fails the
423 query and in depth fix removes the TC flag from the cached item.
424 - Fix proxy length debug output printout typecasts.
426 5 October 2022: Wouter
427 - Fix dnscrypt compile for proxy protocol code changes.
429 5 October 2022: George
430 - Use DEBUG_TDIR from environment in mini_tdir.sh for debugging.
431 - Fix string comparison in mini_tdir.sh.
432 - Make ede.tdir test more predictable by using static data.
433 - Fix checkconf test for dnscrypt and proxy port.
435 4 October 2022: George
436 - Merge #764: Leniency for target discovery when under load (for
437 NRDelegation changes).
439 4 October 2022: Wouter
440 - Fix static analysis report to remove dead code from the
441 rpz_callback_from_iterator_module function.
442 - Fix to clean up after the acl_interface unit test.
444 3 October 2022: George
445 - Merge #760: PROXYv2 downstream support. (New proxy-protocol-port
446 configuration option).
448 3 October 2022: Wouter
449 - Fix to remove erroneous TC flag from TCP upstream.
450 - Fix test tdir skip report printout.
451 - Fix windows compile, the identifier interface is defined in headers.
452 - Fix to close errno block in comm_point_tcp_handle_read outside of
455 26 September 2022: George
456 - Better output for skipped tdir tests.
458 21 September 2022: Wouter
459 - Patch for CVE-2022-3204 Non-Responsive Delegation Attack.
460 - This patch was released in 1.16.3, the code repository continues
461 with the previous features and fixes for 1.17.0.
462 - Fix doxygen warning in respip.h.
464 20 September 2022: George
465 - Convert tdir tests to use the new skip_test functionality.
466 - Remove unused testcode/mini_tpkg.sh file.
468 16 September 2022: George
469 - Merge #753: ACL per interface. (New interface-* configuration
472 2 September 2022: Wouter
473 - Remove include that was there for debug purposes.
474 - Fix to check pthread_t size after pthread has been detected.
476 1 September 2022: Wouter
477 - Fix to update config tests to fix checking if nonblocking sockets
479 - Slow down log frequency of write wait failures.
480 - Fix to set out of file descriptor warning to operational verbosity.
481 - Fix to log a verbose message at operational notice level if a
482 thread is not responding, to stats requests. It is logged with
485 31 August 2022: Wouter
486 - Fix to avoid process wide fcntl calls mixed with nonblocking
487 operations after a blocked write.
488 - Patch from Vadim Fedorenko that adds MSG_DONTWAIT to receive
489 operations, so that instruction reordering does not cause mistakenly
490 blocking socket operations.
491 - Fix to wait for blocked write on UDP sockets, with a timeout if it
492 takes too long the packet is dropped.
493 - Fix for wait for udp send to stop when packet is successfully sent.
495 22 August 2022: Wouter
496 - Fix #741: systemd socket activation fails on IPv6.
498 12 August 2022: Wouter
499 - Fix to log accept error ENFILE and EMFILE errno, but slowly, once
500 per 10 seconds. Also log accept failures when no slow down is used.
502 5 August 2022: Wouter
503 - Fix #734 [FR] enable unbound-checkconf to detect more (basic)
506 4 August 2022: Wouter
507 - Fix ratelimit inconsistency, for ip-ratelimits the value is the
508 amount allowed, like for ratelimits.
510 2 August 2022: Wouter
511 - Fix edns subnet so that scope 0 answers only match sourcemask 0
512 queries for answers from cache if from a query with sourcemask 0.
513 - Fix unittest for edns subnet change.
514 - Merge #730 from luisdallos: Fix startup failure on Windows 8.1 due
515 to unsupported IPV6_USER_MTU socket option being set.
517 1 August 2022: Wouter
518 - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699.
519 - Tests for ghost domain fixes.
520 - Tag for 1.16.2 release. The code repo continues with 1.16.3.
521 - Fix #728: alloc_reg_obtain() core dump. Stop double
522 alloc_reg_release when serviced_create fails.
525 - Update documentation for 'outbound-msg-retry:'.
528 - Merge #718: Introduce infra-cache-max-rtt option to config max
532 - Merge PR 714: Avoid treat normal hosts as unresponsive servers.
533 And fixup the lock code.
534 - iana portlist update.
537 - For windows crosscompile, fix setting the IPV6_MTU socket option
538 equivalent (IPV6_USER_MTU); allows cross compiling with latest
539 cross-compiler versions.
542 - Fix dname count in sldns parse type descriptor for SVCB and HTTPS.
545 - Fix verbose EDE error printout.
548 - Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing for
550 - Merge PR #668 from Cristian Rodríguez: Set IP_BIND_ADDRESS_NO_PORT on
551 outbound tcp sockets.
554 - Tag for 1.16.1rc1 release. This became 1.16.1 on 11 July 2022.
555 The code repo continues with version 1.16.2 under development.
558 - Merge PR #671 from Petr Menšík: Disable ED25519 and ED448 in FIPS
560 - Merge PR #660 from Petr Menšík: Sha1 runtime insecure.
561 - For #660: formatting, less verbose logging, add EDE information.
562 - Fix for correct openssl error when adding windows CA certificates to
563 the openssl trust store.
564 - Improve val_sigcrypt.c::algo_needs_missing for one loop pass.
565 - Reintroduce documentation and more EDE support for
566 val_sigcrypt.c::dnskeyset_verify_rrset_sig.
569 - Merge PR #706: NXNS fallback.
570 - From #706: Cached NXDOMAIN does not increase the target nx
572 - From #706: Don't generate parent side queries if we already
573 have the lame records in cache.
574 - From #706: When a lame address is the best choice, don't try to
575 generate target queries when the missing targets are all lame.
578 - iana portlist update.
579 - Fix detection of libz on windows compile with static option.
580 - Fix compile warning for windows compile.
583 - Add debug option to the mini_tdir.sh test code.
584 - Fix #704: [FR] Statistics counter for number of outgoing UDP queries
585 sent; introduces 'num.query.udpout' to the 'unbound-control stats'
587 - Fix to not count cached NXDOMAIN for MAX_TARGET_NX.
588 - Allow fallback to the parent side when MAX_TARGET_NX is reached.
589 This will also allow MAX_TARGET_NX more NXDOMAINs.
592 - Show the output of the exact .rpl run that failed with 'make test'.
593 - Fix for cached 0 TTL records to not trigger prefetching when
594 serve-expired-client-timeout is set.
597 - Fix test program dohclient close to use portability routine.
600 - Clarify -v flag manpage entry (#705)
603 - Fix #663: use after free issue with edns options.
606 - Fix for loading locally stored zones that have lines with blanks or
610 - Remove unused LDNS function check for GOST Engine unloading.
613 - Merge PR #688: Rpz url notify issue.
614 - Note in the unbound.conf text that NOTIFY is allowed from the url:
615 addresses for auth and rpz zones.
618 - Fix for edns client subnet to respect not looking in its cache when
619 instructed to do so (e.g., prefetch).
622 - makedist.sh picks up 32bit libssp-0.dll when 32bit compile.
625 - Fix #684: [FTBS] configure script error with libmnl on openSUSE 15.3 (and possibly other distributions)
626 - Version is set to 1.16.0 for release. Release tag 1.16.0rc1. This
627 became release 1.16.0 on 2 June 2022. The source code branch
628 continues with version 1.16.1 under development.
631 - Fix to silence test for ede error output to the console from the
633 - Fix ede test to not use default pidfile, and use local interface.
634 - Fix some lint type warnings.
637 - Fix typos in config_set_option for the 'num-threads' and
638 'ede-serve-expired' options.
641 - Fix #678: [FR] modify behaviour of unbound-control rpz_enable zone,
642 by updating unbound-control's documentation.
645 - Fix #417: prefetch and ECS causing cache corruption when used
649 - Merge #677: Allow using system certificates not only on Windows,
651 - For #677: Added tls-system-cert to config parser and documentation.
654 - Fix #673: DNS over TLS: error: SSL_handshake syscall: No route to
658 - Fix Python build in non-source directory; based on patch by
662 - Merge PR #604: Add basic support for EDE (RFC8914).
664 28 April 2022: Wouter
665 - Fix #670: SERVFAIL problems with unbound 1.15.0 running on
669 - Fix zonemd check to allow unsupported algorithms to load.
670 If there are only unsupported algorithms, or unsupported schemes,
671 and no failed or successful other ZONEMD records, or malformed
672 or bad ZONEMD records, the unsupported records allow the zone load.
673 - Fix zonemd unsupported algo check.
674 - Fix zonemd unsupported algo check reason to not copy to next record,
675 and check for success for debug printout.
676 - Fix zonemd unsupported algo check to print unsupported reason before
678 - Fix zonemd unsupported algo check to set reason to NULL before the
679 check routine, but after malformed checks, to get the correct NULL
680 output when the digest matches.
682 25 March 2022: Wouter
683 - Fix spelling error in comment in sldns_str2wire_svcparam_key_lookup.
685 23 March 2022: Wouter
686 - Fix #651: [FR] Better logging for refused queries.
688 18 March 2022: George
689 - Merge PR #648 from eaglegai: fix -q doesn't work when use with
690 'unbound-control stats_shm'.
692 17 March 2022: Wouter
693 - Fix to describe auth-zone and other configuration at the local-zone
694 configuration option, to allow for more broadly view of the options.
696 16 March 2022: Wouter
697 - Fix to ensure uniform handling of spaces and tabs when parsing RRs.
700 - Merge #644: Make `install-lib` make target install the pkg-config
704 - Fix configure for python to use sysutils, because distutils is
705 deprecated. It uses sysutils when available, distutils otherwise.
708 - Fix #637: Integer Overflow in sldns_str2period function.
709 - Fix for #637: fix integer overflow checks in sldns_str2period.
712 - Merge PR #632 from scottrw93: Match cnames in ipset.
713 - Various fixes for #632: variable initialisation, convert the qinfo
714 to str once, accept trailing dot in the local-zone ipset option.
717 - Fix compile warnings for printf ll format on mingw compile.
720 - Fix pythonmod for change in iter_dp_is_useless function prototype.
722 28 February 2022: George
723 - Fix #630: Unify the RPZ log messages.
724 - Merge #623 from rex4539: Fix typos.
726 28 February 2022: Wouter
727 - Fix #633: Document unix domain socket support for unbound-control.
728 - Fix for #633: updated fix with new text.
729 - Fix edns client subnet to add the option based on the option list,
730 so that it is not state dependent, after the state fix of #605 for
732 - Fix for edns client subnet option add fix in removal code, from review.
734 25 February 2022: Wouter
735 - Fix to detect that no IPv6 support means that IPv6 addresses are
736 useless for delegation point lookups.
737 - update Makefile dependencies.
738 - Fix check interface existence for support detection in remote lookup.
740 18 February 2022: Wouter
741 - Fix that address not available is squelched from the logs for
742 udp connect failures. It is visible on verbosity 4 and more.
743 - Merge #631 from mollyim: Replace OpenSSL's ERR_PACK with
746 16 February 2022: Wouter
747 - Fix for #628: fix rpz-passthru for qname trigger by localzone type.
749 15 February 2022: Wouter
750 - Fix #628: A rpz-passthru action is not ending RPZ zone processing.
752 11 February 2022: Wouter
753 - Fix #624: Unable to stop Unbound in Windows console (does not
754 respond to CTRL+C command).
755 - Fix #618: enabling interface-automatic disables DNS-over-TLS.
756 Adds the option to list interface-automatic-ports.
757 - Remove debug info from #618 fix.
759 7 February 2022: Wouter
760 - Fix that TCP interface does not use TLS when TLS is also configured.
762 4 February 2022: Wouter
763 - Fix #412: cache invalidation issue with CNAME+A.
765 3 February 2022: Wouter
766 - Fix for #611: Integer overflow in sldns_wire2str_pkt_scan.
767 - Tag for 1.15.0rc1 created. That became 1.15.0 on 10 feb 2022.
768 The repository continues with version 1.15.1.
770 2 February 2022: George
771 - Merge PR #532 from Shchelk: Fix: buffer overflow bug.
772 - Merge PR #616: Update ratelimit logic. It also introduces
773 ratelimit-backoff and ip-ratelimit-backoff configuration options.
774 - Change aggressive-nsec default to yes.
775 - Merge PR #617: Update stub/forward-host notation to accept port and
777 - Update stream_ssl.tdir test to also use the new forward-host
780 2 February 2022: Wouter
781 - Update version number in repo to 1.15.0 for upcoming release,
782 since it changes the aggressive-nsec default and the ratelimit change.
783 - Fix header comment for doxygen for authextstrtoaddr.
784 - please clang analyzer for loop in test code.
785 - Fix docker splint test to use more portable uname.
786 - Update contrib/aaaa-filter-iterator.patch with diff for current
789 1 February 2022: George
790 - Merge PR #603 from fobser: Use OpenSSL 1.1 API to access DSA and RSA
793 31 January 2022: George
794 - Fix review comment for use-after-free when failing to send UDP out.
796 31 January 2022: Wouter
797 - iana portlist update.
799 29 January 2022: George
800 - Fix tls-* and ssl-* documented alternate syntax to also be available
801 through remote-control and unbound-checkconf.
802 - Better cleanup on failed DoT/DoH listening socket creation.
804 26 January 2022: George
805 - Fix #599: [FR] RFC 9156 (obsoletes RFC 7816), by noting the new RFC
808 26 January 2022: Wouter
809 - Test for NSID in SERVFAIL response due to DNSSEC bogus.
811 25 January 2022: George
812 - Fix #588: Unbound 1.13.2 crashes due to p->pc is NULL in
813 serviced_udp_callback.
814 - Merge PR #612: TCP race condition.
816 25 January 2022: Wouter
817 - Fix #610: Undefine-shift in sldns_str2wire_hip_buf.
819 19 January 2022: George
820 - For dnstap, do not wakeupnow right there. Instead zero the timer to
821 force the wakeup callback asap.
823 14 January 2022: George
825 - Fix EDNS to upstream where the same option could be attached
827 - Add a region to serviced_query for allocations.
829 14 January 2022: Wouter
830 - Add rpz: for-downstream: yesno option, where the RPZ zone is
831 authoritatively answered for, so the RPZ zone contents can be
832 checked with DNS queries directed at the RPZ zone.
833 - For #602: Allow the module-config "subnetcache validator cachedb
836 11 January 2022: George
837 - Fix prematurely terminated TCP queries when a reply has the same ID.
839 7 January 2022: Wouter
840 - Merge #600 from pemensik: Change file mode before changing file
843 5 January 2022: Wouter
844 - Fix for #596: fix that rpz return message is returned and not just
845 the rcode from the iterator return path. This fixes signal unset RA
847 - Fix unit tests for rpz now that the AA flag returns successfully from
849 - Fix for #596: add unit test for nsdname trigger and signal unset RA.
850 - Fix for #596: add unit test for nsip trigger and signal unset RA.
851 - Fix #598: Fix unbound-checkconf fatal error: module conf
852 'respip dns64 validator iterator' is not known to work.
853 - Fix for #596: Fix rpz-signal-nxdomain-ra to work for clientip
856 4 January 2022: Wouter
857 - Fix #596: unset the RA bit when a query is blocked by an unbound
858 RPZ nxdomain reply. The option rpz-signal-nxdomain-ra allows to
859 signal that a domain is externally blocked to clients when it
860 is blocked with NXDOMAIN by unsetting RA.
861 - Fix to add test for rpz-signal-nxdomain-ra.
862 - Fix #596: only unset RA when NXDOMAIN is signalled.
863 - Fix that RPZ does not set RD flag on replies, it should be copied
866 22 December 2021: George
867 - contrib/aaaa-filter-iterator.patch file renewed diff content to
868 apply cleanly to the current coderepo for the current code version.
870 20 December 2021: George
871 - Fix #591: Unbound-anchor manpage links to non-existent license file.
873 13 December 2021: George
874 - Add missing configure flags for optional features in the
876 - Fix Unbound capitalization in the documentation.
878 13 December 2021: Wouter
879 - Fix to pick up other class local zone information before unlock.
881 10 December 2021: George
882 - Allow local-data for classes other than IN to inherit a configured
883 local-zone's type if possible, instead of defaulting to type
884 transparent as per the implicit rule.
886 10 December 2021: Wouter
887 - Add code similar to fix for ldns for tab between strings, for
888 consistency, the test case was not broken.
890 6 December 2021: Wouter
891 - Merge PR #581 from fobser: Fix -Wmissing-prototypes and -Wshadow
893 - Fix validator debug output about DS support, print correct algorithm.
895 3 December 2021: Wouter
896 - Fix compile warning for if_nametoindex on windows 64bit.
898 1 December 2021: Wouter
899 - configure is set to 1.14.0, and release branch.
900 This was released as version 1.14.0 on 9 Dec 2021, with the doxygen
901 fix below included. The main branch continues as 1.14.1.
902 - Fix doc/unbound.doxygen to remove obsolete tag warning.
904 1 December 2021: George
905 - Merge PR #511 from yan12125: Reduce unnecessary linking.
906 - Merge PR #493 from Jaap: Fix generation of libunbound.pc.
907 - Merge PR #555 from fobser: Allow interface names as scope-id in IPv6
908 link-local addresses.
909 - Merge PR #562 from Willem: Reset keepalive per new tcp session.
910 - Merge PR #522 from sibeream: memory management violations fixed.
911 - Merge PR #530 from Shchelk: Fix: dereferencing a null pointer.
912 - Fix #454: listen_dnsport.c:825: error: ‘IPV6_TCLASS’ undeclared.
913 - Fix #574: Review fixes for size allocation.
915 30 November 2021: Wouter
916 - Fix to remove git tracking and ci information from release tarballs.
917 - iana portlist update.
919 29 November 2021: Wouter
920 - Merge PR #570 from rex4539: Fix typos.
921 - Fix for #570: regen aclocal.m4, fix configure.ac for spelling.
922 - Fix to make python module opt_list use opt_list_in.
923 - Fix #574: unbound-checkconf reports fatal error if interface names
924 are used as value for interfaces:
925 - Fix #574: Review fixes for it.
926 - Fix #576: [FR] UB_* error codes in unbound.h
927 - Fix #574: Review fix for spelling.
929 15 November 2021: Tom
930 - Improve EDNS option handling, now also works for synthesised
931 responses such as local-data and server.id CH TXT responses.
933 5 November 2021: George
934 - Fix for #558: fix loop in comm_point->tcp_free when a comm_point is
935 reclaimed more than once during callbacks.
936 - Fix for #558: clear the UB_EV_TIMEOUT bit before adding an event.
938 5 November 2021: Wouter
939 - Fix that forward-zone name is documented as the full name of the
940 zone. It is not relative but a fully qualified domain name.
941 - Fix analyzer review failure in rpz action override code to not
942 crash on unlocking the local zone lock.
943 - Fix to remove unused code from rpz resolve client and action
945 - Merge #565: unbound.service.in: Disable ProtectKernelTunables again.
947 2 November 2021: Wouter
948 - Fix #552: Unbound assumes index.html exists on RPZ host.
950 11 October 2021: Wouter
951 - Fix chaos replies to have truncation for short message lengths,
952 or long reply strings.
953 - Fix to protect custom regional create against small values.
955 4 October 2021: Wouter
956 - Fix to add example.conf note for outbound-msg-retry.
958 27 September 2021: Wouter
959 - Implement RFC8375: Special-Use Domain 'home.arpa.'.
961 21 September 2021: Wouter
962 - For crosscompile on windows, detect 64bit stackprotector library.
963 - Fix crosscompile shell syntax.
964 - Fix crosscompile windows to use libssp when it exists.
965 - For the windows compile script disable gost.
966 - Fix that on windows, use BIO_set_callback_ex instead of deprecated
968 - Fix crosscompile script for the shared build flags.
970 20 September 2021: Wouter
971 - Fix crosscompile on windows to work with openssl 3.0.0 the
972 link with ws2_32 needs -l:libssp.a for __strcpy_chk.
973 Also copy results from lib64 directory if needed.
975 10 September 2021: Wouter
976 - Fix initialisation errors reported by gcc sanitizer.
977 - Fix lock debug code for gcc sanitizer reports.
978 - Fix more initialisation errors reported by gcc sanitizer.
980 8 September 2021: Wouter
981 - Merged #41 from Moritz Schneider: made outbound-msg-retry
983 - Small fixes for #41: changelog, conflicts resolved,
984 processQueryResponse takes an iterator env argument like other
985 functions in the iterator, no colon in string for set_option,
986 and some whitespace style, to make it similar to the rest.
987 - Fix for #41: change outbound retry to int to fix signed comparison
989 - Fix root_anchor test to check with new icannbundle date.
991 3 September 2021: Wouter
992 - Fix #538: Fix subnetcache statistics.
994 1 September 2021: Wouter
995 - Fix tcp fastopen failure when disabled, try normal connect instead.
997 27 August 2021: Wouter
998 - Fix #533: Negative responses get cached even when setting
999 cache-max-negative-ttl: 1
1001 25 August 2021: Wouter
1002 - Merge #401: RPZ triggers. This add additional RPZ triggers,
1003 unbound supports a full set of rpz triggers, and this now
1004 includes nsdname, nsip and clientip triggers. Also actions
1005 are fully supported, and this now includes the tcp-only action.
1006 - Fix #536: error: RPZ: name of record (drop.spamhaus.org.rpz.local.)
1008 - Fix the stream wait stream_wait_count_lock and http2 buffer locks
1009 setup and desetup from race condition.
1010 - Fix RPZ locks. Do not unlock zones lock if requested and rpz find
1011 zone does not find the zone. Readlock the clientip that is found
1012 for ipbased triggers. Unlock the nsdname zone lock when done.
1013 Unlock zone and ip in rpz nsip and nsdname callback. Unlock
1014 authzone and localzone if clientip found in rpz worker call.
1015 - Fix compile warning in libunbound for listen desetup routine.
1016 - Fix asynclook unit test for setup of lockchecks before log.
1018 20 August 2021: Wouter
1019 - Fix #529: Fix: log_assert does nothing if UNBOUND_DEBUG is
1021 - Fix #531: Fix: passed to proc after free.
1023 17 August 2021: Wouter
1024 - Fix that --with-ssl can use "/usr/include/openssl11" to pass the
1025 location of a different openssl version.
1026 - Fix #527: not sending quad9 cert to syslog (and may be more).
1027 - Fix sed script in ssldir split handling.
1029 16 August 2021: George
1030 - Merge PR #528 from fobser: Make sldns_str2wire_svcparam_buf()
1033 16 August 2021: Wouter
1034 - Fix to support harden-algo-downgrade for ZONEMD dnssec checks.
1036 13 August 2021: Wouter
1037 - Support using system-wide crypto policies.
1038 - Fix for #431: Squelch permission denied errors for udp connect,
1039 and udp send, they are visible at higher verbosity settings.
1040 - Fix zonemd verification of key that is not in DNS but in the zone
1041 and needs a chain of trust.
1042 - zonemd, fix order of bogus printout string manipulation.
1044 12 August 2021: George
1045 - Merge PR #514, from ziollek: Docker environment for run tests.
1046 - For #514: generate configure.
1048 12 August 2021: Wouter
1049 - And 1.13.2rc1 became the 1.13.2 with the fix for the python module
1050 build. The current code repository continues with version 1.13.3.
1051 - Add test tool readzone to .gitignore.
1052 - Merge #521: Update mini_event.c.
1053 - Merge #523: fix: free() call more than once with the same pointer.
1054 - Merge #519: Support for selective enabling tcp-upstream for
1056 - For #519: note stub-tcp-upstream and forward-tcp-upstream in
1057 the example configuration file.
1058 - For #519: yacc and lex. And fix python bindings, and test program
1059 unbound-dnstap-socket.
1060 - For #519: fix comments for doxygen.
1061 - Fix to print error from unbound-anchor for writing to the key
1062 file, also when not verbose.
1064 5 August 2021: Wouter
1065 - Tag for 1.13.2rc1 release.
1066 - Fix #520: Unbound 1.13.2rc1 fails to build python module.
1068 4 August 2021: George
1069 - Merge PR #415 from sibeream: Use
1070 /proc/sys/net/ipv4/ip_local_port_range to determine available outgoing
1071 ports. (New --enable-linux-ip-local-port-range configuration option)
1072 - Bump MAX_RESTART_COUNT to 11 from 8; in relation to #438. This
1073 allows longer CNAME chains in Unbound.
1075 4 August 2021: Wouter
1076 - In unit test use openssl set security level to allow keys in test.
1077 - Fix static analysis warnings about localzone locks that are unused.
1078 - Fix missing locks in zonemd unit test.
1079 - Fix readzone compile under debug config.
1080 - Fix out of sourcedir run of zonemd unit tests.
1081 - Fix libnettle zonemd unit test.
1082 - Fix unit test zonemd_reload for use in run_vm.
1084 3 August 2021: George
1085 - Listen to read or write events after the SSL handshake.
1086 Sticky events on windows would stick on read when write was needed.
1088 3 August 2021: Wouter
1089 - Merge PR #517 from dyunwei: #420 breaks the mesh reply list
1090 function that need to reuse the dns answer.
1091 - Annotate assertion into error printout; we think it may be an
1092 error, but the situation looks harmless.
1093 - Fix sign comparison warning on FreeBSD.
1095 2 August 2021: Wouter
1096 - Prepare for OpenSSL 3.0.0 provider API usage, move the sldns
1097 keyraw functions to produce EVP_PKEY results.
1098 - Move RSA and DSA to use OpenSSL 3.0.0 API.
1099 - Move ECDSA functions to use OpenSSL 3.0.0 API.
1100 - iana portlist update.
1101 - Fix verbose printout failure in tcp reuse unit test.
1103 30 July 2021: Wouter
1104 - Fix #515: Compilation against openssl 3.0.0 beta2 is failing to
1106 - For #515: Fix compilation with openssl 3.0.0 beta2, lib64 dir and
1107 SSL_get_peer_certificate.
1108 - Move acx_nlnetlabs.m4 to version 41, with lib64 openssl dir check.
1110 26 July 2021: George
1111 - Merge #513: Stream reuse, attempt to fix #411, #439, #469. This
1112 introduces a couple of fixes for the stream reuse functionality
1113 that could result in broken internal structures.
1115 26 July 2021: Wouter
1116 - Merge #512: unbound.service.in: upgrade hardening to latest
1118 - Fix readzone unknown type print for memory resize.
1120 21 July 2021: Wouter
1121 - Fix that ldns_zone_new_frm_fp_l counts the line number for an empty
1122 line after a comment.
1124 16 July 2021: George
1125 - Introduce 'http-user-agent:' and 'hide-http-user-agent:' options.
1127 16 July 2021: Wouter
1128 - Merge #510 from ndptech: Don't call a function which hasn't been
1130 - Fix for #510: in depth, use ifdefs for windows api event calls.
1131 - Fix spelling in doc/unbound.doxygen comment.
1132 - Fix spelling in localzone.h comment.
1133 - Fix unbound-control local_data and local_datas to print detailed
1135 - review fix to remove duplicate error printout.
1136 - Insert header into testcode/readzone.c, it was missing.
1137 - Fix from lint for ignored return value.
1138 - Fix for older parsers for function call in serve expired get cached.
1141 - iana portlist update.
1144 - Fix compiler warnings for #491.
1145 - Fix clang-analysis warnings for testcode/readzone.c.
1148 - Fix Wunused-result compile warnings.
1151 - Merge PR #491: Add SVCB and HTTPS types and handling according to
1152 draft-ietf-dnsop-svcb-https.
1155 - Fix #506: Python Module Seems to Leak Memory if it Experiences an
1156 Unhandled Exception.
1158 25 June 2021: Wouter
1159 - Fix up permissions on rpl data file in tests.
1160 - Fix testbound newline treatment in moment_read and tempfile write.
1161 - Fix configure grep for reuseport default for failure.
1162 - Fix compat ctime_r return value
1163 - Fix configure does not require pkg-config if not needed.
1164 - Fix unit test in the ctime_r calls for autotrust and in testbound.
1165 - Fix auth zone download on windows to unlink before rename.
1167 24 June 2021: Wouter
1168 - Add analyzer and port compile github workflow.
1170 23 June 2021: Wouter
1171 - Fix #503: DNS over HTTPS response truncated.
1172 - Fix warnings reported by the gcc analyzer.
1174 21 June 2021: George
1175 - Fix #495: Documentation or implementation of "verbosity" option.
1177 18 June 2021: Wouter
1178 - Fix a number of warnings reported by the gcc analyzer.
1180 15 June 2021: George
1181 - Merge #440 by kimheino: Various fixes to contrib/unbound_munin_ file.
1183 14 June 2021: Wouter
1184 - Fix configure nonblocking test and onmingw test to use host.
1186 10 June 2021: Wouter
1187 - Fix #500: SPEC file in version 1.13.1 references version 1.4;
1188 unable to build RPM from source.
1189 - Fix contrib/unbound.spec, fixed url and comment.
1192 - Merge #486 by fobster: Make VAL_MAX_RESTART_COUNT configurable.
1193 - Generated lexer and parser for #486; updated example.conf.
1194 - Fix #413 (based on patch by k-ronny): unbound: does not compile
1195 on macOS 11.1-x86_64 host.
1196 - Use host_os instead of target_os in configure for Darwin8 build.
1199 - Fix unused variable warning when compiling with --enable-dnstap.
1202 - Merge #448 from shoeper: Update unbound-control.8.in, fix
1204 - Fix #425: Document auth-zone supports communication with DNS
1205 primary on nondefault port.
1208 - Fix test for zonemd-check option.
1211 - Merge #496 from banburybill: Use build system endianness if
1212 available, otherwise try to work it out.
1213 - zonemd-check: yesno option, default no, enables the processing
1214 of ZONEMD records for that zone.
1217 - Move the NSEC3 max iterations count in line with the 150 value
1218 used by BIND, Knot and PowerDNS. This sets the default value
1219 for it in the configuration to 150 for all key sizes.
1220 - Fix #492: module-config respip missing in unbound.conf.5.in man
1221 page. Merges #494 from he32.
1222 - For #492: Fix font highlighting for the man page on emacs.
1225 - Test code has -q option for quiet output.
1228 - Fix for #411, #439, #469: Reset the DNS message ID when moving queries
1229 between TCP streams.
1230 - Refactor for uniform way to produce random DNS message IDs.
1233 - Fix #489: Compile using MSYS2 MinGW 64-bit.
1236 - Fix that auth-zone zonefiles use last TTL if no TTL is specified.
1239 - Merge PR #487: ifdef RLIMIT_AS in recently added check.
1242 - Fix #485: Unbound occasionally reports broken stats.
1243 - Add ./configure --with-deprecate-rsa-1024 that turns off RSA 1024.
1244 - Remove case fallthrough from deprecate-rsa-1024 code.
1247 - Fix for #367: only attempt to get the interface for queries that are no
1248 longer on the tcp_waiting_list.
1249 - Add more logging for out-of-memory cases.
1252 - Merge #478: Allow configuration of TCP timeout while waiting for
1254 - Fix to squelch tcp socket bind failures when the interface is gone.
1255 - Rerun flex and bison.
1258 - Fix #481: Fix comment in configuration file.
1260 29 April 2021: Wouter
1261 - Add that log-servfail prints an IP address and more information
1262 about one of the last failures for that query.
1264 28 April 2021: George
1265 - Fix compiler warning for signed/unsigned comparison for
1266 max_reuse_tcp_queries.
1268 28 April 2021: Wouter
1269 - Fix #474: always_null and others inside view.
1271 26 April 2021: Wouter
1272 - Merge #470 from edevil: Allow configuration of persistent TCP
1275 22 April 2021: Wouter
1276 - Merge #466 from FGasper: Support OpenSSLs that lack
1277 SSL_get0_alpn_selected.
1278 - Fix #468: OpenSSL 1.0.1 can no longer build Unbound.
1279 - Further fix for #468: detect SSL_CTX_set_alpn_protos for build with
1281 - Fix that testcode dohclient has OpenSSL initialisation calls.
1283 13 April 2021: George
1284 - Fix documentation comment for files previously residing in checkconf/.
1285 - Remove unused functions worker_handle_reply and libworker_handle_reply.
1287 13 April 2021: Wouter
1288 - Fix that nxdomain synthesis does not happen above the stub or
1291 12 April 2021: George
1292 - Fix (increase) verbosity level for iterator error log in
1293 processQueryTargets().
1295 12 April 2021: Wouter
1296 - Fix permission denied sendto log, squelch the log messages
1297 unless high verbosity is set.
1299 9 April 2021: Wouter
1300 - rebuild configure to set EXTRALINK to libunbound.la for #460.
1302 7 April 2021: Wouter
1303 - Fix for #411: Depth protect for crash on deleted element timeout.
1305 1 April 2021: Wouter
1306 - Merge #460 from orbea: build: Link with the libtool archive.
1307 - Fix to stop IPv6 PMTU discovery.
1309 31 March 2021: George
1310 - Clean makedist.sh.
1312 31 March 2021: Wouter
1313 - Fix stack-protector change to not override other CFLAGS options.
1315 30 March 2021: George
1316 - Disable the use of stack-protector for cross compiled 32-bit windows
1317 builds; relates to #444.
1319 25 March 2021: Wouter
1320 - Fix #429: Also fix end of transfer for http download of auth zones.
1322 24 March 2021: Wouter
1323 - Fix deprecation test to work for iOS TVOS and WatchOS, it uses
1324 CFLAGS and CPPFLAGS and also checks if the item is unavailable.
1325 - Travis, fix script to fail when tasks fail.
1326 - Travis, fix warning in ubsan compile.
1327 - Fix configure Targetconfiditionals.h header check, to use compile.
1328 - Fix that cachedb does not produce empty object files when disabled.
1330 23 March 2021: Wouter
1331 - Travis enable all tests again. Clang analyzer only a couple times,
1332 when there is a difference. homebrew updates disabled, so it does
1333 not hang. removed trailing slashes from configure paths. Moved iOS
1334 tests to allow-failure.
1335 - travis, analyzer disabled on test without debug, that does not
1336 run anway. Turn off failing tests except one. Update iOS test
1337 to xcode image 12.2.
1339 22 March 2021: George
1340 - Fix unused-function warning when compiling with --enable-dnscrypt.
1341 - Fix for #367: fix memory leak when cannot bind to listening port.
1342 - Reformat pythonmod/pythonmod_utils.{c,h}.
1344 22 March 2021: Wouter
1345 - Merge #449 from orbea: build: Add missing linker flags.
1346 - iana portlist update.
1347 - Comment out nonworking OSX and IOS travis tests, vm fails to start.
1348 - Fix compile error in listen_dnsport on Android.
1349 - Fix memory leak reported by asan in rpz SOA record query name.
1351 19 March 2021: Wouter
1352 - Fix for #447: squelch connection refused tcp connection failures
1353 from the log, unless verbosity is high.
1355 17 March 2021: Wouter
1356 - Fix #441: Minimal NSEC range not accepted for top level domains.
1358 11 March 2021: Wouter
1359 - Fix parse of LOC RR type for decimetres.
1361 5 March 2021: Wouter
1362 - Workaround for #439: prevent loops in the reuse rbtree.
1363 - Debug output for #411 and #439: printout internal error and details.
1365 4 March 2021: Wouter
1366 - iana portlist update.
1367 - Fix spurious errors about "Could not generate request: out of
1368 memory". The mesh detect cycle routine no longer wrongly stops
1369 the check when the calling mesh state is unique.
1371 26 February 2021: George
1372 - Fix for #367: rc_ports don't have ub_sock; skip cleaning up.
1374 26 February 2021: Wouter
1375 - Fix: Resolve interface names on control-interface too.
1377 25 February 2021: Wouter
1378 - Merge PR #367 : DNSTAP log local address. With code from PR #365
1379 and fixes #368 : dnstap does not log the DNS message ID for
1381 - Fix to allow rpz with wildcard that applies to all TLDs at once.
1383 24 February 2021: George
1384 - Fix #384: (1) A minor request to improve the log (2) A minor bug in one
1386 - ipsecmod: Better logging for detecting a cycle when attaching the
1389 24 February 2021: Wouter
1390 - On startup of unbound it checks if rlimits on memory size look
1391 sufficient for the configured cache size, and logs warning if not.
1392 - Fix function documentation.
1393 - Fix unit test for added ulimit checks.
1394 - spelling fix in header.
1396 23 February 2021: Wouter
1397 - Fix for zonemd, that domain-insecure zones work without dnssec.
1398 - Fix for zonemd, do not reject insecure result from trust anchor
1399 validation step in dnssec chain of trust.
1401 22 February 2021: Wouter
1402 - Fix #431: Squelch permission denied errors for tcp connect
1403 and udp connect from the logs, unless at high verbosity.
1404 - Fix for zonemd, that nxdomain for the chain of trust is allowed
1405 for island zones, it is treated as an insecure zone for verification.
1407 18 February 2021: Wouter
1408 - Merge PR #317: ZONEMD Zone Verification, with RFC 8976 support.
1409 ZONEMD records are checked for zones loaded as auth-zone,
1410 with DNSSEC if available. There is an added option
1411 zonemd-permissive-mode that makes it log but not fail wrong zones.
1412 With zonemd-reject-absence for an auth-zone the presence of a
1413 zonemd can be mandated for specific zones.
1414 - Fix doxygen and pydoc warnings.
1415 - Fix #429: rpz: url: with https: broken (regression in 1.13.1).
1416 - rpz skip nsec3param records, and nicer log for unsupported actions.
1418 15 February 2021: Wouter
1419 - Fix #422: IPv6 fallback issues when IPv6 is not properly
1421 - Fix to make tests work with support indicators set for iterator.
1422 - Fix build on Python 3.10.
1424 10 February 2021: Wouter
1425 - Merge PR #420 from dyunwei: DOH not responsing with
1426 "http2_query_read_done failure" logged.
1428 9 February 2021: Wouter
1429 - Fix for Python 3.9, no longer use deprecated functions of
1430 PyEval_CallObject (now PyObject_Call), PyEval_InitThreads (now
1431 none), PyParser_SimpleParseFile (now Py_CompileString).
1433 4 February 2021: Wouter
1434 - release 1.13.1rc2 tag on branch-1.13.1 with added changes of 2 feb.
1435 This became 1.13.1 release tag on 9 feb. The main branch is set
1438 2 February 2021: Wouter
1439 - branch-1.13.1 is created, with release-1.13.1rc1 tag.
1440 - Fix dynlibmod link on rhel8 for -ldl inclusion.
1441 - Fix windows dependency on libssp.dll because of default stack
1443 - Fix indentation of root anchor for use by windows install script.
1445 1 February 2021: George
1446 - Attempt to fix NULL keys in the reuse_tcp tree; relates to #411.
1448 29 January 2021: Wouter
1449 - Fix for doxygen 1.8.20 compatibility.
1451 28 January 2021: Wouter
1452 - Annotate that we ignore the return value of if_indextoname.
1453 - Fix to use correct type for label count in rpz routine.
1454 - Fix empty clause warning in config_file nsid parse.
1455 - Fix to use correct type for label count in ipdnametoaddr rpz routine.
1456 - Fix empty clause warning in edns pass for padding.
1457 - Fix fwd ancil test post script when not supported.
1459 26 January 2021: George
1460 - Merge PR #408 from fobser: Prevent a few more yacc clashes.
1461 - Merge PR #275 from Roland van Rijswijk-Deij: Add feature to return the
1462 original instead of a decrementing TTL ('serve-original-ttl')
1463 - Merge PR #355 from noloader: Make ICANN Update CA and DS Trust Anchor
1465 - Ignore cache blacklisting when trying to reply with expired data from
1468 26 January 2021: Wouter
1469 - Fix compile of unbound-dnstap-socket without dnstap installed.
1471 22 January 2021: Willem
1472 - Padding of queries and responses with DNS over TLS as specified in
1473 RFC7830 and RFC8467.
1475 22 January 2021: George
1476 - Fix TTL of SOA record for negative answers (localzone and
1477 authzone data) to be the minimum of the SOA TTL and the SOA.MINIMUM.
1479 19 January 2021: Willem
1480 - Support for RFC5001: DNS Name Server Identifier (NSID) Option
1481 with the nsid: option in unbound.conf
1483 18 January 2021: Wouter
1484 - Fix #404: DNS query with small edns bufsize fail.
1485 - Fix declaration before statement and signed comparison warning in
1488 15 January 2021: Wouter
1489 - Merge #402 from fobser: Implement IPv4-Embedded addresses according
1492 14 January 2021: Wouter
1493 - Fix for #93: dynlibmodule import library is named libunbound.dll.a.
1495 13 January 2021: Wouter
1496 - Merge #399 from xiangbao227: The lock of lruhash table should
1497 unlocked after markdel entry.
1498 - Fix for #93: dynlibmodule link fix for Windows.
1500 12 January 2021: Wouter
1501 - Fix #397: [Feature request] add new type always_null to local-zone
1502 similar to always_nxdomain.
1503 - Fix so local zone types always_nodata and always_deny can be used
1504 from the config file.
1506 8 January 2021: Wouter
1507 - Merge PR #391 from fhriley: Add start_time to reply callbacks so
1508 modules can compute the response time.
1509 - For #391: use struct timeval* start_time for callback information.
1510 - For #391: fix indentation.
1511 - For #391: more double casts in python start time calculation.
1512 - Add comment documentation.
1513 - Fix clang analysis warning.
1515 6 January 2021: Wouter
1516 - Fix #379: zone loading over HTTP appears to have buffer issues.
1517 - Merge PR #395 from mptre: add missing null check.
1518 - Fix #387: client-subnet-always-forward seems to effectively bypass
1521 5 January 2021: Wouter
1522 - Fix #385: autoconf 2.70 impacts unbound build
1523 - Merge PR #375 by fhriley: Add rpz_enable and rpz_disable commands
1526 4 January 2021: Wouter
1527 - For #376: Fix that comm point event is not double removed or double
1529 - iana portlist updated.
1531 16 December 2020: George
1532 - Fix error cases when udp-connect is set and send() returns an error
1533 (modified patch from Xin Li @delphij).
1535 11 December 2020: Wouter
1536 - Fix #371: unbound-control timeout when Unbound is not running.
1537 - Fix to squelch permission denied and other errors from remote host,
1538 they are logged at higher verbosity but not on low verbosity.
1539 - Merge PR #335 from fobser: Sprinkle in some static to prevent
1540 missing prototype warnings.
1541 - Merge PR #373 from fobser: Warning: arithmetic on a pointer to void
1543 - Fix missing prototypes in the code.
1545 3 December 2020: Wouter
1547 - iana portlist updated.
1549 2 December 2020: Wouter
1550 - Fix #360: for the additionally reported TCP Fast Open makes TCP
1551 connections fail, in that case we print a hint that this is
1552 happening with the error in the logs.
1553 - Fix #356: deadlock when listening tcp.
1554 - Fix unbound-dnstap-socket to not use log routine from interrupt
1555 handler and not print so frequently when invoked in sequence.
1556 - Fix on windows to ignore connection failure on UDP, unless verbose.
1557 - Fix for #283: fix stream reuse and tcp fast open.
1558 - Fix update, with write event check with streamreuse and fastopen.
1560 1 December 2020: Wouter
1561 - Fix #358: Squelch udp connect 'no route to host' errors on low
1564 30 November 2020: Wouter
1565 - Fix assertion failure on double callback when iterator loses
1566 interest in query at head of line that then has the tcp stream
1568 - tag for the 1.13.0rc4 release. This also became the 1.13.0
1569 release version on 3 dec 2020 with the streamreuse and fastopen
1570 fix from 2 dec 2020. The code repo continues for 1.13.1 in
1573 27 November 2020: Wouter
1574 - Fix compile warning for type cast in http2_submit_dns_response.
1575 - Fix when use free buffer to initialize rbtree for stream reuse.
1576 - Fix compile warnings for windows.
1577 - Fix compile warnings in rpz initialization.
1578 - Fix contrib/metrics.awk for FreeBSD awk compatibility.
1579 - tag for the 1.13.0rc3 release.
1581 26 November 2020: Wouter
1582 - Fix to omit UDP receive errors from log, if verbosity low.
1583 These happen because of udp-connect.
1584 - For #352: contrib/metrics.awk for Prometheus style metrics output.
1585 - Fix that after failed read, the readagain cannot activate.
1586 - Clear readagain upon decommission of pending tcp structure.
1588 25 November 2020: Wouter
1589 - with udp-connect ignore connection refused with UDP timeouts.
1590 - Fix udp-connect on FreeBSD, do send calls on connected UDP socket.
1591 - Better fix for reuse tree comparison for is-tls sockets. Where
1592 the tree key identity is preserved after cleanup of the TLS state.
1593 - Remove debug commands from reuse tests.
1594 - Fix memory leak for edns client tag opcode config element.
1595 - Attempt fix for libevent state in tcp reuse cases after a packet
1597 - Fix readagain and writeagain callback functions for comm point
1599 - tag for the 1.13.0rc2 release.
1601 24 November 2020: Wouter
1602 - Merge PR #283 : Stream reuse. This implements upstream stream
1603 reuse for performing several queries over the same TCP or TLS
1605 - set version of main branch to 1.13.0 for upcoming release.
1606 - iana portlist updated.
1607 - Fix one port unit test for udp-connect.
1608 - tag for the 1.13.0rc1 release.
1609 - Fix crash when TLS connection is closed prematurely, when
1610 reuse tree comparison is not properly identical to insertion.
1611 - Fix padding of struct regional for 32bit systems.
1613 23 November 2020: George
1614 - Merge PR #313 from Ralph Dolmans: Replace edns-client-tag with
1615 edns-client-string option.
1617 23 November 2020: Wouter
1618 - Merge #351 from dvzrv: Add AF_NETLINK to set of allowed socket
1620 - Fix #350: with the AF_NETLINK permission, to fix 1.12.0 error:
1621 failed to list interfaces: getifaddrs: Address family not
1622 supported by protocol.
1623 - Fix #347: IP_DONTFRAG broken on Apple xcode 12.2.
1624 - Option to toggle udp-connect, default is enabled.
1625 - Fix for #303 CVE-2020-28935 : Fix that symlink does not interfere
1626 with chown of pidfile.
1627 - Further fix for it and retvalue 0 fix for it.
1629 12 November 2020: Wouter
1630 - Fix to connect() to UDP destinations, default turned on,
1631 this lowers vulnerability to ICMP side channels.
1632 - Retry for interfaces with unused ports if possible.
1634 10 November 2020: Wouter
1635 - Fix #341: fixing a possible memory leak.
1636 - Fix memory leak after fix for possible memory leak failure.
1637 - Fix #343: Fail to build --with-libnghttp2 with error: 'SSIZE_MAX'
1640 27 October 2020: Wouter
1641 - In man page note that tls-cert-bundle is read before permission
1644 22 October 2020: Wouter
1645 - Fix #333: Unbound Segmentation Fault w/ log_info Functions From
1647 - Fix that minimal-responses does not remove addresses from a priming
1650 21 October 2020: George
1651 - Fix #327: net/if.h check fails on some darwin versions; contribution by
1653 - Fix #320: potential memory corruption due to size miscomputation upton
1654 custom region alloc init.
1656 21 October 2020: Wouter
1657 - Merge PR #228 : infra-keep-probing option to probe hosts that are
1658 down. Add infra-keep-probing: yes option. Hosts that are down are
1659 probed more frequently.
1660 With the option turned on, it probes about every 120 seconds,
1661 eventually after exponential backoff, and that keeps that way. If
1662 traffic keeps up for the domain. It probes with one at a time, eg.
1663 one query is allowed to probe, other queries within that 120 second
1664 interval are turned away.
1666 19 October 2020: George
1667 - Merge PR #324 from James Renken: Add modern X.509v3 extensions to
1668 unbound-control TLS certificates.
1669 - Fix for PR #324 to attach the x509v3 extensions to the client
1672 19 October 2020: Ralph
1673 - local-zone regional allocations outside of chunk
1675 19 October 2020: Wouter
1676 - Fix that http settings have colon in set_option, for
1677 http-endpoint, http-max-streams, http-query-buffer-size,
1678 http-response-buffer-size, and http-nodelay.
1679 - Fix memory leak of https port string when reading config.
1680 - Fix #330: [Feature request] Add unencrypted DNS over HTTPS support.
1681 This adds the option http-notls-downstream: yesno to change that,
1682 and the dohclient test code has the -n option.
1683 - Fix python documentation warning on functions.rst inplace_cb_reply.
1684 - Fix dnstap test to wait for log timer to see if queries are logged.
1685 - Log ip address when http session recv fails, eg. due to tls fail.
1686 - Fix to set the tcp handler event toggle flag back to default when
1687 the handler structure is reused.
1688 - Clean the fix for out of order TCP processing limits on number
1689 of queries. It was tested to work.
1691 16 October 2020: Wouter
1692 - Fix that the out of order TCP processing does not limit the
1693 number of outstanding queries over a connection.
1695 15 October 2020: George
1696 - Fix that if there are reply callbacks for the given rcode, those
1697 are called per reply and a new message created if that was modified
1699 - Pass the comm_reply information to the inplace_cb_reply* functions
1700 during the mesh state and update the documentation on that.
1702 15 October 2020: Wouter
1703 - Merge PR #326 from netblue30: DoH: implement content-length
1705 - DoH content length, simplify code, remove declaration after
1706 statement and fix cast warning.
1708 14 October 2020: Wouter
1709 - Fix for python reply callback to see mesh state reply_list member,
1710 it only removes it briefly for the commpoint call so that it does
1711 not drop it and attempt to modify the reply list during reply.
1712 - Fix that if there are on reply callbacks, those are called per
1713 reply and a new message created if that was modified by the call.
1714 - Free up auth zone parse region after use for lookup of host
1716 13 October 2020: Wouter
1717 - Fix #323: unbound testsuite fails on mock build in systemd-nspawn
1718 if systemd support is build.
1720 9 October 2020: Wouter
1721 - Fix dnstap socket and the chroot not applied properly to the dnstap
1723 - Fix warning in libnss compile, nss_buf2dsa is not used without DSA.
1725 8 October 2020: Wouter
1726 - Tag for 1.12.0 release.
1727 - Current repo is version 1.12.1 in development.
1728 - Fix #319: potential memory leak on config failure, in rpz config.
1730 1 October 2020: Wouter
1731 - Current repo is version 1.12.0 for release. Tag for 1.12.0rc1.
1733 30 September 2020: Wouter
1734 - Fix doh tests when not compiled in.
1735 - Add dohclient test executable to gitignore.
1736 - Fix stream_ssl, ssl_req_order and ssl_req_timeout tests for
1737 alloc check debug output.
1738 - Easier kill of unbound-dnstap-socket tool in test.
1739 - Fix memory leak of edns tags at libunbound context delete.
1740 - Fix double loopexit for unbound-dnstap-socket after sigterm.
1742 29 September 2020: Ralph
1743 - DNS Flag Day 2020: change edns-buffer-size default to 1232.
1745 28 September 2020: Wouter
1746 - Fix unit test for dnstap changes, so that it waits for the timer.
1748 23 September 2020: Wouter
1749 - Fix #305: dnstap logging significantly affects unbound performance
1750 (regression in 1.11).
1751 - Fix #305: only wake up thread when threshold reached.
1752 - Fix to ifdef fptr wlist item for dnstap.
1754 23 September 2020: Ralph
1755 - Fix edns-client-tags get_option typo
1756 - Add edns-client-tag-opcode option
1757 - Use inclusive language in configuration
1759 21 September 2020: Ralph
1760 - Fix #304: dnstap logging not recovering after dnstap process restarts
1762 21 September 2020: Wouter
1763 - Merge PR #311 by luismerino: Dynlibmod leak.
1764 - Error message is logged for dynlibmod malloc failures.
1765 - iana portlist updated.
1767 18 September 2020: Wouter
1768 - Fix that prefer-ip4 and prefer-ip6 can be get and set with
1769 unbound-control, with libunbound and the unbound-checkconf option
1771 - iana portlist updated.
1773 15 September 2020: George
1774 - Introduce test for statistics.
1776 15 September 2020: Wouter
1779 11 September 2020: Wouter
1780 - Remove x file mode on ipset/ipset.c and h files.
1782 9 September 2020: Wouter
1783 - Fix num.expired statistics output.
1785 31 August 2020: Wouter
1786 - Merge PR #293: Add missing prototype. Also refactor to use the new
1787 shorthand function to clean up the code.
1788 - Refactor to use sock_strerr shorthand function.
1789 - Fix #296: systemd nss-lookup.target is reached before unbound can
1790 successfully answer queries. Changed contrib/unbound.service.in.
1792 27 August 2020: Wouter
1793 - Similar to NSD PR#113, implement that interface names can be used,
1794 eg. something like interface: eth0 is resolved at server start and
1795 uses the IP addresses for that named interface.
1796 - Review fix, doxygen and assign null in case of error free.
1798 26 August 2020: George
1799 - Update documentation in python example code.
1801 24 August 2020: Wouter
1802 - Fix that dnstap reconnects do not spam the log with the repeated
1803 attempts. Attempts on the timer are only logged on high verbosity,
1804 if they produce a connection failure error.
1805 - Fix to apply chroot to dnstap-socket-path, if chroot is enabled.
1806 - Change configure to use EVP_sha256 instead of HMAC_Update for
1809 20 August 2020: Ralph
1810 - Fix stats double count issue (#289).
1812 13 August 2020: Ralph
1813 - Create and init edns tags data for libunbound.
1815 10 August 2020: Ralph
1816 - Merge (modified) PR #277, use EVP_MAC_CTX_set_params if available,
1819 10 August 2020: Wouter
1820 - Fix #287: doc typo: "Additionaly".
1823 6 August 2020: Wouter
1824 - Merge PR #284 and Fix #246: Remove DLV entirely from Unbound.
1825 The DLV has been decommisioned and in unbound 1.5.4, in 2015, there
1826 was advise to stop using it. The current code base does not contain
1827 DLV code any more. The use of dlv options displays a warning.
1829 5 August 2020: Wouter
1830 - contrib/aaaa-filter-iterator.patch file renewed diff content to
1831 apply cleanly to the current coderepo for the current code version.
1833 5 August 2020: Ralph
1834 - Merge PR #272: Add EDNS client tag functionality.
1836 4 August 2020: George
1837 - Improve error log message when inserting rpz RR.
1838 - Merge PR #280, Make tvOS & watchOS checks verify truthiness as well as
1839 definedness, by Felipe Gasper.
1841 4 August 2020: Wouter
1842 - Fix mini_event.h on OpenBSD cannot find fd_set.
1844 31 July 2020: Wouter
1845 - Fix doxygen comment for no ssl for tls session ticket key callback
1848 27 July 2020: George
1849 - Merge PR #268, draft-ietf-dnsop-serve-stale-10 has become RFC 8767 on
1850 March 2020, by and0x000.
1853 - Merge PR #269, Fix python module len() implementations, by Torbjörn
1856 27 July 2020: Wouter
1857 - branch now named 1.11.1. 1.11.0rc1 became the 1.11.0 release.
1858 - Merge PR #270 from cgzones: munin plugin: always exit 0 in autoconf
1860 20 July 2020: Wouter
1861 - Fix streamtcp to print packet data to stdout. This makes the
1862 stdout and stderr not mix together lines, when parsing its output.
1863 - Fix contrib/fastrpz.patch to apply cleanly. It fixes for changes
1864 due to added libdynmod, but it does not compile, it conflicts with
1866 - branch now named 1.11.0 and 1.11.0rc1 tag.
1868 17 July 2020: Wouter
1869 - Fix libnettle compile for session ticket key callback function
1871 - Fix lock dependency cycle in rpz zone config setup.
1874 - Merge PR #234 - Ensure proper alignment of cmsg buffers by Jérémie
1876 - Fix PR #234 log_assert sizeof to use union buffer.
1878 16 July 2020: Wouter
1879 - Fix check conf test for referencing installation paths.
1880 - Fix unused variable warning for clang analyzer.
1882 16 July 2020: George
1883 - Introduce 'include-toplevel:' configuration option.
1886 - Add bidirectional frame streams support.
1889 - Fix add missing DSA header, for compilation without deprecated
1891 - Fix to use SSL_CTX_set_tlsext_ticket_key_evp_cb in OpenSSL
1893 - Longer keys for the test set, this avoids weak crypto errors.
1896 - Fix #259: Fix unbound-checkconf does not check view existence.
1897 unbound-checkconf checks access-control-view, access-control-tags,
1898 access-control-tag-actions and access-control-tag-datas.
1899 - Fix offset of error printout for access-control-tag-datas.
1900 - Review fixes for checkconf #259 change.
1903 - run_vm cleanup better and removes trailing slash on single argument.
1905 29 June 2020: Wouter
1906 - Move reply list clean for serve expired mesh callback to after
1907 the reply is sent, so that script callbacks have reply_info.
1908 - Also move reply list clean for mesh callbacks to the scrip callback
1909 can see the reply_info.
1910 - Fix for mesh accounting if the reply list already empty to begin
1912 - Fix for mesh accounting when rpz decides to drop a reply with a
1913 tcp stream waiting for it.
1914 - Review fix for number of detached states due to use of variable
1916 - Fix tcp req info drop due to size call into mesh accounting
1917 removal of mesh state during mesh send reply.
1919 24 June 2020: Wouter
1920 - iana portlist updated.
1921 - doxygen file comments for dynlibmodule.
1923 17 June 2020: Wouter
1924 - Fix default explanation in man page for qname-minimisation-strict.
1925 - Fix display of event loop method with libev.
1928 - Mention tls name possible when tls is enabled for stub-addr in the
1932 - Merge PR #241 by Robert Edmonds: contrib/libunbound.pc.in: Do not use
1936 - Update contrib/aaaa-filter-iterator.patch for the recent
1937 generate_sub_request() change and to apply cleanly.
1940 - Fix for integer overflow when printing RDF_TYPE_TIME.
1943 - CVE-2020-12662 Unbound can be tricked into amplifying an incoming
1944 query into a large number of queries directed to a target.
1945 - CVE-2020-12663 Malformed answers from upstream name servers can be
1946 used to make Unbound unresponsive.
1947 - Release 1.10.1 is 1.10.0 with fixes, code repository continues,
1948 including those fixes, towards the next release. Configure has
1949 version 1.10.2 version number in it.
1950 - For PR #93: windows compile warnings removal
1951 - windows compile warnings removal for ip dscp option code.
1952 - For PR #93: unit test for dynlib module.
1955 - For PR #93: dynlibmod can handle reloads and deinit and inits again,
1956 with dlclose and dlopen of the library again. Also for multiple
1957 modules. Fix memory leak by not closing dlopened content. Fix
1958 to allow one dynlibmod instance by unbound-checkconf.
1959 - For PR #93: checkconf allows multiple dynlib in module-config, for
1961 - For PR #93: checkconf allows python dynlib in module-config, for
1963 - For PR #93: man page spelling reference fix.
1964 - For PR #93: fix link of other executables for dynlibmod dependency.
1967 - Merge PR #93: Add dynamic library support.
1968 - Fixed conflicts for PR #93 and make configure, yacc, lex.
1969 - For PR #93: Fix warnings for dynlibmodule.
1972 - Cache ECS answers with longest scope of CNAME chain.
1974 22 April 2020: George
1975 - Explicitly use 'rrset-roundrobin: no' for test cases.
1977 21 April 2020: Wouter
1978 - Merge #225 from akhait: KSK-2010 has been revoked. It removes the
1979 KSK-2010 from the default list in unbound-anchor, now that the
1980 revocation period is over. KSK-2017 is the only trust anchor in
1981 the shipped default now.
1983 21 April 2020: George
1984 - Change default value for 'rrset-roundrobin' to yes.
1985 - Fix tests for new rrset-roundrobin default.
1987 20 April 2020: Wouter
1988 - Fix #222: --enable-rpath, fails to rpath python lib.
1989 - Fix for count of reply states in the mesh.
1990 - Remove unneeded was_mesh_reply check.
1992 17 April 2020: George
1993 - Add SNI support on more TLS connections (fixes #193).
1994 - Add SNI support to unbound-anchor.
1996 16 April 2020: George
1997 - Add doxygen documentation for DSCP.
1999 16 April 2020: Wouter
2000 - Fix help return code in unbound-control-setup script.
2001 - Fix for posix shell syntax for trap in nsd-control-setup.
2002 - Fix for posix shell syntax for trap in run_msg.sh test script.
2004 15 April 2020: George
2005 - Fix #220: auth-zone section in config may lead to segfault.
2007 7 April 2020: Wouter
2008 - Merge PR #214 from gearnode: unbound-control-setup recreate
2009 certificates. With the -r option the certificates are created
2010 again, without it, only the files that do not exist are created.
2013 - Keep track of number of timeouts. Use this counter to determine if
2014 capsforid fallback should be started.
2016 6 April 2020: George
2017 - More documentation for redis-expire-records option.
2019 1 April 2020: George
2020 - Merge PR #206: Redis TTL, by Talkabout.
2022 30 March 2020: Wouter
2023 - Merge PR #207: Clarify if-automatic listens on 0.0.0.0 and ::
2024 - Merge PR #208: Fix uncached CLIENT_RESPONSE'es on stateful
2027 27 March 2020: Wouter
2028 - Merge PR #203 from noloader: Update README-Travis.md with current
2031 27 March 2020: Ralph
2032 - Make unbound-control error returned on missing domain name more user
2035 26 March 2020: Ralph
2036 - Fix RPZ concurrency issue when using auth_zone_reload.
2038 25 March 2020: George
2039 - Merge PR #201 from noloader: Fix OpenSSL cross-compaile warnings.
2042 24 March 2020: Wouter
2043 - Merge PR #200 from yarikk: add ip-dscp option to specify the DSCP
2044 tag for outgoing packets.
2046 - Travis fix for ios by omitting tools from install.
2048 23 March 2020: Wouter
2049 - Fix compile on Solaris for unbound-checkconf.
2051 20 March 2020: George
2052 - Merge PR #198 from fobser: Declare lz_enter_rr_into_zone() static, it's
2053 only used in this file.
2055 20 March 2020: Wouter
2056 - Merge PR #197 from fobser: Make log_ident_revert_to_default() a
2059 19 March 2020: Ralph
2060 - Merge PR#191: Update iOS testing on Travis, by Jeffrey Walton.
2061 - Fix #158: open tls-session-ticket-keys as binary, for Windows. By
2063 - Merge PR#134, Allow the kernel to provide random source ports. By
2065 - Log warning when using outgoing-port-permit and outgoing-port-avoid
2066 while explicit port randomisation is disabled.
2067 - Merge PR#194: Add libevent testing to Travis, by Jeffrey Walton.
2068 - Fix .travis.yml error, missing 'env' option.
2070 16 March 2020: Wouter
2071 - Fix #192: In the unbound-checkconf tool, the module config of
2072 dns64 subnetcache respip validator iterator is whitelisted, it was
2073 reported it seems to work.
2075 12 March 2020: Wouter
2076 - Fix compile of test tools without protobuf.
2078 11 March 2020: Ralph
2079 - Add check to make sure RPZ records are subdomains of configured
2082 11 March 2020: George
2083 - Fix #189: mini_event.h:142:17: error: field 'ev_timeout' has incomplete
2085 - Changelog entry for (Fix #189, Merge PR #190).
2087 11 March 2020: Wouter
2088 - Fix #188: unbound-control.c:882:6: error: 'execlp' is
2089 unavailable: not available on tvOS.
2091 6 March 2020: George
2092 - Merge PR #186, fix #183: Fix unrecognized 'echo -n' option on OS X, by
2095 5 March 2020: Wouter
2096 - Fix PR #182 from noloader: Add iOS testing to Travis.
2099 - Update README-Travis.md (from PR #179), by Jeffrey Walton.
2101 4 March 2020: George
2102 - Merge PR #181 from noloader: Fix OpenSSL -pie warning on Android.
2104 4 March 2020: Wouter
2105 - Merge PR #180 from noloader: Avoid calling exit in Travis script.
2107 3 March 2020: George
2108 - Upgrade config.guess(2020-01-01) and config.sub(2020-01-01).
2111 - Fix #175, Merge PR #176: fix link error when OpenSSL is configured
2112 with no-engine, thanks noloader.
2114 2 March 2020: George
2115 - Fix compiler warning in dns64/dns64.c
2116 - Merge PR #174: Add Android to Travis testing, by noloader.
2117 - Move android build scripts to contrib/ and allow android tests to fail.
2119 2 March 2020: Wouter
2120 - Fix #177: dnstap does not build on macOS.
2122 28 February 2020: Ralph
2123 - Merge PR #172: Add IBM s390x arch for testing, by noloader.
2125 28 February 2020: Wouter
2126 - Merge PR #173: updated makedist.sh for config.guess and
2127 config.sub and sha256 digest for gpg, by noloader.
2128 - Merge PR #164: Framestreams, this branch implements dnstap
2129 unidirectional connectivity in unbound. This has a number of
2132 The dependency on libfstrm is removed. The fstrm protocol code
2133 resides in dnstap/dnstap_fstrm.h and dnstap/dnstap_fstrm.c. This
2134 contains a brief definition of what unbound needs.
2136 The make unbound-dnstap-socket builds a debug tool,
2137 unbound-dnstap-socket. It can listen, accept multiple DNSTAP
2138 streams and print information. Commandline options control it.
2140 Unbound can reconnect if the unix domain socket file socket is
2141 closed. This uses exponential backoff after which it uses a
2142 one second timer to throttle cpu down. There is also support
2143 to use TCP and TLS for connecting to the log server. There
2144 are new config options to turn them on, in the dnstap section
2145 in the man page and example config file. dnstap-ip with IP
2146 address of server for TCP or TLS use. dnstap-tls to turn
2147 on TLS. And dnstap-tls-server-name, dnstap-tls-cert-bundle,
2148 dnstap-tls-client-key-file and dnstap-tls-client-cert-file
2149 to configure the certificates for server authentication and
2150 client authentication, or leave at "" to not use that.
2152 27 February 2020: George
2153 - Merge PR #171: Add additional compilers and platforms to Travis
2154 testing, by noloader.
2156 27 February 2020: Wouter
2157 - Fix #169: Fix warning for daemon/remote.c output may be truncated
2159 - Fix #170: Fix gcc undefined sanitizer signed integer overflow
2160 warning in signature expiry RFC1982 serial number arithmetic.
2161 - Fix more undefined sanitizer issues, in respip copy_rrset null
2162 dname, and in the client_info_compare routine for null memcmp.
2164 26 February 2020: Wouter
2165 - iana portlist updated.
2167 25 February 2020: Wouter
2168 - Fix #165: Add prefer-ip4: yesno config option to prefer ipv4 for
2169 using ipv4 filters, because the hosts ip6 netblock /64 is not owned
2170 by one operator, and thus reputation is shared.
2172 24 February 2020: George
2173 - Merge PR #166: Fix typo in unbound.service.in, by glitsj16.
2175 20 February 2020: Wouter
2176 - Updated contrib/unbound_smf23.tar.gz with Solaris SMF service for
2177 Unbound from Yuri Voinov.
2178 - master branch has 1.10.1 version.
2180 18 February 2020: Wouter
2181 - protect X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS with ifdef for
2182 different openssl versions.
2184 17 February 2020: Wouter
2185 - changelog point where the tag for 1.10.0rc2 release is. And with
2186 the unbound_smf23 commit added to it, that is the 1.10.0 release.
2188 17 February 2020: Ralph
2189 - Add respip to supported module-config options in unbound-checkconf.
2191 17 February 2020: George
2192 - Remove unused variable.
2194 17 February 2020: Wouter
2195 - contrib/drop2rpz: perl script that converts the Spamhaus DROP-List
2196 in RPZ-Format, contributed by Andreas Schulze.
2198 14 February 2020: Wouter
2199 - Fix spelling in unbound.conf.5.in.
2200 - Stop unbound-checkconf from insisting that auth-zone and rpz
2201 zonefiles have to exist. They can not exist, and download later.
2203 13 February 2020: Wouter
2204 - tag for 1.10.0rc1 release.
2206 12 February 2020: Wouter
2207 - Fix with libnettle make test with dsa disabled.
2208 - Fix contrib/fastrpz.patch to apply cleanly. Fix for serve-stale
2209 fixes, but it does not compile, conflicts with new rpz code.
2210 - Fix to clean memory leak of respip_addr.lock when ip_tree deleted.
2211 - Fix compile warning when threads disabled.
2212 - updated version number to 1.10.0.
2214 10 February 2020: George
2215 - Document 'ub_result.was_ratelimited' in libunbound.
2216 - Fix use after free on log-identity after a reload; Fixes #163.
2218 6 February 2020: George
2219 - Fix num_reply_states and num_detached_states counting with
2220 serve_expired_callback.
2221 - Cleaner code in mesh_serve_expired_lookup.
2222 - Document in unbound.conf manpage that configuration clauses can be
2223 repeated in the configuration file.
2225 6 February 2020: Wouter
2226 - Fix num_reply_addr counting in mesh and tcp drop due to size
2227 after serve_stale commit.
2228 - Fix to create and destroy rpz_lock in auth_zones structure.
2229 - Fix to lock zone before adding rpz qname trigger.
2230 - Fix to lock and release once in mesh_serve_expired_lookup.
2231 - Fix to put braces around empty if body when threading is disabled.
2233 5 February 2020: George
2234 - Added serve-stale functionality as described in
2235 draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used
2236 to configure the behavior.
2237 - Updated cachedb to honor `serve-expired-ttl`; Fixes #107.
2238 - Renamed statistic `num.zero_ttl` to `num.expired` as expired replies
2239 come with a configurable TTL value (`serve-expired-reply-ttl`).
2240 - Fixed stats when replying with cached, cname-aliased records.
2241 - Added missing default values for redis cachedb backend.
2243 3 February 2020: Ralph
2244 - Add assertion to please static analyzer
2246 31 January 2020: Wouter
2247 - Fix fclose on error in TLS session ticket code.
2249 30 January 2020: Ralph
2250 - Fix memory leak in error condition remote.c
2251 - Fix double free in error condition view.c
2252 - Fix memory leak in do_auth_zone_transfer on success
2253 - Merge RPZ support into master. Only QNAME and Response IP triggers are
2255 - Stop working on socket when socket() call returns an error.
2256 - Check malloc return values in TLS session ticket code
2258 30 January 2020: Wouter
2259 - Fix subnet tests for disabled DSA algorithm by default.
2260 - Update contrib/fastrpz.patch for clean diff with current code.
2261 - Merge PR#151: Fixes for systemd units, by Maryse47, Edmonds
2262 and Frzk. Updates the unbound.service systemd file and adds
2263 a portable systemd service file.
2264 - updated .gitignore for added contrib file.
2265 - Add build rule for ipset to Makefile
2266 - Add getentropy_freebsd.o to Makefile dependencies.
2268 29 January 2020: Ralph
2269 - Merge PR#156 from Alexander Berkes; Added unbound-control
2270 view_local_datas_remove command.
2272 29 January 2020: Wouter
2273 - Fix #157: undefined reference to `htobe64'.
2275 28 January 2020: Ralph
2276 - Merge PR#147; change rfc reference for reserved top level dns names.
2278 28 January 2020: Wouter
2279 - iana portlist updated.
2280 - Fix to silence the tls handshake errors for broken pipe and reset
2281 by peer, unless verbosity is set to 2 or higher.
2283 27 January 2020: Ralph
2284 - Merge PR#154; Allow use of libbsd functions with configure option
2285 --with-libbsd. By Robert Edmonds and Steven Chamberlain.
2286 - Merge PR#148; Add some TLS stats to unbound_munin_. By Fredrik Pettai.
2288 27 January 2020: Wouter
2289 - Merge PR#155 from Robert Edmonds: contrib/libunbound.pc.in: Fixes
2290 to Libs/Requires for crypto library dependencies.
2291 - Fix #153: Disable validation for DSA algorithms. RFC 8624
2294 23 January 2020: Wouter
2295 - Merge PR#150 from Frzk: Systemd unit without chroot. It add
2296 contrib/unbound_nochroot.service.in, a systemd file for use with
2297 chroot: "", see comments in the file, it uses systemd protections
2300 14 January 2020: Wouter
2301 - Removed the dnscrypt_queries and dnscrypt_queries_chacha tests,
2302 because dnscrypt-proxy (2.0.36) does not support the test setup
2303 any more, and also the config file format does not seem to have
2304 the appropriate keys to recreate that setup.
2305 - Fix crash after reload where a stats lookup could reference old key
2306 cache and neg cache structures.
2307 - Fix for memory leak when edns subnet config options are read when
2308 compiled without edns subnet support.
2309 - Fix auth zone support for NSEC3 records without salt.
2311 10 January 2020: Wouter
2312 - Fix the relationship between serve-expired and prefetch options,
2313 patch from Saksham Manchanda from Secure64.
2314 - Fix unreachable code in ssl set options code.
2316 8 January 2020: Ralph
2317 - Fix #138: stop binding pidfile inside chroot dir in systemd service
2320 8 January 2020: Wouter
2321 - Fix 'make test' to work for --disable-sha1 configure option.
2322 - Fix out-of-bounds null-byte write in sldns_bget_token_par while
2323 parsing type WKS, reported by Luis Merino from X41 D-Sec.
2324 - Updated sldns_bget_token_par fix for also space for the zero
2325 delimiter after the character. And update for more spare space.
2327 6 January 2020: George
2328 - Downgrade compat/getentropy_solaris.c to version 1.4 from OpenBSD.
2329 The dl_iterate_phdr() function introduced in newer versions raises
2330 compilation errors on solaris 10.
2331 - Changes to compat/getentropy_solaris.c for,
2332 ifdef stdint.h inclusion for older systems.
2333 ifdef sha2.h inclusion for older systems.
2335 6 January 2020: Wouter
2336 - Merge #135 from Florian Obser: Use passed in neg and key cache
2338 - Fix #140: Document slave not downloading new zonefile upon update.
2340 16 December 2019: George
2341 - Update mailing list URL.
2343 12 December 2019: Ralph
2344 - Master is 1.9.7 in development.
2345 - Fix typo to let serve-expired-ttl work with ub_ctx_set_option(), by
2348 10 December 2019: Wouter
2349 - Fix to make auth zone IXFR to fallback to AXFR if a single
2350 response RR is received over TCP with the SOA in it.
2352 6 December 2019: Wouter
2353 - Fix ipsecmod compile.
2354 - Fix Makefile.in for ipset module compile, from Adi Prasaja.
2355 - release-1.9.6 tag, which became the 1.9.6 release
2357 5 December 2019: Wouter
2358 - unbound-fuzzers.tar.bz2: three programs for fuzzing, that are 1:1
2359 replacements for unbound-fuzzme.c that gets created after applying
2360 the contrib/unbound-fuzzme.patch. They are contributed by
2361 Eric Sesterhenn from X41 D-Sec.
2364 4 December 2019: Wouter
2365 - Fix lock type for memory purify log lock deletion.
2366 - Fix testbound for alloccheck runs, memory purify and lock checks.
2367 - update contrib/fastrpz.patch to apply more cleanly.
2368 - Fix Make Test Fails when Configured With --enable-alloc-nonregional,
2369 reported by X41 D-Sec.
2371 3 December 2019: Wouter
2372 - Merge pull request #124 from rmetrich: Changed log lock
2373 from 'quick' to 'basic' because this is an I/O lock.
2374 - Fix text around serial arithmatic used for RRSIG times to refer
2375 to correct RFC number.
2376 - Fix Assert Causing DoS in synth_cname(),
2377 reported by X41 D-Sec.
2378 - Fix similar code in auth_zone synth cname to add the extra checks.
2379 - Fix Assert Causing DoS in dname_pkt_copy(),
2380 reported by X41 D-Sec.
2381 - Fix OOB Read in sldns_wire2str_dname_scan(),
2382 reported by X41 D-Sec.
2383 - Fix Out of Bounds Write in sldns_str2wire_str_buf(),
2384 reported by X41 D-Sec.
2385 - Fix Out of Bounds Write in sldns_b64_pton(),
2386 fixed by check in sldns_str2wire_int16_data_buf(),
2387 reported by X41 D-Sec.
2388 - Fix Insufficient Handling of Compressed Names in dname_pkt_copy(),
2389 reported by X41 D-Sec.
2390 - Fix Out of Bound Write Compressed Names in rdata_copy(),
2391 reported by X41 D-Sec.
2392 - Fix Hang in sldns_wire2str_pkt_scan(),
2393 reported by X41 D-Sec.
2394 This further lowers the max to 256.
2395 - Fix snprintf() supports the n-specifier,
2396 reported by X41 D-Sec.
2397 - Fix Bad Indentation, in dnscrypt.c,
2398 reported by X41 D-Sec.
2399 - Fix Client NONCE Generation used for Server NONCE,
2400 reported by X41 D-Sec.
2401 - Fix compile error in dnscrypt.
2402 - Fix _vfixed not Used, removed from sbuffer code,
2403 reported by X41 D-Sec.
2404 - Fix Hardcoded Constant, reported by X41 D-Sec.
2407 2 December 2019: Wouter
2408 - Merge pull request #122 from he32: In tcp_callback_writer(),
2409 don't disable time-out when changing to read.
2411 22 November 2019: George
2412 - Fix compiler warnings.
2414 22 November 2019: Wouter
2415 - Fix dname loop maximum, reported by Eric Sesterhenn from X41 D-Sec.
2416 - Add make distclean that removes everything configure produced,
2417 and make maintainer-clean that removes bison and flex output.
2419 20 November 2019: Wouter
2420 - Fix Out of Bounds Read in rrinternal_get_owner(),
2421 reported by X41 D-Sec.
2422 - Fix Race Condition in autr_tp_create(),
2423 reported by X41 D-Sec.
2424 - Fix Shared Memory World Writeable,
2425 reported by X41 D-Sec.
2426 - Adjust unbound-control to make stats_shm a read only operation.
2427 - Fix Weak Entropy Used For Nettle,
2428 reported by X41 D-Sec.
2429 - Fix Randomness Error not Handled Properly,
2430 reported by X41 D-Sec.
2431 - Fix Out-of-Bounds Read in dname_valid(),
2432 reported by X41 D-Sec.
2433 - Fix Config Injection in create_unbound_ad_servers.sh,
2434 reported by X41 D-Sec.
2435 - Fix Local Memory Leak in cachedb_init(),
2436 reported by X41 D-Sec.
2437 - Fix Integer Underflow in Regional Allocator,
2438 reported by X41 D-Sec.
2439 - Upgrade compat/getentropy_linux.c to version 1.46 from OpenBSD.
2440 - Synchronize compat/getentropy_win.c with version 1.5 from
2441 OpenBSD, no changes but makes the file, comments, identical.
2442 - Upgrade compat/getentropy_solaris.c to version 1.13 from OpenBSD.
2443 - Upgrade compat/getentropy_osx.c to version 1.12 from OpenBSD.
2444 - Changes to compat/getentropy files for,
2445 no link to openssl if using nettle, and hence config.h for
2446 HAVE_NETTLE variable.
2447 compat definition of MAP_ANON, for older systems.
2448 ifdef stdint.h inclusion for older systems.
2449 ifdef sha2.h inclusion for older systems.
2450 - Fixed Compat Code Diverging from Upstream, reported by X41 D-Sec.
2451 - Fix compile with --enable-alloc-checks, reported by X41 D-Sec.
2452 - Fix Terminating Quotes not Written, reported by X41 D-Sec.
2453 - Fix Useless memset() in validator, reported by X41 D-Sec.
2454 - Fix Unrequired Checks, reported by X41 D-Sec.
2455 - Fix Enum Name not Used, reported by X41 D-Sec.
2456 - Fix NULL Pointer Dereference via Control Port,
2457 reported by X41 D-Sec.
2458 - Fix Bad Randomness in Seed, reported by X41 D-Sec.
2459 - Fix python examples/calc.py for eval, reported by X41 D-Sec.
2460 - Fix comments for doxygen in dns64.
2462 19 November 2019: Wouter
2463 - Fix CVE-2019-18934, shell execution in ipsecmod.
2464 - 1.9.5 is 1.9.4 with bugfix, trunk is 1.9.6 in development.
2465 - Fix authzone printout buffer length check.
2466 - Fixes to please lint checks.
2467 - Fix Integer Overflow in Regional Allocator,
2468 reported by X41 D-Sec.
2469 - Fix Unchecked NULL Pointer in dns64_inform_super()
2470 and ipsecmod_new(), reported by X41 D-Sec.
2471 - Fix Out-of-bounds Read in rr_comment_dnskey(),
2472 reported by X41 D-Sec.
2473 - Fix Integer Overflows in Size Calculations,
2474 reported by X41 D-Sec.
2475 - Fix Integer Overflow to Buffer Overflow in
2476 sldns_str2wire_dname_buf_origin(), reported by X41 D-Sec.
2477 - Fix Out of Bounds Read in sldns_str2wire_dname(),
2478 reported by X41 D-Sec.
2479 - Fix Out of Bounds Write in sldns_bget_token_par(),
2480 reported by X41 D-Sec.
2482 18 November 2019: Wouter
2483 - In unbound-host use separate variable for get_option to please
2485 - update to bison output of 3.4.1 in code repository.
2486 - Provide a prototype for compat malloc to remove compile warning.
2487 - Portable grep usage for reuseport configure test.
2488 - Check return type of HMAC_Init_ex for openssl 0.9.8.
2489 - gitignore .source tempfile used for compatible make.
2491 13 November 2019: Wouter
2492 - iana portlist updated.
2493 - contrib/fastrpz.patch updated to apply for current code.
2494 - fixes for splint cleanliness, long vs int in SSL set_mode.
2496 11 November 2019: Wouter
2497 - Fix #109: check number of arguments for stdin-pipes in
2498 unbound-control and fail if too many arguments.
2499 - Merge #102 from jrtc27: Add getentropy emulation for FreeBSD.
2501 24 October 2019: Wouter
2502 - Fix #99: Memory leak in ub_ctx (event_base will never be freed).
2504 23 October 2019: George
2505 - Add new configure option `--enable-fully-static` to enable full static
2506 build if requested; in relation to #91.
2508 23 October 2019: Wouter
2509 - Merge #97: manpage: Add missing word on unbound.conf,
2512 22 October 2019: Wouter
2513 - drop-tld.diff: adds option drop-tld: yesno that drops 2 label
2514 queries, to stop random floods. Apply with
2515 patch -p1 < contrib/drop-tld.diff and compile.
2516 From Saksham Manchanda (Secure64). Please note that we think this
2517 will drop DNSKEY and DS lookups for tlds and hence break DNSSEC
2518 lookups for downstream clients.
2520 7 October 2019: Wouter
2521 - Add doxygen comments to unbound-anchor source address code, in #86.
2523 3 October 2019: Wouter
2524 - Merge #90 from vcunat: fix build with nettle-3.5.
2525 - Merge 1.9.4 release with fix for vulnerability CVE-2019-16866.
2526 - Continue with development of 1.9.5.
2527 - Merge #86 from psquarejho: Added -b source address option to
2528 smallapp/unbound-anchor.c, from Lukas Wunner.
2530 26 September 2019: Wouter
2531 - Merge #87 from hardfalcon: Fix contrib/unbound.service.in,
2532 Drop CAP_KILL, use + prefix for ExecReload= instead.
2534 25 September 2019: Wouter
2535 - The unbound.conf includes are sorted ascending, for include
2536 statements with a '*' from glob.
2538 23 September 2019: Wouter
2539 - Merge #85 for #84 from sam-lunt: Add kill capability to systemd
2540 service file to fix that systemctl reload fails.
2542 20 September 2019: Wouter
2543 - Merge #82 from hardfalcon: Downgrade CAP_NET_ADMIN to CAP_NET_RAW
2545 - Merge #81 from Maryse47: Consistently use /dev/urandom instead
2546 of /dev/random in scripts and docs.
2547 - Merge #83 from Maryse47: contrib/unbound.service.in: do not fork
2548 into the background.
2550 19 September 2019: Wouter
2551 - Fix #78: Memory leak in outside_network.c.
2552 - Merge pull request #76 from Maryse47: Improvements and fixes for
2553 systemd unbound.service.
2554 - oss-fuzz badge on README.md.
2555 - Fix fix for #78 to also free service callback struct.
2556 - Fix for oss-fuzz build warning.
2557 - Fix wrong response ttl for prepended short CNAME ttls, this would
2558 create a wrong zero_ttl response count with serve-expired enabled.
2559 - Merge #80 from stasic: Improve wording in man page.
2561 11 September 2019: Wouter
2562 - Use explicit bzero for wiping clear buffer of hash in cachedb,
2563 reported by Eric Sesterhenn from X41 D-Sec.
2565 9 September 2019: Wouter
2566 - Fix #72: configure --with-syslog-facility=LOCAL0-7 with default
2567 LOG_DAEMON (as before) can set the syslog facility that the server
2568 uses to log messages.
2570 4 September 2019: Wouter
2571 - Fix #71: fix openssl error squelch commit compilation error.
2573 3 September 2019: Wouter
2574 - squelch DNS over TLS errors 'ssl handshake failed crypto error'
2575 on low verbosity, they show on verbosity 3 (query details), because
2576 there is a high volume and the operator cannot do anything for the
2577 remote failure. Specifically filters the high volume errors.
2579 2 September 2019: Wouter
2580 - ipset module #28: log that an address is added, when verbosity high.
2581 - ipset: refactor long routine into three smaller ones.
2582 - updated Makefile dependencies.
2584 23 August 2019: Wouter
2585 - Fix contrib/fastrpz.patch asprintf return value checks.
2587 22 August 2019: Wouter
2588 - Fix that pkg-config is setup before --enable-systemd needs it.
2589 - 1.9.3rc2 release candidate tag. And this became the 1.9.3 release.
2590 Master is 1.9.4 in development.
2592 21 August 2019: Wouter
2593 - Fix log_dns_msg to log irrespective of minimal responses config.
2595 19 August 2019: Ralph
2596 - Document limitation of pidfile removal outside of chroot directory.
2598 16 August 2019: Wouter
2599 - Fix unittest valgrind false positive uninitialised value report,
2600 where if gcc 9.1.1 uses -O2 (but not -O1) then valgrind 3.15.0
2601 issues an uninitialised value for the token buffer at the str2wire.c
2602 rrinternal_get_owner() strcmp with the '@' value. Rewritten to use
2603 straight character comparisons removes the false positive. Also
2604 valgrinds --expensive-definedness-checks=yes can stop this false
2606 - Please doxygen's parser for "@" occurrence in doxygen comment.
2607 - Fixup contrib/fastrpz.patch
2608 - Remove warning about unknown cast-function-type warning pragma.
2610 15 August 2019: Wouter
2611 - iana portlist updated.
2612 - Fix autotrust temp file uniqueness windows compile.
2613 - avoid warning about upcast on 32bit systems for autotrust.
2614 - escape commandline contents for -V.
2615 - Fix character buffer size in ub_ctx_hosts.
2616 - 1.9.3rc1 release candidate tag.
2617 - Option -V prints if TCP fastopen is available.
2619 14 August 2019: George
2620 - Fix #59, when compiled with systemd support check that we can properly
2621 communicate with systemd through the `NOTIFY_SOCKET`.
2623 14 August 2019: Wouter
2624 - Generate configlexer with newer flex.
2625 - Fix warning for unused variable for compilation without systemd.
2627 12 August 2019: George
2628 - Introduce `-V` option to print the version number and build options.
2629 Previously reported build options like linked libs and linked modules
2630 are now moved from `-h` to `-V` as well for consistency.
2631 - PACKAGE_BUGREPORT now also includes link to GitHub issues.
2633 1 August 2019: Wouter
2634 - For #52 #53, second context does not close logfile override.
2635 - Fix #52 #53, fix for example fail program.
2636 - Fix to return after failed auth zone http chunk write.
2637 - Fix to remove unused test for task_probe existance.
2638 - Fix to timeval_add for remaining second in microseconds.
2639 - Check repinfo in worker_handle_request, if null, drop it.
2641 29 July 2019: Wouter
2642 - Add verbose log message when auth zone file is written, at level 4.
2643 - Add hex print of trust anchor pointer to trust anchor file temp
2644 name to make it unique, for libunbound created multiple contexts.
2646 23 July 2019: Wouter
2647 - Fix question section mismatch in local zone redirect.
2649 19 July 2019: Wouter
2650 - Fix #49: Set no renegotiation on the SSL context to stop client
2651 session renegotiation.
2653 12 July 2019: Wouter
2654 - Fix #48: Unbound returns additional records on NODATA response,
2655 if minimal-responses is enabled, also the additional for negative
2656 responses is removed.
2659 - Fix in respip addrtree selection. Absence of addr_tree_init_parents()
2660 call made it impossible to go up the tree when the matching netmask is
2664 - Fix for possible assertion failure when answering respip CNAME from
2667 25 June 2019: Wouter
2668 - For #45, check that 127.0.0.1 and ::1 are not used in unbound.conf
2669 when do-not-query-localhost is turned on, or at default on,
2670 unbound-checkconf prints a warning if it is found in forward-addr or
2671 stub-addr statements.
2673 24 June 2019: Wouter
2674 - Fix memleak in unit test, reported from the clang 8.0 static analyzer.
2676 18 June 2019: Wouter
2677 - PR #28: IPSet module, by Kevin Chou. Created a module to support
2678 the ipset that could add the domain's ip to a list easily.
2679 Needs libmnl, and --enable-ipset and config it, doc/README.ipset.md.
2680 - Fix to omit RRSIGs from addition to the ipset.
2681 - Fix to make unbound-control with ipset, remove unused variable,
2682 use unsigned type because of comparison, and assign null instead
2683 of compare with it. Remade lex and yacc output.
2685 - Added documentation to the ipset files (for doxygen output).
2686 - Merge PR #6: Python module: support multiple instances
2687 - Merge PR #5: Python module: define constant MODULE_RESTART_NEXT
2688 - Merge PR #4: Python module: assign something useful to the
2689 per-query data store 'qdata'
2690 - Fix python dict reference and double free in config.
2692 17 June 2019: Wouter
2693 - Master contains version 1.9.3 in development.
2694 - Fix #39: In libunbound, leftover logfile is close()d unpredictably.
2695 - Fix for #24: Fix abort due to scan of auth zone masters using old
2696 address from previous scan.
2698 12 June 2019: Wouter
2699 - Fix another spoolbuf storage code point, in prefetch.
2700 - 1.9.2rc3 release candidate tag. Which became the 1.9.2 release
2703 11 June 2019: Wouter
2704 - Fix that fixes the Fix that spoolbuf is not used to store tcp
2705 pipelined response between mesh send and callback end, this fixes
2706 error cases that did not use the correct spoolbuf.
2707 - 1.9.2rc2 release candidate tag.
2710 - 1.9.2rc1 release candidate tag.
2713 - iana portlist updated.
2716 - Fix to guard _OPENBSD_SOURCE from redefinition.
2719 - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.
2720 - gitignore config.h.in~.
2723 - Fix double file close in tcp pipelined response code.
2726 - Fix that spoolbuf is not used to store tcp pipelined response
2727 between mesh send and callback end.
2730 - Note that so-reuseport at extreme load is better turned off,
2731 otherwise queries are not distributed evenly, on Linux 4.4.x.
2734 - Fix #31: swig 4.0 and python module.
2737 - Squelch log messages from tcp send about connection reset by peer.
2738 They can be enabled with verbosity at higher values for diagnosing
2739 network connectivity issues.
2740 - Attempt to fix malformed tcp response.
2743 - Revert fix for oss-fuzz, error is in that build script that
2744 unconditionally includes .o files detected by configure, also
2745 when the machine architecture uses different LIBOBJS files.
2748 - Attempt to fix build failure in oss-fuzz because of reallocarray.
2749 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14648.
2750 Does not omit compile flags from commandline.
2753 - Fix edns-subnet locks, in error cases the lock was not unlocked.
2754 - Fix doxygen output error on readme markdown vignettes.
2757 - Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64.
2758 - Fix #30: AddressSanitizer finding in lookup3.c. This sets the
2759 hash function to use a slower but better auditable code that does
2760 not read beyond array boundaries. This makes code better security
2761 checkable, and is better for security. It is fixed to be slower,
2762 but not read outside of the array.
2765 - contrib/fastrpz.patch updated for code changes, and with git diff.
2766 - Fix .gitignore, add pythonmod and dnstap generated files.
2767 And unit test generated files, and generated doc files.
2770 - Update makedist for git.
2771 - Nicer travis output for clang analysis.
2772 - PR #16: XoT support, AXFR over TLS, turn it on with
2773 master: <ip>#<authname> in unbound.conf. This uses TLS to
2774 download the AXFR (or IXFR).
2776 25 April 2019: Wouter
2777 - Fix wrong query name in local zone redirect answers with a CNAME,
2778 the copy of the local alias is in unpacked form.
2780 18 April 2019: Ralph
2781 - Scrub RRs from answer section when reusing NXDOMAIN message for
2783 - For harden-below-nxdomain: do not consider a name to be non-exitent
2784 when message contains a CNAME record.
2786 18 April 2019: Wouter
2787 - travis build file.
2789 16 April 2019: Wouter
2790 - Better braces in if statement in TCP fastopen code.
2791 - iana portlist updated.
2793 15 April 2019: Wouter
2794 - Fix tls write event for read state change to re-call SSL_write and
2795 not resume the TLS handshake.
2797 11 April 2019: George
2798 - Update python documentation for init_standard().
2801 11 April 2019: Wouter
2802 - Fix that auth zone uses correct network type for sockets for
2803 SOA serial probes. This fixes that probes fail because earlier
2804 probe addresses are unreachable.
2805 - Fix that auth zone fails over to next master for timeout in tcp.
2806 - Squelch SSL read and write connection reset by peer and broken pipe
2807 messages. Verbosity 2 and higher enables them.
2809 8 April 2019: Wouter
2810 - Fix to use event_assign with libevent for thread-safety.
2811 - verbose information about auth zone lookup process, also lookup
2812 start, timeout and fail.
2813 - Fix #17: Add python module example from Jan Janak, that is a
2814 plugin for the Unbound DNS resolver to resolve DNS records in
2815 multicast DNS [RFC 6762] via Avahi. The plugin communicates
2816 with Avahi via DBus. The comment section at the beginning of
2817 the file contains detailed documentation.
2818 - Fix to wipe ssl ticket keys from memory with explicit_bzero,
2821 5 April 2019: Wouter
2822 - Fix to reinit event structure for accepted TCP (and TLS) sockets.
2824 4 April 2019: Wouter
2825 - Fix spelling error in log output for event method.
2827 3 April 2019: Wouter
2828 - Move goto label in answer_from_cache to the end of the function
2829 where it is more visible.
2830 - Fix auth-zone NSEC3 response for wildcard nodata answers,
2831 include the closest encloser in the answer.
2833 2 April 2019: Wouter
2834 - Fix auth-zone NSEC3 response for empty nonterminals with exact
2835 match nsec3 records.
2836 - Fix for out of bounds integers, thanks to OSTIF audit. It is in
2837 allocation debug code.
2838 - Fix for auth zone nsec3 ent fix for wildcard nodata.
2840 25 March 2019: Wouter
2841 - Fix that tls-session-ticket-keys: "" on its own in unbound.conf
2842 disables the tls session ticker key calls into the OpenSSL API.
2843 - Fix crash if tls-servic-pem not filled in when necessary.
2845 21 March 2019: Wouter
2846 - Fix #4240: Fix whitespace cleanup in example.conf.
2848 19 March 2019: Wouter
2849 - add type CAA to libpyunbound (accessing libunbound from python).
2851 18 March 2019: Wouter
2852 - Add log message, at verbosity 4, that says the query is encrypted
2853 with TLS, if that is enabled for the query.
2854 - Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482.
2856 7 March 2019: Wouter
2857 - Fix for #4233: guard use of NDEBUG, so that it can be passed in
2858 CFLAGS into configure.
2860 5 March 2019: Wouter
2861 - Tag release 1.9.1rc1. Which became 1.9.1 on 12 March 2019. Trunk
2862 has 1.9.2 in development.
2864 1 March 2019: Wouter
2865 - output forwarder log in ssl_req_order test.
2867 28 February 2019: Wouter
2868 - Remove memory leak on pythonmod python2 script file init.
2869 - Remove swig gcc8 python function cast warnings, they are ignored.
2870 - Print correct module that failed when module-config is wrong.
2872 27 February 2019: Wouter
2873 - Fix #4229: Unbound man pages lack information, about access-control
2874 order and local zone tags, and elements in views.
2875 - Fix #14: contrib/unbound.init: Fix wrong comparison judgment
2877 - Fix for python module on Windows, fix fopen.
2879 25 February 2019: Wouter
2880 - Fix #4227: pair event del and add for libevent for tcp_req_info.
2882 21 February 2019: Wouter
2883 - Fix the error for unknown module in module-config is understandable,
2884 and explains it was not compiled in and where to see the list.
2885 - In example.conf explain where to put cachedb module in module-config.
2886 - In man page and example config explain that most modules have to
2887 be listed at the start of module-config.
2889 20 February 2019: Wouter
2890 - Fix pythonmod include and sockaddr_un ifdefs for compile on
2891 Windows, and for libunbound.
2893 18 February 2019: Wouter
2894 - Print query name with ip_ratelimit exceeded log lines.
2895 - Spaces instead of tabs in that log message.
2896 - Print query name and IP address when domain rate limit exceeded.
2898 14 February 2019: Wouter
2899 - Fix capsforid canonical sort qsort callback.
2901 11 February 2019: Wouter
2902 - Note default for module-config in man page.
2903 - Fix recursion lame test for qname minimisation asked queries,
2904 that were not present in the set of prepared answers.
2905 - Fix #13: Remove left-over requirements on OpenSSL >= 1.1.0 for
2906 cert name matching, from man page.
2907 - make depend, with newer gcc, nicer layout.
2909 7 February 2019: Wouter
2910 - Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2.
2911 - Fix that qname minimisation does not skip a label when missing
2912 nameserver targets need to be fetched.
2913 - Fix #4225: clients seem to erroneously receive no answer with
2914 DNS-over-TLS and qname-minimisation.
2916 4 February 2019: Wouter
2917 - Fix that log-replies prints the correct name for local-alias
2918 names, for names that have a CNAME in local-data configuration.
2919 It logs the original query name, not the target of the CNAME.
2920 - Add local-zone type inform_redirect, which logs like type inform,
2921 and redirects like type redirect.
2922 - Perform canonical sort for 0x20 capsforid compare of replies,
2923 this sorts rrsets in the authority and additional section before
2924 comparison, so that out of order rrsets do not cause failure.
2926 31 January 2019: Wouter
2927 - Set ub_ctx_set_tls call signature in ltrace config file for
2928 libunbound in contrib/libunbound.so.conf.
2929 - improve documentation for tls-service-key and forward-first.
2930 - #10: fixed pkg-config operations, PKG_PROG_PKG_CONFIG moved out of
2931 conditional section, fixes systemd builds, from Enrico Scholz.
2932 - #9: For openssl 1.0.2 use the CRYPTO_THREADID locking callbacks,
2933 still supports the set_id_callback previous API. And for 1.1.0
2934 no locking callbacks are needed.
2935 - #8: Fix OpenSSL without ENGINE support compilation.
2936 - Wipe TLS session key data from memory on exit.
2938 30 January 2019: Ralph
2939 - Fix case in which query timeout can result in marking delegation
2942 29 January 2019: Wouter
2943 - Fix spelling of tls-ciphers in example.conf.in.
2944 - Fix #4224: auth_xfr_notify.rpl test broken due to typo
2945 - Fix locking for libunbound context setup with broken port config.
2947 28 January 2019: Wouter
2948 - ub_ctx_set_tls call for libunbound that enables DoT for the machines
2949 set with ub_ctx_set_fwd. Patch from Florian Obser.
2950 - Set build system for added call in the libunbound API.
2951 - List example config for root zone copy locally hosted with auth-zone
2952 as suggested from draft-ietf-dnsop-7706-bis-02. But with updated
2954 - set version to 1.9.0 for release. And this was released with the
2955 spelling for tls-ciphers fix as 1.9.0 on Feb 5. Trunk has 1.9.1 in
2958 25 January 2019: Wouter
2959 - Fix that tcp for auth zone and outgoing does not remove and
2960 then gets the ssl read again applied to the deleted commpoint.
2961 - updated contrib/fastrpz.patch to cleanly diff.
2962 - no lock when threads disabled in tcp request buffer count.
2963 - remove compile warnings from libnettle compile.
2964 - output of newer lex 2.6.1 and bison 3.0.5.
2966 24 January 2019: Wouter
2967 - Newer aclocal and libtoolize used for generating configure scripts,
2968 aclocal 1.16.1 and libtoolize 2.4.6.
2969 - Fix unit test for python 3.7 new keyword 'async'.
2970 - clang analysis fixes, assert arc4random buffer in init,
2971 no check for already checked delegation pointer in iterator,
2972 in testcode check for NULL packet matches, in perf do not copy
2973 from NULL start list when growing capacity. Adjust host and file
2974 only when present in test header read to please checker. In
2975 testcode for unknown macro operand give zero result. Initialise the
2976 passed argv array in test code. In test code add EDNS data
2977 segment copy only when nonempty.
2978 - Patch from Florian Obser fixes some compiler warnings:
2979 include mini_event.h to have a prototype for mini_ev_cmp
2980 include edns.h to have a prototype for apply_edns_options
2981 sldns_wire2str_edns_keepalive_print is only called in the wire2str,
2982 module declare it static to get rid of compiler warning:
2983 no previous prototype for function
2984 infra_find_ip_ratedata() is only called in the infra module,
2985 declare it static to get rid of compiler warning:
2986 no previous prototype for function
2987 do not shadow local variable buf in authzone
2988 auth_chunks_delete and az_nsec3_findnode are only called in the
2989 authzone module, declare them static to get rid of compiler warning:
2990 no previous prototype for function...
2991 copy_rrset() is only called in the respip module, declare it
2992 static to get rid of compiler warning:
2993 no previous prototype for function 'copy_rrset'
2994 no need for another variable "r"; gets rid of compiler warning:
2995 declaration shadows a local variable in libunbound.c
2996 no need for another variable "ns"; gets rid of compiler warning:
2997 declaration shadows a local variable in iterator.c
2998 - Moved includes and make depend.
3000 23 January 2019: Wouter
3001 - Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites
3002 options for unbound.conf.
3003 - Fixes for the patch, and man page entry.
3004 - Fix configure to detect SSL_CTX_set_ciphersuites, for better
3005 library compatibility when compiling.
3006 - Patch for TLS session resumption from Manabu Sonoda,
3007 enable with tls-session-ticket-keys in unbound.conf.
3008 - Fixes for patch (includes, declarations, warnings). Free at end
3009 and keep config options in order read from file to keep the first
3010 one as the first one.
3011 - Fix for IXFR fallback to reset counter when IXFR does not timeout.
3013 22 January 2019: Wouter
3014 - Fix space calculation for tcp req buffer size.
3015 - Doc for stream-wait-size and unit test.
3016 - unbound-control stats has mem.streamwait that counts TCP and TLS
3017 waiting result buffers.
3018 - Fix for #4219: secondaries not updated after serial change, unbound
3019 falls back to AXFR after IXFR gives several timeout failures.
3020 - Fix that auth zone after IXFR fallback tries the same master.
3022 21 January 2019: Wouter
3023 - Fix tcp idle timeout test, for difference in the tcp reply code.
3024 - Unit test for tcp request reorder and timeouts.
3025 - Unit tests for ssl out of order processing.
3026 - Fix that multiple dns fragments can be carried in one TLS frame.
3027 - Add stream-wait-size: 4m config option to limit the maximum
3028 memory used by waiting tcp and tls stream replies. This avoids
3029 a denial of service where these replies use up all of the memory.
3031 17 January 2019: Wouter
3032 - For caps-for-id fallback, use the whitelist to avoid timeout
3033 starting a fallback sequence for it.
3034 - increase mesh max activation count for capsforid long fetches.
3036 16 January 2019: Ralph
3037 - Get ready for the DNS flag day: remove EDNS lame procedure, do not
3038 re-query without EDNS after timeout.
3040 15 January 2019: Wouter
3041 - In the out of order processing, reset byte count for (potential)
3043 - Review fixes in out of order processing.
3045 14 January 2019: Wouter
3046 - streamtcp option -a send queries consecutively and prints answers
3048 - Fix for out of order processing administration quit cleanup.
3049 - unit test for tcp out of order processing.
3051 11 January 2019: Wouter
3052 - Initial commit for out-of-order processing for TCP and TLS.
3054 9 January 2019: Wouter
3055 - Log query name for looping module errors.
3057 8 January 2019: Wouter
3058 - Fix syntax in comment of local alias processing.
3059 - Fix NSEC3 record that is returned in wildcard replies from
3060 auth-zone zones with NSEC3 and wildcards.
3062 7 January 2019: Wouter
3063 - On FreeBSD warn if systcl settings do not allow server TCP FASTOPEN,
3064 and server tcp fastopen is enabled at compile time.
3065 - Document interaction between the tls-upstream option in the server
3066 section and forward-tls-upstream option in the forward-zone sections.
3067 - Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews,
3068 the patch adds a program used for fuzzing.
3070 12 December 2018: Wouter
3071 - Fix for crash in dns64 module if response is null.
3073 10 December 2018: Wouter
3074 - Fix config parser memory leaks.
3075 - ip-ratelimit-factor of 1 allows all traffic through, instead of the
3076 previous blocking everything.
3077 - Fix for FreeBSD port make with dnscrypt and dnstap enabled.
3078 - Fix #4206: support openssl 1.0.2 for TLS hostname verification,
3079 alongside the 1.1.0 and later support that is already there.
3080 - Fixup openssl 1.0.2 compile
3082 6 December 2018: Wouter
3083 - Fix dns64 allocation in wrong region for returned internal queries.
3085 3 December 2018: Wouter
3086 - Fix icon, no ragged edges and nicer resolutions available, for eg.
3087 Win 7 and Windows 10 display.
3088 - cache-max-ttl also defines upperbound of initial TTL in response.
3090 30 November 2018: Wouter
3091 - Patch for typo in unbound.conf man page.
3092 - log-tag-queryreply: yes in unbound.conf tags the log-queries and
3093 log-replies in the log file for easier log filter maintenance.
3095 29 November 2018: Wouter
3096 - iana portlist updated.
3097 - Fix chroot auth-zone fix to remove chroot prefix.
3098 - tag for 1.8.2rc1, which became 1.8.2 on 4 dec 2018, with icon
3099 updated. Trunk contains 1.8.3 in development.
3100 Which became 1.8.3 on 11 december with only the dns64 fix of 6 dec.
3101 Trunk then became 1.8.4 in development.
3102 - Fix that unbound-checkconf does not complains if the config file
3103 is not placed inside the chroot.
3104 - Refuse to start with no ports.
3105 - Remove clang analysis warnings.
3107 28 November 2018: Wouter
3108 - Fix leak in chroot fix for auth-zone.
3109 - Fix clang analysis for outside directory build test.
3111 27 November 2018: Wouter
3112 - Fix DNS64 to not store intermediate results in cache, this avoids
3113 other threads from picking up the wrong data. The module restores
3114 the previous no_cache_store setting when the the module is finished.
3115 - Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work.
3116 - New and better fix for Fix #4193: Fix that prefetch failure does
3117 not overwrite valid cache entry with SERVFAIL.
3118 - auth-zone give SERVFAIL when expired, fallback activates when
3119 expired, and this is documented in the man page.
3120 - stat count SERVFAIL downstream auth-zone queries for expired zones.
3121 - Put new logos into windows installer.
3122 - Fix windows compile for new rrset roundrobin fix.
3123 - Update contrib fastrpz patch for latest release.
3125 26 November 2018: Wouter
3126 - Fix to not set GLOB_NOSORT so the unbound.conf include: files are
3127 sorted and in a predictable order.
3128 - Fix #4193: Fix that prefetch failure does not overwrite valid cache
3129 entry with SERVFAIL.
3130 - Add unbound-control view_local_datas command, like local_datas.
3131 - Fix that unbound-control can send file for view_local_datas.
3133 22 November 2018: Wouter
3134 - With ./configure --with-pyunbound --with-pythonmodule
3135 PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests
3136 succeed for the python module.
3137 - pythonmod logs the python error and traceback on failure.
3138 - ignore debug python module for test in doxygen output.
3139 - review fixes for python module.
3140 - Fix #4209: Crash in libunbound when called from getdns.
3141 - auth zone zonefiles can be in a chroot, the chroot directory
3142 components are removed before use.
3143 - Fix that empty zonefile means the zonefile is not set and not used.
3146 21 November 2018: Wouter
3147 - Scrub NS records from NODATA responses as well.
3149 20 November 2018: Wouter
3150 - Scrub NS records from NXDOMAIN responses to stop fragmentation
3151 poisoning of the cache.
3152 - Add patch from Jan Vcelak for pythonmod,
3153 add sockaddr_storage getters, add support for query callbacks,
3154 allow raw address access via comm_reply and update API documentation.
3155 - Removed compile warnings in pythonmod sockaddr routines.
3157 19 November 2018: Wouter
3158 - Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes
3159 option in unbound.conf.
3161 6 November 2018: Ralph
3162 - Bugfix min-client-subnet-ipv6
3164 25 October 2018: Ralph
3165 - Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options.
3167 25 October 2018: Wouter
3168 - Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query.
3169 - Fix #4190: Please create a "ANY" deny option, adds the option
3170 deny-any: yes in unbound.conf. This responds with an empty message
3171 to queries of type ANY.
3172 - Fix #4141: More randomness to rrset-roundrobin.
3173 - Fix #4132: Openness/closeness of RANGE intervals in rpl files.
3174 - Fix #4126: RTT_band too low on VSAT links with 600+ms latency,
3175 adds the option unknown-server-time-limit to unbound.conf that
3176 can be increased to avoid the problem.
3177 - remade makefile dependencies.
3178 - Fix #4152: Logs shows wrong time when using log-time-ascii: yes.
3180 24 October 2018: Ralph
3181 - Add markdel function to ECS slabhash.
3182 - Limit ECS scope returned to client to the scope used for caching.
3183 - Make lint like previous #4154 fix.
3185 22 October 2018: Wouter
3186 - Fix #4192: unbound-control-setup generates keys not readable by
3188 - check that the dnstap socket file can be opened and exists, print
3190 - Fix #4154: make ECS_MAX_TREESIZE configurable, with
3191 the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options.
3193 22 October 2018: Ralph
3194 - Change fast-server-num default to 3.
3196 8 October 2018: Ralph
3197 - Add fast-server-permil and fast-server-num options.
3198 - Deprecate low-rtt and low-rtt-permil options.
3200 8 October 2018: Wouter
3201 - Squelch log of failed to tcp initiate after TCP Fastopen failure.
3203 5 October 2018: Wouter
3204 - Squelch EADDRNOTAVAIL errors when the interface goes away,
3205 this omits 'can't assign requested address' errors unless
3206 verbosity is set to a high value.
3207 - Set default for so-reuseport to no for FreeBSD. It is enabled
3208 by default for Linux and DragonFlyBSD. The setting can
3209 be configured in unbound.conf to override the default.
3212 2 October 2018: Wouter
3213 - updated contrib/fastrpz.patch to apply for this version
3214 - dnscrypt.c removed sizeof to get array bounds.
3215 - Fix testlock code to set noreturn on error routine.
3216 - Remove unused variable from contrib fastrpz/rpz.c and
3217 remove unused diagnostic pragmas that themselves generate warnings
3218 - clang analyze test is used only when assertions are enabled.
3220 1 October 2018: Wouter
3221 - tag for release 1.8.1rc1. Became release 1.8.1 on 8 oct, with
3222 fastrpz.patch fix included. Trunk has 1.8.2 in development.
3224 27 September 2018: Wouter
3225 - Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes
3226 qname minimisation with a forwarder when connectivity has issues
3227 from rejecting responses.
3229 25 September 2018: Wouter
3230 - Perform TLS SNI indication of the host that is being contacted
3231 for DNS over TLS service. It sets the configured tls auth name.
3232 This is useful for hosts that apart from the DNS over TLS services
3233 also provide other (web) services.
3234 - Fix #4149: Add SSL cleanup for tcp timeout.
3236 17 September 2018: Wouter
3237 - Fix compile on Mac for unbound, provide explicit_bzero when libc
3239 - Fix unbound for openssl in FIPS mode, it uses the digests with
3240 the EVP call contexts.
3241 - Fix that with harden-below-nxdomain and qname minisation enabled
3242 some iterator states for nonresponsive domains can get into a
3243 state where they waited for an empty list.
3244 - Stop UDP to TCP failover after timeouts that causes the ping count
3245 to be reset by the TCP time measurement (that exists for TLS),
3246 because that causes the UDP part to not be measured as timeout.
3247 - Fix #4156: Fix systemd service manager state change notification.
3249 13 September 2018: Wouter
3250 - Fix seed for random backup code to use explicit zero when wiped.
3251 - exit log routine is annotated as noreturn function.
3252 - free memory leaks in config strlist and str2list insert functions.
3253 - do not move unused argv variable after getopt.
3254 - Remove unused if clause in testcode.
3255 - in testcode, free async ids, initialise array, and check for null
3256 pointer during test of the test. And use exit for return to note
3257 irregular program stop.
3258 - Free memory leak in config strlist append.
3259 - make sure nsec3 comparison salt is initialized.
3260 - unit test has clang analysis.
3261 - remove unused variable assignment from iterator scrub routine.
3262 - check for null in delegation point during iterator refetch
3264 - neater pointer cast in libunbound context quit routine.
3265 - initialize statistics totals for printout.
3266 - in authzone check that node exists before adding rrset.
3267 - in unbound-anchor, use readwrite memory BIO.
3268 - assertion in autotrust that packed rrset is formed correctly.
3269 - Fix memory leak when message parse fails partway through copy.
3270 - remove unused udpsize assignment in message encode.
3271 - nicer bio free code in unbound-anchor.
3272 - annotate exit functions with noreturn in unbound-control.
3274 11 September 2018: Wouter
3275 - Fixed unused return value warnings in contrib/fastrpz.patch for
3277 - Fix to squelch respip warning in unit test, it is printed at
3278 higher verbosity settings.
3279 - Fix spelling errors.
3280 - Fix initialisation in remote.c
3282 10 September 2018: Wouter
3283 - 1.8.1 in svn trunk. (changes from 4,5,.. sep apply).
3286 5 September 2018: Wouter
3287 - Fix spelling error in header, from getdns commit by Andreas Gelmini.
3289 4 September 2018: Ralph
3290 - More explicitly mention the type of ratelimit when applying
3293 4 September 2018: Wouter
3294 - Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018.
3296 31 August 2018: Wouter
3297 - Disable minimal-responses in subnet unit tests.
3299 30 August 2018: Wouter
3300 - Fix that a local-zone with a local-zone-type that is transparent
3301 in a view with view-first, makes queries check for answers from the
3302 local-zones defined outside of views.
3304 28 August 2018: Ralph
3305 - Disable minimal-responses in ipsecmod unit tests.
3306 - Added serve-expired-ttl and serve-expired-ttl-reset options.
3308 27 August 2018: Wouter
3309 - Set defaults to yes for a number of options to increase speed and
3310 resilience of the server. The so-reuseport, harden-below-nxdomain,
3311 and minimal-responses options are enabled by default. They used
3312 to be disabled by default, waiting to make sure they worked. They
3313 are enabled by default now, and can be disabled explicitly by
3314 setting them to "no" in the unbound.conf config file. The reuseport
3315 and minimal options increases speed of the server, and should be
3316 otherwise harmless. The harden-below-nxdomain option works well
3317 together with the recently default enabled qname minimisation, this
3318 causes more fetches to use information from the cache.
3319 - next release is called 1.8.0.
3320 - Fix lintflags for lint on FreeBSD.
3322 22 August 2018: George
3323 - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This
3324 gives access to reply information for the client's communication
3325 point when the callback is called before the mesh state (modules).
3326 Changes to C and Python's inplace_callback signatures were also
3329 21 August 2018: Wouter
3330 - log-local-actions: yes option for unbound.conf that logs all the
3331 local zone actions, a patch from Saksham Manchanda (Secure64).
3332 - #4146: num.query.subnet and num.query.subnet_cache counters.
3333 - Fix only misc failure from log-servfail when val-log-level is not
3336 17 August 2018: Ralph
3337 - Fix classification for QTYPE=CNAME queries when QNAME minimisation is
3340 17 August 2018: Wouter
3341 - Set libunbound to increase current, because the libunbound change
3342 to the event callback function signature. That needs programs,
3343 that use it, to recompile against the new header definition.
3344 - print servfail info to log as error.
3345 - added more servfail printout statements, to the iterator.
3346 - log-servfail: yes prints log lines that say why queries are
3347 returning SERVFAIL to clients.
3349 16 August 2018: Wouter
3350 - Fix warning on compile without threads.
3351 - Fix contrib/fastrpz.patch.
3353 15 August 2018: Wouter
3354 - Fix segfault in auth-zone read and reorder of RRSIGs.
3356 14 August 2018: Wouter
3357 - Fix that printout of error for cycle targets is a verbosity 4
3358 printout and does not wrongly print it is a memory error.
3359 - Upgraded crosscompile script to include libunbound DLL in the
3362 10 August 2018: Wouter
3363 - Fix #4144: dns64 module caches wrong (negative) information.
3365 9 August 2018: Wouter
3366 - unbound-checkconf checks if modules exist and prints if they are
3367 not compiled in the name of the wrong module.
3368 - document --enable-subnet in doc/README.
3369 - Patch for stub-no-cache and forward-no-cache options that disable
3370 caching for the contents of that stub or forward, for when you
3371 want immediate changes visible, from Bjoern A. Zeeb.
3373 7 August 2018: Ralph
3374 - Make capsforid fallback QNAME minimisation aware.
3376 7 August 2018: Wouter
3377 - Fix #4142: unbound.service.in: improvements and fixes.
3378 Add unit dependency ordering (based on systemd-resolved).
3379 Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings
3380 about missing privileges during startup). Add 'AF_INET6' to
3381 'RestrictAddressFamilies' (without it IPV6 can't work). From
3383 - Patch to implement tcp-connection-limit from Jim Hague (Sinodun).
3384 This limits the number of simultaneous TCP client connections
3385 from a nominated netblock.
3386 - make depend, yacc, lex, doc, headers. And log the limit exceeded
3387 message only on high verbosity, so as to not spam the logs when
3390 6 August 2018: Wouter
3391 - Fix for #4136: Fix to unconditionally call destroy in daemon.c.
3393 3 August 2018: George
3394 - Expose if a query (or a subquery) was ratelimited (not src IP
3395 ratelimiting) to libunbound under 'ub_result.was_ratelimited'.
3396 This also introduces a change to 'ub_event_callback_type' in
3397 libunbound/unbound-event.h.
3400 3 August 2018: Wouter
3401 - Revert previous change for #4136: because it introduces build
3403 - New fix for #4136: This one ignores lex without without
3406 1 August 2018: Wouter
3407 - Fix to remove systemd sockaddr function check, that is not
3408 always present. Make socket activation more lenient. But not
3409 different when socket activation is not used.
3410 - iana port list update.
3412 31 July 2018: Wouter
3413 - Patches from Jim Hague (Sinodun) for EDNS KeepAlive.
3414 - Sort out test runs when the build directory isn't the project
3416 - Add config tcp-idle-timeout (default 30s). This applies to
3417 client connections only; the timeout on TCP connections upstream
3419 - Error if EDNS Keepalive received over UDP.
3420 - Add edns-tcp-keepalive and edns-tcp-keepalive timeout options
3421 and implement option in client responses.
3422 - Correct and expand manual page entries for keepalive and idle timeout.
3423 - Implement progressive backoff of TCP idle/keepalive timeout.
3424 - Fix 'make depend' to work when build dir is not project root.
3425 - Add delay parameter to streamtcp, -d secs.
3426 To be used when testing idle timeout.
3427 - From Wouter: make depend, the dependencies in the patches did not
3428 apply cleanly. Also remade yacc and lex.
3429 - Fix mesh.c incompatible pointer pass.
3430 - Please doxygen so it passes.
3431 - Fix #4139: Fix unbound-host leaks memory on ANY.
3433 30 July 2018: Wouter
3434 - Fix #4136: insufficiency from mismatch of FLEX capability between
3435 released tarball and build host.
3437 27 July 2018: Wouter
3438 - Fix man page, say that chroot is enabled by default.
3440 26 July 2018: Wouter
3441 - Fix #4135: 64-bit Windows Installer Creates Entries Under The
3442 Wrong Registry Key, reported by Brian White.
3444 23 July 2018: Wouter
3445 - Fix use-systemd readiness signalling, only when use-systemd is yes
3446 and not in signal handler.
3448 20 July 2018: Wouter
3449 - Fix #4130: print text describing -dd and unbound-checkconf on
3450 config file read error at startup, the errors may have been moved
3451 away by the startup process.
3452 - Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared.
3454 19 July 2018: Wouter
3455 - Fix #4129 unbound-control error message with wrong cert permissions
3458 17 July 2018: Wouter
3459 - Fix #4127 unbound -h does not list -p help.
3460 - Print error if SSL name verification configured but not available
3462 - Fix that ratelimit and ip-ratelimit are applied after reload of
3463 changed config file.
3464 - Resize ratelimit and ip-ratelimit caches if changed on reload.
3466 16 July 2018: Wouter
3467 - Fix qname minimisation NXDOMAIN validation lookup failures causing
3468 error_supers assertion fails.
3469 - Squelch can't bind socket errors with Permission denied unless
3470 verbosity is 4 or higher, for UDP outgoing sockets.
3472 12 July 2018: Wouter
3473 - Fix to improve systemd socket activation code file descriptor
3475 - Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more
3476 easily changed to adjust default rtt assumptions.
3478 10 July 2018: Wouter
3479 - Note in documentation that the cert name match code needs
3480 OpenSSL 1.1.0 or later to be enabled.
3483 - Fix documentation ambiguity for tls-win-cert in tls-upstream and
3484 forward-tls-upstream docs.
3486 - Note RFC8162 support. SMIMEA record type can be read in by the
3488 - Fix round robin for failed addresses with prefer-ip6: yes
3491 - Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass
3492 if DNSSEC is not enabled. New option -R allows fallback from
3493 resolv.conf to direct queries.
3496 - Better documentation for unblock-lan-zones and insecure-lan-zones
3498 - Fix permission denied printed for auth zone probe random port nrs.
3501 - Fix checking for libhiredis printout in configure output.
3502 - Fix typo on man page in ip-address description.
3503 - Update libunbound/python/examples/dnssec_test.py example code to
3504 also set the 20326 trust anchor for the root in the example code.
3506 29 June 2018: Wouter
3507 - dns64-ignore-aaaa: config option to list domain names for which the
3508 existing AAAA is ignored and dns64 processing is used on the A
3511 28 June 2018: Wouter
3512 - num.queries.tls counter for queries over TLS.
3513 - log port number with err_addr logs.
3515 27 June 2018: Wouter
3516 - #4109: Fix that package config depends on python unconditionally.
3517 - Patch, do not export python from pkg-config, from Petr Menšík.
3519 26 June 2018: Wouter
3520 - Partial fix for permission denied on IPv6 address on FreeBSD.
3521 - Fix that auth-zone master reply with current SOA serial does not
3522 stop scan of masters for an updated zone.
3523 - Fix that auth-zone does not start the wait timer without checking
3524 if the wait timer has already been started.
3526 21 June 2018: Wouter
3527 - #4108: systemd reload hang fix.
3528 - Fix usage printout for unbound-host, hostname has to be last
3529 argument on BSDs and Windows.
3531 19 June 2018: Wouter
3532 - Fix for unbound-control on Windows and set TCP socket parameters
3534 This fix is part of 1.7.3.
3535 - Windows example service.conf edited with more windows specific
3537 - Fix windows unbound-control no cert bad file descriptor error.
3538 This fix is part of 1.7.3.
3540 18 June 2018: Wouter
3541 - Fix that control-use-cert: no works for 127.0.0.1 to disable certs.
3542 This fix is part of 1.7.3rc2.
3543 - Fix unbound-checkconf for control-use-cert.
3544 This fix is part of 1.7.3.
3546 15 June 2018: Wouter
3549 - unbound-control auth_zone_reload _zone_ option rereads the zonefile.
3550 - unbound-control auth_zone_transfer _zone_ option starts the probe
3551 sequence for a master to transfer the zone from and transfers when
3552 a new zone version is available.
3554 14 June 2018: Wouter
3555 - #4103: Fix that auth-zone does not insist on SOA record first in
3556 file for url downloads.
3557 - Fix that first control-interface determines if TLS is used. Warn
3558 when IP address interfaces are used without TLS.
3559 - Fix nettle compile.
3562 - Don't count CNAME response types received during qname minimisation as
3565 12 June 2018: Wouter
3566 - #4102 for NSD, but for Unbound. Named unix pipes do not use
3567 certificate and key files, access can be restricted with file and
3568 directory permissions. The option control-use-cert is no longer
3569 used, and ignored if found in unbound.conf.
3570 - Rename tls-additional-ports to tls-additional-port, because every
3572 - Fix buffer size warning in unit test.
3573 - remade dependencies in the Makefile.
3576 - Patch to fix openwrt for mac os build darwin detection in configure.
3579 - Fix crash if ratelimit taken into use with unbound-control
3580 instead of with unbound.conf.
3583 - Fix deadlock caused by incoming notify for auth-zone.
3584 - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018,
3585 trunk is 1.7.3 in development from this point.
3586 - #4100: Fix stub reprime when it becomes useless.
3589 - Rename additional-tls-port to tls-additional-ports.
3590 The older name is accepted for backwards compatibility.
3593 - Patch from Syzdek: Add ability to ignore RD bit and treat all
3594 requests as if the RD bit is set.
3597 - in compat/arc4random call getentropy_urandom when getentropy fails
3599 - Fix that fallback for windows port.
3602 - Fix windows tcp and tls spin on events.
3603 - Add routine from getdns to add windows cert store to the SSL_CTX.
3604 - tls-win-cert option that adds the system certificate store for
3605 authenticating DNS-over-TLS connections. It can be used instead
3606 of the tls-cert-bundle option, or with it to add certificates.
3609 - For TCP and TLS connections that don't establish, perform address
3610 update in infra cache, so future selections can exclude them.
3611 - Fix that tcp sticky events are removed for closed fd on windows.
3612 - Fix close events for tcp only.
3615 - Fix that libunbound can do DNS-over-TLS, when configured.
3616 - Fix that windows unbound service can use DNS-over-TLS.
3617 - unbound-host initializes ssl (for potential DNS-over-TLS usage
3618 inside libunbound), when ssl upstream or a cert-bundle is configured.
3621 - Use accept4 to speed up incoming TCP (and TLS) connections,
3622 available on Linux, FreeBSD and OpenBSD.
3625 - Qname minimisation default changed to yes.
3628 - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand.
3631 - Fix contrib/libunbound.pc for libssl libcrypto references,
3632 from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914
3635 - Fix windows to not have sticky TLS events for TCP.
3636 - Fix read of DNS over TLS length and data in one read call.
3637 - Fix mesh state assertion failure due to callback removal.
3640 - Fix that configure --with-libhiredis also turns on cachedb.
3641 - Fix gcc 8 buffer warning in testcode.
3642 - Fix function type cast warning in libunbound context callback type.
3645 - Fix fail to reject dead peers in forward-zone, with ssl-upstream.
3648 - Fix that unbound-control reload frees the rrset keys and returns
3649 the memory pages to the system.
3651 30 April 2018: Wouter
3652 - Fix spelling error in man page and note defaults as no instead of
3655 26 April 2018: Wouter
3656 - Fix for crash in daemon_cleanup with dnstap during reload,
3657 from Saksham Manchanda.
3658 - Also that for dnscrypt.
3659 - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk
3660 is from here 1.7.2 in development.
3662 25 April 2018: Ralph
3663 - Fix memory leak when caching wildcard records for aggressive NSEC use
3665 24 April 2018: Wouter
3666 - Fix contrib/fastrpz.patch for this release.
3667 - Fix auth https for libev.
3669 24 April 2018: Ralph
3670 - Added root-key-sentinel support
3672 23 April 2018: Wouter
3673 - makedist uses bz2 for expat code, instead of tar.gz.
3674 - Fix #4092: libunbound: use-caps-for-id lacks colon in
3676 - auth zone http download stores exact copy of downloaded file,
3677 including comments in the file.
3678 - Fix sldns parse failure for CDS alternate delete syntax empty hex.
3679 - Attempt for auth zone fix; add of callback in mesh gets from
3680 callback does not skip callback of result.
3681 - Fix cname classification with qname minimisation enabled.
3682 - list_auth_zones unbound-control command.
3684 20 April 2018: Wouter
3685 - man page documentation for dns-over-tls forward-addr '#' notation.
3686 - removed free from failed parse case.
3687 - Fix #4091: Fix that reload of auth-zone does not merge the zonefile
3688 with the previous contents.
3689 - Delete auth zone when removed from config.
3691 19 April 2018: Wouter
3692 - Can set tls authentication with forward-addr: IP#tls.auth.name
3693 And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem".
3694 such as forward-addr: 9.9.9.9@853#dns.quad9.net or
3695 1.1.1.1@853#cloudflare-dns.com
3696 - Fix #658: unbound using TLS in a forwarding configuration does not
3697 verify the server's certificate (RFC 8310 support).
3698 - For addr with #authname and no @port notation, the default is 853.
3700 18 April 2018: Wouter
3701 - Fix auth-zone retry timer to be on schedule with retry timeout,
3702 with backoff. Also time a refresh at the zone expiry.
3704 17 April 2018: Wouter
3705 - auth zone notify work.
3706 - allow-notify: config statement for auth-zones.
3707 - unit test for allow-notify
3709 16 April 2018: Wouter
3710 - Fix auth zone target lookup iterator.
3711 - auth zone notify with prefix
3712 - auth zone notify work.
3714 13 April 2018: Wouter
3715 - Fix for max include depth for authzones.
3716 - Fix memory free on fail for $INCLUDE in authzone.
3717 - Fix that an internal error to look up the wrong rr type for
3718 auth zone gets stopped, before trying to send there.
3719 - auth zone notify work.
3721 10 April 2018: Ralph
3722 - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN
3723 statistics counters.
3725 10 April 2018: Wouter
3726 - documentation for low-rtt and low-rtt-pct.
3727 - auth zone notify work.
3729 9 April 2018: Wouter
3730 - Fix that flush_zone sets prefetch ttl expired, so that with
3731 serve-expired enabled it'll start prefetching those entries.
3732 - num.query.authzone.up and num.query.authzone.down statistics counters.
3733 - Fix downstream auth zone, only fallback when auth zone fails to
3734 answer and fallback is enabled.
3735 - Accept both option names with and without colon for get_option
3737 - low-rtt and low-rtt-pct in unbound.conf enable the server selection
3738 of fast servers for some percentage of the time.
3740 5 April 2018: Wouter
3741 - Combine write of tcp length and tcp query for dns over tls.
3742 - nitpick fixes in example.conf.
3743 - Fix above stub queries for type NS and useless delegation point.
3744 - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3
3745 tls_choose_sigalg routine does not allow the ciphers for the pipe,
3749 3 April 2018: Wouter
3750 - Fix #4043: make test fails due to v6 presentation issue in macOS.
3751 - Fix unable to resolve after new WLAN connection, due to auth-zone
3752 failing with a forwarder set. Now, auth-zone is only used for
3753 answers (not referrals) when a forwarder is set.
3755 29 March 2018: Ralph
3756 - Check "result" in dup_all(), by Florian Obser.
3758 23 March 2018: Ralph
3759 - Fix unbound-control get_option aggressive-nsec
3761 21 March 2018: Ralph
3762 - Do not use cached NSEC records to generate negative answers for
3763 domains under DNSSEC Negative Trust Anchors.
3765 19 March 2018: Wouter
3768 16 March 2018: Wouter
3769 - corrected a minor typo in the changelog.
3770 - move htobe64/be64toh portability code to cachedb.c.
3772 15 March 2018: Wouter
3773 - Add --with-libhiredis, unbound support for a new cachedb backend
3774 that uses a Redis server as the storage. This implementation
3775 depends on the hiredis client library (https://redislabs.com/lp/hiredis/).
3776 And unbound should be built with both --enable-cachedb and
3777 --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h
3778 should exist). Patch from Jinmei Tatuya (Infoblox).
3779 - Fix #3817: core dump happens in libunbound delete, when queued
3780 servfail hits deleted message queue.
3781 - Create additional tls service interfaces by opening them on other
3782 portnumbers and listing the portnumbers as additional-tls-port: nr.
3784 13 March 2018: Wouter
3785 - Fix typo in documentation.
3786 - Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually
3787 flushed with serve-expired on.
3789 12 March 2018: Wouter
3790 - Added documentation for aggressive-nsec: yes.
3791 - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk
3792 now has 1.7.1 in development.
3793 - Fix #3727: Protocol name is TLS, options have been renamed but
3794 documentation is not consistent.
3795 - Check IXFR start serial.
3797 9 March 2018: Wouter
3798 - Fix #3598: Fix swig build issue on rhel6 based system.
3799 configure --disable-swig-version-check stops the swig version check.
3801 8 March 2018: Wouter
3804 7 March 2018: Wouter
3805 - Fixed contrib/fastrpz.patch, even though this already applied
3806 cleanly for me, now also for others.
3807 - patch to log creates keytag queries, from A. Schulze.
3808 - patch suggested by Debian lintian: allow to -> allow one to, from
3810 - Attempt to remove warning about trailing whitespace.
3812 6 March 2018: Wouter
3813 - Reverted fix for #3512, this may not be the best way forward;
3814 although it could be changed at a later time, to stay similar to
3815 other implementations.
3816 - svn trunk contains 1.7.0, this is the number for the next release.
3817 - Fix for windows compile.
3820 5 March 2018: Wouter
3821 - Fix to check define of DSA for when openssl is without deprecated.
3823 - Fix #3582: Squelch address already in use log when reuseaddr option
3824 causes same port to be used twice for tcp connections.
3826 27 February 2018: Wouter
3827 - Fixup contrib/fastrpz.patch so that it applies.
3828 - Fix compile without threads, and remove unused variable.
3829 - Fix compile with staticexe and python module.
3830 - Fix nettle compile.
3832 22 February 2018: Ralph
3833 - Save wildcard RRset from answer with original owner for use in
3836 21 February 2018: Wouter
3837 - Fix #3512: unbound incorrectly reports SERVFAIL for CAA query
3838 when there is a CNAME loop.
3839 - Fix validation for CNAME loops. When it detects a cname loop,
3840 by finding the cname, cname in the existing list, it returns
3841 the partial result with the validation result up to then.
3842 - more robust cachedump rrset routine.
3844 19 February 2018: Wouter
3845 - Fix #3505: Documentation for default local zones references
3847 - Fix #3494: local-zone noview can be used to break out of the view
3848 to the global local zone contents, for queries for that zone.
3849 - Fix for more maintainable code in localzone.
3851 16 February 2018: Wouter
3852 - Fixes for clang static analyzer, the missing ; in
3853 edns-subnet/addrtree.c after the assert made clang analyzer
3854 produce a failure to analyze it.
3856 13 February 2018: Ralph
3857 - Aggressive NSEC tests
3859 13 February 2018: Wouter
3860 - tls-cert-bundle option in unbound.conf enables TLS authentication.
3863 12 February 2018: Wouter
3864 - Unit test for auth zone https url download.
3866 12 February 2018: Ralph
3867 - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test)
3868 - Processed aggressive NSEC code review remarks Wouter
3870 8 February 2018: Ralph
3871 - Aggressive use of NSEC implementation. Use cached NSEC records to
3872 generate NXDOMAIN, NODATA and positive wildcard answers.
3874 8 February 2018: Wouter
3876 - auth zone url config.
3878 5 February 2018: Wouter
3879 - Fix #3451: dnstap not building when you have a separate build dir.
3880 And removed protoc warning, set dnstap.proto syntax to proto2.
3881 - auth-zone provides a way to configure RFC7706 from unbound.conf,
3882 eg. with auth-zone: name: "." for-downstream: no for-upstream: yes
3883 fallback-enabled: yes and masters or a zonefile with data.
3885 2 February 2018: Wouter
3886 - Fix unfreed locks in log and arc4random at exit of unbound.
3887 - unit test with valgrind
3888 - Fix lock race condition in dns cache dname synthesis.
3889 - lock subnet new item before insertion to please checklocks,
3890 no modification of critical regions outside of lock region.
3892 1 February 2018: Wouter
3893 - fix unaligned structure making a false positive in checklock
3896 29 January 2018: Ralph
3897 - Use NSEC with longest ce to prove wildcard absence.
3898 - Only use *.ce to prove wildcard absence, no longer names.
3900 25 January 2018: Wouter
3901 - ltrace.conf file for libunbound in contrib.
3903 23 January 2018: Wouter
3904 - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file
3905 for startup scripts to get the full pathname(s) of anchor file(s).
3906 - Print fatal errors about remote control setup before log init,
3907 so that it is printed to console.
3909 22 January 2018: Wouter
3910 - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is
3911 also recognized and means the same. Also for tls-port,
3912 tls-service-key, tls-service-pem, stub-tls-upstream and
3913 forward-tls-upstream.
3914 - Fix #3397: Fix that cachedb could return a partial CNAME chain.
3915 - Fix #3397: Fix that when the cache contains an unsigned DNAME in
3916 the middle of a cname chain, a result without the DNAME could
3919 19 January 2018: Wouter
3920 - tag 1.6.8 for release with CVE fix.
3921 - trunk has 1.6.9 with fix and previous commits.
3922 - patch for CVE-2017-15105: vulnerability in the processing of
3923 wildcard synthesized NSEC records.
3925 - make depend: code dependencies updated in Makefile.
3927 4 January 2018: Ralph
3928 - Copy query and correctly set flags on REFUSED answers when cache
3929 snooping is not allowed.
3931 3 January 2018: Ralph
3932 - Fix queries being leaked above stub when refetching glue.
3934 2 January 2017: Wouter
3935 - Fix that DS queries with referral replies are answered straight
3936 away, without a repeat query picking the DS from cache.
3937 The correct reply should have been an answer, the reply is fixed
3938 by the scrubber to have the answer in the answer section.
3939 - Remove clang optimizer disable,
3940 Fix that expiration date checks don't fail with clang -O2.
3942 15 December 2017: Wouter
3943 - Fix timestamp failure because of clang optimizer failure, by
3944 disabling -O2 when the compiler --version is clang.
3946 - Also disable -flto for clang, to make incep-expi signature check
3949 12 December 2017: Ralph
3950 - Fix qname-minimisation documentation (A QTYPE, not NS)
3952 12 December 2017: Wouter
3953 - authzone work, transfer connect.
3955 7 December 2017: Ralph
3956 - Check whether --with-libunbound-only is set when using --with-nettle
3959 4 December 2017: Wouter
3960 - Fix link failure on OmniOS.
3962 1 December 2017: Wouter
3965 30 November 2017: Wouter
3966 - Fix #3299 - forward CNAME daisy chain is not working
3968 14 November 2017: Wouter
3969 - Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is
3970 set for stub zone. It no longer searches for DNSSEC information.
3971 - auth xfer work on probe timer and lookup.
3973 13 November 2017: Wouter
3974 - Fix #2801: Install libunbound.pc.
3975 - Fix qname minimisation to send AAAA queries at zonecut like type A.
3976 - reverted AAAA change.
3978 7 November 2017: Wouter
3979 - Fix #2492: Documentation libunbound.
3981 3 November 2017: Wouter
3982 - Fix #2362: TLS1.3/openssl-1.1.1 not working.
3983 - Fix #2034 - Autoconf and -flto.
3984 - Fix #2141 - for libsodium detect lack of entropy in chroot, print
3987 2 November 2017: Wouter
3988 - Fix #1913: ub_ctx_config is under circumstances thread-safe.
3989 - make ip-transparent option work on OpenBSD.
3991 31 October 2017: Wouter
3992 - Document that errno is left informative on libunbound config read
3997 25 October 2017: Ralph
3998 - Fixed libunbound manual typo.
3999 - Fix #1949: [dnscrypt] make provider name mismatch more obvious.
4000 - Fix #2031: Double included headers
4002 24 October 2017: Ralph
4003 - Update B root ipv4 address.
4005 19 October 2017: Wouter
4006 - authzone work, probe timer setup.
4008 18 October 2017: Wouter
4009 - lint for recent authzone commit.
4011 17 October 2017: Wouter
4012 - Fix #1749: With harden-referral-path: performance drops, due to
4013 circular dependency in NS and DS lookups.
4014 - [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert
4016 - [dnscrypt] introduce dnscrypt-provider-cert-rotated option,
4018 This option allows handling multiple cert/key pairs while only
4019 distributing some of them.
4020 In order to reliably match a client magic with a given key without
4021 strong assumption as to how those were generated, we need both key and
4022 cert. Likewise, in order to know which ES version should be used.
4023 On the other hand, when rotating a cert, it can be desirable to only
4024 serve the new cert but still be able to handle clients that are still
4025 using the old certs's public key.
4026 The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not
4027 publish the cert as part of the DNS's provider_name's TXT answer.
4028 - Better documentation for cache-max-negative-ttl.
4029 - Work on local root zone code.
4031 10 October 2017: Wouter
4033 - trunk has version 1.6.8.
4035 6 October 2017: Wouter
4036 - Fix spelling in unbound-control man page.
4038 5 October 2017: Wouter
4039 - Fix trust-anchor-signaling works in libunbound.
4040 - Fix some more crpls in testdata for different signaling default.
4043 5 October 2017: Ralph
4044 - Set trust-anchor-signaling default to yes
4045 - Use RCODE from A query on DNS64 synthesized answer.
4047 2 October 2017: Wouter
4048 - Fix param unused warning for windows exportsymbol compile.
4050 25 September 2017: Ralph
4051 - Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
4052 (by Danilo G. Baio).
4054 21 September 2017: Ralph
4055 - Log name of looping module
4057 19 September 2017: Wouter
4058 - use a cachedb answer even if it's "expired" when serve-expired is yes
4059 (patch from Jinmei Tatuya).
4060 - trigger refetching of the answer in that case (this will bypass
4062 - allow storing a 0-TTL answer from cachedb in the in-memory message
4063 cache when serve-expired is yes
4064 - Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
4066 18 September 2017: Ralph
4067 - Fix #1400: allowing use of global cache on ECS-forwarding unless
4070 18 September 2017: Wouter
4071 - tag 1.6.6 (is 1.6.6rc2)
4072 - Fix that looping modules always stop the query, and don't pass
4074 - Fix #1435: Please allow UDP to be disabled separately upstream and
4076 - Fix #1440: [dnscrypt] client nonce cache.
4078 15 September 2017: Wouter
4079 - Fix unbound-host to report error for DNSSEC state of failed lookups.
4080 - Spelling fixes, from Josh Soref.
4082 13 September 2017: Wouter
4083 - tag 1.6.6rc2, became 1.6.6 on 18 sep. trunk 1.6.7 in development.
4085 12 September 2017: Wouter
4086 - Add dns64 for client-subnet in unbound-checkconf.
4088 4 September 2017: Ralph
4089 - Fix #1412: QNAME minimisation strict mode not honored
4090 - Fix #1434: Fix windows openssl 1.1.0 linking.
4092 4 September 2017: Wouter
4094 - makedist fix for windows binaries, with openssl 1.1.0 windres fix,
4095 and expat 2.2.4 install target fix.
4097 1 September 2017: Wouter
4098 - Recommend 1472 buffer size in unbound.conf
4100 31 August 2017: Wouter
4101 - Fix #1424: cachedb:testframe is not thread safe.
4102 - For #1417: escape ; in dnscrypt tests.
4103 - but reverted that, tests fails with that escape.
4104 - Fix #1417: [dnscrypt] shared secret cache counters, and works when
4105 dnscrypt is not enabled. And cache size configuration option.
4107 - Fix #1418: [ip ratelimit] initialize slabhash using
4110 30 August 2017: Wouter
4111 - updated contrib/fastrpz.patch to apply with configparser changes.
4112 - Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
4114 29 August 2017: Wouter
4115 - Fix #1414: fix segfault on parse failure and log_replies.
4116 - zero qinfo in handle_request, this zeroes local_alias and also the
4118 - new keys and certs for dnscrypt tests.
4119 - fixup WKS test on buildhost without servicebyname.
4121 28 August 2017: Wouter
4122 - Fix #1415: patch to free dnscrypt environment on reload.
4123 - iana portlist update
4124 - Fix #1415: [dnscrypt] shared secret cache, patch from
4126 - Small fixes for the shared secret cache patch.
4127 - Fix WKS records on kvm autobuild host, with default protobyname
4128 entries for udp and tcp.
4130 23 August 2017: Wouter
4131 - Fix #1407: Add ECS options check to unbound-checkconf.
4133 - Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
4136 22 August 2017: Wouter
4137 - Fix install of trust anchor when two anchors are present, makes both
4138 valid. Checks hash of DS but not signature of new key. This fixes
4139 the root.key file if created when unbound is installed between
4140 sep11 and oct11 2017.
4141 - tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix).
4142 - trunk version 1.6.6 in development.
4143 - Fix issue on macOX 10.10 where TCP fast open is detected but not
4144 implemented causing TCP to fail. The fix allows fallback to regular
4145 TCP in this case and is also more robust for cases where connectx()
4146 fails for some reason.
4147 - Fix #1402: squelch invalid argument error for fd_set_block on windows.
4149 10 August 2017: Wouter
4150 - Patch to show DNSCrypt status in help output, from Carsten
4153 8 August 2017: Wouter
4154 - Fix #1398: make cachedb secret configurable.
4155 - Remove spaces from Makefile.
4157 7 August 2017: Wouter
4158 - Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
4160 3 August 2017: Ralph
4161 - Remove unused iter_env member (ip6arpa_dname)
4162 - Do not reset rrset.bogus stats when called using stats_noreset.
4163 - Added stats for queries that have been ratelimited by domain
4165 - Do not add rrset_bogus and query ratelimiting stats per thread, these
4166 module stats are global.
4168 3 August 2017: Wouter
4169 - Fix #1394: mix of serve-expired and response-ip could cause a crash.
4171 24 July 2017: Wouter
4172 - upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
4173 config.sub(2016-09-05).
4174 - annotate case statement fallthrough for gcc 7.1.1.
4175 - flex output from flex 2.6.1.
4176 - snprintf of thread number does not warn about truncated string.
4177 - squelch TCP fast open error on FreeBSD when kernel has it disabled,
4178 unless verbosity is high.
4179 - remove warning from windows compile.
4180 - Fix compile with libnettle
4181 - Fix DSA configure switch (--disable dsa) for libnettle and libnss.
4182 - Fix #1365: Add Ed25519 support using libnettle.
4183 - iana portlist update
4185 17 July 2017: Wouter
4186 - Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
4187 - Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
4188 With the -p option unbound does not create a pidfile.
4190 11 July 2017: Wouter
4191 - Fix #1344: RFC6761-reserved domains: test. and invalid.
4192 - Redirect all localhost names to localhost address for RFC6761.
4195 - Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
4196 - Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists)..
4199 - Fix 1332: Bump verbosity of failed chown'ing of the control socket.
4202 - Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
4204 - Fix #1331: libunbound segfault in threaded mode when context is
4206 - Fix pythonmod link line option flag.
4207 - Fix openssl 1.1.0 load of ssl error strings from ssl init.
4209 29 June 2017: Wouter
4210 - Fix python example0 return module wait instead of error for pass.
4211 - iana portlist update
4212 - enhancement for hardened-tls for DNS over TLS. Removed duplicated
4215 27 June 2017: Wouter
4216 - Tag 1.6.4 is created with the 1.6.4rc2 contents.
4217 - Trunk contains 1.6.5, with changes from 26, 27 june.
4218 - Remove signed unsigned warning from authzone.
4219 - Fix that infra cache host hash does not change after reconfig.
4221 26 June 2017: Wouter
4223 Better fixup of dnscrypt_cert_chacha test for different escapes.
4224 - First fix for zero b64 and hex text zone format in sldns.
4225 - unbound-control dump_infra prints port number for address if not 53.
4227 23 June 2017: Wouter
4228 - (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
4230 22 June 2017: Wouter
4234 - Added fastrpz patch to contrib
4236 21 June 2017: Wouter
4237 - Fix #1316: heap read buffer overflow in parse_edns_options.
4239 20 June 2017: Wouter
4240 - Fix warning in pythonmod under clang compiler.
4245 - Fix #1277: disable domain ratelimit by setting value to 0.
4247 16 June 2017: Wouter
4248 - Fix #1301: memory leak in respip and tests.
4249 - Free callback in edns-subnetmod on exit and restart.
4250 - Fix memory leak in sldns_buffer_new_frm_data.
4251 - Fix memory leak in dnscrypt config read.
4252 - Fix dnscrypt chacha cert support ifdefs.
4253 - Fix dnscrypt chacha cert unit test escapes in grep.
4254 - Remove asynclook tests that cause test and purifier problems.
4255 - Fix to unlock view in view test.
4257 15 June 2017: Wouter
4258 - Fix stub zone queries leaking to the internet for
4259 harden-referral-path ns checks.
4260 - Fix query for refetch_glue of stub leaking to internet.
4262 13 June 2017: Wouter
4263 - Fix #1279: Memory leak on reload when python module is enabled.
4264 - Fix #1280: Unbound fails assert when response from authoritative
4265 contains malformed qname. When 0x20 caps-for-id is enabled, when
4266 assertions are not enabled the malformed qname is handled correctly.
4267 - 1.6.3 tag created, with only #1280 fix, trunk is 1.6.4 development.
4268 - More fixes in depth for buffer checks in 0x20 qname checks.
4270 12 June 2017: Wouter
4271 - Fix #1278: Incomplete wildcard proof.
4274 - Added domain name based ECS whitelist.
4277 - Detect chacha for dnscrypt at configure time.
4278 - dnscrypt unit tests with chacha.
4281 - Fix that unbound-control can set val_clean_additional and val_permissive_mode.
4282 - Add dnscrypt XChaCha20 tests.
4285 - Add an explicit type cast for TCP FASTOPEN fix.
4286 - renumbering B-Root's IPv6 address to 2001:500:200::b.
4287 - Fix #1275: cached data in cachedb is never used.
4288 - Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
4291 - Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
4292 (from Manu Bretelle).
4295 - Fix fastopen EPIPE fallthrough to perform connect.
4298 - Also use global local-zones when there is a matching view that does
4299 not have any local-zone specified.
4302 - Fix #1273: cachedb.c doesn't compile with -Wextra.
4303 - If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
4306 - Fix #1269: inconsistent use of built-in local zones with views.
4307 - Add defaults for new local-zone trees added to views using
4311 - Support for openssl EVP_DigestVerify.
4312 - Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
4315 - Fix assertion for low buffer size and big edns payload when worker
4319 - Added redirect-bogus.patch to contrib directory.
4322 - Fix #1270: unitauth.c doesn't compile with higher warning level
4324 - exec_prefix is by default equal to prefix.
4325 - printout localzone for duplicate local-zone warnings.
4328 - authzone cname chain, no rrset duplicates, wildcard doesn't change
4329 rrsets added for cname chain.
4332 - first services/authzone check in, it compiles and reads and writes
4334 - iana portlist update
4337 - Fix #1268: SIGSEGV after log_reopen.
4340 - Fix #1265 to use /bin/kill.
4341 - Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
4342 and compatibility with BoringSSL.
4345 - Fix #1265: contrib/unbound.service contains hardcoded path.
4348 - Use qstate's region for IPSECKEY rrset (ipsecmod).
4351 - Implemented opportunistic IPsec support module (ipsecmod).
4352 - Some whitespace fixup.
4355 - updated dependencies in the makefile.
4356 - document trust-anchor-signaling in example config file.
4357 - updated configure, dependencies and flex output.
4358 - better module memory lookup, fix of unbound-control shm names for
4359 module memory printout of statistics.
4360 - Fix type AVC sldns rrdef.
4363 - Adjust servfail by iterator to not store in cache when serve-expired
4364 is enabled, to avoid overwriting useful information there.
4365 - Fix queries for nameservers under a stub leaking to the internet.
4368 - Add 'c' to getopt() in testbound.
4369 - iana portlist update
4372 - Fix tcp-mss failure printout text.
4373 - Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
4374 connect limited tcp connections. With the option tcp connections
4375 can share the same source port (for different destinations).
4378 - Added mesh_add_sub to add detached mesh entries.
4379 - Use mesh_add_sub for key tag signaling query.
4382 - Added test for leak of stub information.
4383 - Fix sldns wire2str printout of RR type CAA tags.
4384 - Fix sldns int16_data parse.
4385 - Fix sldns parse and printout of TSIG RRs.
4386 - sldns SMIMEA and AVC definitions, same as getdns definitions.
4389 - Fix #1259: "--disable-ecdsa" argument overwritten
4390 by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
4391 - iana portlist update
4392 - Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
4393 and fix that 64bit getting installed in C:\Program Files (x86).
4395 26 April 2017: Ralph
4396 - Implemented trust anchor signaling using key tag query.
4398 26 April 2017: Wouter
4399 - Based on #1257: check parse limit before t increment in sldns RR
4400 string parse routine.
4402 24 April 2017: Wouter
4403 - unbound-checkconf -o allows query of dnstap config variables.
4404 Also unbound-control get_option. Also for dnscrypt.
4405 - trunk contains 1.6.3 version number (changes from 1.6.2 back from
4406 when the 1.6.2rc1 tag has been created).
4408 21 April 2017: Ralph
4409 - Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
4410 - iana portlist update
4412 18 April 2017: Ralph
4413 - Fix #1252: more indentation inconsistencies.
4414 - Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
4416 13 April 2017: Ralph
4417 - Added ECS unit test (from Manu Bretelle).
4418 - ECS documentation fix (from Manu Bretelle).
4420 13 April 2017: Wouter
4421 - Fix #1250: inconsistent indentation in services/listen_dnsport.c.
4423 - (for 1.6.3:) unbound.h exports the shm stats structures. They use
4424 type long long and no ifdefs, and ub_ before the typenames.
4426 12 April 2017: Wouter
4427 - subnet mem value is available in shm, also when not enabled,
4428 to make the struct easier to memmap by other applications,
4429 independent of the configuration of unbound.
4431 12 April 2017: Ralph
4432 - Fix #1247: unbound does not shorten source prefix length when
4434 - Properly check for allocation failure in local_data_find_tag_datas.
4435 - Fix #1249: unbound doesn't return FORMERR to bogus ECS.
4436 - Set SHM ECS memory usage to 0 when module not loaded.
4438 11 April 2017: Ralph
4439 - Display ECS module memory usage.
4441 10 April 2017: Wouter
4442 - harden-algo-downgrade: no also makes unbound more lenient about
4443 digest algorithms in DS records.
4445 10 April 2017: Ralph
4446 - Remove ECS option after REFUSED answer.
4447 - Fix small memory leak in edns_opt_copy_alloc.
4448 - Respip dereference after NULL check.
4449 - Zero initialize addrtree allocation.
4450 - Use correct identifier for SHM destroy.
4452 7 April 2017: George
4453 - Fix pythonmod for cb changes.
4454 - Some whitespace fixup.
4457 - Unlock view in respip unit test
4460 - Generalise inplace callback (de)registration
4461 - (de)register inplace callbacks for module id
4462 - No unbound-control set_option for ECS options
4463 - Deprecated client-subnet-opcode config option
4464 - Introduced client-subnet-always-forward config option
4465 - Changed max-client-subnet-ipv6 default to 56 (as in RFC)
4466 - Removed extern ECS config options
4467 - module_restart_next now calls clear on all following modules
4468 - Also create ECS module qstate on module_event_pass event
4469 - remove malloc from inplace_cb_register
4471 6 April 2017: Wouter
4472 - Small fixup for documentation.
4473 - iana portlist update
4474 - Fix respip for braces when locks arent used.
4475 - Fix pythonmod for cb changes.
4477 4 April 2017: Wouter
4478 - Fix #1244: document that use of chroot requires trust anchor file to
4480 - iana portlist update
4483 - Do not add current time twice to TTL before ECS cache store.
4484 - Do not touch rrset cache after ECS cache message generation.
4485 - Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode.
4487 3 April 2017: Wouter
4488 - Fix #1217: Add metrics to unbound-control interface showing
4489 crypted, cert request, plaintext and malformed queries (from
4491 - iana portlist update
4493 27 March 2017: Wouter
4494 - Remove (now unused) event2 include from dnscrypt code.
4496 24 March 2017: George
4497 - Fix to prevent non-referal query from being cached as referal when the
4498 no_cache_store flag was set.
4500 23 March 2017: Wouter
4501 - Fix #1239: configure fails to find python distutils if python
4504 22 March 2017: Wouter
4505 - Fix #1238: segmentation fault when adding through the remote
4506 interface a per-view local zone to a view with no previous
4507 (configured) local zones.
4508 - Fix #1229: Systemd service sandboxing, options in wrong sections.
4510 21 March 2017: Ralph
4511 - Merge EDNS Client subnet implementation from feature branch into main
4512 branch, using new EDNS processing framework.
4514 21 March 2017: Wouter
4515 - Fix doxygen for dnscrypt files.
4517 20 March 2017: Wouter
4518 - #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then
4519 enabled in the config file from Manu Bretelle.
4520 - make depend, autoconf, remove warnings about statement before var.
4521 - lru_demote and lruhash_insert_or_retrieve functions for getdns.
4522 - fixup for lruhash (whitespace and header file comment).
4525 17 March 2017: Wouter
4526 - Patch for view functionality for local-data-ptr from Björn Ketelaars.
4527 - Fix #1237 - Wrong resolving in chain, for norec queries that get
4530 16 March 2017: Wouter
4531 - Fix that SHM is not inited if not enabled.
4532 - Add trustanchor.unbound CH TXT that gets a response with a number
4533 of TXT RRs with a string like "example.com. 2345 1234" with
4534 the trust anchors and their keytags.
4535 - Fix that looped DNAMEs do not cause unbound to spend effort.
4536 - trustanchor tags are sorted. reusable routine to fetch taglist.
4538 13 March 2017: Wouter
4539 - testbound understands Deckard MATCH rcode question answer commands.
4540 - Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead
4541 of YXDOMAIN + query loop, reported by Petr Spacek.
4543 10 March 2017: Wouter
4544 - Fix #1234: shortening DNAME loop produces duplicate DNAME records
4547 9 March 2017: Wouter
4548 - --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and
4549 DS records. NSEC3 is not disabled.
4550 - fake-sha1 test option; print warning if used. To make unit tests.
4551 - unbound-control list local zone and data commands listed in the
4554 8 March 2017: Wouter
4555 - make depend for build dependencies.
4556 - swig version 2.0.1 required.
4557 - fix enum conversion warnings
4559 7 March 2017: Wouter
4560 - Fix #1230: swig version 2.0.0 is required for pythonmod, with
4561 1.3.40 it crashes when running repeatly unbound-control reload.
4562 - Response actions based on IP address from Jinmei Tatuya (Infoblox).
4564 6 March 2017: Wouter
4565 - Fix #1229: Systemd service sandboxing in contrib/unbound.service.
4566 - iana portlist update
4568 28 February 2017: Ralph
4569 - Fix testpkts.c, check if DO bit is set, not only if there is an OPT
4572 28 February 2017: Wouter
4573 - For #1227: if we have sha256, set the cipher list to have no
4576 27 February 2017: Wouter
4577 - Fix #1227: Fix that Unbound control allows weak ciphersuits.
4578 - Fix #1226: provide official 32bit binary for windows.
4580 24 February 2017: Wouter
4581 - include sys/time.h for new shm code on NetBSD.
4583 23 February 2017: Wouter
4584 - Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to
4586 - Patch from Luiz Fernando Softov for Stats Shared Memory.
4587 - unbound-control stats_shm command prints stats using shared memory,
4588 which uses less cpu.
4589 - make depend, autoconf, doxygen and lint fixed up.
4591 22 February 2017: Wouter
4592 - Fix #1224: Fix that defaults should not fall back to "Program Files
4593 (x86) if Unbound is 64bit by default on windows.
4595 21 February 2017: Wouter
4596 - iana portlist update
4598 16 February 2017: Wouter
4599 - sldns updated for vfixed and buffer resize indication from getdns.
4601 15 February 2017: Wouter
4602 - sldns has ED25519 and ED448 algorithm number and name for display.
4604 14 February 2017: Wouter
4605 - tag 1.6.1rc3. -- which became 1.6.1 on 21feb, trunk has 1.6.2
4607 13 February 2017: Wouter
4608 - Fix autoconf of systemd check for lack of pkg-config.
4610 10 February 2017: Wouter
4611 - Fix pythonmod for typedef changes.
4612 - Fix dnstap for warning of set but not used.
4615 9 February 2017: Wouter
4618 8 February 2017: Wouter
4619 - Fix for type name change and fix warning on windows compile.
4621 7 February 2017: Wouter
4622 - Include root trust anchor id 20326 in unbound-anchor.
4624 6 February 2017: Wouter
4625 - Fix compile on solaris of the fix to use $host detect.
4627 4 February 2017: Wouter
4628 - fix root_anchor test for updated icannbundle.pem lower certificates.
4630 26 January 2017: Wouter
4631 - Fix 1211: Fix can't enable interface-automatic if no IPv6 with
4632 more helpful error message.
4634 20 January 2017: Wouter
4635 - Increase MAX_MODULE to 16.
4637 19 January 2017: Wouter
4638 - Fix to Rename ub_callback_t to ub_callback_type, because POSIX
4639 reserves _t typedefs.
4640 - Fix to rename internally used types from _t to _type, because _t
4641 type names are reserved by POSIX.
4642 - iana portlist update
4644 12 January 2017: Wouter
4645 - Fix to also block meta types 128 through to 248 with formerr.
4646 - Fix #1206: Some view-related commands are missing from 'unbound-control -h'
4648 9 January 2017: Wouter
4649 - Fix #1202: Fix code comment that packed_rrset_data is not always
4652 6 January 2017: Wouter
4653 - Fix #1201: Fix missing unlock in answer_from_cache error condition.
4655 5 January 2017: Wouter
4656 - Fix to return formerr for queries for meta-types, to avoid
4657 packet amplification if this meta-type is sent on to upstream.
4658 - Fix #1184: Log DNS replies. This includes the same logging
4659 information that DNS queries and response code and response size,
4660 patch from Larissa Feng.
4661 - Fix #1187: Source IP rate limiting, patch from Larissa Feng.
4663 3 January 2017: Wouter
4664 - configure --enable-systemd and lets unbound use systemd sockets if
4665 you enable use-systemd: yes in unbound.conf.
4666 Also there are contrib/unbound.socket and contrib/unbound.service:
4667 systemd files for unbound, install them in /usr/lib/systemd/system.
4668 Contributed by Sami Kerola and Pavel Odintsov.
4669 - Fix reload chdir failure when also chrooted to that directory.
4671 2 January 2017: Wouter
4672 - Fix #1194: Cross build fails when $host isn't `uname` for getentropy.
4674 23 December 2016: Ralph
4675 - Fix #1190: Do not echo back EDNS options in local-zone error response.
4676 - iana portlist update
4678 21 December 2016: Ralph
4679 - Fix #1188: Unresolved symbol 'fake_dsa' in libunbound.so when built
4682 19 December 2016: Ralph
4683 - Fix #1191: remove comment about view deletion.
4685 15 December 2016: Wouter
4686 - iana portlist update
4687 - 64bit is default for windows builds.
4688 - Fix inet_ntop and inet_pton warnings in windows compile.
4690 14 December 2016: Wouter
4691 - Fix #1178: attempt to fix setup error at end, pop result values
4694 13 December 2016: Wouter
4695 - Fix #1182: Fix Resource leak (socket), at startup.
4696 - Fix unbound-control and ipv6 only.
4698 9 December 2016: Wouter
4699 - Fix #1176: stack size too small for Alpine Linux.
4701 8 December 2016: Wouter
4702 - Fix downcast warnings from visual studio in sldns code.
4703 - tag 1.6.0rc1 which became 1.6.0 on 15 dec, and trunk is 1.6.1.
4705 7 December 2016: Ralph
4706 - Add DSA support for OpenSSL 1.1.0
4707 - Fix remote control without cert for LibreSSL
4709 6 December 2016: George
4710 - Added generic EDNS code for registering known EDNS option codes,
4711 bypassing the cache response stage and uniquifying mesh states. Four EDNS
4712 option lists were added to module_qstate (module_qstate.edns_opts_*) to
4713 store EDNS options from/to front/back side.
4714 - Added two flags to module_qstate (no_cache_lookup, no_cache_store) that
4715 control the modules' cache interactions.
4716 - Added code for registering inplace callback functions. The registered
4717 functions can be called just before replying with local data or Chaos,
4718 replying from cache, replying with SERVFAIL, replying with a resolved
4719 query, sending a query to a nameserver. The functions can inspect the
4720 available data and maybe change response/query related data (i.e. append
4722 - Updated Python module for the above.
4723 - Updated Python documentation.
4725 5 December 2016: Ralph
4726 - Fix #1173: differ local-zone type deny from unset
4727 tag_actions element.
4729 5 December 2016: Wouter
4730 - Fix #1170: document that 'inform' local-zone uses local-data.
4732 1 December 2016: Ralph
4733 - hyphen as minus fix, by Andreas Schulze
4735 30 November 2016: Ralph
4736 - Added local-zones and local-data bulk addition and removal
4737 functionality in unbound-control (local_zones, local_zones_remove,
4738 local_datas and local_datas_remove).
4739 - iana portlist update
4741 29 November 2016: Wouter
4742 - version 1.6.0 is in the development branch.
4743 - braces in view.c around lock statements.
4745 28 November 2016: Wouter
4748 25 November 2016: Wouter
4749 - Fix that with openssl 1.1 control-use-cert: no uses less cpu, by
4750 using no encryption over the unix socket.
4752 22 Novenber 2016: Ralph
4753 - Make access-control-tag-data RDATA absolute. This makes the RDATA
4754 origin consistent between local-data and access-control-tag-data.
4755 - Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
4756 subdomain of the NSEC owner.
4757 - QNAME minimisation uses QTYPE=A, therefore always check cache for
4758 this type in harden-below-nxdomain functionality.
4759 - Added unit test for QNAME minimisation + harden below nxdomain
4762 22 November 2016: Wouter
4763 - iana portlist update.
4764 - Fix unit tests for DS hash processing for fake-dsa test option.
4765 - patch from Dag-Erling Smorgrav that removes code that relies
4768 21 November 2016: Wouter
4769 - Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
4770 Underneath" for the harden-below-nxdomain option.
4772 10 November 2016: Ralph
4773 - Fix #1155: test status code of unbound-control in 04-checkconf,
4774 not the status code from the tee command.
4776 4 November 2016: Ralph
4777 - Added stub-ssl-upstream and forward-ssl-upstream options.
4779 4 November 2016: Wouter
4780 - configure detects ssl security level API function in the autoconf
4781 manner. Every function on its own, so that other libraries (eg.
4782 LibreSSL) can develop their API without hindrance.
4783 - Fix #1154: segfault when reading config with duplicate zones.
4784 - Note that for harden-below-nxdomain the nxdomain must be secure,
4785 this means nsec3 with optout is insufficient.
4787 3 November 2016: Ralph
4788 - Set OpenSSL security level to 0 when using aNULL ciphers.
4790 3 November 2016: Wouter
4791 - .gitattributes line for githubs code language display.
4792 - log-identity: config option to set sys log identity, patch from
4793 "Robin H. Johnson" <robbat2@gentoo.org>
4795 2 November 2016: Wouter
4796 - iana portlist update.
4798 31 October 2016: Wouter
4799 - Fix failure to build on arm64 with no sbrk.
4800 - iana portlist update.
4802 28 October 2016: Wouter
4803 - Patch for server.num.zero_ttl stats for count of expired replies,
4804 from Pavel Odintsov.
4806 26 October 2016: Wouter
4807 - Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled
4808 with the undocumented switch 'fake-dsa'. It logs a warning.
4810 25 October 2016: Wouter
4811 - Fix #1134: unbound-control set_option -- val-override-date: -1 works
4812 immediately to ignore datetime, or back to 0 to enable it again.
4813 The -- is to ignore the '-1' as an option flag.
4815 24 October 2016: Wouter
4816 - serve-expired config option: serve expired responses with TTL 0.
4817 - g.root-servers.net has AAAA address.
4819 21 October 2016: Wouter
4820 - Ported tests for local_cname unit test to testbound framework.
4822 20 October 2016: Wouter
4823 - suppress compile warning in lex files.
4824 - init lzt variable, for older gcc compiler warnings.
4825 - fix --enable-dsa to work, instead of copying ecdsa enable.
4826 - Fix DNSSEC validation of query type ANY with DNAME answers.
4827 - Fixup query_info local_alias init.
4829 19 October 2016: Wouter
4830 - Fix #1130: whitespace in example.conf.in more consistent.
4832 18 October 2016: Wouter
4833 - Patch that resolves CNAMEs entered in local-data conf statements that
4834 point to data on the internet, from Jinmei Tatuya (Infoblox).
4835 - Removed patch comments from acllist.c and msgencode.c
4836 - Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf,
4837 from Jinmei Tatuya (Infoblox).
4838 - Fix #1125: unbound could reuse an answer packet incorrectly for
4839 clients with different EDNS parameters, from Jinmei Tatuya.
4840 - Fix #1118: libunbound.pc sets strange Libs, Libs.private values.
4841 - Added Requires line to libunbound.pc
4842 - Please doxygen by modifying mesh.h
4844 17 October 2016: Wouter
4845 - Re-fix #839 from view commit overwrite.
4846 - Fixup const void cast warning.
4848 12 October 2016: Ralph
4849 - Free view config elements.
4851 11 October 2016: Ralph
4852 - Added qname-minimisation-strict config option.
4853 - iana portlist update.
4854 - fix memoryleak logfile when in debug mode.
4856 5 October 2016: Ralph
4857 - Added views functionality.
4858 - Fix #1117: spelling errors, from Robert Edmonds.
4860 30 September 2016: Wouter
4861 - Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.
4863 29 September 2016: Wouter
4864 - Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
4865 - Fix #839: Memory grows unexpectedly with large RPZ files.
4866 - Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile.
4867 - Fix #841: big local-zone's make it consume large amounts of memory.
4869 27 September 2016: Wouter
4870 - tag for 1.5.10 release
4871 - trunk contains 1.5.11 in development.
4872 - Fix dnstap relaying "random" messages instead of resolver/forwarder
4873 responses, from Nikolay Edigaryev.
4874 - Fix #836: unbound could echo back EDNS options in an error response.
4876 20 September 2016: Wouter
4877 - iana portlist update.
4878 - Fix #835: fix --disable-dsa with nettle verify.
4879 - tag for 1.5.10rc1 release.
4881 15 September 2016: Wouter
4882 - Fix 883: error for duplicate local zone entry.
4883 - Test for openssl init_crypto and init_ssl functions.
4885 15 September 2016: Ralph
4886 - fix potential memory leak in daemon/remote.c and nullpointer
4887 dereference in validator/autotrust.
4888 - iana portlist update.
4890 13 September 2016: Wouter
4891 - Silenced flex-generated sign-unsigned warning print with gcc
4893 - Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len.
4895 9 September 2016: Wouter
4896 - Fix #831: workaround for spurious fread_chk warning against petal.c
4898 5 September 2016: Ralph
4899 - Take configured minimum TTL into consideration when reducing TTL
4900 to original TTL from RRSIG.
4902 5 September 2016: Wouter
4903 - Fix #829: doc of sldns_wire2str_rdata_buf() return value has an
4904 off-by-one typo, from Jinmei Tatuya (Infoblox).
4905 - Fix incomplete prototypes reported by Dag-Erling Smørgrav.
4906 - Fix #828: missing type in access-control-tag-action redirect results
4909 2 September 2016: Wouter
4910 - Fix compile with openssl 1.1.0 with api=1.1.0.
4912 1 September 2016: Wouter
4913 - RFC 7958 is now out, updated docs for unbound-anchor.
4914 - Fix for compile without warnings with openssl 1.1.0.
4915 - Fix #826: Fix refuse_non_local could result in a broken response.
4916 - iana portlist update.
4918 29 August 2016: Wouter
4919 - Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A.
4921 - Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
4923 25 August 2016: Ralph
4924 - Clarify local-zone-override entry in unbound.conf.5
4926 25 August 2016: Wouter
4927 - 64bit build option for makedist windows compile, -w64.
4929 24 August 2016: Ralph
4930 - Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter
4931 in each iteration in find_tag_datas().
4932 - unbound.conf.5 entries for define-tag, access-control-tag,
4933 access-control-tag-action, access-control-tag-data, local-zone-tag,
4934 and local-zone-override.
4936 23 August 2016: Wouter
4937 - Fix #804: unbound stops responding after outage. Fixes queries
4938 that attempt to wait for an empty list of subqueries.
4939 - Fix #804: lower num_target_queries for iterator also for failed
4942 8 August 2016: Wouter
4943 - Note that OPENPGPKEY type is RFC 7929.
4945 4 August 2016: Wouter
4946 - Fix #807: workaround for possible some "unused" function parameters
4947 in test code, from Jinmei Tatuya.
4949 3 August 2016: Wouter
4950 - use sendmsg instead of sendto for TFO.
4952 28 July 2016: Wouter
4953 - Fix #806: wrong comment removed.
4955 26 July 2016: Wouter
4956 - nicer ratelimit-below-domain explanation.
4958 22 July 2016: Wouter
4959 - Fix #801: missing error condition handling in
4960 daemon_create_workers().
4961 - Fix #802: workaround for function parameters that are "unused"
4963 - Fix #803: confusing (and incorrect) code comment in daemon_cleanup().
4965 20 July 2016: Wouter
4966 - Fix typo in unbound.conf.
4968 18 July 2016: Wouter
4969 - Fix #798: Client-side TCP fast open fails (Linux).
4971 14 July 2016: Wouter
4972 - TCP Fast open patch from Sara Dickinson.
4973 - Fixed unbound.doxygen for 1.8.11.
4976 - access-control-tag-data implemented. verbose(4) prints tag debug.
4979 - Fix dynamic link of anchor-update.exe on windows.
4980 - Fix detect of mingw for MXE package build.
4981 - Fixes for 64bit windows compile.
4982 - Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and
4983 --with-libunbound-only --with-nettle.
4986 - For #787: prefer-ip6 option for unbound.conf prefers to send
4987 upstream queries to ipv6 servers.
4988 - Fix #787: outgoing-interface netblock/64 ipv6 option to use linux
4989 freebind to use 64bits of entropy for every query with random local
4992 30 June 2016: Wouter
4993 - Document always_transparent, always_refuse, always_nxdomain types.
4995 29 June 2016: Wouter
4996 - Fix static compile on windows missing gdi32.
4998 28 June 2016: Wouter
4999 - Create a pkg-config file for libunbound in contrib.
5001 27 June 2016: Wouter
5002 - Fix #784: Build configure assumess that having getpwnam means there
5003 is endpwent function available.
5004 - Updated repository with newer flex and bison output.
5007 - Possibility to specify local-zone type for an acl/tag pair
5008 - Possibility to specify (override) local-zone type for a source address
5011 - Decrease dp attempts at each QNAME minimisation iteration
5013 16 June 2016: Wouter
5014 - Fix tcp timeouts in tv.usec.
5016 15 June 2016: Wouter
5017 - TCP_TIMEOUT is specified in milliseconds.
5018 - If more than half of tcp connections are in use, a shorter timeout
5019 is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
5022 - QNAME minimisation unit test for dropped QTYPE=A queries.
5024 14 June 2016: Wouter
5025 - Fix 775: unbound-host and unbound-anchor crash on windows, ignore
5026 null delete for wsaevent.
5027 - Fix spelling in freebind option man page text.
5028 - Fix windows link of ssl with crypt32.
5029 - Fix 779: Union casting is non-portable.
5030 - Fix 780: MAP_ANON not defined in HP-UX 11.31.
5031 - Fix 781: prealloc() is an HP-UX system library call.
5034 - Use QTYPE=A for QNAME minimisation.
5035 - Keep track of number of time-outs when performing QNAME minimisation.
5036 Stop minimising when number of time-outs for a QNAME/QTYPE pair is
5039 13 June 2016: Wouter
5040 - Fix #778: unbound 1.5.9: -h segfault (null deref).
5041 - Fix directory: fix for unbound-checkconf, it restores cwd.
5043 10 June 2016: Wouter
5044 - And delete service.conf.shipped on uninstall.
5045 - In unbound.conf directory: dir immediately changes to that directory,
5046 so that include: file below that is relative to that directory.
5047 With chroot, make the directory an absolute path inside chroot.
5048 - keep debug symbols in windows build.
5049 - do not delete service.conf on windows uninstall.
5050 - document directory immediate fix and allow EXECUTABLE syntax in it
5054 - Trunk is called 1.5.10 (with previous fixes already in there to 2
5056 - Revert fix for NetworkService account on windows due to breakage
5058 - Fix that windows install will not overwrite existing service.conf
5059 file (and ignore gui config choices if it exists).
5062 - Lookup localzones by taglist from acl.
5063 - Possibility to lookup local_zone, regardless the taglist.
5064 - Added local_zone/taglist/acl unit test.
5067 - Fix #773: Non-standard Python location build failure with pyunbound.
5068 - Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
5071 - Better help text from -h (from Ray Griffith).
5072 - access-control-tag config directive.
5073 - local-zone-override config directive.
5074 - access-control-tag-action and access-control-tag-data config
5076 - free acl-tags, acltag-action and acltag-data config lists during
5077 initialisation to free up memory for more entries.
5080 - Fix to not ignore return value of chown() in daemon startup.
5083 - Fix libubound for edns optlist feature.
5084 - Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc.
5085 - Fix #752: retry resource temporarily unavailable on control pipe.
5086 - un-document localzone tags.
5087 - tag for release 1.5.9rc1.
5088 And this also became release 1.5.9.
5089 - Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to
5090 Program Files with (x86) appended.
5091 - re-documented localzone tags in example.conf.
5094 - Fix windows service to be created run with limited rights, as a
5095 network service account, from Mario Turschmann.
5096 - compat strsep implementation.
5097 - generic edns option parse and store code.
5098 - and also generic edns options for upstream messages (and replies).
5099 after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID),
5100 to insert use edns_opt_append(edns, region, code, len, bindata) on
5101 the opt_list passed to send_query, or in edns_opt_inplace_reply.
5104 - Fix time in case answer comes from cache in ub_resolve_event().
5105 - Attempted fix for #765: _unboundmodule missing for python3.
5108 - Fix #770: Small subgroup attack on DH used in unix pipe on localhost
5109 if unbound control uses a unix local named pipe.
5110 - Document write permission to directory of trust anchor needed.
5111 - Fix #768: Unbound Service Sometimes Can Not Shutdown
5112 Completely, WER Report Shown Up. Close handle before closing WSA.
5115 - Updated patch from Charles Walker.
5118 - disable-dnssec-lame-check config option from Charles Walker.
5119 - remove memory leak from lame-check patch.
5120 - iana portlist update.
5123 - Fix #767: Reference to an expired Internet-Draft in
5124 harden-below-nxdomain documentation.
5127 - No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC
5129 - iana portlist update.
5132 - Fix #766: dns64 should synthesize results on timeout/errors.
5135 - Fix #761: DNSSEC LAME false positive resolving nic.club.
5138 - trunk updated with output of flex 2.6.0.
5141 - Fix memory leak in out-of-memory conditions of local zone add.
5143 29 April 2016: Wouter
5144 - Fix sldns with static checking fixes copied from getdns.
5146 28 April 2016: Wouter
5147 - Fix #759: 0x20 capsforid no longer checks type PTR, for
5148 compatibility with cisco dns guard. This lowers false positives.
5150 18 April 2016: Wouter
5151 - Fix some malformed responses to edns queries get fallback to nonedns.
5153 15 April 2016: Wouter
5154 - cachedb module event handling design.
5156 14 April 2016: Wouter
5157 - cachedb module framework (empty).
5158 - iana portlist update.
5160 12 April 2016: Wouter
5161 - Fix #753: document dump_requestlist is for first thread.
5163 24 March 2016: Wouter
5164 - Document permit-small-holddown for 5011 debug.
5165 - Fix #749: unbound-checkconf gets SIGSEGV when use against a
5166 malformatted conf file.
5168 23 March 2016: Wouter
5169 - OpenSSL 1.1.0 portability, --disable-dsa configure option.
5171 21 March 2016: Wouter
5172 - Fix compile of getentropy_linux for SLES11 servicepack 4.
5173 - Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev.
5174 - Fix test for openssl to use HMAC_Update for 1.1.0.
5175 - acx_nlnetlabs.m4 to v33, with HMAC_Update.
5176 - acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto.
5177 - ERR_remove_state deprecated since openssl 1.0.0.
5178 - OPENSSL_config is deprecated, removing.
5180 18 March 2016: Ralph
5181 - Validate QNAME minimised NXDOMAIN responses.
5182 - If QNAME minimisation is enabled, do cache lookup for QTYPE NS in
5183 harden-below-nxdomain.
5185 17 March 2016: Ralph
5186 - Limit number of QNAME minimisation iterations.
5188 17 March 2016: Wouter
5189 - Fix #746: Fix unbound sets CD bit on all forwards.
5190 If no trust anchors, it'll not set CD bit when forwarding to another
5191 server. If a trust anchor, no CD bit on the first attempt to a
5192 forwarder, but CD bit thereafter on repeated attempts to get DNSSEC.
5193 - iana portlist update.
5195 16 March 2016: Wouter
5196 - Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma.
5197 - Fix ip-transparent for tcp on freebsd.
5199 15 March 2016: Wouter
5200 - ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for
5201 binding to an IP address while the interface or address is down.
5203 14 March 2016: Wouter
5204 - Fix warnings in ifdef corner case, older or unknown libevent.
5205 - Fix compile for ub_event code with older libev.
5207 11 March 2016: Wouter
5208 - Remove warning about unused parameter in event_pluggable.c.
5209 - Fix libev usage of dispatch return value.
5210 - No side effects in tolower() call, in case it is a macro.
5211 - For test put free in pluggable api in parenthesis.
5213 10 March 2016: Wouter
5214 - Fixup backend2str for libev.
5216 09 March 2016: Willem
5217 - User defined pluggable event API for libunbound
5218 - Fixup of compile fix for pluggable event API from P.Y. Adi
5221 09 March 2016: Wouter
5222 - Updated configure and ltmain.sh.
5223 - Updated L root IPv6 address.
5225 07 March 2016: Wouter
5226 - Fix #747: assert in outnet_serviced_query_stop.
5227 - iana ports fetched via https.
5228 - iana portlist update.
5230 03 March 2016: Wouter
5231 - configure tests for the weak attribute support by the compiler.
5233 02 March 2016: Wouter
5235 - trunk contains 1.5.9 in development.
5236 - iana portlist update.
5237 - Fix #745: unbound.py - idn2dname throws UnicodeError when idnname
5238 contains trailing dot.
5240 24 February 2016: Wouter
5241 - Fix OpenBSD asynclook lock free that gets used later (fix test code).
5242 - Fix that NSEC3 negative cache is used when there is no salt.
5244 23 February 2016: Wouter
5245 - ub_ctx_set_stub() function for libunbound to config stub zones.
5246 - sorted ubsyms.def file with exported libunbound functions.
5248 19 February 2016: Wouter
5249 - Print understandable debug log when unusable DS record is seen.
5250 - load gost algorithm if digest is seen before key algorithm.
5251 - iana portlist update.
5253 17 February 2016: Wouter
5254 - Fix that "make install" fails due to "text file busy" error.
5256 16 February 2016: Wouter
5257 - Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
5259 15 February 2016: Wouter
5260 - ip-transparent option for FreeBSD with IP_BINDANY socket option.
5261 - wait for sendto to drain socket buffers when they are full.
5263 9 February 2016: Wouter
5264 - Test for type OPENPGPKEY.
5265 - insecure-lan-zones: yesno config option, patch from Dag-Erling
5268 8 February 2016: Wouter
5269 - Fix patch typo in prevuous commit for 734 from Adi Prasaja.
5270 - RR Type CSYNC support RFC 7477, in debug printout and config input.
5271 - RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
5273 29 January 2016: Wouter
5274 - Neater cmdline_verbose increment patch from Edgar Pettijohn.
5276 27 January 2016: Wouter
5277 - Made netbsd sendmsg test nonfatal, in case of false positives.
5278 - Fix #741: log message for dnstap socket connection is more clear.
5280 26 January 2016: Wouter
5281 - Fix #734: chown the pidfile if it resides inside the chroot.
5282 - Use arc4random instead of random in tests (because it is
5283 available, possibly as compat, anyway).
5284 - Fix cmsg alignment for argument to sendmsg on NetBSD.
5285 - Fix that unbound complains about unimplemented IP_PKTINFO for
5286 sendmsg on NetBSD (for interface-automatic).
5288 25 January 2016: Wouter
5289 - Fix #738: Swig should not be invoked with CPPFLAGS.
5291 19 January 2016: Wouter
5292 - Squelch 'cannot assign requested address' log messages unless
5293 verbosity is high, it was spammed after network down.
5295 14 January 2016: Wouter
5296 - Fix to simplify empty string checking from Michael McConville.
5297 - iana portlist update.
5299 12 January 2016: Wouter
5300 - Fix #734: Do not log an error when the PID file cannot be chown'ed.
5301 Patch from Simon Deziel.
5303 11 January 2016: Wouter
5304 - Fix test if -pthreads unused to use better grep for portability.
5306 06 January 2016: Wouter
5307 - Fix mingw crosscompile for recent mingw.
5308 - Update aclocal, autoconf output with new versions (1.15, 2.4.6).
5310 05 January 2016: Wouter
5311 - #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch
5312 from Daisuke Higashi.
5313 - Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
5314 by default, and can be unblocked with "nodefault" localzone config.
5316 04 January 2016: Wouter
5317 - Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
5318 for Linux glibc 2.20.
5319 - Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
5320 source code, so it applies cleanly again. Removed unused variable
5323 15 December 2015: Ralph
5324 - Fix #729: omit use of escape sequences in echo since they are not
5325 portable (unbound-control-setup).
5327 11 December 2015: Wouter
5328 - remove NULL-checks before free, patch from Michael McConville.
5329 - updated ax_pthread.m4 to version 21 with clang support, this
5330 removes a warning from compilation.
5331 - OSX portability, detect if sbrk is deprecated.
5332 - OSX clang, stop -pthread unused during link stage warnings.
5333 - OSX clang new flto check.
5335 10 December 2015: Wouter
5337 - trunk has 1.5.8 in development.
5339 8 December 2015: Wouter
5340 - Fixup 724 for unbound-control.
5342 7 December 2015: Ralph
5343 - Do not minimise forwarded requests.
5345 4 December 2015: Wouter
5346 - Removed unneeded whitespace from example.conf.
5348 3 December 2015: Ralph
5350 - Committed fix to qname minimisation and unit test case for it.
5352 3 December 2015: Wouter
5353 - iana portlist update.
5354 - 1.5.7rc1 prerelease tag.
5356 2 December 2015: Wouter
5357 - Fixup 724: Fix PCA prompt for unbound-service-install.exe.
5358 re-enable stdout printout.
5359 - For 724: Add Changelog to windows binary dist.
5361 1 December 2015: Ralph
5362 - Qname minimisation review fixes
5364 1 December 2015: Wouter
5365 - Fixup 724 fix for fname_after_chroot() calls.
5366 - Remove stdout printout for unbound-service-install.exe
5367 - .gitignore for git users.
5369 30 November 2015: Ralph
5370 - Implemented qname minimisation
5372 30 November 2015: Wouter
5373 - Fix for #724: conf syntax to read files from run dir (on Windows).
5375 25 November 2015: Wouter
5376 - Fix for #720, fix unbound-control-setup windows batch file.
5378 24 November 2015: Wouter
5379 - Fix #720: add windows scripts to zip bundle.
5380 - iana portlist update.
5382 20 November 2015: Wouter
5383 - Added assert on rrset cache correctness.
5384 - Fix that malformed EDNS query gets a response without malformed EDNS.
5386 18 November 2015: Wouter
5387 - newer acx_nlnetlabs.m4.
5388 - spelling fixes from Igor Sobrado Delgado.
5390 17 November 2015: Wouter
5391 - Fix #594. libunbound: optionally use libnettle for crypto.
5392 Contributed by Luca Bruno. Added --with-nettle for use with
5393 --with-libunbound-only.
5394 - refactor nsec3 hash implementation to be more library-portable.
5395 - iana portlist update.
5396 - Fixup DER encoded DSA signatures for libnettle.
5398 16 November 2015: Wouter
5399 - Fix for lenient accept of reverse order DNAME and CNAME.
5401 6 November 2015: Wouter
5402 - Change example.conf: ftp.internic.net to https://www.internic.net
5404 5 November 2015: Wouter
5405 - ACX_SSL_CHECKS no longer adds -ldl needlessly.
5407 3 November 2015: Wouter
5408 - Fix #718: Fix unbound-control-setup with support for env
5409 without HEREDOC bash support.
5411 29 October 2015: Wouter
5412 - patch from Doug Hogan for SSL_OP_NO_SSLvx options.
5413 - Fix #716: nodata proof with empty non-terminals and wildcards.
5415 28 October 2015: Wouter
5416 - Fix checklock testcode for linux threads on exit.
5418 27 October 2015: Wouter
5419 - isblank() compat implementation.
5420 - detect libexpat without xml_StopParser function.
5421 - portability fixes.
5422 - portability, replace snprintf if return value broken.
5424 23 October 2015: Wouter
5425 - Fix #714: Document config to block private-address for IPv4
5426 mapped IPv6 addresses.
5428 22 October 2015: Wouter
5429 - Fix #712: unbound-anchor appears to not fsync root.key.
5431 20 October 2015: Wouter
5433 - trunk tracks development of 1.5.7.
5435 15 October 2015: Wouter
5436 - Fix segfault in the dns64 module in the formaterror error path.
5437 - Fix sldns_wire2str_rdata_scan for malformed RRs.
5438 - tag for 1.5.6rc1 release.
5440 14 October 2015: Wouter
5441 - ANY responses include DNAME records if present, as per Evan Hunt's
5443 - Fix manpage to suggest using SIGTERM to terminate the server.
5445 9 October 2015: Wouter
5446 - Default for ssl-port is port 853, the temporary port assignment
5447 for secure domain name system traffic.
5448 If you used to rely on the older default of port 443, you have
5449 to put a clause in unbound.conf for that. The new value is likely
5450 going to be the standardised port number for this traffic.
5451 - iana portlist update.
5453 6 October 2015: Wouter
5455 - trunk tracks the development of 1.5.6.
5457 28 September 2015: Wouter
5458 - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution
5460 - tag for 1.5.5rc1 release.
5461 - makedist.sh: pgp sig echo commands.
5463 25 September 2015: Wouter
5464 - Fix unbound-control flush that does not succeed in removing data.
5466 22 September 2015: Wouter
5467 - Fix config globbed include chroot treatment, this fixes reload of
5468 globs (patch from Dag-Erling Smørgrav).
5469 - iana portlist update.
5470 - Fix #702: New IPs for for h.root-servers.net.
5471 - Remove confusion comment from canonical_compare() function.
5472 - Fix #705: ub_ctx_set_fwd() return value mishandled on windows.
5473 - testbound selftest also works in non-debug mode.
5474 - Fix minor error in unbound.conf.5.in
5475 - Fix unbound.conf(5) access-control description for precedence
5478 31 August 2015: Wouter
5479 - changed windows setup compression to be more transparent.
5481 28 August 2015: Wouter
5482 - Fix #697: Get PY_MAJOR_VERSION failure at configure for python
5484 - Feature #699: --enable-pie option to that builds PIE binary.
5485 - Feature #700: --enable-relro-now option that enables full read-only
5488 24 August 2015: Wouter
5489 - Fix deadlock for local data add and zone add when unbound-control
5490 list_local_data printout is interrupted.
5491 - iana portlist update.
5492 - Change default of harden-algo-downgrade to off. This is lenient
5493 for algorithm rollover.
5495 13 August 2015: Wouter
5496 - 5011 implementation does not insist on all algorithms, when
5497 harden-algo-downgrade is turned off.
5498 - Reap the child process that libunbound spawns.
5500 11 August 2015: Wouter
5501 - Fix #694: configure script does not detect LibreSSL 2.2.2
5503 4 August 2015: Wouter
5504 - Document that local-zone nodefault matches exactly and transparent
5505 can be used to release a subzone.
5507 3 August 2015: Wouter
5508 - Document in the manual more text about configuring locally served
5510 - Fix 5011 anchor update timer after reload.
5511 - Fix mktime in unbound-anchor not using UTC.
5513 30 July 2015: Wouter
5514 - please afl-gcc (llvm) for uninitialised variable warning.
5515 - Added permit-small-holddown config to debug fast 5011 rollover.
5517 24 July 2015: Wouter
5518 - Fix #690: Reload fails when so-reuseport is yes after changing
5520 - iana portlist update.
5522 21 July 2015: Wouter
5523 - Fix configure to detect SSL_CTX_set_ecdh_auto.
5524 - iana portlist update.
5526 20 July 2015: Wouter
5527 - Enable ECDHE for servers. Where available, use
5528 SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to
5529 enable ECDHE. Otherwise, manually offer curve p256.
5530 Client connections should automatically use ECDHE when available.
5531 (thanks Daniel Kahn Gillmor)
5533 18 July 2015: Willem
5534 - Allow certificate chain files to allow for intermediate certificates.
5535 (thanks Daniel Kahn Gillmor)
5537 13 July 2015: Wouter
5538 - makedist produces sha1 and sha256 files for created binaries too.
5542 - trunk has 1.5.5 in development.
5543 - Fix #681: Setting forwarders with unbound-control forward
5544 implicitly turns on forward-first.
5546 29 June 2015: Wouter
5547 - iana portlist update.
5548 - Fix alloc with log for allocation size checks.
5550 26 June 2015: Wouter
5551 - Fix #677 Fix DNAME responses from cache that failed internal chain
5553 - iana portlist update.
5555 22 June 2015: Wouter
5556 - Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly
5557 and was therefore always synthesized (thanks to Valentin Dietrich).
5560 - RFC 7553 RR type URI support, is now enabled by default.
5563 - Fix #674: Do not free pointers given by getenv.
5566 - Fix that unparseable error responses are ratelimited.
5567 - SOA negative TTL is capped at minimumttl in its rdata section.
5568 - cache-max-negative-ttl config option, default 3600.
5571 - Document that ratelimit works with unbound-control set_option.
5574 - iana portlist update.
5575 - documentation proposes ratelimit of 1000 (closer to what upstream
5576 servers expect from us).
5579 - DLV is going to be decommissioned. Advice to stop using it, and
5580 put text in the example configuration and man page to that effect.
5583 - Change syntax of particular validator error to be easier for
5584 machine parse, swap rrset and ip adres info so it looks like:
5585 validation failure <www.example.nl. TXT IN>: signature crypto
5586 failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
5589 - caps-whitelist in unbound.conf allows whitelist of loadbalancers
5590 that cannot work with caps-for-id or its fallback.
5592 30 April 2015: Wouter
5593 - Unit test for type ANY synthesis.
5595 22 April 2015: Wouter
5596 - Removed contrib/unbound_unixsock.diff, because it has been
5597 integrated, use control-interface: /path in unbound.conf.
5598 - iana portlist update.
5600 17 April 2015: Wouter
5601 - Synthesize ANY responses from cache. Does not search exhaustively,
5602 but MX,A,AAAA,SOA,NS also CNAME.
5603 - Fix leaked dns64prefix configuration string.
5605 16 April 2015: Wouter
5606 - Add local-zone type inform_deny, that logs query and drops answer.
5607 - Ratelimit does not apply to prefetched queries, and ratelimit-factor
5608 is default 10. Repeated normal queries get resolved and with
5609 prefetch stay in the cache.
5610 - Fix bug#664: libunbound python3 related fixes (from Tomas Hozza)
5611 Use print_function also for Python2.
5612 libunbound examples: produce sorted output.
5613 libunbound-Python: libldns is not used anymore.
5614 Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
5616 10 April 2015: Wouter
5617 - unbound-control ratelimit_list lists high rate domains.
5618 - ratelimit feature, ratelimit: 100, or some sensible qps, can be
5619 used to turn it on. It ratelimits recursion effort per zone.
5620 For particular names you can configure exceptions in unbound.conf.
5621 - Fix that get_option for cache-sizes does not print double newline.
5622 - Fix#663: ssl handshake fails when using unix socket because dh size
5625 8 April 2015: Wouter
5626 - Fix crash in dnstap: Do not try to log TCP responses after timeout.
5628 7 April 2015: Wouter
5629 - Libunbound skips dos-line-endings from etc/hosts.
5630 - Unbound exits with a fatal error when the auto-trust-anchor-file
5631 fails to be writable. This is seconds after startup. You can
5632 load a readonly auto-trust-anchor-file with trust-anchor-file.
5633 The file has to be writable to notice the trust anchor change,
5634 without it, a trust anchor change will be unnoticed and the system
5635 will then become inoperable.
5636 - unbound-control list_insecure command shows the negative trust
5637 anchors currently configured, patch from Jelte Jansen.
5639 2 April 2015: Wouter
5640 - Fix #660: Fix interface-automatic broken in the presence of
5643 26 March 2015: Wouter
5644 - remote.c probedelay line is easier to read.
5645 - rename ldns subdirectory to sldns to avoid name collision.
5647 25 March 2015: Wouter
5648 - Fix #657: libunbound(3) recommends deprecated
5649 CRYPTO_set_id_callback.
5650 - If unknown trust anchor algorithm, and libressl is used, error
5651 message encourages upgrade of the libressl package.
5653 23 March 2015: Wouter
5654 - Fix segfault on user not found at startup (from Maciej Soltysiak).
5656 20 March 2015: Wouter
5657 - Fixed to add integer overflow checks on allocation (defense in depth).
5659 19 March 2015: Wouter
5660 - Add ip-transparent config option for bind to non-local addresses.
5662 17 March 2015: Wouter
5663 - Use reallocarray for integer overflow protection, patch submitted
5664 by Loganaden Velvindron.
5666 16 March 2015: Wouter
5667 - Fixup compile on cygwin, more portable openssl thread id.
5669 12 March 2015: Wouter
5670 - Updated default keylength in unbound-control-setup to 3k.
5672 10 March 2015: Wouter
5673 - Fix lintian warning in unbound-checkconf man page (from Andreas
5675 - print svnroot when building windows dist.
5676 - iana portlist update.
5677 - Fix warning on sign compare in getentropy_linux.
5679 9 March 2015: Wouter
5680 - Fix #644: harden-algo-downgrade option, if turned off, fixes the
5681 reported excessive validation failure when multiple algorithms
5682 are present. It allows the weakest algorithm to validate the zone.
5683 - iana portlist update.
5685 5 March 2015: Wouter
5686 - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
5687 scripts. Contributed by Yuri Voinov.
5688 - Document that incoming-num-tcp increase is good for large servers.
5689 - stats reports tcp usage, of incoming-num-tcp buffers.
5691 4 March 2015: Wouter
5692 - Patch from Brad Smith that syncs compat/getentropy_linux with
5693 OpenBSD's version (2015-03-04).
5694 - 0x20 fallback improved: servfail responses do not count as missing
5695 comparisons (except if all responses are errors),
5696 inability to find nameservers does not fail equality comparisons,
5697 many nameservers does not try to compare more than max-sent-count,
5698 parse failures start 0x20 fallback procedure.
5699 - store caps_response with best response in case downgrade response
5700 happens to be the last one.
5701 - Document windows 8 tests.
5703 3 March 2015: Wouter
5705 [ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ]
5707 2 March 2015: Wouter
5708 - iana portlist update.
5710 20 February 2015: Wouter
5711 - Use the getrandom syscall introduced in Linux 3.17 (from Heiner
5713 - Fix #645 Portability to Solaris 10, use AF_LOCAL.
5714 - Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
5715 - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after
5718 19 February 2015: Wouter
5719 - 1.5.2 release tag.
5720 - svn trunk contains 1.5.3 under development.
5722 13 February 2015: Wouter
5723 - Fix #643: doc/example.conf.in: unnecessary whitespace.
5725 12 February 2015: Wouter
5728 11 February 2015: Wouter
5729 - iana portlist update.
5731 10 February 2015: Wouter
5732 - Fix scrubber with harden-glue turned off to reject NS (and other
5733 not-address) records.
5735 9 February 2015: Wouter
5736 - Fix validation failure in case upstream forwarder (ISC BIND) does
5737 not have the same trust anchors and decides to insert unsigned NS
5738 record in authority section.
5740 2 February 2015: Wouter
5741 - infra-cache-min-rtt patch from Florian Riehm, for expected long
5742 uplink roundtrip times.
5744 30 January 2015: Wouter
5745 - Fix 0x20 capsforid fallback to omit gratuitous NS and additional
5747 - Portability fix for Solaris ('sun' is not usable for a variable).
5749 29 January 2015: Wouter
5750 - Fix pyunbound byte string representation for python3.
5752 26 January 2015: Wouter
5753 - Fix unintended use of gcc extension for incomplete enum types,
5754 compile with pedantic c99 compliance (from Daniel Dickman).
5756 23 January 2015: Wouter
5757 - windows port fixes, no AF_LOCAL, no chown, no chmod(grp).
5759 16 January 2015: Wouter
5760 - unit test for local unix connection. Documentation and log_addr
5761 does not inspect port for AF_LOCAL.
5762 - unbound-checkconf -f prints chroot with pidfile path.
5764 13 January 2015: Wouter
5765 - iana portlist update.
5767 12 January 2015: Wouter
5768 - Cast sun_len sizeof to socklen_t.
5769 - Fix pyunbound ord call, portable for python 2 and 3.
5771 7 January 2015: Wouter
5772 - Fix warnings in pythonmod changes.
5774 6 January 2015: Wouter
5775 - iana portlist update.
5776 - patch for remote control over local sockets, from Dag-Erling
5777 Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and
5778 control-use-cert: no.
5779 - Fixup that patch and uid lookup (only for daemon).
5780 - coded the default of control-use-cert, to yes.
5782 5 January 2015: Wouter
5783 - getauxval test for ppc64 linux compatibility.
5784 - make strip works for unbound-host and unbound-anchor.
5785 - patch from Stephane Lapie that adds to the python API, that
5786 exposes struct delegpt, and adds the find_delegation function.
5787 - print query name when max target count is exceeded.
5788 - patch from Stuart Henderson that fixes DESTDIR in
5789 unbound-control-setup for installs where config is not in
5790 the prefix location.
5791 - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing
5792 IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne).
5793 - Updated contrib warmup.cmd/sh to support two modes - load
5794 from pre-defined list of domains or (with filename as argument)
5795 load from user-specified list of domains, and updated contrib
5796 unbound_cache.sh/cmd to support loading/save/reload cache to/from
5797 default path or (with secondary argument) arbitrary path/filename,
5799 - Patch from Philip Paeps to contrib/unbound_munin_ that uses
5800 type ABSOLUTE. Allows munin.conf: [idleserver.example.net]
5801 unbound_munin_hits.graph_period minute
5803 9 December 2014: Wouter
5804 - svn trunk has 1.5.2 in development.
5805 - config.guess and config.sub update from libtoolize.
5806 - local-zone: example.com inform makes unbound log a message with
5807 client IP for queries in that zone. Eg. for finding infected hosts.
5809 8 December 2014: Wouter
5810 - Fix CVE-2014-8602: denial of service by making resolver chase
5811 endless series of delegations.
5813 1 December 2014: Wouter
5814 - Fix bug#632: unbound fails to build on AArch64, protects
5815 getentropy compat code from calling sysctl if it is has been removed.
5817 29 November 2014: Wouter
5818 - Add include to getentropy_linux.c, hopefully fixing debian build.
5820 28 November 2014: Wouter
5821 - Fix makefile for build from noexec source tree.
5823 26 November 2014: Wouter
5824 - Fix libunbound undefined symbol errors for main.
5825 Referencing main does not seem to be possible for libunbound.
5827 24 November 2014: Wouter
5828 - Fix log at high verbosity and memory allocation failure.
5829 - iana portlist update.
5831 21 November 2014: Wouter
5832 - Fix crash on multiple thread random usage on systems without
5835 20 November 2014: Wouter
5836 - fix compat/getentropy_win.c check if CryptGenRandom works and no
5837 immediate exit on windows.
5839 19 November 2014: Wouter
5840 - Fix cdflag dns64 processing.
5842 18 November 2014: Wouter
5843 - Fix that CD flag disables DNS64 processing, returning the DNSSEC
5845 - iana portlist update.
5847 17 November 2014: Wouter
5848 - Fix #627: SSL_CTX_load_verify_locations return code not properly
5851 14 November 2014: Wouter
5852 - parser with bison 2.7
5854 13 November 2014: Wouter
5855 - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter,
5856 added to contrib/aaaa-filter-iterator.patch.
5858 12 November 2014: Wouter
5859 - trunk has 1.5.1 in development.
5860 - Patch from Robert Edmonds to build pyunbound python module
5861 differently. No versioninfo, with -shared and without $(LIBS).
5862 - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page.
5863 - Removed 'increased limit open files' log message that is written
5864 to console. It is only written on verbosity 4 and higher.
5865 This keeps system bootup console cleaner.
5866 - Patch from James Raftery, always print stats for rcodes 0..5.
5868 11 November 2014: Wouter
5869 - iana portlist update.
5870 - Fix bug where forward or stub addresses with same address but
5871 different port number were not tried.
5872 - version number in svn trunk is 1.5.0
5874 - review fix from Ralph.
5876 7 November 2014: Wouter
5877 - dnstap fixes by Robert Edmonds:
5878 dnstap/dnstap.m4: cosmetic fixes
5879 dnstap/: Remove compiled protoc-c output files
5880 dnstap/dnstap.m4: Error out if required libraries are not found
5881 dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of
5883 dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0)
5885 4 November 2014: Wouter
5886 - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically
5887 tracked trust anchor to libunbound.
5888 - Redefine internal minievent symbols to unique symbols that helps
5889 linking on platforms where the linker leaks names across modules.
5891 27 October 2014: Wouter
5892 - Disabled use of SSLv3 in remote-control and ssl-upstream.
5893 - iana portlist update.
5895 16 October 2014: Wouter
5896 - Documented dns64 configuration in unbound.conf man page.
5898 13 October 2014: Wouter
5899 - Fix #617: in ldns in unbound, lowercase WKS services.
5900 - Fix ctype invocation casts.
5902 10 October 2014: Wouter
5903 - Fix unbound-checkconf check for module config with dns64 module.
5904 - Fix unbound capsforid fallback, it ignores TTLs in comparison.
5906 6 October 2014: Wouter
5907 - Fix #614: man page variable substitution bug.
5908 6 October 2014: Willem
5909 - Whitespaces after $ORIGIN are not part of the origin dname (ldns).
5910 - $TTL's value starts at position 5 (ldns).
5912 1 October 2014: Wouter
5913 - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire).
5915 29 September 2014: Wouter
5916 - Fix #612: create service with service.conf in present directory and
5918 - Fix for mingw compile openssl ranlib.
5920 25 September 2014: Wouter
5921 - updated configure and aclocal with newer autoconf 1.13.
5923 22 September 2014: Wouter
5924 - Fix swig and python examples for Python 3.x.
5925 - Fix for mingw compile with openssl-1.0.1i.
5927 19 September 2014: Wouter
5928 - improve python configuration detection to build on Fedora 22.
5930 18 September 2014: Wouter
5931 - patches to also build with Python 3.x (from Pavel Simerda).
5933 16 September 2014: Wouter
5934 - Fix tcp timer waiting list removal code.
5935 - iana portlist update.
5936 - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue
5937 is longer and more tcp connections can be handled.
5939 15 September 2014: Wouter
5940 - Fix unit test for CDS typecode.
5942 5 September 2014: Wouter
5943 - type CDS and CDNSKEY types in sldns.
5945 25 August 2014: Wouter
5946 - Fixup checklock code for log lock and its mutual initialization
5948 - iana portlist update.
5949 - Removed necessity for pkg-config from the dnstap.m4, new are
5950 the --with-libfstrm and --with-protobuf-c configure options.
5952 19 August 2014: Wouter
5953 - Update unbound manpage with more explanation (from Florian Obser).
5955 18 August 2014: Wouter
5956 - Fix #603: unbound-checkconf -o <option> should skip verification
5958 - iana portlist update.
5959 - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings.
5961 5 August 2014: Wouter
5962 - dnstap support, with a patch from Farsight Security, written by
5963 Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c.
5964 It is BSD licensed (see dnstap/dnstap.c).
5965 Building with --enable-dnstap needs pkg-config with this patch.
5966 - Noted dnstap in doc/README and doc/CREDITS.
5967 - Changes to the dnstap patch.
5969 - dnstap/dnstap_config.h should not have been added to the repo,
5970 because is it generated.
5972 1 August 2014: Wouter
5973 - Patch add msg, rrset, infra and key cache sizes to stats command
5974 from Maciej Soltysiak.
5975 - iana portlist update.
5977 31 July 2014: Wouter
5978 - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault.
5979 Initial commit of the patch from the FreeBSD base (with its fixes).
5980 This adds a module (for module-config in unbound.conf) dns64 that
5981 performs DNS64 processing, see README.DNS64.
5982 - Changes from DNS64:
5983 strcpy changed to memmove.
5984 arraybound check fixed from prefix_net/8/4 to prefix_net/8+4.
5985 allocation of result consistently in the correct region.
5986 time_t is now used for ttl in unbound (since the patch's version).
5987 - testdata/dns64_lookup.rpl for unit test for dns64 functionality.
5989 29 July 2014: Wouter
5990 - Patch from Dag-Erling Smorgrav that implements feature, unbound -dd
5991 does not fork in the background and also logs to stderr.
5993 21 July 2014: Wouter
5994 - Fix endian.h include for OpenBSD.
5996 16 July 2014: Wouter
5997 - And Fix#596: Bail out of unbound-control dump_infra when ssl
6000 15 July 2014: Wouter
6001 - Fix #596: Bail out of unbound-control list_local_zones when ssl
6003 - iana portlist update.
6005 13 July 2014: Wouter
6006 - Configure tests if main can be linked to from getentropy compat.
6008 12 July 2014: Wouter
6009 - Fix getentropy compat code, function refs were not portable.
6010 - Fix to check openssl version number only for OpenSSL.
6011 - LibreSSL provides compat items, check for that in configure.
6012 - Fix bug in fix for log locks that caused deadlock in signal handler.
6013 - update compat/getentropy and arc4random to the most recent ones from OpenBSD.
6015 11 July 2014: Matthijs
6016 - fake-rfc2553 patch (thanks Benjamin Baier).
6018 11 July 2014: Wouter
6019 - arc4random in compat/ and getentropy, explicit_bzero, chacha for
6020 dependencies, from OpenBSD. arc4_lock and sha512 in compat.
6021 This makes arc4random available on all platforms, except when
6022 compiled with LIBNSS (it uses libNSS crypto random).
6023 - fix strptime implicit declaration error on OpenBSD.
6024 - arc4random, getentropy and explicit_bzero compat for Windows.
6027 - Fix #593: segfault or crash upon rotating logfile.
6031 - signit tool fixup for compile with libldns library.
6032 - iana portlist updated.
6034 27 June 2014: Wouter
6035 - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X.
6037 26 June 2014: Wouter
6038 - unbound-control status reports if so-reuseport was successful.
6039 - iana portlist updated.
6041 24 June 2014: Wouter
6042 - Fix caps-for-id fallback, and added fallback attempt when servers
6043 drop 0x20 perturbed queries.
6044 - Fixup testsetup for VM tests (run testcode/run_vm.sh).
6046 17 June 2014: Wouter
6047 - iana portlist updated.
6050 - Add AAAA for B root server to default root hints.
6053 - Remove unused define from iterator.h
6056 - Fixup sldns_enum_edns_option typedef definition.
6059 - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue
6060 fixes from FreeBSD's copy of Unbound, he notes:
6061 Generate unbound-control-setup.sh at build time so it respects
6062 prefix and sysconfdir from the configure script. Also fix the
6063 umask to match the comment, and the comment to match the umask.
6064 Add const and static where needed. Use unions instead of
6065 playing pointer poker. Move declarations that are needed in
6066 multiple source files into a shared header. Move sldns_bgetc()
6067 from parse.c to buffer.c where it belongs. Introduce a new
6068 header file, worker.h, which declares the callbacks that
6069 all workers must define. Remove those declarations from
6070 libworker.h. Include the correct headers in the correct places.
6071 Fix a few dummy callbacks that don't match their prototype.
6072 Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK.
6073 Remove a useless printf which breaks reproducible builds.
6074 Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're
6075 no longer used. Add unbound-control-setup.sh to the list of
6076 generated files. The prototype for libworker_event_done_cb()
6077 needs to be moved from libunbound/libworker.h to
6078 libunbound/worker.h.
6079 - Fixup out-of-directory compile with unbound-control-setup.sh.in.
6083 - unbound-host -D enabled dnssec and reads root trust anchor from
6084 the default root key file that was compiled in.
6087 - Feature, unblock-lan-zones: yesno that you can use to make unbound
6088 perform 10.0.0.0/8 and other reverse lookups normally, for use if
6089 unbound is running service for localhost on localhost.
6092 - Updated create_unbound_ad_servers and unbound_cache scripts from
6093 Yuri Voinov in the source/contrib directory. Added
6094 warmup.cmd (and .sh): warm up the DNS cache with your MRU domains.
6097 - Implement draft-ietf-dnsop-rfc6598-rfc6303-01.
6098 - iana portlist updated.
6101 - Contrib windows scripts from Yuri Voinov added to src/contrib:
6102 create_unbound_ad_servers.cmd: enters anti-ad server lists.
6103 unbound_cache.cmd: saves and loads the cache.
6104 - Added unbound-control-setup.cmd from Yuri Voinov to the windows
6105 unbound distribution set. It requires openssl installed in %PATH%.
6108 - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier.
6111 - More #567: remove : from output of stub and forward lists, this is
6114 29 April 2014: Wouter
6115 - iana portlist updated.
6116 - Add unbound-control flush_negative that flushed nxdomains, nodata,
6117 and errors from the cache. For dnssec-trigger and NetworkManager,
6118 fixes cases where network changes have localdata that was already
6119 negatively cached from the previous network.
6121 23 April 2014: Wouter
6122 - Patch from Jeremie Courreges-Anglas to use arc4random_uniform
6123 if available on the OS, it gets entropy from the OS.
6125 15 April 2014: Wouter
6126 - Fix compile with libevent2 on FreeBSD.
6128 11 April 2014: Wouter
6129 - Fix #502: explain that do-ip6 disable does not stop AAAA lookups,
6130 but it stops the use of the ipv6 transport layer for DNS traffic.
6131 - iana portlist updated.
6133 10 April 2014: Wouter
6134 - iana portlist updated.
6135 - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation
6136 option for DNS fragmentation defense.
6137 - Document that dump_requestlist only prints queries from thread 0.
6138 - unbound-control stats prints num.query.tcpout with number of TCP
6139 outgoing queries made in the previous statistics interval.
6140 - Fix #567: unbound lists if forward zone is secure or insecure with
6141 +i annotation in output of list_forwards, also for list_stubs
6142 (for NetworkManager integration.)
6143 - Fix #554: use unsigned long to print 64bit statistics counters on
6145 - Fix #558: failed prefetch lookup does not remove cached response
6146 but delays next prefetch (in lieu of caching a SERVFAIL).
6147 - Fix #545: improved logging, the ip address of the error is printed
6148 on the same log-line as the error.
6150 8 April 2014: Wouter
6151 - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control
6152 in testbound scripts.
6153 - iana portlist updated.
6155 7 April 2014: Wouter
6156 - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root
6157 hints (patch from Anand Buddhdev).
6158 - Fix #572: Fix unit test failure for systems with different
6161 28 March 2014: Wouter
6162 - Fix #569: do_tcp is do-tcp in unbound.conf man page.
6164 25 March 2014: Wouter
6165 - Patch from Stuart Henderson to build unbound-host man from .1.in.
6167 24 March 2014: Wouter
6168 - Fix print filename of encompassing config file on read failure.
6170 12 March 2014: Wouter
6172 - trunk has 1.4.23 in development.
6174 10 March 2014: Wouter
6175 - Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes
6176 because of spelling. Patch from Chris Coates.
6178 27 February 2014: Wouter
6181 21 February 2014: Wouter
6182 - iana portlist updated.
6184 20 February 2014: Matthijs
6185 - Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is
6186 received. This is okay according 4035, but not after revising
6187 existence in 4592. NSEC empty non-terminals exist and thus the
6188 RCODE should have been NOERROR. If this occurs, and the RRsets
6189 are secure, we set the RCODE to NOERROR and the security status
6190 of the response is also considered secure.
6192 14 February 2014: Wouter
6193 - Works on Minix (3.2.1).
6195 11 February 2014: Wouter
6196 - Fix parse of #553(NSD) string in sldns, quotes without spaces.
6198 7 February 2014: Wouter
6199 - iana portlist updated.
6200 - add body to ifstatement if locks disabled.
6201 - add TXT string"string" test case to unit test.
6202 - Fix #551: License change "Regents" to "Copyright holder", matching
6203 the BSD license on opensource.org.
6205 6 February 2014: Wouter
6206 - sldns has type HIP.
6207 - code documentation on the module interface.
6209 5 February 2014: Wouter
6210 - Fix sldns parse tests on osx.
6212 3 February 2014: Wouter
6213 - Detect libevent2 install automatically by configure.
6214 - Fixup link with lib/event2 subdir.
6215 - Fix parse in sldns of quoted parenthesized text strings.
6217 31 January 2014: Wouter
6218 - unit test for ldns wire to str and back with zones, root, nlnetlabs
6220 - Fix for hex to string in unknown, atma and nsap.
6221 - fixup nss compile (no ldns in it).
6222 - fixup warning in unitldns
6223 - fixup WKS and rdata type service to print unsigned because strings
6224 are not portable; they cannot be read (for sure) on other computers.
6225 - fixup type EUI48 and EUI64, type APL and type IPSECKEY in string
6228 30 January 2014: Wouter
6229 - delay-close does not act if there are udp-wait queries, so that
6230 it does not make a socketdrain DoS easier.
6232 28 January 2014: Wouter
6233 - iana portlist updated.
6234 - iana portlist test updated so it does not touch the source
6235 if there are no changes.
6236 - delay-close: msec option that delays closing ports for which
6237 the UDP reply has timed out. Keeps the port open, only accepts
6238 the correct reply. This correct reply is not used, but the port
6239 is open so that no port-denied ICMPs are generated.
6241 27 January 2014: Wouter
6242 - reuseport is attempted, then fallback to without on failure.
6244 24 January 2014: Wouter
6245 - Change unbound-event.h to use void* buffer, length idiom.
6246 - iana portlist updated.
6247 - unbound-event.h is installed if you configure --enable-event-api.
6248 - speed up unbound (reports say it could be up to 10%), by reducing
6249 lock contention on localzones.lock. It is changed to an rwlock.
6250 - so-reuseport: yesno option to distribute queries evenly over
6251 threads on Linux (Thanks Robert Edmonds).
6254 21 January 2014: Wouter
6255 - Fix #547: no trustanchor written if filesystem full, fclose checked.
6257 17 January 2014: Wouter
6258 - Fix isprint() portability in sldns, uses unsigned int.
6259 - iana portlist updated.
6261 16 January 2014: Wouter
6262 - fix #544: Fixed +i causes segfault when running with module conf
6264 - Windows port, adjust %lld to %I64d, and warning in win_event.c.
6266 14 January 2014: Wouter
6267 - iana portlist updated.
6270 - Fix bug in cachedump that uses sldns.
6271 - update pythonmod for ldns_ to sldns_ name change.
6274 - Fix sldns to use sldns_ prefix for all ldns_ variables.
6275 - Fix windows compile to compile with sldns.
6278 - Fix sldns to make globals use sldns_ prefix. This fixes
6279 linking with libldns that uses global variables ldns_ .
6282 - Fix bug#537: compile python plugin without ldns library.
6285 - Fix bug#536: acl_deny_non_local and refuse_non_local added.
6288 - Patch from Neel Goyal to fix async id assignment if callback
6289 is called by libunbound in the mesh attach.
6290 - Accept ip-address: as an alternative for interface: for
6291 consistency with nsd.conf syntax.
6294 - Patch from Neel Goyal to fix callback in libunbound.
6297 - if configured --with-libunbound-only fix make install.
6300 - Fix #531: Set SO_REUSEADDR so that the wildcard interface and a
6301 more specific interface port 53 can be used at the same time, and
6302 one of the daemons is unbound.
6303 - iana portlist update.
6304 - separate ldns into core ldns inside ldns/ subdirectory. No more
6305 --with-ldns is needed and unbound does not rely on libldns.
6306 - portability fixes for new USE_SLDNS ldns subdir codebase.
6309 - Patch from Neel Goyal: Add an API call to set an event base on an
6310 existing ub_ctx. This basically just destroys the current worker and
6311 sets the event base to the current. And fix a deadlock in
6312 ub_resolve_event – the cfglock is held when libworker_create is
6313 called. This ends up trying to acquire the lock again in
6314 context_obtain_alloc in the call chain.
6315 - Fix #528: if very high logging (4 or more) segfault on allow_snoop.
6318 - unbound-event.h is installed if configured --with-libevent. It
6319 contains low-level library calls, that use libevent's event_base
6320 and an ldns_buffer for the wire return packet to perform async
6321 resolution in the client's eventloop.
6324 - 1.4.21 tag created.
6325 - trunk has 1.4.22 number inside it.
6326 - iana portlist updated.
6327 - acx_nlnetlabs.m4 to 26; improve FLTO help text.
6330 - Fix#524: max-udp-size not effective to non-EDNS0 queries, from
6334 - MIN_TTL and MAX_TTL also in time_t.
6335 - tag 1.4.21rc1 made again.
6338 - More fixes for bug#519: for the threaded case test if the bg
6339 thread has been killed, on ub_ctx_delete, to avoid hangs.
6342 - more fixes that I overlooked.
6343 - review fixes from Willem.
6346 - Fix#520: Errors found by static analysis from Tomas Hozza(redhat).
6349 - Fix for 2038, with time_t instead of uint32_t.
6352 - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound).
6355 - Fix uninit variable in fix#516.
6358 - Fix#516 dnssec lameness detection for answers that are improper.
6364 - Fix#512 memleak in testcode for testbound (if it fails).
6365 - Fix#512 NSS returned arrays out of setup function to be statics.
6368 - max include of 100.000 files (depth and globbed at one time).
6369 This is to preserve system memory in bug cases, or endless cases.
6370 - iana portlist updated.
6373 - streamtcp man page, contributed by Tomas Hozza.
6374 - iana portlist updated.
6375 - libunbound documentation on how to avoid openssl race conditions.
6378 - Squelch sendto-permission denied errors when the network is
6379 not connected, to avoid spamming syslog.
6380 - configure --disable-flto option (from Robert Edmonds).
6383 - Fix for const string literals in C++ for libunbound, from Karel
6385 - iana portlist updated.
6388 - Fixup manpage syntax.
6391 - get_option and set_option support for log-time-ascii, python-script
6392 val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect
6393 immediately. The others are mostly useful for libunbound users.
6396 - get_option, set_option, unbound-checkconf -o and libunbound
6397 getoption and setoption support cache-min-ttl and cache-max-ttl.
6400 - Fix#501: forward-first does not recurse, when forward name is ".".
6401 - iana portlist update.
6402 - Max include depth is unlimited.
6405 - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply
6406 patch to it to not fail when -Werror is also specified, from the
6408 - iana portlist update.
6411 - Explain bogus and secure flags in libunbound more.
6414 - Fix#499 use-after-free in out-of-memory handling code (thanks Jake
6416 - Fix#500 use on non-initialised values on socket bind failures.
6419 - Fix round-robin doesn't work with some Windows clients (from Ilya
6423 - update acx_nlnetlabs.m4 to v23, sleep w32 fix.
6425 26 April 2013: Wouter
6426 - add unbound-control insecure_add and insecure_remove for the
6427 administration of negative trust anchors.
6429 25 April 2013: Wouter
6430 - Implement max-udp-size config option, default 4096 (thanks
6432 - Robust checks on dname validity from rdata for dname compare.
6433 - updated iana portlist.
6435 19 April 2013: Wouter
6436 - Fixup snprintf return value usage, fixed libunbound_get_option.
6438 18 April 2013: Wouter
6439 - fix bug #491: pick program name (0th argument) as syslog identity.
6440 - own implementation of compat/snprintf.c.
6442 15 April 2013: Wouter
6443 - Fix so that for a configuration line of include: "*.conf" it is not
6444 an error if there are no files matching the glob pattern.
6445 - unbound-anchor review: BIO_write can return 0 successfully if it
6446 has successfully appended a zero length string.
6448 11 April 2013: Wouter
6449 - Fix queries leaking up for stubs and forwards, if the configured
6450 nameservers all fail to answer.
6452 10 April 2013: Wouter
6453 - code improve for minimal responses, small speed increase.
6455 9 April 2013: Wouter
6456 - updated iana portlist.
6457 - Fix crash in previous private address fixup of 22 March.
6459 28 March 2013: Wouter
6460 - Make reverse zones easier by documenting the nodefault statements
6461 commented-out in the example config file.
6463 26 March 2013: Wouter
6464 - more fixes to lookup3.c endianness detection.
6466 25 March 2013: Wouter
6467 - #492: Fix endianness detection, revert to older lookup3.c detection
6468 and put new detect lines after previous tests, to avoid regressions
6469 but allow new detections to succeed.
6470 And add detection for machine/endian.h to it.
6472 22 March 2013: Wouter
6473 - Fix resolve of names that use a mix of public and private addresses.
6474 - iana portlist update.
6475 - Fix makedist for new svn for -d option.
6476 - unbound.h header file has UNBOUND_VERSION_MAJOR define.
6477 - Fix windows RSRC version for long version numbers.
6479 21 March 2013: Wouter
6482 - committed libunbound version 4:1:2 for binary API updated in 1.4.20
6483 - install copy of unbound-control.8 man page for unbound-control-setup
6485 14 March 2013: Wouter
6486 - iana portlist update.
6489 12 March 2013: Wouter
6490 - Fixup makedist.sh for windows compile.
6492 11 March 2013: Wouter
6493 - iana portlist update.
6494 - testcode/ldns-testpkts.c check for makedist is informational.
6496 15 February 2013: Wouter
6497 - fix defines in lookup3 for bigendian bsd alpha
6499 11 February 2013: Wouter
6500 - Fixup openssl_thread init code to only run if compiled with SSL.
6502 7 February 2013: Wouter
6503 - detect endianness in lookup3 on BSD.
6504 - add libunbound.ttl at end of result structure, version bump for
6505 libunbound and binary backwards compatible, but 1.4.19 is not
6506 forward compatible with 1.4.20.
6507 - update iana port list.
6509 30 January 2013: Wouter
6510 - includes and have_ssl fixes for nss.
6512 29 January 2013: Wouter
6513 - printout name of zone with duplicate fwd and hint errors.
6515 28 January 2013: Wouter
6516 - updated fwd_zero for newer nc. Updated common.sh for newer netstat.
6518 17 January 2013: Wouter
6519 - unbound-anchors checks the emailAddress of the signer of the
6520 root.xml file, default is dnssec@iana.org. It also checks that
6521 the signer has the correct key usage for a digital signature.
6522 - update iana port list.
6524 3 January 2013: Wouter
6525 - Test that unbound-control checks client credentials.
6526 - Test that unbound can handle a CNAME at an intermediate node in
6527 the chain of trust (where it seeks a DS record).
6528 - Check the commonName of the signer of the root.xml file in
6529 unbound-anchor, default is dnssec@iana.org.
6531 2 January 2013: Wouter
6532 - Fix openssl lock free on exit (reported by Robert Fleischman).
6533 - iana portlist updated.
6534 - Tested that unbound implements the RFC5155 Technical Errata id 3441.
6535 Unbound already implements insecure classification of an empty
6536 nonterminal in NSEC3 optout zone.
6538 20 December 2012: Wouter
6539 - Fix unbound-anchor xml parse of entity declarations for safety.
6541 19 December 2012: Wouter
6542 - iana portlist updated.
6544 18 December 2012: Wouter
6545 - iana portlist updated.
6547 14 December 2012: Wouter
6548 - Change of D.ROOT-SERVERS.NET A address in default root hints.
6550 12 December 2012: Wouter
6552 - trunk has 1.4.20 under development.
6554 5 December 2012: Wouter
6555 - note support for AAAA RR type RFC.
6557 4 December 2012: Wouter
6560 30 November 2012: Wouter
6561 - bug 481: fix python example0.
6562 - iana portlist updated.
6564 27 November 2012: Wouter
6565 - iana portlist updated.
6567 9 November 2012: Wouter
6568 - Fix unbound-control forward disables configured stubs below it.
6570 7 November 2012: Wouter
6571 - Fixup ldns-testpkts, identical to ldns/examples.
6572 - iana portlist updated.
6574 30 October 2012: Wouter
6575 - Fix bug #477: unbound-anchor segfaults if EDNS is blocked.
6577 29 October 2012: Matthijs
6578 - Fix validation for responses with both CNAME and wildcard
6579 expanded CNAME records in answer section.
6581 8 October 2012: Wouter
6582 - update ldns-testpkts.c to ldns 1.6.14 version.
6583 - fix build of pythonmod in objdir, for unbound.py.
6584 - make clean and makerealclean remove generated python and docs.
6586 5 October 2012: Wouter
6587 - fix build of pythonmod in objdir (thanks Jakob Schlyter).
6589 3 October 2012: Wouter
6590 - fix text in unbound-anchor man page.
6592 1 October 2012: Wouter
6593 - ignore trusted-keys globs that have no files (from Paul Wouters).
6595 27 September 2012: Wouter
6596 - include: directive in config file accepts wildcards. Patch from
6597 Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*"
6598 - unbound-control -q option is quiet, patch from Mariano Absatz.
6599 - iana portlist updated.
6600 - updated contrib/unbound.spec, patch from Valentin Bud.
6602 21 September 2012: Wouter
6603 - chdir to / after chroot call (suggested by Camiel Dobbelaar).
6605 17 September 2012: Wouter
6606 - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation
6607 otherwise it is treated as insecure. The RSAMD5 algorithm is
6608 deprecated (RFC6725). The MD5 hash is considered weak for some
6609 purposes, if you want to sign your zone, then RSASHA256 is an
6612 30 August 2012: Wouter
6613 - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled.
6614 - iana portlist updated.
6616 29 August 2012: Wouter
6617 - Nicer comments outgoing-port-avoid, thanks Stu (bug #465).
6619 22 August 2012: Wouter
6620 - Fallback to 1472 and 1232, one fragment size without headers.
6622 21 August 2012: Wouter
6623 - Fix timeouts so that when a server has been offline for a while
6624 and is probed to see it works, it becomes fully available for
6625 server selection again.
6627 17 August 2012: Wouter
6628 - Add documentation to libunbound for default nonuse of resolv.conf.
6630 2 August 2012: Wouter
6631 - trunk has 1.4.19 under development (fixes from 1 aug and 31 july
6633 - iana portlist updated.
6635 1 August 2012: Wouter
6636 - Fix openssl race condition, initializes openssl locks, reported
6637 by Einar Lonn and Patrik Wallstrom.
6639 31 July 2012: Wouter
6640 - Improved forward-first and stub-first documentation.
6641 - Fix that enables modules to register twice for the same
6642 serviced_query, without race conditions or administration issues.
6643 This should not happen with the current codebase, but it is robust.
6644 - Fix forward-first option where it sets the RD flag wrongly.
6645 - added manpage links for libunbound calls (Thanks Paul Wouters).
6647 30 July 2012: Wouter
6648 - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012).
6650 27 July 2012: Wouter
6651 - unbound-host works with libNSS
6652 - fix bogus nodata cname chain not reported as bogus by validator,
6653 (Thanks Peter van Dijk).
6655 26 July 2012: Wouter
6656 - iana portlist updated.
6659 25 July 2012: Wouter
6660 - review fix for libnss, check hash prefix allocation size.
6662 23 July 2012: Wouter
6663 - fix missing break for GOST DS hash function.
6664 - implemented forward_first for the root.
6666 20 July 2012: Wouter
6667 - Fix bug#452 and another assertion failure in mesh.c, makes
6668 assertions in mesh.c resist duplicates. Fixes DS NS search to
6669 not generate duplicate sub queries.
6671 19 July 2012: Willem
6672 - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac,
6673 if CFLAGS is specified at configure time then '-g -O2' is not
6674 appended to CFLAGS, so that the user can override them.
6676 18 July 2012: Willem
6677 - Fix libunbound report of errors when in background mode.
6679 11 July 2012: Willem
6680 - updated iana ports list.
6683 - Add flush_bogus option for unbound-control
6686 - Fix validation of qtype DS queries that result in no data for
6687 non-optout NSEC3 zones.
6690 - compile libunbound with libnss on Suse, passes regression tests.
6693 - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.
6696 - updated iana ports list.
6698 29 June 2012: Wouter
6699 - patch for unbound_munin_ script to handle arbitrary thread count by
6702 28 June 2012: Wouter
6703 - detect if openssl has FIPS_mode.
6704 - code review: return value of cache_store can be ignored for better
6705 performance in out of memory conditions.
6706 - fix edns-buffer-size and msg-buffer-size manpage documentation.
6707 - updated iana ports list.
6709 25 June 2012: Wouter
6710 - disable RSAMD5 if in FIPS mode (for openssl and for libnss).
6712 22 June 2012: Wouter
6713 - implement DS records, NSEC3 and ECDSA for compile with libnss.
6715 21 June 2012: Wouter
6716 - fix error handling of alloc failure during rrsig verification.
6717 - nss check for verification failure.
6718 - nss crypto works for RSA and DSA.
6720 20 June 2012: Wouter
6721 - work on --with-nss build option (for now, --with-libunbound-only).
6723 19 June 2012: Wouter
6724 - --with-libunbound-only build option, only builds the library and
6725 not the daemon and other tools.
6727 18 June 2012: Wouter
6730 15 June 2012: Wouter
6731 - implement log-time-ascii on windows.
6732 - The key-cache bad key ttl is now 60 seconds.
6733 - updated iana ports list.
6736 11 June 2012: Wouter
6737 - bug #452: fix crash on assert in mesh_state_attachment.
6740 - silence warning from swig-generated code (md set but not used in
6741 swig initmodule, due to ifdefs in swig-generated code).
6744 - Fix debian-bugs-658021: Please enable hardened build flags.
6747 - updated iana ports list.
6750 - tag for 1.4.17 release.
6751 - trunk is 1.4.18 in development.
6754 - Review comments, removed duplicate memset to zero in delegpt.
6757 - Updated doc/FEATURES with RFCs that are implemented but not listed.
6758 - Protect if statements in val_anchor for compile without locks.
6759 - tag for 1.4.17rc1.
6762 - fix configure ECDSA support in ldns detection for windows compile.
6763 - fix possible uninitialised variable in windows pipe implementation.
6766 - Fix alignment problem in util/random on sparc64/freebsd.
6769 - Fix for accept spinning reported by OpenBSD.
6770 - iana portlist updated.
6773 - Fix validation of nodata for DS query in NSEC zones, reported by
6776 13 April 2012: Wouter
6777 - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older
6780 10 April 2012: Wouter
6781 - Applied patch from Daisuke HIGASHI for rrset-roundrobin and
6782 minimal-responses features.
6783 - iana portlist updated.
6785 5 April 2012: Wouter
6786 - fix bug #443: --with-chroot-dir not honoured by configure.
6787 - fix bug #444: setusercontext was called too late (thanks Bjorn
6790 27 March 2012: Wouter
6791 - fix bug #442: Fix that Makefile depends on pythonmod headers
6792 even using --without-pythonmodule.
6794 22 March 2012: Wouter
6795 - contrib/validation-reporter follows rotated log file (patch from
6798 21 March 2012: Wouter
6799 - new approach to NS fetches for DS lookup that works with
6800 cornercases, and is more robust and considers forwarders.
6802 19 March 2012: Wouter
6803 - iana portlist updated.
6804 - fix to locate nameservers for DS lookup with NS fetches.
6806 16 March 2012: Wouter
6807 - Patch for access to full DNS packet data in unbound python module
6810 9 March 2012: Wouter
6811 - Applied line-buffer patch from Augie Schwer to validation.reporter.sh.
6813 2 March 2012: Wouter
6814 - flush_infra cleans timeouted servers from the cache too.
6815 - removed warning from --enable-ecdsa.
6817 1 March 2012: Wouter
6818 - forward-first option. Tries without forward if a query fails.
6819 Also stub-first option that is similar.
6821 28 February 2012: Wouter
6822 - Fix from code review, if EINPROGRESS not defined chain if statement
6825 27 February 2012: Wouter
6826 - Fix bug#434: on windows check registry for config file location
6827 for unbound-control.exe, and unbound-checkconf.exe.
6829 23 February 2012: Wouter
6830 - Fix to squelch 'network unreachable' errors from tcp connect in
6831 logs, high verbosity will show them.
6833 16 February 2012: Wouter
6834 - iter_hints is now thread-owned in module env, and thus threadsafe.
6835 - Fix prefetch and sticky NS, now the prefetch works. It picks
6836 nameservers that 'would be valid in the future', and if this makes
6837 the NS timeout, it updates that NS by asking delegation from the
6838 parent again. If child NS has longer TTL, that TTL does not get
6839 refreshed from the lookup to the child nameserver.
6841 15 February 2012: Wouter
6842 - Fix forward-zone memory, uses malloc and frees original root dp.
6843 - iter hints (stubs) uses malloc inside for more dynamicity.
6844 - unbound-control forward_add, forward_remove, stub_add, stub_remove
6845 can modify stubs and forwards for running unbound (on mobile computer)
6846 they can also add and remove domain-insecure for the zone.
6848 14 February 2012: Wouter
6849 - Fix sticky NS (ghost domain problem) if prefetch is yes.
6850 - iter forwards uses malloc inside for more dynamicity.
6852 13 February 2012: Wouter
6853 - RT#2955. Fix for cygwin compilation.
6854 - iana portlist updated.
6856 10 February 2012: Wouter
6857 - Slightly smaller critical region in one case in infra cache.
6858 - Fix timeouts to keep track of query type, A, AAAA and other, if
6859 another has caused timeout blacklist, different type can still probe.
6860 - unit test fix for nomem_cnametopos.rpl race condition.
6862 9 February 2012: Wouter
6863 - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h.
6865 8 February 2012: Wouter
6866 - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This
6867 implementation is experimental at this time and not recommended
6868 for use on the public internet (the protocol numbers have not
6869 been assigned). Needs recent ldns with --enable-ecdsa.
6870 - fix memory leak in errorcase for DSA signatures.
6871 - iana portlist updated.
6872 - workaround for openssl 0.9.8 ecdsa sha2 and evp problem.
6874 3 February 2012: Wouter
6875 - fix for windows, rename() is not posix compliant on windows.
6877 2 February 2012: Wouter
6878 - 1.4.16 release tag.
6879 - svn trunk is 1.4.17 in development.
6880 - iana portlist updated.
6882 1 February 2012: Wouter
6883 - Fix validation failures (like: validation failure xx: no NSEC3
6884 closest encloser from yy for DS zz. while building chain of trust,
6885 because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata
6886 for an NSEC3. Now it does not change rdata, and fixes TTL.
6888 30 January 2012: Wouter
6889 - Fix version-number in libtool to be version-info so it produces
6890 libunbound.so.2 like it should.
6892 26 January 2012: Wouter
6893 - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release.
6894 - trunk 1.4.16; includes changes memset testcode, #424 openindiana,
6895 and keyfile write fixup.
6896 - applied patch to support outgoing-interface with ub_ctx_set_option.
6898 23 January 2012: Wouter
6899 - Fix memset in test code.
6901 20 January 2012: Wouter
6902 - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2.
6904 19 January 2012: Wouter
6905 - Fix to write key files completely to a temporary file, and if that
6906 succeeds, replace the real key file. So failures leave a useful file.
6908 18 January 2012: Wouter
6909 - tag 1.4.15rc1 created
6910 - updated libunbound/ubsyms.def and remade tag 1.4.15rc1.
6912 17 January 2012: Wouter
6913 - Fix bug where canonical_compare of RRSIG did not downcase the
6914 signer-name. This is mostly harmless because RRSIGs do not have
6915 to be sorted in canonical order, usually.
6917 12 January 2012: Wouter
6918 - bug#428: add ub_version() call to libunbound. API version increase,
6919 with (binary) backwards compatibility for the previous version.
6921 10 January 2012: Wouter
6922 - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL
6923 that would be permissible by the RFCs but it is not the TTL in the
6925 - iana portlist updated.
6926 - uninitialised variable in reprobe for rtt blocked domains fixed.
6927 - lintfix and new flex output.
6929 2 January 2012: Wouter
6930 - Fix to randomize hash function, based on 28c3 congress, reported
6933 24 December 2011: Wouter
6934 - Fix for memory leak (about 20 bytes when a tcp or udp send operation
6935 towards authority servers failed, takes about 50.000 such failures to
6936 leak one Mb, such failures are also usually logged), reported by
6938 - iana portlist updated.
6940 19 December 2011: Wouter
6941 - Fix for VU#209659 CVE-2011-4528: Unbound denial of service
6942 vulnerabilities from nonstandard redirection and denial of existence
6943 http://www.unbound.net/downloads/CVE-2011-4528.txt
6944 - robust checks for next-closer NSEC3s.
6945 - tag 1.4.14 created.
6946 - trunk has 1.4.15 in development.
6948 15 December 2011: Wouter
6949 - remove uninit warning from cachedump code.
6950 - Fix parse error on negative SOA RRSIGs if badly ordered in the packet.
6952 13 December 2011: Wouter
6953 - iana portlist updated.
6955 - fix infra cache comparison.
6956 - Fix to constrain signer_name to be a parent of the lookupname.
6958 5 December 2011: Wouter
6959 - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
6960 - Fix warnings with gcc 4.6 in compat/inet_ntop.c.
6961 - Fix warning unused in compat/strptime.c.
6962 - Fix malloc detection and double definition.
6964 2 December 2011: Wouter
6965 - configure generated with autoconf 2.68.
6967 30 November 2011: Wouter
6968 - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes
6969 SERVFAILs. Also fixed for UDP (but less likely).
6971 28 November 2011: Wouter
6972 - Fix quartile time estimate, it was too low, (thanks Jan Komissar).
6973 - iana ports updated.
6975 11 November 2011: Wouter
6976 - Makefile compat with SunOS make, BSD make and GNU make.
6977 - iana ports updated.
6979 10 November 2011: Wouter
6980 - Makefile changed for BSD make compatibility.
6982 9 November 2011: Wouter
6983 - added unit test for SSL service and SSL-upstream.
6985 8 November 2011: Wouter
6986 - can configure ssl service to one port number, and not on others.
6987 - fixup windows compile with ssl support.
6988 - Fix double free in unbound-host, reported by Steve Grubb.
6989 - iana portlist updated.
6991 1 November 2011: Wouter
6992 - dns over ssl support as a client, ssl-upstream yes turns it on.
6993 It performs an SSL transaction for every DNS query (250 msec).
6994 - documentation for new options: ssl-upstream, ssl-service-key and
6996 - iana portlist updated.
6997 - fix -flto detection on Lion for llvm-gcc.
6999 31 October 2011: Wouter
7000 - dns over ssl support, ssl-service-pem and ssl-service-key files
7001 can be given and then TCP queries are serviced wrapped in SSL.
7003 27 October 2011: Wouter
7004 - lame-ttl and lame-size options no longer exist, it is integrated
7005 with the host info. They are ignored (with verbose warning) if
7006 encountered to keep the config file backwards compatible.
7007 - fix iana-update for changing gzip compression of results.
7008 - fix export-all-symbols on OSX.
7010 26 October 2011: Wouter
7011 - iana portlist updated.
7012 - Infra cache stores information about ping and lameness per IP, zone.
7013 This fixes bug #416.
7014 - fix iana_update target for gzipped file on iana site.
7016 24 October 2011: Wouter
7017 - Fix resolve of partners.extranet.microsoft.com with a fix for the
7018 server selection for choosing out of a (particular) list of bad
7020 - Fix make_new_space function so that the incoming query is not
7021 overwritten if a jostled out query causes a waiting query to be
7022 resumed that then fails and sends an error message. (Thanks to
7025 21 October 2011: Wouter
7026 - fix --enable-allsymbols, fptr wlist is disabled on windows with this
7027 option enabled because of memory layout exe vs dll.
7029 19 October 2011: Wouter
7030 - fix unbound-anchor for broken strptime on OSX lion, detected
7032 - Detect if GOST really works, openssl1.0 on OSX fails.
7033 - Implement ipv6%interface notation for scope_id usage.
7035 17 October 2011: Wouter
7036 - better documentation for inform_super (Thanks Yang Zhe).
7038 14 October 2011: Wouter
7039 - Fix for out-of-memory condition in libunbound (thanks
7042 13 October 2011: Wouter
7043 - Fix --enable-allsymbols, it depended on link specifics of the
7044 target platform, or fptr_wlist assertion failures could occur.
7046 12 October 2011: Wouter
7047 - updated contrib/unbound_munin_ to family=auto so that it works with
7048 munin-node-configure automatically (if installed as
7049 /usr/local/share/munin/plugins/unbound_munin_ ).
7051 27 September 2011: Wouter
7052 - unbound.exe -w windows option for start and stop service.
7054 23 September 2011: Wouter
7055 - TCP-upstream calculates tcp-ping so server selection works if there
7058 20 September 2011: Wouter
7059 - Fix classification of NS set in answer section, where there is a
7060 parent-child server, and the answer has the AA flag for dir.slb.com.
7061 Thanks to Amanda Constant from Secure64.
7063 16 September 2011: Wouter
7064 - fix bug #408: accept patch from Steve Snyder that comments out
7065 unused functions in lookup3.c.
7066 - iana portlist updated.
7067 - fix EDNS1480 change memleak and TCP fallback.
7068 - fix various compiler warnings (reported by Paul Wouters).
7069 - max sent count. EDNS1480 only for rtt < 5000. No promiscuous
7070 fetch if sentcount > 3, stop query if sentcount > 16. Count is
7071 reset when referral or CNAME happens. This makes unbound better
7072 at managing large NS sets, they are explored when there is continued
7073 interest (in the form of queries).
7075 15 September 2011: Wouter
7077 - trunk contains 1.4.14 in development.
7078 - Unbound probes at EDNS1480 if there an EDNS0 timeout.
7080 12 September 2011: Wouter
7081 - Reverted dns EDNS backoff fix, it did not help and needs
7082 fragmentation fixes instead.
7085 7 September 2011: Wouter
7086 - Fix operation in ipv6 only (do-ip4: no) mode.
7088 6 September 2011: Wouter
7089 - fedora specfile updated.
7091 5 September 2011: Wouter
7094 2 September 2011: Wouter
7095 - iana portlist updated.
7097 26 August 2011: Wouter
7098 - Fix num-threads 0 does not segfault, reported by Simon Deziel.
7099 - Fix validation failures due to EDNS backoff retries, the retry
7100 for fetch of data has want_dnssec because the iter_indicate_dnssec
7101 function returns true when validation failure retry happens, and
7102 then the serviced query code does not fallback to noEDNS, even if
7103 the cache says it has this. This helps for DLV deployment when
7104 the DNSSEC status is not known for sure before the lookup concludes.
7106 24 August 2011: Wouter
7107 - Applied patch from Karel Slany that fixes a memory leak in the
7108 unbound python module, in string conversions.
7110 22 August 2011: Wouter
7111 - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy
7112 Zhang and Luo Ce). Unbound responds with the RR types that are
7113 available at the name for qtype ANY and validates those RR types.
7114 It does not test for completeness (i.e. with NSEC or NSEC3 query),
7115 and it does not follow the CNAME or DNAME to another name (with
7116 even more data for the already large response).
7117 - Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
7118 - Documented the options that work with control set_option command.
7119 - tcp-upstream yes/no option (works with set_option) for tunnels.
7121 18 August 2011: Wouter
7122 - fix autoconf call in makedist crosscompile to RC or snapshot.
7124 17 August 2011: Wouter
7125 - Fix validation of . DS query.
7126 - new xml format at IANA, new awk for iana_update.
7127 - iana portlist updated.
7129 10 August 2011: Wouter
7130 - Fix python site-packages path to /usr/lib64.
7131 - updated patch from Tom.
7132 - fix memory and fd leak after out-of-memory condition.
7134 9 August 2011: Wouter
7135 - patch from Tom Hendrikx fixes load of python modules.
7137 8 August 2011: Wouter
7138 - make clean had ldns-src reference, removed.
7140 1 August 2011: Wouter
7141 - Fix autoconf 2.68 warnings
7143 14 July 2011: Wouter
7144 - Unbound implements RFC6303 (since version 1.4.7).
7145 - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
7146 meantime, those are for 1.4.13).
7147 - iana portlist updated.
7149 13 July 2011: Wouter
7150 - Quick fix for contrib/unbound.spec example, no ldns-builtin any more.
7152 11 July 2011: Wouter
7153 - Fix wildcard expansion no-data reply under an optout NSEC3 zone is
7154 validated as insecure, reported by Jia Li (lijia@cnnic.cn).
7157 - 1.4.12rc1 tag created.
7160 - version number in example config file.
7161 - fix that --enable-static-exe does not complain about it unknown.
7163 30 June 2011: Wouter
7164 - tag relase 1.4.11, trunk is 1.4.12 development.
7165 - iana portlist updated.
7166 - fix bug#395: id bits of other query may leak out under conditions
7167 - fix replyaddr count wrong after jostled queries, which leads to
7168 eventual starvation where the daemon has no replyaddrs left to use.
7169 - fix comment about rndc port, that referred to the old port number.
7170 - fix that the listening socket is not closed when too many remote
7171 control connections are made at the same time.
7172 - removed ldns-src tarball inside the unbound tarball.
7174 23 June 2011: Wouter
7175 - Changed -flto check to support clang compiler.
7176 - tag 1.4.11rc3 created.
7178 17 June 2011: Wouter
7179 - tag 1.4.11rc1 created.
7180 - remove warning about signed/unsigned from flex (other flex version).
7181 - updated aclocal.m4 and libtool to match.
7182 - tag 1.4.11rc2 created.
7184 16 June 2011: Wouter
7185 - log-queries: yesno option, default is no, prints querylog.
7186 - version is 1.4.11.
7188 14 June 2011: Wouter
7189 - Use -flto compiler flag for link time optimization, if supported.
7190 - iana portlist updated.
7192 12 June 2011: Wouter
7193 - IPv6 service address for d.root-servers.net (2001:500:2D::D).
7195 10 June 2011: Wouter
7196 - unbound-control has version number in the header,
7197 UBCT[version]_space_ is the header sent by the client now.
7198 - Unbound control port number is registered with IANA:
7199 ub-dns-control 8953/tcp unbound dns nameserver control
7200 This is the new default for the control-port config setting.
7201 - statistics-interval prints the number of jostled queries to log.
7204 - Fix Makefile for U in environment, since wrong U is more common than
7205 deansification necessity.
7206 - iana portlist updated.
7207 - updated ldns tarball to 1.6.10rc2 snapshot of today.
7210 - Fix assertion failure when unbound generates an empty error reply
7211 in response to a query, CVE-2011-1922 VU#531342.
7212 - This fix is in tag 1.4.10.
7213 - defense in depth against the above bug, an error is printed to log
7214 instead of an assertion failure.
7217 - bug#386: --enable-allsymbols option links all binaries to libunbound
7218 and reduces install size significantly.
7219 - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
7220 - iana portlist updated.
7221 - Fix TTL of SOA so negative TTL is separately cached from normal TTL.
7223 14 April 2011: Wouter
7224 - configure created with newer autoconf 2.66.
7226 12 April 2011: Wouter
7227 - bug#378: Fix that configure checks for ldns_get_random presence.
7229 8 April 2011: Wouter
7230 - iana portlist updated.
7231 - queries with CD flag set cause DNSSEC validation, but the answer is
7232 not withheld if it is bogus. Thus, unbound will retry if it is bad
7233 and curb the TTL if it is bad, thus protecting the cache for use by
7234 downstream validators.
7235 - val-override-date: -1 ignores dates entirely, for NTP usage.
7237 29 March 2011: Wouter
7238 - harden-below-nxdomain: changed so that it activates when the
7239 cached nxdomain is dnssec secure. This avoids backwards
7240 incompatibility because those old servers do not have dnssec.
7242 24 March 2011: Wouter
7243 - iana portlist updated.
7247 17 March 2011: Wouter
7248 - bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
7249 Applied but did not do the --disable-gost.
7251 10 March 2011: Wouter
7252 - tag 1.4.9 release candidate 1 created.
7254 3 March 2011: Wouter
7255 - updated ldns to today.
7257 1 March 2011: Wouter
7258 - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
7259 - give config parse error for multiple names on a stub or forward zone.
7260 - updated ldns tarball to 1.6.9(todays snapshot).
7262 24 February 2011: Wouter
7263 - bug #361: Fix, time.elapsed variable not reset with stats_noreset.
7265 23 February 2011: Wouter
7266 - iana portlist updated.
7267 - common.sh to version 3.
7269 18 February 2011: Wouter
7270 - common.sh in testdata updated to version 2.
7272 15 February 2011: Wouter
7273 - Added explicit note on unbound-anchor usage:
7274 Please note usage of unbound-anchor root anchor is at your own risk
7275 and under the terms of our LICENSE (see that file in the source).
7277 11 February 2011: Wouter
7278 - iana portlist updated.
7279 - tpkg updated with common.sh for common functionality.
7281 7 February 2011: Wouter
7282 - Added regression test for addition of a .net DS to the root, and
7283 cache effects with different TTL for glue and DNSKEY.
7284 - iana portlist updated.
7286 28 January 2011: Wouter
7287 - Fix remove private address does not throw away entire response.
7289 24 January 2011: Wouter
7292 19 January 2011: Wouter
7293 - fix bug#349: no -L/usr for ldns.
7295 18 January 2011: Wouter
7296 - ldns 1.6.8 tarball included.
7299 17 January 2011: Wouter
7300 - add get and set option for harden-below-nxdomain feature.
7301 - iana portlist updated.
7303 14 January 2011: Wouter
7304 - Fix so a changed NS RRset does not get moved name stuck on old
7305 server, for type NS the TTL is not increased.
7307 13 January 2011: Wouter
7308 - Fix prefetch so it does not get stuck on old server for moved names.
7310 12 January 2011: Wouter
7311 - iana portlist updated.
7313 11 January 2011: Wouter
7314 - Fix insecure CNAME sequence marked as secure, reported by Bert
7317 10 January 2011: Wouter
7318 - faster lruhash get_mem routine.
7320 4 January 2011: Wouter
7321 - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root.
7322 - iana portlist updated.
7324 23 December 2010: Wouter
7325 - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
7327 21 December 2010: Wouter
7328 - algorithm compromise protection using the algorithms signalled in
7329 the DS record. Also, trust anchors, DLV, and RFC5011 receive this,
7330 and thus, if you have multiple algorithms in your trust-anchor-file
7331 then it will now behave different than before. Also, 5011 rollover
7332 for algorithms needs to be double-signature until the old algorithm
7334 It is not an option, because I see no use to turn the security off.
7335 - iana portlist updated.
7337 17 December 2010: Wouter
7338 - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them).
7339 - fix validation in this case: CNAME to nodata for co-hosted opt-in
7340 NSEC3 insecure delegation, was bogus, fixed to be insecure.
7342 16 December 2010: Wouter
7343 - Fix our 'BDS' license (typo reported by Xavier Belanger).
7345 10 December 2010: Wouter
7346 - iana portlist updated.
7347 - review changes for unbound-anchor.
7349 2 December 2010: Wouter
7350 - feature typetransparent localzone, does not block other RR types.
7352 1 December 2010: Wouter
7353 - Fix bug#338: print address when socket creation fails.
7355 30 November 2010: Wouter
7356 - Fix storage of EDNS failures in the infra cache.
7357 - iana portlist updated.
7359 18 November 2010: Wouter
7360 - harden-below-nxdomain option, default off (because very old
7361 software may be incompatible). We could enable it by default in
7364 17 November 2010: Wouter
7365 - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
7366 - make test output nicer.
7368 15 November 2010: Wouter
7369 - silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
7370 - iana portlist updated.
7371 - so-sndbuf option for very busy servers, a bit like so-rcvbuf.
7373 9 November 2010: Wouter
7374 - unbound-anchor compiles with openssl 0.9.7.
7376 8 November 2010: Wouter
7377 - release tag 1.4.7.
7378 - trunk is version 1.4.8.
7379 - Be lenient and accept imgw.pl malformed packet (like BIND).
7381 5 November 2010: Wouter
7382 - do not synthesize a CNAME message from cache for qtype DS.
7384 4 November 2010: Wouter
7385 - Use central entropy to seed threads.
7387 3 November 2010: Wouter
7388 - Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
7390 2 November 2010: Wouter
7394 1 November 2010: Wouter
7395 - GOST code enabled by default (RFC 5933).
7397 27 October 2010: Wouter
7398 - Fix uninit value in dump_infra print.
7399 - Fix validation failure for parent and child on same server with an
7400 insecure childzone and a CNAME from parent to child.
7401 - Configure detects libev-4.00.
7403 26 October 2010: Wouter
7404 - dump_infra and flush_infra commands for unbound-control.
7405 - no timeout backoff if meanwhile a query succeeded.
7406 - Change of timeout code. No more lost and backoff in blockage.
7407 At 12sec timeout (and at least 2x lost before) one probe per IP
7408 is allowed only. At 120sec, the IP is blocked. After 15min, a
7409 120sec entry has a single retry packet.
7411 25 October 2010: Wouter
7412 - Configure errors if ldns is not found.
7414 22 October 2010: Wouter
7415 - Windows 7 fix for the installer.
7417 21 October 2010: Wouter
7418 - Fix bug where fallback_tcp causes wrong roundtrip and edns
7419 observation to be noted in cache. Fix bug where EDNSprobe halted
7420 exponential backoff if EDNS status unknown.
7421 - new unresponsive host method, exponentially increasing block backoff.
7422 - iana portlist updated.
7424 20 October 2010: Wouter
7425 - interface automatic works for some people with ip6 disabled.
7426 Therefore the error check is removed, so they can use the option.
7428 19 October 2010: Wouter
7429 - Fix for request list growth, if a server has long timeout but the
7430 lost counter is low, then its effective rtt is the one without
7431 exponential backoff applied. Because the backoff is not working.
7432 The lost counter can then increase and the server is blacklisted,
7433 or the lost counter does not increase and the server is working
7436 18 October 2010: Wouter
7437 - iana portlist updated.
7439 13 October 2010: Wouter
7440 - Fix TCP so it uses a random outgoing-interface.
7441 - unbound-anchor handles ADDPEND keystate.
7443 11 October 2010: Wouter
7444 - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where
7445 the zone has a secure delegation hosted on the same server did not
7446 verify as secure (it was insecure by mistake).
7447 - iana portlist updated.
7448 - ldns tarball updated (for reading cachedumps with bad RR data).
7450 1 October 2010: Wouter
7451 - test for unbound-anchor. fix for reading certs.
7452 - Fix alloc_reg_release for longer uptime in out of memory conditions.
7454 28 September 2010: Wouter
7455 - unbound-anchor working, it creates or updates a root.key file.
7456 Use it before you start the validator (e.g. at system boot time).
7458 27 September 2010: Wouter
7459 - iana portlist updated.
7461 24 September 2010: Wouter
7462 - bug#329: in example.conf show correct ipv4 link-local 169.254/16.
7464 23 September 2010: Wouter
7465 - unbound-anchor app, unbound requires libexpat (xml parser library).
7467 22 September 2010: Wouter
7468 - compliance with draft-ietf-dnsop-default-local-zones-14, removed
7469 reverse ipv6 orchid prefix from builtin list.
7470 - iana portlist updated.
7472 17 September 2010: Wouter
7473 - DLV has downgrade protection again, because the RFC says so.
7474 - iana portlist updated.
7476 16 September 2010: Wouter
7477 - Algorithm rollover operational reality intrudes, for trust-anchor,
7478 5011-store, and DLV-anchor if one key matches it's good enough.
7479 - iana portlist updated.
7480 - Fix reported validation error in out of memory condition.
7482 15 September 2010: Wouter
7483 - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
7485 14 September 2010: Wouter
7486 - increased mesh-max-activation from 1000 to 3000 for crazy domains
7487 like _tcp.slb.com with 262 servers.
7488 - iana portlist updated.
7490 13 September 2010: Wouter
7491 - bug#327: Fix for cannot access stub zones until the root is primed.
7493 9 September 2010: Wouter
7494 - unresponsive servers are not completely blacklisted (because of
7495 firewalls), but also not probed all the time (because of the request
7496 list size it generates). The probe rate is 1%.
7497 - iana portlist updated.
7499 20 August 2010: Wouter
7500 - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
7501 iterator get_mem includes priv_get_mem. delegpt nodup removed.
7502 listen_pushback, query_info_allocqname, write_socket, send_packet,
7503 comm_point_set_cb_arg and listen_resume removed.
7505 19 August 2010: Wouter
7506 - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20.
7507 Delegpt structures checked for duplicates always.
7508 No more nameserver lookups generated when depth is full anyway.
7509 - example.conf notes how to do DNSSEC validation and track the root.
7510 - iana portlist updated.
7512 18 August 2010: Wouter
7513 - Fix bug#322: configure does not respect CFLAGS on Solaris.
7514 Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line
7515 if use sun-cc, but some systems need different flags.
7517 16 August 2010: Wouter
7518 - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP
7519 changes, uses m4_bpatsubst now.
7520 - make test (or make check) should be more portable and run the unit
7521 test and testbound scripts. (make longtest has special requirements).
7523 13 August 2010: Wouter
7524 - More pleasant remote control command parsing.
7525 - documentation added for return values reported by doxygen 1.7.1.
7526 - iana portlist updated.
7528 9 August 2010: Wouter
7529 - Fix name of rrset printed that failed validation.
7531 5 August 2010: Wouter
7532 - Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
7534 4 August 2010: Wouter
7535 - Fix validation in case a trust anchor enters into a zone with
7536 unsupported algorithms.
7538 3 August 2010: Wouter
7539 - updated ldns tarball with bugfixes.
7540 - release tag 1.4.6.
7541 - trunk becomes 1.4.7 develop.
7542 - iana portlist updated.
7544 22 July 2010: Wouter
7545 - more error details on failed remote control connection.
7547 15 July 2010: Wouter
7548 - rlimit adjustments for select and ulimit can happen at the same time.
7550 14 July 2010: Wouter
7551 - Donation text added to README.
7552 - Fix integer underflow in prefetch ttl creation from cache. This
7553 fixes a potential negative prefetch ttl.
7555 12 July 2010: Wouter
7556 - Changed the defaults for num-queries-per-thread/outgoing-range.
7557 For builtin-select: 512/960, for libevent 1024/4096 and for
7558 windows 24/48 (because of win api). This makes the ratio this way
7559 to improve resilience under heavy load. For high performance, use
7560 libevent and possibly higher numbers.
7562 10 July 2010: Wouter
7563 - GOST enabled if SSL is recent and ldns has GOST enabled too.
7564 - ldns tarball updated.
7567 - iana portlist updated.
7568 - Fix validation of qtype DNSKEY when a key-cache entry exists but
7569 no rr-cache entry is used (it expired or prefetch), it then goes
7570 back up to the DS or trust-anchor to validate the DNSKEY.
7573 - Neat function prototypes, unshadowed local declarations.
7576 - failure to chown the pidfile is not fatal any more.
7577 - testbound uses UTC timezone.
7578 - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add
7579 /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake.
7582 - log if a server is skipped because it is on the donotquery list,
7583 at verbosity 4, to enable diagnosis why no queries to 127.0.0.1.
7584 - added feature to print configure date, target and options with -h.
7585 - added feature to print event backend system details with -h.
7586 - wdiff is not actually required by make test, updated requirements.
7589 - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex
7590 must be signed with all algorithms from the DS rrset at the parent.
7591 This is now checked and becomes bogus if not.
7593 28 June 2010: Wouter
7594 - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps
7595 in overload situations to be about 5 qps for the class of shortly
7597 The capacity of the resolver is then about (numqueriesperthread / 2)
7598 / (average time for such long queries) qps for long queries.
7599 And about (numqueriesperthread / 2)/(jostletimeout in whole seconds)
7600 qps for short queries, per thread.
7601 - Fix the max number of reply-address count to be applied for duplicate
7602 queries, and not for new query list entries. This raises the memory
7603 usage to a max of (16+1)*numqueriesperthread reply addresses.
7605 25 June 2010: Wouter
7606 - Fix handling of corner case reply from lame server, follows rfc2308.
7607 It could lead to a nodata reply getting into the cache if the search
7608 for a non-lame server turned up other misconfigured servers.
7609 - unbound.h has extern "C" statement for easier include in c++.
7611 23 June 2010: Wouter
7612 - iana portlist updated.
7613 - makedist upgraded cross compile openssl option, like this:
7614 ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost
7616 22 June 2010: Wouter
7617 - Unbound reports libev or libevent correctly in logs in verbose mode.
7618 - Fix to unload gost dynamic library module for leak testing.
7620 18 June 2010: Wouter
7621 - iana portlist updated.
7623 17 June 2010: Wouter
7624 - Add AAAA to root hints for I.ROOT-SERVERS.NET.
7626 16 June 2010: Wouter
7627 - Fix assertion failure reported by Kai Storbeck from XS4ALL, the
7628 assertion was wrong.
7629 - updated ldns tarball.
7631 15 June 2010: Wouter
7632 - tag 1.4.5 created.
7633 - trunk contains 1.4.6 in development.
7634 - Fix TCPreply on systems with no writev, if just 1 byte could be sent.
7635 - Fix to use one pointer less for iterator query state store_parent_NS.
7636 - makedist crosscompile to windows uses builtin ldns not host ldns.
7637 - Max referral count from 30 to 130, because 128 one character domains
7639 - added documentation for the histogram printout to syslog.
7641 11 June 2010: Wouter
7642 - When retry to parent the retrycount is not wiped, so failed
7643 nameservers are not tried again.
7644 - iana portlist updated.
7646 10 June 2010: Wouter
7647 - Fix bug where a long loop could be entered, now cycle detection
7648 has a loop-counter and maximum search amount.
7651 - iana portlist updated.
7652 - 1.4.5rc1 tag created.
7655 - ldns tarball updated, 1.6.5.
7656 - review comments, split dependency cycle tracking for parentside
7657 last resort lookups for A and AAAA so there are more lookup options.
7660 - Fix compile warning if compiled without threads.
7661 - updated ldns-tarball with current ldns svn (pre 1.6.5).
7662 - GOST disabled-by-default, the algorithm number is allocated but the
7663 RFC is still has to pass AUTH48 at the IETF.
7666 - Ignore Z flag in incoming messages too.
7667 - Fix storage of negative parent glue if that last resort fails.
7668 - libtoolize 2.2.6b, autoconf 2.65 applied to configure.
7669 - new splint flags for newer splint install.
7672 - Fix AD flag handling, it could in some cases mistakenly copy the AD
7673 flag from upstream servers.
7674 - alloc_special_obtain out of memory is not a fatal error any more,
7675 enabling unbound to continue longer in out of memory conditions.
7676 - parentside names are dispreferred but not said to be dnssec-lame.
7677 - parentside check for cached newname glue.
7678 - fix parentside and querytargets modulestate, for dump_requestlist.
7679 - unbound-control-setup makes keys -rw-r--- so not all users permitted.
7680 - fix parentside from cache to be marked dispreferred for bad names.
7683 - iana portlist updated.
7684 - parent-child disagreement approach altered. Older fixes are
7685 removed in place of a more exhaustive search for misconfigured data
7686 available via the parent of a delegation.
7687 This is designed to be throttled by cache entries, with TTL from the
7688 parent if possible. Additionally the loop-counter is used.
7689 It also tests for NS RRset differences between parent and child.
7690 The fetch of misconfigured data should be more reliable and thorough.
7691 It should work reliably even with no or only partial data in cache.
7692 Data received from the child (as always) is deemed more
7693 authoritative than information received from the delegation parent.
7694 The search for misconfigured data is not performed normally.
7697 - Contribution from Migiel de Vos (Surfnet): nagios patch for
7698 unbound-host, in contrib/ (in the source tarball). Makes
7699 unbound-host suitable for monitoring dnssec(-chain) status.
7702 - EDNS timeout code will not fire if EDNS status already known.
7703 - EDNS failure not stored if EDNS status known to work.
7706 - Fix resolution for domains like safesvc.com.cn. If the iterator
7707 can not recurse further and it finds the delegation in a state
7708 where it would otherwise have rejected it outhand if so received
7709 from a cache lookup, then it can try to ask higherup (with loop
7711 - Fix comments in iter_utils:dp_is_useless.
7714 - Fix various compiler warnings from the clang llvm compiler.
7715 - iana portlist updated.
7718 - Fix bug#308: spelling error in variable name in parser and lexer.
7721 - Fix dnssec-missing detection that was turned off by server selection.
7722 - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default
7723 reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa,
7724 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa.
7726 29 April 2010: Wouter
7727 - Fix for dnssec lameness detection to use the key cache.
7728 - infra cache entries that are expired are wiped clean. Previously
7729 it was possible to not expire host data (if accessed often).
7731 28 April 2010: Wouter
7732 - ldns tarball updated and GOST support is detected and then enabled.
7733 - iana portlist updated.
7734 - Fix detection of gost support in ldns (reported by Chris Smith).
7736 27 April 2010: Wouter
7737 - unbound-control get_option domain-insecure shows config file items.
7738 - fix retry sequence if prime hints are recursion-lame.
7739 - autotrust anchor file can be initialized with a ZSK key as well.
7740 - harden-referral-path does not result in failures due to max-depth.
7741 You can increase the max-depth by adding numbers (' 0') after the
7742 target-fetch-policy, this increases the depth to which is checked.
7744 26 April 2010: Wouter
7745 - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use
7746 CPPFLAGS during configure process.
7747 - if libev is installed on the base system (not libevent), detect
7748 it from the event.h header file and link with -lev.
7749 - configlexer.lex gets config.h, and configyyrename.h added by make,
7750 no more double include.
7751 - More strict scrubber (Thanks to George Barwood for the idea):
7752 NS set must be pertinent to the query (qname subdomain nsname).
7753 - Fix bug#307: In 0x20 backoff fix fallback so the number of
7754 outstanding queries does not become -1 and block the request.
7755 Fixed handling of recursion-lame in combination with 0x20 fallback.
7756 Fix so RRsets are compared canonicalized and sorted if the immediate
7757 comparison fails, this makes it work around round-robin sites.
7759 23 April 2010: Wouter
7760 - Squelch log message: sendto failed permission denied for
7761 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2).
7762 - Fix to fetch data as last resort more tenaciously. When cycle
7763 targets cause the server selection to believe there are more options
7764 when they really are not there, the server selection is reinitiated.
7765 - Fix fetch from blacklisted dnssec lame servers as last resort. The
7766 server's IP address is then given in validator errors as well.
7767 - Fix local-zone type redirect that did not use the query name for
7770 22 April 2010: Wouter
7772 - trunk contains 1.4.5 in development.
7773 - Fix validation failure for qtype ANY caused by a RRSIG parse failure.
7774 The validator error message was 'no signatures from ...'.
7776 16 April 2010: Wouter
7777 - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
7780 15 April 2010: Wouter
7781 - ECC-GOST algorithm number 12 that is assigned by IANA. New test
7782 example key and signatures for GOST. GOST requires openssl-1.0.0.
7783 GOST is still disabled by default.
7785 9 April 2010: Wouter
7786 - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
7787 get into an endless loop, if 0x20 was enabled, and buffers are small
7788 or particular broken packets are received.
7789 - Fix chain of trust with CNAME at an intermediate step, for the DS
7792 8 April 2010: Wouter
7793 - Fix validation of queries with wildcard names (*.example).
7795 6 April 2010: Wouter
7796 - Fix EDNS probe for .de DNSSEC testbed failure, where the infra
7797 cache timeout coincided with a server update, the current EDNS
7798 backoff is less sensitive, and does not cache the backoff unless
7799 the backoff actually works and the domain is not expecting DNSSEC.
7800 - GOST support with correct algorithm numbers.
7802 1 April 2010: Wouter
7803 - iana portlist updated.
7805 24 March 2010: Wouter
7806 - unbound control flushed items are not counted when flushed again.
7808 23 March 2010: Wouter
7809 - iana portlist updated.
7811 22 March 2010: Wouter
7812 - unbound-host disables use-syslog from config file so that the
7813 config file for the main server can be used more easily.
7814 - fix bug#301: unbound-checkconf could not parse interface
7815 '0.0.0.0@5353', even though unbound itself worked fine.
7817 19 March 2010: Wouter
7818 - fix fwd_ancil test to pass if the socket options are not supported.
7820 18 March 2010: Wouter
7821 - Fixed random numbers for port, interface and server selection.
7822 Removed very small bias.
7823 - Refer to the listing in unbound-control man page in the extended
7824 statistics entry in the unbound.conf man page.
7826 16 March 2010: Wouter
7827 - Fix interface-automatic for OpenBSD: msg.controllen was too small,
7828 also assertions on ancillary data buffer.
7829 - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
7830 - for NSEC3 check if signatures are cached.
7832 15 March 2010: Wouter
7833 - unit test for util/regional.c.
7835 12 March 2010: Wouter
7836 - Reordered configure checks so fork and -lnsl -lsocket checks are
7837 earlier, and thus later checks benefit from and do not hinder them.
7838 - iana portlist updated.
7839 - ldns tarball updated.
7840 - Fix python use when multithreaded.
7841 - Fix solaris python compile.
7842 - Include less in config.h and include per code file for ldns, ssl.
7844 11 March 2010: Wouter
7845 - another memory allocation option: --enable-alloc-nonregional.
7846 exposes the regional allocations to other memory purifiers.
7847 - fix for memory alignment in struct sock_list allocation.
7848 - Fix for MacPorts ldns without ssl default, unbound checks if ldns
7849 has dnssec functionality and uses the builtin if not.
7850 - Fix daemonize on Solaris 10, it did not detach from terminal.
7851 - tag 1.4.3 created.
7852 - trunk is 1.4.4 in development.
7853 - spelling fix in validation error involving cnames.
7855 10 March 2010: Wouter
7856 - --enable-alloc-lite works with test set.
7857 - portability in the testset: printf format conversions, prototypes.
7859 9 March 2010: Wouter
7860 - tag 1.4.2 created.
7861 - trunk is 1.4.3 in development.
7862 - --enable-alloc-lite debug option.
7864 8 March 2010: Wouter
7865 - iana portlist updated.
7867 4 March 2010: Wouter
7868 - Fix crash in control channel code.
7870 3 March 2010: Wouter
7871 - better casts in pipe code, brackets placed wrongly.
7872 - iana portlist updated.
7874 1 March 2010: Wouter
7875 - make install depends on make all.
7876 - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs.
7877 - --enable-checking: enables assertions but does not look nonproduction.
7878 - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with
7879 nxdomain and nodata distinguished.
7880 - ldns tarball updated.
7881 - --disable-rpath fixed for libtool not found errors.
7882 - new fedora specfile from Fedora13 in contrib from Paul Wouters.
7884 26 February 2010: Wouter
7885 - Fixup prototype for lexer cleanup in daemon code.
7886 - unbound-control list_stubs, list_forwards, list_local_zones and
7889 24 February 2010: Wouter
7890 - Fix scrubber bug that potentially let NS records through. Reported
7892 - Also delete potential poison references from additional.
7893 - Fix: no classification of a forwarder as lame, throw away instead.
7895 23 February 2010: Wouter
7896 - libunbound ub_ctx_get_option() added.
7897 - unbound-control set_option and get_option commands.
7898 - iana portlist updated.
7900 18 February 2010: Wouter
7901 - A little more strict DS scrubbing.
7902 - No more blacklisting of unresponsive servers, a 2 minute timeout
7904 - RD flag not enabled for dnssec-blacklisted tries, unless necessary.
7905 - pickup ldns compile fix, libdl for libcrypto.
7906 - log 'tcp connect: connection timed out' only in high verbosity.
7907 - unbound-control log_reopen command.
7908 - moved get_option code from unbound-checkconf to util/config_file.c
7910 17 February 2010: Wouter
7911 - Disregard DNSKEY from authority section for chain of trust.
7912 DS records that are irrelevant to a referral scrubbed. Anti-poison.
7913 - iana portlist updated.
7915 16 February 2010: Wouter
7916 - Check for 'no space left on device' (or other errors) when
7917 writing updated autotrust anchors and print errno to log.
7919 15 February 2010: Wouter
7920 - Fixed the requery protection, the TTL was 0, it is now 900 seconds,
7921 hardcoded. We made the choice to send out more conservatively,
7922 protecting against an aggregate effect more than protecting a
7923 single user (from their own folly, perhaps in case of misconfig).
7925 12 February 2010: Wouter
7926 - Re-query pattern changed on validation failure. To protect troubled
7927 authority servers, unbound caches a failure for the DNSKEY or DS
7928 records for the entire zone, and only retries that 900 seconds later.
7929 This implies that only a handful of packets are sent extra to the
7930 authority if the zone fails.
7932 11 February 2010: Wouter
7933 - ldns tarball update for long label length syntax error fix.
7934 - iana portlist updated.
7936 9 February 2010: Wouter
7937 - Fixup in compat snprintf routine, %f 1.02 and %g support.
7938 - include math.h for testbound test compile portability.
7940 2 February 2010: Wouter
7941 - Updated url of IANA itar, interim trust anchor repository, in script.
7943 1 February 2010: Wouter
7944 - iana portlist updated.
7945 - configure test for memcmp portability.
7947 27 January 2010: Wouter
7948 - removed warning on format string in validator error log statement.
7949 - iana portlist updated.
7951 22 January 2010: Wouter
7952 - libtool finish the install of unbound python dynamic library.
7954 21 January 2010: Wouter
7955 - acx_nlnetlabs.m4 synchronised with nsd's version.
7957 20 January 2010: Wouter
7958 - Fixup lookup trouble for parent-child domains on the first query.
7960 14 January 2010: Wouter
7961 - Fixup ldns detection to also check for header files.
7963 13 January 2010: Wouter
7964 - prefetch-key option that performs DNSKEY queries earlier in the
7965 validation process, and that could halve the latency on DNSSEC
7966 queries. It takes some extra processing (CPU, a cache is needed).
7968 12 January 2010: Wouter
7969 - Fix unbound-checkconf for auto-trust-anchor-file present checks.
7971 8 January 2010: Wouter
7972 - Fix for parent-child disagreement code which could have trouble
7973 when (a) ipv6 was disabled and (b) the TTL for parent and child
7974 were different. There were two bugs, the parent-side information
7975 is fixed to no longer block lookup of child side information and
7976 the iterator is fixed to no longer attempt to get ipv6 when it is
7977 not enabled and then give up in failure.
7978 - test and fixes to make prefetch actually store the answer in the
7979 cache. Considers some rrsets 'already expired' but does not allow
7980 overwriting of rrsets considered more secure.
7982 7 January 2010: Wouter
7983 - Fixup python documentation (thanks Leo Vandewoestijne).
7984 - Work on cache prefetch feature.
7985 - Stats for prefetch, in log print stats, unbound-control stats
7986 and in unbound_munin plugin.
7988 6 January 2010: Wouter
7989 - iana portlist updated.
7990 - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length.
7991 - verbose output includes parent-side-address notion for lameness.
7992 - documented val-log-level: 2 setting in example.conf and man page.
7993 - change unbound-control-setup from 1024(sha1) to 1536(sha256).
7995 1 January 2010: Wouter
7996 - iana portlist updated.
7998 22 December 2009: Wouter
7999 - configure with newer libtool 2.2.6b.
8001 17 December 2009: Wouter
8004 - trunk to version 1.4.2.
8006 15 December 2009: Wouter
8007 - Answer to qclass=ANY queries, with class IN contents.
8008 Test that validation also works.
8009 - updated ldns snapshot tarball with latest fixes (parsing records).
8011 11 December 2009: Wouter
8012 - on IPv4 UDP turn off DF flag.
8014 10 December 2009: Wouter
8015 - requirements.txt updated with design choice explanations.
8016 - Reading fixes: fix to set unlame when child confirms parent glue,
8017 and fix to avoid duplicate addresses in delegation point.
8018 - verify_rrsig routine checks expiration last.
8020 9 December 2009: Wouter
8021 - Fix Bug#287(reopened): update of ldns tarball with fix for parse
8022 errors generated for domain names like '.example.com'.
8023 - Fix SOA excluded from negative DS responses. Reported by Hauke
8024 Lampe. The negative cache did not include proper SOA records for
8025 negative qtype DS responses which makes BIND barf on it, such
8026 responses are now only used internally.
8027 - Fix negative cache lookup of closestencloser check of DS type bit.
8029 8 December 2009: Wouter
8030 - Fix for lookup of parent-child disagreement domains, where the
8031 parent-side glue works but it does not provide proper NS, A or AAAA
8032 for itself, fixing domains such as motorcaravanners.eu.
8033 - Feature: you can specify a port number in the interface: line, so
8034 you can bind the same interface multiple times at different ports.
8036 7 December 2009: Wouter
8037 - Bug#287: Fix segfault when unbound-control remove nonexistent local
8038 data. Added check to tests.
8040 1 December 2009: Wouter
8041 - Fix crash with module-config "iterator".
8042 - Added unit test that has "iterator" module-config.
8044 30 November 2009: Wouter
8045 - bug#284: fix parse of # without end-of-line at end-of-file.
8047 26 November 2009: Wouter
8048 - updated ldns with release candidate for version 1.6.3.
8049 - tag for 1.4.0 release.
8050 - 1.4.1 version in trunk.
8051 - Fixup major libtool version to 2 because of why_bogus change.
8052 It was 1:5:0 but should have been 2:0:0.
8054 23 November 2009: Wouter
8055 - Patch from David Hubbard for libunbound manual page.
8056 - Fixup endless spinning in unbound-control stats reported by
8057 Attila Nagy. Probably caused by clock reversal.
8059 20 November 2009: Wouter
8060 - contrib/split-itar.sh contributed by Tom Hendrikx.
8062 19 November 2009: Wouter
8063 - better argument help for unbound-control.
8064 - iana portlist updated.
8066 17 November 2009: Wouter
8067 - noted multiple entries for multiple domain names in example.conf.
8068 - iana portlist updated.
8070 16 November 2009: Wouter
8071 - Fixed signer detection of CNAME responses without signatures.
8072 - Fix#282 libunbound memleak on error condition by Eric Sesterhenn.
8073 - Tests for CNAMEs to deeper trust anchors, secure and bogus.
8074 - svn tag 1.4.0rc1 made.
8076 13 November 2009: Wouter
8077 - Fixed validation failure for CNAME to optout NSEC3 nodata answer.
8078 - unbound-host does not fail on type ANY.
8079 - Fixed wireparse failure to put RRSIGs together with data in some
8080 long ANY mix cases, which fixes validation failures.
8082 12 November 2009: Wouter
8083 - iana portlist updated.
8084 - fix manpage errors reported by debian lintian.
8086 - fixup very long vallog2 level error strings.
8088 11 November 2009: Wouter
8089 - ldns tarball updated (to 1.6.2).
8092 10 November 2009: Wouter
8093 - Thanks to Surfnet found bug in new dnssec-retry code that failed
8094 to combine well when combined with DLV and a particular failure.
8095 - Fixed unbound-control -h output about argument optionality.
8098 5 November 2009: Wouter
8099 - lint fixes and portability tests.
8100 - better error text for multiple domain keys in one autotrust file.
8102 2 November 2009: Wouter
8103 - Fix bug where autotrust does not work when started with a DS.
8104 - Updated GOST unit tests for unofficial algorithm number 249
8105 and DNSKEY-format changes in draft version -01.
8107 29 October 2009: Wouter
8108 - iana portlist updated.
8109 - edns-buffer-size option, default 4096.
8112 28 October 2009: Wouter
8113 - removed abort on prealloc failure, error still printed but softfail.
8114 - iana portlist updated.
8115 - RFC 5702: RSASHA256 and RSASHA512 support enabled by default.
8116 - ldns tarball updated (which also enables rsasha256 support).
8118 27 October 2009: Wouter
8119 - iana portlist updated.
8121 8 October 2009: Wouter
8123 - add val-log-level print to corner case (nameserver.epost.bg).
8124 - more detail to errors from insecure delegation checks.
8125 - Fix double time subtraction in negative cache reported by
8126 Amanda Constant and Hugh Mahon.
8127 - Made new validator error string available from libunbound for
8128 applications. It is in result->why_bogus, a zero-terminated string.
8129 unbound-host prints it by default if a result is bogus.
8130 Also the errinf is public in module_qstate (for other modules).
8132 7 October 2009: Wouter
8133 - retry for validation failure in DS and prime results. Less mem use.
8134 unit test. Provisioning in other tests for requeries.
8135 - retry for validation failure in DNSKEY in middle of chain of trust.
8137 - retry for empty non terminals in chain of trust and unit test.
8138 - Fixed security bug where the signatures for NSEC3 records were not
8139 checked when checking for absence of DS records. This could have
8140 enabled the substitution of an insecure delegation.
8141 - moved version number to 1.4.0 because of 1.3.4 release with only
8142 the NSEC3 patch from the entry above.
8143 - val-log-level: 2 shows extended error information for validation
8144 failures, but still one (longish) line per failure. For example:
8145 validation failure <example.com. DNSKEY IN>: signature expired from
8146 192.0.2.4 for trust anchor example.com. while building chain of trust
8147 validation failure <www.example.com. A IN>: no signatures from
8148 192.0.2.6 for key example.com. while building chain of trust
8150 6 October 2009: Wouter
8151 - Test set updated to provide additional ns lookup result.
8152 The retry would attempt to fetch the data from other nameservers
8153 for bogus data, and this needed to be provisioned in the tests.
8155 5 October 2009: Wouter
8156 - first validation failure retry code. Retries for data failures.
8159 2 October 2009: Wouter
8160 - improve 5011 modularization.
8161 - fix unbound-host so -d can be given before -C.
8162 - iana portlist updated.
8164 28 September 2009: Wouter
8165 - autotrust-anchor-file can read multiline input and $ORIGIN.
8166 - prevent integer overflow in holddown calculation. review fixes.
8167 - fixed race condition in trust point revocation. review fix.
8168 - review fixes to comments, removed unused code.
8170 25 September 2009: Wouter
8171 - so-rcvbuf: 4m option added. Set this on large busy servers to not
8172 drop the occasional packet in spikes due to full socket buffers.
8173 netstat -su keeps a counter of UDP dropped due to full buffers.
8174 - review of validator/autotrust.c, small fixes and comments.
8176 23 September 2009: Wouter
8177 - 5011 query failed counts verification failures, not lookup failures.
8178 - 5011 probe failure handling fixup.
8179 - test unbound reading of original autotrust data.
8180 The metadata per-key, such as key state (PENDING, MISSING, VALID) is
8181 picked up, otherwise performs initial probe like usual.
8183 22 September 2009: Wouter
8184 - autotrust test with algorithm rollover, new ordering of checks
8185 assists in orderly rollover.
8186 - autotrust test with algorithm rollover to unknown algorithm.
8187 checks if new keys are supported before adding them.
8188 - autotrust test with trust point revocation, becomes unsigned.
8189 - fix DNSSEC-missing-signature detection for minimal responses
8190 for qtype DNSKEY (assumes DNSKEY occurs at zone apex).
8192 18 September 2009: Wouter
8193 - autotrust tests, fix trustpoint timer deletion code.
8194 fix count of valid anchors during missing remove.
8195 - autotrust: pick up REVOKE even if not signed with known other keys.
8197 17 September 2009: Wouter
8198 - fix compile of unbound-host when --enable-alloc-checks.
8199 - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis.
8200 - Manual page fixes reported by Tony Finch.
8202 16 September 2009: Wouter
8203 - Fix memory leak reported by Tao Ma.
8204 - Fix memstats test tool for log-time-ascii log format.
8206 15 September 2009: Wouter
8207 - iana portlist updated.
8209 10 September 2009: Wouter
8210 - increased MAXSYSLOGLEN so .bg key can be printed in debug output.
8211 - use linebuffering for log-file: output, this can be significantly
8212 faster than the previous fflush method and enable some class of
8213 resolvers to use high verbosity (for short periods).
8214 Not on windows, because line buffering does not work there.
8216 9 September 2009: Wouter
8217 - Fix bug where DNSSEC-bogus messages were marked with too high TTL.
8218 The RRsets would still expire at the normal time, but this would
8219 keep messages bogus in the cache for too long.
8220 - regression test for that bug.
8221 - documented that load_cache is meant for debugging.
8223 8 September 2009: Wouter
8224 - fixup printing errors when load_cache, they were printed to the
8225 SSL connection which broke, now to the log.
8226 - new ldns - with fixed parse of large SOA values.
8228 7 September 2009: Wouter
8229 - autotrust testbound scenarios.
8230 - autotrust fix that failure count is written to file.
8231 - autotrust fix that keys may become valid after add holddown time
8232 alone, before the probe returns.
8234 4 September 2009: Wouter
8235 - Changes to make unbound work with libevent-2.0.3 alpha. (in
8236 configure detection due to new ssl dependency in libevent)
8237 - do not call sphinx for documentation when python is disabled.
8238 - remove EV_PERSIST from libevent timeout code to make the code
8239 compatible with the libevent-2.0. Works with older libevent too.
8240 - fix memory leak in python code.
8242 3 September 2009: Wouter
8243 - Got a patch from Luca Bruno for libunbound support on windows to
8244 pick up the system resolvconf nameservers and hosts there.
8245 - included ldns updated (enum warning fixed).
8246 - makefile fix for parallel makes.
8247 - Patch from Zdenek Vasicek and Attila Nagy for using the source IP
8248 from python scripts. See pythonmod/examples/resip.py.
8249 - doxygen comment fixes.
8251 2 September 2009: Wouter
8252 - TRAFFIC keyword for testbound. Simplifies test generation.
8253 ${range lower val upper} to check probe timeout values.
8254 - test with 5011-prepublish rollover and revocation.
8255 - fix revocation of RR for autotrust, stray exclamation mark.
8257 1 September 2009: Wouter
8258 - testbound variable arithmetic.
8259 - autotrust probe time is randomised.
8260 - autotrust: the probe is active and does not fetch from cache.
8262 31 August 2009: Wouter
8263 - testbound variable processing.
8265 28 August 2009: Wouter
8266 - fixup unbound-control lookup to print forward and stub servers.
8268 27 August 2009: Wouter
8269 - autotrust: mesh answer callback is empty.
8271 26 August 2009: Wouter
8272 - autotrust probing.
8273 - iana portlist updated.
8275 25 August 2009: Wouter
8276 - fixup memleak in trust anchor unsupported algorithm check.
8277 - iana portlist updated.
8278 - autotrust options: add-holddown, del-holddown, keep-missing.
8279 - autotrust store revoked status of trust points.
8280 - ctime_r compat definition.
8281 - detect yylex_destroy() in configure.
8282 - detect SSL_get_compression_methods declaration in configure.
8283 - fixup DS lookup at anchor point with unsigned parent.
8284 - fixup DLV lookup for DS queries to unsigned domains.
8286 24 August 2009: Wouter
8287 - cleaner memory allocation on exit. autotrust test routines.
8288 - free all memory on program exit, fix for ssl and flex.
8290 21 August 2009: Wouter
8291 - autotrust: debug routines. Read,write and conversions work.
8293 20 August 2009: Wouter
8294 - autotrust: save and read trustpoint variables.
8296 19 August 2009: Wouter
8297 - autotrust: state table updates.
8298 - iana portlist updated.
8300 17 August 2009: Wouter
8301 - autotrust: process events.
8303 17 August 2009: Wouter
8304 - Fix so that servers are only blacklisted if they fail to reply
8305 to 16 queries in a row and the timeout gets above 2 minutes.
8306 - autotrust work, split up DS verification of DNSKEYs.
8308 14 August 2009: Wouter
8309 - unbound-control lookup prints out infra cache information, like RTT.
8310 - Fix bug in DLV lookup reported by Amanda from Secure64.
8311 It could sometimes wrongly classify a domain as unsigned, which
8312 does not give the AD bit on replies.
8314 13 August 2009: Wouter
8315 - autotrust read anchor files. locked trust anchors.
8317 12 August 2009: Wouter
8318 - autotrust import work.
8320 11 August 2009: Wouter
8321 - Check for openssl compatible with gost if enabled.
8322 - updated unit test for GOST=211 code.
8323 Nicer naming of test files.
8324 - iana portlist updated.
8326 7 August 2009: Wouter
8327 - call OPENSSL_config() in unbound and unit test so that the
8328 operator can use openssl.cnf for configuration options.
8329 - removed small memory leak from config file reader.
8331 6 August 2009: Wouter
8332 - configure --enable-gost for GOST support, experimental
8333 implementation of draft-dolmatov-dnsext-dnssec-gost-01.
8334 - iana portlist updated.
8335 - ldns tarball updated (with GOST support).
8337 5 August 2009: Wouter
8338 - trunk moved to 1.3.4.
8340 4 August 2009: Wouter
8341 - Added test that the examples from draft rsasha256-14 verify.
8342 - iana portlist updated.
8345 3 August 2009: Wouter
8346 - nicer warning when algorithm not supported, tells you to upgrade.
8347 - iana portlist updated.
8349 27 July 2009: Wouter
8350 - Updated unbound-cacti contribution from Dmitriy Demidov, with
8351 the queue statistics displayed in its own graph.
8352 - iana portlist updated.
8354 22 July 2009: Wouter
8355 - Fix bug found by Michael Tokarev where unbound would try to
8356 prime the root servers even though forwarders are configured for
8360 21 July 2009: Wouter
8361 - Fix server selection, so that it waits for open target queries when
8362 faced with lameness.
8364 20 July 2009: Wouter
8365 - Ignore transient sendto errors, no route to host, and host, net down.
8366 - contrib/update-anchor.sh has -r option for root-hints.
8367 - feature val-log-level: 1 prints validation failures so you can
8368 keep track of them during dnssec deployment.
8370 16 July 2009: Wouter
8371 - fix replacement malloc code. Used in crosscompile.
8372 - makedist -w creates crosscompiled setup.exe on fedora11.
8374 15 July 2009: Wouter
8375 - dependencies for compat items, for crosscompile.
8376 - mingw32 crosscompile changes, dependencies and zipfile creation.
8377 and with System.dll from the windows NSIS you can make setup.exe.
8378 - package libgcc_s_sjlj exception handler for NSISdl.dll.
8380 14 July 2009: Wouter
8381 - updated ldns tarball for solaris x64 compile assistance.
8382 - no need to define RAND_MAX from config.h.
8383 - iana portlist updated.
8384 - configure changes and ldns update for mingw32 crosscompile.
8386 13 July 2009: Wouter
8387 - Fix for crash at start on windows.
8388 - tag for release 1.3.2.
8389 - trunk has version 1.3.3.
8390 - Fix for ID bits on windows to use all 16. RAND_MAX was not
8391 defined like you'd expect on mingw. Reported by Mees de Roo.
8394 - tag for release 1.3.1.
8395 - trunk has version 1.3.2.
8398 - iana portlist updated.
8401 - prettier error handling in SSL setup.
8402 - makedist.sh uname fix (same as ldns).
8403 - updated fedora spec file.
8406 - fixup linking when ldnsdir is "".
8408 30 June 2009: Wouter
8409 - more lenient truncation checks.
8411 29 June 2009: Wouter
8412 - ldns trunk r2959 imported as tarball, because of solaris cc compile
8413 support for c99. r2960 for better configure.
8414 - better wrongly_truncated check.
8415 - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to
8416 avoid dropped packets at routers.
8418 26 June 2009: Wouter
8419 - Fix EDNS fallback when EDNS works for short answers but long answers
8422 22 June 2009: Wouter
8423 - fixup iter priv strict aliasing while preserving size of sockaddr.
8424 - iana portlist updated. (one less port allocated, one more fraction
8425 of a bit for security!)
8426 - updated fedora specfile in contrib from Paul Wouters.
8428 19 June 2009: Wouter
8429 - Fixup strict aliasing warning in iter priv code.
8430 and config_file code.
8431 - iana portlist updated.
8432 - harden-referral-path: handle cases where NS is in answer section.
8434 18 June 2009: Wouter
8435 - Fix of message parse bug where (specifically) an NSEC and RRSIG
8436 in the wrong order would be parsed, but put wrongly into internal
8437 structures so that later validation would fail.
8438 - Extreme lenience for wrongly truncated replies where a positive
8439 reply has an NS in the authority but no signatures. They are
8440 turned into minimal responses with only the (secure) answer.
8441 - autoconf 2.63 for configure.
8442 - python warnings suppress. Keep python API away from header files.
8444 17 June 2009: Wouter
8445 - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was
8446 used for the python code in unbound. (http://www.nic.cz/vip/ in cz).
8448 16 June 2009: Wouter
8449 - Fixup opportunistic target query generation to it does not
8450 generate queries that are known to fail.
8451 - Touchup on munin total memory report.
8452 - messages picked out of the cache by the iterator are checked
8453 if their cname chain is still correct and if validation status
8454 has to be reexamined.
8456 15 June 2009: Wouter
8457 - iana portlist updated.
8459 14 June 2009: Wouter
8460 - Fixed bug where cached responses would lose their security
8461 status on second validation, which especially impacted dlv
8462 lookups. Reported by Hauke Lampe.
8464 13 June 2009: Wouter
8465 - bug #254. removed random whitespace from example.conf.
8467 12 June 2009: Wouter
8468 - Fixup potential wrong NSEC picked out of the cache.
8469 - If unfulfilled callbacks are deleted they are called with an error.
8470 - fptr wlist checks for mesh callbacks.
8471 - fwd above stub in configuration works.
8473 11 June 2009: Wouter
8474 - Fix queries for type DS when forward or stub zones are there.
8475 They are performed to higherup domains, and thus treated as if
8476 going to higher zones when looking up the right forward or stub
8477 server. This makes a stub pointing to a local server that has
8478 a local view of example.com signed with the same keys as are
8479 publicly used work. Reported by Johan Ihren.
8480 - Added build-unbound-localzone-from-hosts.pl to contrib, from
8481 Dennis DeDonatis. It converts /etc/hosts into config statements.
8482 - same thing fixed for forward-zone and DS, chain of trust from
8483 public internet into the forward-zone works now. Added unit test.
8486 - openssl key files are opened apache-style, when user is root and
8487 before chrooting. This makes permissions on remote-control key
8488 files easier to set up. Fixes bug #251.
8489 - flush_type and flush_name remove msg cache entries.
8490 - codereview - dp copy bogus setting fix.
8493 - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause
8494 inadvertant behaviour.
8495 - 1.3.0 tarball for release created.
8496 - 1.3.1 development in svn trunk.
8497 - iana portlist updated.
8498 - fix lint from complaining on ldns/sha.h.
8499 - help compiler figure out aliasing in priv_rrset_bad() routine.
8500 - fail to configure with python if swig is not found.
8501 - unbound_munin_ in contrib uses ps to show rss if sbrk does not work.
8504 - fixup bad free() when wrongly encoded DSA signature is seen.
8505 Reported by Paul Wouters.
8506 - review comments from Matthijs.
8509 - --enable-sha2 option. The draft rsasha256 changed its algorithm
8510 numbers too often. Therefore it is more prudent to disable the
8511 RSASHA256 and RSASHA512 support by default.
8512 - ldns trunk included as new tarball.
8513 - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point.
8516 - fixup doc bug in README reported by Matthew Dempsky.
8519 - update iana port list
8520 - update ldns lib tarball
8523 - detect lack of IPv6 support on XP (with a different error code).
8524 - Fixup a crash-on-exit which was triggered by a very long queue.
8525 Unbound would try to re-use ports that came free, but this is
8526 of course not really possible because everything is deleted.
8527 Most easily triggered on XP (not Vista), maybe because of the
8528 network stack encouraging large messages backlogs.
8529 - change in debug statements.
8530 - Fixed bug that could cause a crash if root prime failed when there
8531 were message backlogs.
8534 - Thanks again to Brett Carr, found an assertion that was not true.
8535 Assertion checked if recursion parent query still existed.
8537 29 April 2009: Wouter
8538 - Thanks to Brett Carr, caught windows resource leak, use
8539 closesocket() and not close() on sockets or else the network stack
8540 starts to leak handles.
8541 - Removed usage of windows Mutex because windows cannot handle enough
8542 mutexes open. Provide own mutex implementation using primitives.
8544 28 April 2009: Wouter
8545 - created svn tag for 1.3.0.
8547 27 April 2009: Wouter
8548 - optimised cname from cache.
8549 - ifdef windows functions in testbound.
8551 23 April 2009: Wouter
8552 - fix for threadsafety in solaris thr_key_create() in tests.
8553 - iana portlist updated.
8554 - fix pylib test for Darwin.
8555 - fix pymod test for Darwin and a python threading bug in pymod init.
8556 - check python >= 2.4 in configure.
8557 - -ldl check for libcrypto 1.0.0beta.
8559 21 April 2009: Wouter
8560 - fix for build outside sourcedir.
8561 - fix for configure script swig detection.
8563 17 April 2009: Wouter
8564 - Fix reentrant in minievent handler for unix. Could have resulted
8565 in spurious event callbacks.
8566 - timers do not take up a fd slot for winsock handler.
8567 - faster fix for winsock reentrant check.
8568 - fix rsasha512 unit test for new (interim) algorithm number.
8569 - fix test:ldns doesn't like DOS line endings in keyfiles on unix.
8570 - fix compile warning on ubuntu (configlexer fwrite return value).
8571 - move python include directives into CPPFLAGS instead of CFLAGS.
8573 16 April 2009: Wouter
8574 - winsock event handler exit very quickly on signal, even if
8576 - iana portlist updated.
8577 - fixup windows winsock handler reentrant problem.
8579 14 April 2009: Wouter
8580 - bug #245: fix munin plugin, perform cleanup of stale lockfiles.
8581 - makedist.sh; better help text.
8582 - cache-min-ttl option and tests.
8583 - mingw detect error condition on TCP sockets (NOTCONN).
8585 9 April 2009: Wouter
8586 - Fix for removal of RSASHA256_NSEC3 protonumber from ldns.
8587 - ldns tarball updated.
8588 - iana portlist update.
8589 - detect GOST support in openssl-1.0.0-beta1, and fix compile problem
8590 because that openssl defines the name STRING for itself.
8592 6 April 2009: Wouter
8593 - windows compile fix.
8594 - Detect FreeBSD jail without ipv6 addresses assigned.
8595 - python libunbound wrapper unit test.
8596 - installs the following files. Default is to not build them.
8597 from configure --with-pythonmodule:
8598 /usr/lib/python2.x/site-packages/unboundmodule.py
8599 from configure --with-pyunbound:
8600 /usr/lib/python2.x/site-packages/unbound.py
8601 /usr/lib/python2.x/site-packages/_unbound.so*
8602 The example python scripts (pythonmod/examples and
8603 libunbound/python/examples) are not installed.
8604 - python invalidate routine respects packed rrset ids and locks.
8605 - clock skew checks in unbound, config statements.
8606 - nxdomain ttl considerations in requirements.txt
8608 3 April 2009: Wouter
8609 - Fixed a bug that caused messages to be stored in the cache too
8610 long. Hard to trigger, but NXDOMAINs for nameservers or CNAME
8611 targets have been more vulnerable to the TTL miscalculation bug.
8612 - documentation test fixed for python addition.
8614 2 April 2009: Wouter
8615 - pyunbound (libunbound python plugin) compiles using libtool.
8616 - documentation for pythonmod and pyunbound is generated in doc/html.
8617 - iana portlist updated.
8618 - fixed bug in unbound-control flush_zone where it would not flush
8619 every message in the target domain. This especially impacted
8620 NXDOMAIN messages which could remain in the cache regardless.
8621 - python module test package.
8623 1 April 2009: Wouter
8624 - suppress errors when trying to contact authority servers that gave
8625 ipv6 AAAA records for their nameservers with ipv4 mapped contents.
8626 Still tries to do so, could work when deployed in intranet.
8627 Higher verbosity shows the error.
8628 - new libunbound calls documented.
8629 - pyunbound in libunbound/python. Removed compile warnings.
8630 Makefile to make it.
8632 30 March 2009: Wouter
8633 - Fixup LDFLAGS from libevent sourcedir compile configure restore.
8634 - Fixup so no non-absolute rpaths are added.
8635 - Fixup validation of RRSIG queries, they are let through.
8636 - read /dev/random before chroot
8637 - checkconf fix no python checks when no python module enabled.
8638 - fix configure, pthread first, so other libs do not change outcome.
8640 27 March 2009: Wouter
8641 - nicer -h output. report linked libraries and modules.
8642 - prints modules in intuitive order (config file friendly).
8643 - python compiles easily on BSD.
8645 26 March 2009: Wouter
8646 - ignore swig varargs warnings with gcc.
8647 - remove duplicate example.conf text from python example configs.
8648 - outofdir compile fix for python.
8650 - print modules compiled in on -h. manpage.
8652 25 March 2009: Wouter
8653 - initial import of the python contribution from Zdenek Vasicek and
8655 - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0.
8657 24 March 2009: Wouter
8658 - more neat configure.ac. Removed duplicate config.h includes.
8659 - neater config.h.in.
8660 - iana portlist updated.
8661 - fix util/configlexer.c and solaris -std=c99 flag.
8662 - fix postcommit aclocal errors.
8663 - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R.
8664 - swap order of host detect and libtool generation.
8666 23 March 2009: Wouter
8667 - added launchd plist example file for MacOSX to contrib.
8668 - deprecation test for daemon(3).
8669 - moved common configure actions to m4 include, prettier Makefile.
8671 20 March 2009: Wouter
8672 - bug #239: module-config entries order is important. Documented.
8673 - build fix for test asynclook.
8675 19 March 2009: Wouter
8676 - winrc/README.txt dos-format text file.
8677 - iana portlist updated.
8678 - use _beginthreadex() when available (performs stack alignment).
8679 - defaults for windows baked into configure.ac (used if on mingw).
8681 18 March 2009: Wouter
8682 - Added tests, unknown algorithms become insecure. fallback works.
8683 - Fix for and test for unknown algorithms in a trust anchor
8684 definition. Trust anchors with no supported algos are ignored.
8685 This means a (higher)DS or DLV entry for them could succeed, and
8686 otherwise they are treated as insecure.
8687 - domain-insecure: "example.com" statement added. Sets domain
8688 insecure regardless of chain of trust DSs or DLVs. The inverse
8691 17 March 2009: Wouter
8692 - unit test for unsupported algorithm in anchor warning.
8693 - fixed so queries do not fail on opportunistic target queries.
8695 16 March 2009: Wouter
8696 - fixup diff error printout in contrib/update-itar.sh.
8697 - added contrib/unbound_cacti for statistics support in cacti,
8698 contributed by Dmitriy Demidov.
8700 13 March 2009: Wouter
8701 - doxygen and lex/yacc on linux.
8702 - strip update-anchor on makedist -w.
8703 - fix testbound on windows.
8704 - default log to syslog for windows.
8705 - uninstaller can stop unbound - changed text on it to reflect that.
8706 - remove debugging from windows 'cron' actions.
8708 12 March 2009: Wouter
8709 - log to App.logs on windows prints executable identity.
8711 - munin plugin fix benign locking error printout.
8712 - anchor-update for windows, called every 24 hours; unbound reloads.
8714 11 March 2009: Wouter
8715 - winsock event handler resets WSAevents after signalled.
8716 - winsock event handler tests if signals are really signalled.
8717 - install and service with log to file works on XP and Vista on
8718 default install location.
8719 - on windows logging to the Application logbook works (as a service).
8720 - fix RUN_DIR on windows compile setting in makedist.
8721 - windows registry has Software\Unbound\ConfigFile element.
8722 If does not exist, the default is used. The -c switch overrides it.
8723 - fix makedist version cleanup function.
8725 10 March 2009: Wouter
8726 - makedist -w strips out old rc.. and snapshot info from version.
8727 - setup.exe starts and stops unbound after install, before uninstall.
8728 - unbound-checkconf recognizes absolute pathnames on windows (C:...).
8730 9 March 2009: Wouter
8731 - Nullsoft NSIS installer creation script.
8733 5 March 2009: Wouter
8734 - fixup memory leak introduced on 18feb in mesh reentrant fix.
8736 3 March 2009: Wouter
8737 - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8).
8738 - service works on xp/vista, no config necessary (using defaults).
8739 - windows registry settings.
8741 2 March 2009: Wouter
8742 - fixup --export-symbols to be -export-symbls for libtool.
8743 This should fix extraneous symbols exported from libunbound.
8744 Thanks to Ondrej Sury and Robert Edmonds for finding it.
8745 - iana portlist updated.
8746 - document FAQ entry on stub/forward zones and default blocking.
8747 - fix asynclook test app for libunbound not exporting symbols.
8748 - service install and remove utils that work with vista UAC.
8750 27 February 2009: Wouter
8751 - Fixup lexer, to not give warnings about fwrite. Appeared in
8753 - makedistro functionality for mingw. Has RC support.
8754 - support spaces and backslashes in configured defaults paths.
8755 - register, deregister in service control manager.
8757 25 February 2009: Wouter
8758 - windres usage for application resources.
8760 24 February 2009: Wouter
8761 - isc moved their dlv key download location.
8762 - fixup warning on vista/mingw.
8763 - makedist -w for window zip distribution first version.
8765 20 February 2009: Wouter
8766 - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped.
8767 Nicer script layout. Added url to site in -h output.
8769 19 February 2009: Wouter
8770 - unbound-checkconf and unbound print warnings when trust anchors
8771 have unsupported algorithms.
8772 - added contrib/update-itar.sh This script is similar to
8773 update-anchor.sh, and updates from the IANA ITAR repository.
8774 You can provide your own PGP key and trust repo, or can use the
8775 builtin. The program uses wget and gpg to work.
8776 - iana portlist updated.
8777 - update-itar.sh: using ftp:// urls because https godaddy certificate
8778 is not available everywhere and then gives fatal errors. The
8779 security is provided by pgp signature.
8781 18 February 2009: Wouter
8782 - more cycle detection. Also for target queries.
8783 - fixup bug where during deletion of the mesh queries the callbacks
8784 that were reentrant caused assertion failures. Keep the mesh in
8785 a reentrant safe state. Affects libunbound, reload of server,
8786 on quit and flush_requestlist.
8787 - iana portlist updated.
8789 13 February 2009: Wouter
8790 - forwarder information now per-thread duplicated.
8791 This keeps it read only for speed, with no locking necessary.
8792 - forward command for unbound control to change forwarders to use
8794 - document that unbound-host reads no config file by default.
8795 - updated iana portlist.
8797 12 February 2009: Wouter
8798 - call setusercontext if available (on BSD).
8799 - small refactor of stats clearing.
8800 - #227: flush_stats feature for unbound-control.
8801 - stats_noreset feature for unbound-control.
8802 - flush_requestlist feature for unbound-control.
8803 - libunbound version upped API (was changed 5 feb).
8804 - unbound-control status shows if root forwarding is in use.
8805 - slightly nicer memory management in iter-fwd code.
8807 10 February 2009: Wouter
8808 - keys with rfc5011 REVOKE flag are skipped and not considered when
8810 - iana portlist updated
8811 - #226: dump_requestlist feature for unbound-control.
8813 6 February 2009: Wouter
8814 - contrib contains specfile for fedora 1.2.1 (from Paul Wouters).
8815 - iana portlist updated.
8816 - fixup EOL in include directive (reported by Paul Wouters).
8817 You can no longer specify newlines in the names of included files.
8818 - config parser changed. Gives some syntax errors closer to where they
8819 occurred. Does not enforce a space after keyword anymore.
8820 Does not allow literal newlines inside quoted strings anymore.
8821 - verbosity level 5 logs customer IP for new requestlist entries.
8822 - test fix, lexer and cancel test.
8823 - new option log-time-ascii: yes if you enable it prints timestamps
8824 in the log file as Feb 06 13:45:26 (like syslog does).
8825 - detect event_base_new in libevent-1.4.1 and later and use it.
8826 - #231 unbound-checkconf -o option prints that value from config file.
8827 Useful for scripting in management scripts and the like.
8829 5 February 2009: Wouter
8830 - ldns 1.5.0 rc as tarball included.
8831 - 1.3.0 development continues:
8832 change in libunbound API: ub_cancel can return an error, that
8833 the async_id did not exist, or that it was already delivered.
8834 The result could have been delivered just before the cancel
8835 routine managed to acquire the lock, so a caller may get the
8836 result at the same time they call cancel. For this case,
8837 ub_cancel tries to return an error code.
8838 Fixes race condition in ub_cancel() libunbound function.
8839 - MacOSX Leopard cleaner text output from configure.
8840 - initgroups(3) is called to drop secondary group permissions, if
8842 - configure option --with-ldns-builtin forces the use of the
8843 inluded ldns package with the unbound source. The -I include
8844 is put before the others, so it avoids bad include files from
8845 an older ldns install.
8846 - daemon(3) posix call is used when available.
8847 - testbound test for older fix added.
8849 4 February 2009: Wouter
8850 - tag for release 1.2.1.
8851 - trunk setup for 1.3.0 development.
8853 3 February 2009: Wouter
8854 - noted feature requests in doc/TODO.
8855 - printout more detailed errors on ssl certificate loading failures.
8856 - updated IANA portlist.
8858 16 January 2009: Wouter
8859 - more quiet about ipv6 network failures, i.e. when ipv6 is not
8860 available (network unreachable). Debug still printed on high
8862 - unbound-host -4 and -6 options. Stops annoying ipv6 errors when
8863 debugging with unbound-host -4 -d ...
8864 - more cycle detection for NS-check, addr-check, root-prime and
8865 stub-prime queries in the iterator. Avoids possible deadlock
8868 15 January 2009: Wouter
8869 - bug #229: fixup configure checks for compilation with Solaris
8870 Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc
8871 - fixup suncc warnings.
8872 - fix bug where unbound could crash using libevent 1.3 and older.
8873 - update testset for recent retry change.
8875 14 January 2009: Wouter
8876 - 1.2.1 feature: negative caching for failed queries.
8877 Queries that failed are cached for 5 seconds (NORR_TTL).
8878 If the failure is local, like out of memory, it is not cached.
8879 - the TTL comparison for the cache used different comparisons,
8880 causing many cache responses that used the iterator and validator
8881 state machines unnecessarily.
8882 - retry from 4 to 5 so that EDNS drop retry is part of the first
8883 query resolve attempt, and cached error does not stop EDNS fallback.
8884 - remove debug prints that protect against bad referrals.
8885 - honor QUIET=no on make commandline (or QUIET=yes ).
8887 13 January 2009: Wouter
8888 - fixed bug in lameness marking, removed printouts.
8889 - find NS rrset more cleanly for qtype NS.
8890 - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for
8892 - 1.2.1 feature: stops resolving AAAAs promiscuously when they
8893 are in the negative cache.
8895 12 January 2009: Wouter
8896 - fixed bug in infrastructure lameness cache, did not lowercase
8897 name of zone to hash when setting lame.
8898 - lameness debugging printouts.
8900 9 January 2009: Wouter
8901 - created svn tag for 1.2.0 release.
8902 - svn trunk contains 1.2.1 version number.
8903 - iana portlist updated for todays list.
8904 - removed debug print.
8906 8 January 2009: Wouter
8907 - new version of ldns-trunk (today) included as tarball, fixed
8908 bug #224, building with -j race condition.
8909 - remove possible race condition in the test for race conditions.
8911 7 January 2009: Wouter
8912 - version 1.2.0 in preparation.
8913 - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file
8914 statements. (Adapted from patch by Paul Wouters).
8915 - typo fix and iana portlist updated.
8916 - porting testsuite; unused var warning, and type fixup.
8918 6 January 2009: Wouter
8919 - fixup packet-of-death when compiled with --enable-debug.
8920 A malformed packet could cause an internal assertion failure.
8921 - added test for HINFO canonicalisation behaviour.
8922 - fixup reported problem with transparent local-zone data where
8923 queries with different type could get nxdomain. Now queries
8924 with a different name get resolved normally, with different type
8925 get a correct NOERROR/NODATA answer.
8926 - HINFO no longer downcased for validation, making unbound compatible
8928 - fix reading included config files when chrooted.
8929 Give full path names for include files.
8930 Relative path names work if the start dir equals the working dir.
8931 - fix libunbound message transport when no packet buffer is available.
8933 5 January 2009: Wouter
8934 - fixup getaddrinfo failure handling for remote control port.
8935 - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints.
8936 - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/
8937 - comm_timer_set performs base_set operation after event_add.
8939 18 December 2008: Wouter
8940 - fixed bug reported by Duane Wessels: error in DLV lookup, would make
8941 some zones that had correct DLV keys as insecure.
8942 - follows -rc makedist from ldns changes (no _rc).
8943 - ldns tarball updated with 1.4.1rc for DLV unit test.
8944 - verbose prints about recursion lame detection and server selection.
8945 - fixup BSD port for infra host storage. It hashed wrongly.
8946 - fixup makedist snapshot name generation.
8947 - do not reopen syslog to avoid dev/log dependency.
8949 17 December 2008: Wouter
8950 - follows ldns makedist.sh. -rc option. autom4te dir removed.
8951 - unbound-control status command.
8952 - extended statistics has a number of ipv6 queries counter.
8953 contrib/unbound_munin_ was updated to draw ipv6 in the hits graph.
8955 16 December 2008: Wouter
8956 - follow makedist improvements from ldns, for maintainers prereleases.
8957 - snapshot version uses _ not - to help rpm distinguish the
8960 11 December 2008: Wouter
8961 - better fix for bug #219: use LOG_NDELAY with openlog() call.
8962 Thanks to Tamas Tevesz.
8964 9 December 2008: Wouter
8965 - bug #221 fixed: unbound checkconf checks if key files exist if
8966 remote control is enabled. Also fixed NULL printf when not chrooted.
8967 - iana portlist updated.
8969 3 December 2008: Wouter
8970 - Fix problem reported by Jaco Engelbrecht where unbound-control stats
8971 freezes up unbound if this was compiled without threading, and
8972 was using multiple processes.
8973 - iana portlist updated.
8974 - test for remote control with interprocess communication.
8975 - created command distribution mechanism so that remote control
8976 commands other than 'stats' work on all processes in a nonthreaded
8977 compiled version. dump/load cache work, on the first process.
8978 - fixup remote control local_data addition memory corruption bug.
8980 1 December 2008: Wouter
8981 - SElinux policy files in contrib/selinux for the unbound daemon,
8982 by Paul Wouters and Adam Tkac.
8984 25 November 2008: Wouter
8985 - configure complains when --without-ssl is given (bug #220).
8986 - skip unsupported feature tests on vista/mingw.
8987 - fixup testcode/streamtcp to work on vista/mingw.
8988 - root-hints test checks version of dig required.
8989 - blacklisted servers are polled at a low rate (1%) to see if they
8990 come back up. But not if there is some other working server.
8992 24 November 2008: Wouter
8993 - document that the user of the server daemon needs read privileges
8994 on the keys and certificates generated by unbound-control-setup.
8995 This is different per system or distribution, usually, running the
8996 script under the same username as the server uses suffices.
8997 i.e. sudo -u unbound unbound-control-setup
8998 - testset port to vista/mingw.
8999 - tcp_sigpipe to freebsd port.
9001 21 November 2008: Wouter
9002 - fixed tcp accept, errors were printed when they should not.
9003 - unbound-control-setup.sh removes read/write permissions other
9004 from the keys it creates (as suggested by Dmitriy Demidov).
9006 20 November 2008: Wouter
9007 - fixup fatal error due to faulty error checking after tcp accept.
9008 - add check in rlimit to avoid integer underflow.
9009 - rlimit check with new formula; better estimate for number interfaces
9010 - nicer comments in rlimit check.
9011 - tag 1.1.1 created in svn.
9012 - trunk label is 1.1.2
9014 19 November 2008: Wouter
9015 - bug #219: fixed so that syslog which delays opening until the first
9016 log line is written, gets a log line while not chroot'ed yet.
9018 18 November 2008: Wouter
9019 - iana portlist updated.
9020 - removed cast in unit test debug print that was not 64bit safe.
9021 - trunk back to 1.1.0; copied to tags 1.1.0 release.
9022 - trunk to has version number 1.1.1 again.
9023 - in 1.1.1; make clean nicer. grammar in manpage.
9025 17 November 2008: Wouter
9026 - theoretical fix for problems reported on mailing list.
9027 If a delegation point has no A but only AAAA and do-ip6 is no,
9028 resolution would fail. Fixed to ask for the A and AAAA records.
9029 It has to ask for both always, so that it can fail quietly, from
9030 TLD perspective, when a zone is only reachable on one transport.
9031 - test for above, only AAAA and doip6 is no. Fix causes A record
9032 for nameserver to be fetched.
9033 - fixup address duplication on cache fillup for delegation points.
9034 - testset updated for new query answer requirements.
9036 14 November 2008: Wouter
9037 - created 1.1.0 release tag in svn.
9038 - trunk moved to 1.1.1
9039 - fixup unittest-neg for locking.
9041 13 November 2008: Wouter
9042 - added fedora init and specfile to contrib (by Paul Wouters).
9043 - added configure check for ldns 1.4.0 (using its compat funcs).
9044 - neater comments in worker.h.
9045 - removed doc/plan and updated doc/TODO.
9046 - silenced EHOSTDOWN (verbosity 2 or higher to see it).
9047 - review comments from Jelte, Matthijs. Neater code.
9049 12 November 2008: Wouter
9050 - add unbound-control manpage to makedist replace list.
9052 11 November 2008: Wouter
9053 - unit test for negative cache, stress tests the refcounting.
9054 - fix for refcounting error that could cause fptr_wlist fatal exit
9055 in the negative cache rbtree (upcoming 1.1 feature). (Thanks to
9056 Attila Nagy for testing).
9057 - nicer comments in cachedump about failed RR to string conversion.
9058 - fix 32bit wrap around when printing large (4G and more) mem usage
9059 for extended statistics.
9061 10 November 2008: Wouter
9062 - fixup the getaddrinfo compat code rename.
9064 8 November 2008: Wouter
9065 - added configure check for eee build warning.
9067 7 November 2008: Wouter
9068 - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4.
9069 - detect nonblocking problems in network stack in configure script.
9071 6 November 2008: Wouter
9072 - dname_priv must decompress the name before comparison.
9073 - iana portlist updated.
9075 5 November 2008: Wouter
9076 - fixed possible memory leak in key_entry_key deletion.
9077 Would leak a couple bytes when trust anchors were replaced.
9078 - if query and reply qname overlap, the bytes are skipped not copied.
9079 - fixed file descriptor leak when messages were jostled out that
9080 had outstanding (TCP) replies.
9081 - DNAMEs used from cache have their synthesized CNAMEs initialized
9083 - fixed file descriptor leak for localzone type deny (for TCP).
9084 - fixed memleak at exit for nsec3 negative cached zones.
9085 - fixed memleak for the keyword 'nodefault' when reading config.
9086 - made verbosity of 'edns incapable peer' warning higher, so you
9087 do not get spammed by it.
9088 - caught elusive Bad file descriptor error bug, that would print the
9089 error while unnecessarily try to listen to a closed fd. Fixed.
9091 4 November 2008: Wouter
9092 - fixed -Wwrite-strings warnings that result in better code.
9094 3 November 2008: Wouter
9095 - fixup build process for Mac OSX linker, use ldns b32 compat funcs.
9096 - generated configure with autoconf-2.61.
9097 - iana portlist updated.
9098 - detect if libssl needs libdl. For static linking with libssl.
9099 - changed to use new algorithm identifiers for sha256/sha512
9100 from ldns 1.4.0 (need very latest version).
9101 - updated the included ldns tarball.
9102 - proper detection of SHA256 and SHA512 functions (not just sizes).
9104 23 October 2008: Wouter
9105 - a little more debug info for failure on signer names. prints names.
9107 22 October 2008: Wouter
9108 - CFLAGS are picked up by configure from the environment.
9109 - iana portlist updated.
9110 - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too.
9111 - new stub-prime: yesno option. Default is off, so it does not prime.
9112 can be turned on to get same behaviour as previous unbound release.
9113 - made automated test that checks if builtin root hints are uptodate.
9114 - finished draft-wijngaards-dnsext-resolver-side-mitigation
9115 implementation. The unwanted-reply-threshold can be set.
9116 - fixup so fptr_whitelist test in alloc.c works.
9118 21 October 2008: Wouter
9119 - fix update-anchors.sh, so it does not report different RR order
9120 as an update. Sorts the keys in the file. Updated copyright.
9121 - fixup testbound on windows, the command control pipe doesn't exist.
9122 - skip 08hostlib test on windows, no fork() available.
9123 - made unbound-remote work on windows.
9125 20 October 2008: Wouter
9126 - quench a log message that is debug only.
9127 - iana portlist updated.
9128 - do not query bogus nameservers. It is like nameservers that have
9129 the NS or A or AAAA record bogus are listed as donotquery.
9130 - if server selection is faced with only bad choices, it will
9131 attempt to get more options to be fetched.
9132 - changed bogus-ttl default value from 900 to 60 seconds.
9133 In anticipation that operator caused failures are more likely than
9134 actual attacks at this time. And thus repeated validation helps
9135 the operators get the problem fixed sooner. It makes validation
9136 failures go away sooner (60 seconds after the zone is fixed).
9137 Also it is likely to try different nameserver targets every minute,
9138 so that if a zone is bad on one server but not another, it is
9139 likely to pick up the 'correct' one after a couple minutes,
9140 and if the TTL is big enough that solves validation for the zone.
9141 - fixup unbound-control compilation on windows.
9143 17 October 2008: Wouter
9144 - port Leopard/G5: fixup type conversion size_t/uint32.
9145 please ranlib, stop file without symbols warning.
9146 - harden referral path now also validates the root after priming.
9147 It looks up the root NS authoritatively as well as the root servers
9148 and attemps to validate the entries.
9150 16 October 2008: Wouter
9151 - Fixup negative TTL values appearing (reported by Attila Nagy).
9153 15 October 2008: Wouter
9154 - better documentation for 0x20; remove fallback TODO, it is done.
9155 - harden-referral-path feature includes A, AAAA queries for glue,
9156 as well as very careful NS caching (only when doing NS query).
9157 A, AAAA use the delegation from the NS-query.
9159 14 October 2008: Wouter
9160 - fwd_three.tpkg test was flaky. If the three requests hit the
9161 wrong threads by chance (or bad OS) then the test would fail.
9162 Made less flaky by increasing number of retries.
9163 - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs.
9164 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014).
9165 Which includes the ldns_dname_absolute fix.
9166 - fwd_three test remains flaky now that unbound does not stop
9167 listening when full. Thus, removed timeout problem.
9168 It may be serviced by three threads, or maybe by one.
9169 Mostly only useful for lock-check testing now.
9171 13 October 2008: Wouter
9172 - fixed recursion servers deployed as authoritative detection, so
9173 that as a last resort, a +RD query is sent there to get the
9175 - iana port list update.
9176 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013).
9178 10 October 2008: Wouter
9179 - fixup tests - the negative cache contained the correct NSEC3s for
9180 two tests that are supposed to fail to validate.
9182 9 October 2008: Wouter
9183 - negative cache caps max iterations of NSEC3 done.
9184 - NSEC3 negative cache for qtype DS works.
9186 8 October 2008: Wouter
9187 - NSEC negative cache for DS.
9189 6 October 2008: Wouter
9190 - jostle-timeout option, so you can config for slow links.
9191 - 0x20 fallback code. Tries 3xnumber of nameserver addresses
9192 queries that must all be the same. Sent to random nameservers.
9193 - documented choices for DoS, EDNS, 0x20.
9195 2 October 2008: Wouter
9196 - fixup unlink of pidfile.
9197 - fixup SHA256 algorithm collation code.
9198 - contrib/update-anchor.sh does not overwrite anchors if not needed.
9199 exits 0 when a restart is needed, other values if not.
9200 so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart
9201 can restart unbound exactly when needed.
9203 30 September 2008: Wouter
9204 - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1.
9205 - tests for sha256 support and downgrade resistance.
9206 - RSASHA256 and RSASHA512 support (using the draft in dnsext),
9207 using the drafted protocol numbers.
9208 - when using stub on localhost (127.0.0.1@10053) unbound works.
9209 Like when running NSD to host a local zone, on the same machine.
9210 The noprime feature. manpages more explanation. Added a test for it.
9211 - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com"
9213 29 September 2008: Wouter
9214 - EDNS lameness detection, if EDNS packets are dropped this is
9215 detected, eventually.
9216 - multiple query timeout rtt backoff does not backoff too much.
9218 26 September 2008: Wouter
9219 - tests for remote-control.
9220 - small memory leak in exception during remote control fixed.
9221 - fixup for lock checking but not unchecking in remote control.
9222 - iana portlist updated.
9224 23 September 2008: Wouter
9225 - Msg cache is loaded. A cache load enables cache responses.
9226 - unbound-control flush [name], flush_type and flush_zone.
9228 22 September 2008: Wouter
9229 - dump_cache and load_cache statements in unbound-control.
9230 RRsets are dumped and loaded correctly.
9231 Msg cache is dumped.
9233 19 September 2008: Wouter
9234 - locking on the localdata structure.
9235 - add and remove local zone and data with unbound-control.
9236 - ldns trunk snapshot updated, make tests work again.
9238 18 September 2008: Wouter
9239 - fixup error in time calculation.
9240 - munin plugin improvements.
9241 - nicer abbreviations for high query types values (ixfr, axfr, any...)
9242 - documented the statistics output in unbound-control man page.
9243 - extended statistics prints out histogram, over unbound-control.
9245 17 September 2008: Wouter
9246 - locking for threadsafe bogus rrset counter.
9247 - ldns trunk no longer exports b32 functions, provide compat.
9248 - ldns tarball updated.
9249 - testcode/ldns-testpkts.c const fixups.
9250 - fixed rcode stat printout.
9251 - munin plugin in contrib.
9252 - stats always printout uptime, because stats plugins need it.
9254 16 September 2008: Wouter
9255 - extended-statistics: yesno config option.
9256 - unwanted replies spoof nearmiss detector.
9257 - iana portlist updated.
9259 15 September 2008: Wouter
9260 - working start, stop, reload commands for unbound-control.
9261 - test for unbound-control working; better exit value for control.
9262 - verbosity control via unbound-control.
9263 - unbound-control stats.
9265 12 September 2008: Wouter
9266 - removed browser control mentions. Proto speccy.
9268 11 September 2008: Wouter
9269 - set nonblocking on new TCP streams, because linux does not inherit
9270 the socket options to the accepted socket.
9272 - SSL protected connection between server and unbound-control.
9274 10 September 2008: Wouter
9275 - remove memleak in privacy addresses on reloads and quits.
9276 - remote control work.
9278 9 September 2008: Wouter
9279 - smallapp/unbound-control-setup.sh script to set up certificates.
9281 4 September 2008: Wouter
9282 - scrubber scrubs away private addresses.
9283 - test for private addresses. man page entry.
9284 - code refactored for name and address tree lookups.
9286 3 September 2008: Wouter
9287 - options for 'DNS Rebinding' protection: private-address and
9289 - dnstree for reuse of routines that help with domain, addr lookups.
9290 - private-address and private-domain config option read, stored.
9292 2 September 2008: Wouter
9293 - DoS protection features. Queries are jostled out to make room.
9294 - testbound can pass time, increasing the internal timer.
9295 - do not mark unsigned additionals bogus, leave unchecked, which
9298 1 September 2008: Wouter
9299 - disallow nonrecursive queries for cache snooping by default.
9300 You can allow is using access-control: <subnet> allow_snoop.
9301 The defaults do allow access no authoritative data without RD bit.
9302 - two tests for it and fixups of tests for nonrec refused.
9304 29 August 2008: Wouter
9305 - version 1.1 number in trunk.
9306 - harden-referral-path option for query for NS records.
9307 Default turns off expensive, experimental option.
9309 28 August 2008: Wouter
9310 - fixup logfile handling; it is created with correct permissions
9311 again. (from bugfix#199).
9312 Some errors are not written to logfile (pidfile writing, forking),
9313 and these are only visible by using the -d commandline flag.
9315 27 August 2008: Wouter
9316 - daemon(3) is causing problems for people. Reverting the patch.
9317 bug#200, and 199 and 203 contain sideline discussion on it.
9318 - bug#199 fixed: pidfile can be outside chroot. openlog is done before
9319 chroot and drop permissions.
9320 - config option to set size of aggressive negative cache,
9322 - bug#203 fixed: dlv has been implemented.
9324 26 August 2008: Wouter
9325 - test for insecure zone when DLV is in use, also does negative cache.
9326 - test for trustanchor when DLV is in use (the anchor works).
9327 - test for DLV used for a zone below a trustanchor.
9328 - added scrub filter for overreaching NSEC records and unit test.
9329 - iana portlist update
9330 - use of setresuid or setreuid when available.
9331 - use daemon(3) if available.
9333 25 August 2008: Wouter
9334 - realclean patch from Robert Edmonds.
9336 22 August 2008: Wouter
9337 - nicer debuglogging of DLV.
9338 - test with secure delegation inside the DLV repository.
9340 21 August 2008: Wouter
9341 - negative cache code linked into validator, for DLV use.
9342 negative cache works for DLV.
9343 - iana portlist update.
9344 - dlv-anchor option for unit tests.
9345 - fixup NSEC_AT_APEX classification for short typemaps.
9346 - ldns-testns has subdomain checks, for unit tests.
9348 20 August 2008: Wouter
9349 - negative cache code, reviewed.
9351 18 August 2008: Wouter
9352 - changes info: in logfile to notice: info: or debug: depending on
9353 the verbosity of the statements. Better logfile message
9355 - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd.
9357 15 August 2008: Wouter
9358 - DLV nsec code fixed for better detection of closest existing
9359 enclosers from NSEC responses.
9360 - DLV works, straight to the dlv repository, so not for production.
9363 14 August 2008: Wouter
9364 - synthesize DLV messages from the rrset cache, like done for DS.
9366 13 August 2008: Wouter
9367 - bug #203: nicer do-auto log message when user sets incompatible
9369 - bug #204: variable name ameliorated in log.c.
9370 - bug #206: in iana_update, no egrep, but awk use.
9371 - ldns snapshot r2699 taken (includes DLV type).
9372 - DLV work, config file element, trust anchor read in.
9374 12 August 2008: Wouter
9375 - finished adjusting testset to provide qtype NS answers.
9377 11 August 2008: Wouter
9378 - Fixup rrset security updates overwriting 2181 trust status.
9379 This makes validated to be insecure data just as worthless as
9380 nonvalidated data, and 2181 rules prevent cache overwrites to them.
9381 - Fix assertion fail on bogus key handling.
9382 - dnssec lameness detection works on first query at trust apex.
9383 - NS queries get proper cache and dnssec lameness treatment.
9384 - fixup compilation without pthreads on linux.
9386 8 August 2008: Wouter
9387 - NS queries are done after every referral.
9388 validator is used on those NS records (if anchors enabled).
9390 7 August 2008: Wouter
9391 - Scrubber more strict. CNAME chains, DNAMEs from cache, other
9392 irrelevant rrsets removed.
9393 - 1.0.2 released from 1.0 support branch.
9394 - fixup update-anchor.sh to work both in BSD shell and bash.
9396 5 August 2008: Wouter
9397 - fixup DS test so apex nodata works again.
9399 4 August 2008: Wouter
9402 - fix bug 201: null ptr deref on cleanup while udp pkts wait for port.
9403 - added explanatory text for outgoing-port-permit in manpage.
9405 30 July 2008: Wouter
9406 - fixup bug qtype DS for unsigned zone and signed parent validation.
9408 25 July 2008: Wouter
9409 - added original copyright statement of OpenBSD arc4random code.
9410 - created tube signaling solution on windows, as a pipe replacement.
9411 this makes background asynchronous resolution work on windows.
9412 - removed very insecure socketpair compat code. It also did not
9413 work with event_waiting. Solved by pipe replacement.
9414 - unbound -h prints openssl version number as well.
9416 22 July 2008: Wouter
9417 - moved pipe actions to util/tube.c. easier porting and shared code.
9418 - check _raw() commpoint callbacks with fptr_wlist.
9421 21 July 2008: Wouter
9422 - #198: nicer entropy warning message. manpage OS hints.
9424 19 July 2008: Wouter
9425 - #198: fixup man page to suggest chroot entropy fix.
9427 18 July 2008: Wouter
9428 - branch for 1.0 support.
9429 - trunk work on tube.c.
9431 17 July 2008: Wouter
9432 - fix bug #196, compile outside source tree.
9433 - fix bug #195, add --with-username=user configure option.
9434 - print error and exit if started with config that requires more
9435 fds than the builtin minievent can handle.
9437 16 July 2008: Wouter
9438 - made svn tag 1.0.1, trunk now 1.0.2
9439 - sha256 checksums enabled in makedist.sh
9441 15 July 2008: Wouter
9442 - Follow draft-ietf-dnsop-default-local-zones-06 added reverse
9443 IPv6 example prefix to AS112 default blocklist.
9444 - fixup lookup of DS records by client with trustanchor for same.
9445 - libunbound ub_resolve, fix handling of error condition during setup.
9446 - lowered log_hex blocksize to fit through BSD syslog linesize.
9447 - no useless initialisation if getpwnam not available.
9448 - iana, ldns snapshot updated.
9451 - Matthijs fixed memory leaks in root hints file reading.
9453 26 June 2008: Wouter
9454 - fixup streamtcp bounds setting for udp mode, in the test framework.
9455 - contrib item for updating trust anchors.
9457 25 June 2008: Wouter
9458 - fixup fwd_ancil test typos.
9459 - Fix for newegg lameness : ok for qtype=A, but lame for others.
9460 - fixup unit test for infra cache, test lame merging.
9461 - porting to mingw, bind, listen, getsockopt and setsockopt error
9464 24 June 2008: Wouter
9465 - removed testcode/checklocks from production code compilation path.
9466 - streamtcp can use UDP mode (connected UDP socket), for testing IPv6
9468 - fwd_ancil test fails if platform support is lacking.
9470 23 June 2008: Wouter
9471 - fixup minitpkg to cleanup on windows with its file locking troubles.
9472 - minitpkg shows skipped tests in report.
9473 - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not
9475 - winsock event handler keeps track of sticky TCP events, that have
9476 not been fully handled yet. when interest in the event(s) resumes,
9477 they are sent again. When WOULDBLOCK is returned events are cleared.
9478 - skip tests that need signals when testing on mingw.
9480 18 June 2008: Wouter
9481 - open testbound replay files in binary mode, because fseek/ftell
9482 do not work in ascii-mode on windows. The b does nothing on unix.
9483 unittest and testbound tests work on windows (xp too).
9484 - ioctlsocket prints nicer error message.
9485 - fixed up some TCP porting for winsock.
9486 - lack of IPv6 gives a warning, no fatal error.
9487 - use WSAGetLastError() on windows instead of errno for some errors.
9489 17 June 2008: Wouter
9490 - outgoing num fds 32 by default on windows ; it supports less
9491 fds for waiting on than unixes.
9492 - winsock_event minievent handler for windows. (you could also
9493 attempt to link with libevent/libev ports for windows).
9494 - neater crypto check and gdi32 detection.
9495 - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista.
9497 16 June 2008: Wouter
9498 - on windows, use windows threads, mutex and thread-local-storage(Tls).
9499 - detect if openssl needs gdi32.
9500 - if no threading, THREADS_DISABLED is defined for use in the code.
9501 - sets USE_WINSOCK if using ws2_32 on windows.
9502 - wsa_strerror() function for more readable errors.
9503 - WSA Startup and Cleanup called in unbound.exe.
9505 13 June 2008: Wouter
9506 - port mingw32, more signal ifdefs, detect sleep, usleep,
9507 random, srandom (used inside the tests).
9508 - signed or unsigned FD_SET is cast.
9510 10 June 2008: Wouter
9511 - fixup warnings compiling on eeepc xandros linux.
9514 - in iteration response type code
9515 * first check for SOA record (negative answer) before NS record
9517 * check if no AA bit for non-forwarder, and thus lame zone.
9518 In response to error report by Richard Doty for mail.opusnet.com.
9519 - fixup unput warning from lexer on freeBSD.
9520 - bug#183. pidfile, rundir, and chroot configure options. Also the
9521 example.conf and manual pages get the configured defaults.
9522 You can use: (or accept the defaults to /usr/local/etc/unbound/)
9523 --with-conf-file=filename
9524 --with-pidfile=filename
9526 --with-chroot-dir=path
9529 - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug.
9530 Reported by Robert Edmonds.
9531 - iana port updated.
9534 - updated libtool files with newer version.
9535 - iana portlist updated.
9538 - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the
9539 trailing dot is not used during comparison.
9542 - Jelte fixed bugs in my absence
9543 - bug 178: fixed unportable shell usage in configure (relied on
9545 - bug 180: fixed buffer overflow in unbound-checkconf use of strncat.
9546 - bug 181: fixed buffer overflow in ldns (called by unbound to parse
9549 - bug 177: fixed compilation failure on opensuse, the
9550 --disable-static configure flag caused problems. (Patch from
9552 - bug 179: same fix as 177.
9553 - bug 185: --disable-shared not passed along to ldns included with
9554 unbound. Fixed so that configure parameters are passed to the
9555 subdir configure script.
9556 fixed that ./libtool is used always, you can still override
9557 manually with ./configure libtool=mylibtool or set $libtool in
9559 - update of the ldns tarball to current ldns svn version (fix 181).
9560 - bug 184: -r option for unbound-host, read resolv.conf for
9561 forwarder. (Note that forwarder must support DNSSEC for validation
9566 - test for sys/wait.h
9567 - WSAEWOULDBLOCK test after nonblocking TCP connect.
9568 - write_iov_buffer removed: unused and no struct iov on windows.
9569 - signed/unsigned warning fixup mini_event.
9570 - use ioctlsocket to set nonblocking I/O if fnctl is unavailable.
9571 - skip signals that are not defined
9573 - detect getpwnam, getrlimit, setsid, sbrk, chroot.
9574 - default config has no chroot if chroot() unavailable.
9575 - if no kill() then no pidfile is read or written.
9576 - gmtime_r is replaced by nonthreadsafe alternative if unavail.
9577 used in rrsig time validation errors.
9580 - contrib unbound.spec from Patrick Vande Walle.
9581 - fixup bug#175: call tzset before chroot to have correct timestamps
9583 - do not generate lex input and lex unput functions.
9584 - mingw port. replacement functions labelled _unbound.
9585 - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed.
9588 - fedora 9, check in6_pktinfo define in configure.
9589 - CREDITS fixup of history.
9590 - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative.
9593 - fixup for MacOSX hosts file reading (reported by John Dickinson).
9594 - created 1.0.0 svn tag.
9595 - trunk version 1.0.1.
9598 - accepted patch from Ondrej Sury for library version libtool option.
9599 - configure --disable-rpath fixes up libtool for rpath trouble.
9600 Adapted from debian package patch file.
9603 - Added root ipv6 addresses to builtin root hints.
9604 - TODO modified for post 1.0 plans.
9605 - trunk version set to 1.0.0.
9606 - no unnecessary linking with librt (only when libevent/libev used).
9609 - fixup no-ip4 problem with error callback in outside network.
9611 25 April 2008: Wouter
9612 - DESTDIR is honored by the Makefile for rpms.
9613 - contrib files unbound.spec and unbound.init, builds working RPM
9614 on FC7 Linux, a chrooted caching resolver, and libunbound.
9615 - iana ports update.
9617 24 April 2008: Wouter
9618 - chroot checks improved. working directory relative to chroot.
9619 checks if config file path is inside chroot. Documentation on it.
9620 - nicer example.conf text.
9623 23 April 2008: Wouter
9624 - parseunbound.pl contrib update from Kai Storbeck for threads.
9627 22 April 2008: Wouter
9629 - unit test for SIGPIPE ignore.
9631 21 April 2008: Wouter
9632 - FEATURES document.
9633 - fixup reread of config file if it was given as a full path
9634 and chroot was used.
9636 16 April 2008: Wouter
9637 - requirements doc, updated clean query returns.
9638 - parseunbound.pl update from Kai Storbeck.
9639 - sunos4 porting changes.
9641 15 April 2008: Wouter
9642 - fixup default rc.d pidfile location to /usr/local/etc.
9643 - iana ports updated.
9644 - copyright updated in ldns-testpkts to keep same as in ldns.
9645 - fixup checkconf chroot tests a bit more, chdir must be inside
9647 - documented 'gcc: unrecognized -KPIC option' errors on Solaris.
9648 - example.conf values changed to /usr/local/etc/unbound
9650 - DSA signatures: unbound is compatible with both encodings found.
9651 It will detect and convert when necessary.
9653 14 April 2008: Wouter
9654 - got update for parseunbound.pl statistics script from Kai Storbeck.
9655 - tpkg tests for udp wait list.
9656 - documented 0x20 status.
9657 - fixup chroot and checkconf, it is much smarter now.
9658 - fixup DSA EVP signature decoding. Solution that Jelte found copied.
9659 - and check first sig byte for the encoding type.
9661 11 April 2008: Wouter
9662 - random port selection out of the configged ports.
9663 - fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
9664 - removed base_port.
9665 - created 256-port ephemeral space for the OS, 59802 available.
9666 - fixup consistency of port_if out array during heavy use.
9668 10 April 2008: Wouter
9669 - --with-libevent works with latest libevent 1.4.99-trunk.
9670 - added log file statistics perl script to contrib.
9671 - automatic iana ports update from makefile. 60058 available.
9673 9 April 2008: Wouter
9674 - configure can detect libev(from its build directory) when passed
9675 --with-libevent=/home/wouter/libev-3.2
9676 libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
9677 - unused commpoints not listed in epoll list.
9678 - statistics-cumulative option so that the values are not reset.
9679 - config creates array of available ports, 61841 available,
9680 it excludes <1024 and iana assigned numbers.
9681 config statements to modify the available port numbers.
9683 8 April 2008: Wouter
9684 - unbound tries to set the ulimit fds when started as server.
9685 if that does not work, it will scale back its requirements.
9687 27 March 2008: Wouter
9688 - documented /dev/random symlink from chrootdir as FAQ entry.
9690 26 March 2008: Wouter
9691 - implemented AD bit signaling. If a query sets AD bit (but not DO)
9692 then the AD bit is set in the reply if the answer validated.
9693 Without including DNSSEC signatures. Useful if you have a trusted
9694 path from the client to the resolver. Follows dnssec-updates draft.
9696 25 March 2008: Wouter
9697 - implemented check that for NXDOMAIN and NOERROR answers a query
9698 section must be present in the reply (by the scrubber). And it must
9699 be equal to the question sent, at least lowercase folded.
9700 Previously this feature happened because the cache code refused
9701 to store such messages. However blocking by the scrubber makes
9702 sure nothing gets into the RRset cache. Also, this looks like a
9703 timeout (instead of an allocation failure) and this retries are
9704 done (which is useful in a spoofing situation).
9705 - RTT banding. Band size 400 msec, this makes band around zero (fast)
9706 include unknown servers. This makes unbound explore unknown servers.
9708 7 March 2008: Wouter
9709 - -C config feature for harvest program.
9710 - harvest handles CNAMEs too.
9712 5 March 2008: Wouter
9713 - patch from Hugo Koji Kobayashi for iterator logs spelling.
9715 4 March 2008: Wouter
9716 - From report by Jinmei Tatuya, rfc2181 trust value for remainder
9717 of a cname trust chain is lower; not full answer_AA.
9718 - test for this fix.
9719 - default config file location is /usr/local/etc/unbound.
9720 Thus prefix is used to determine the location. This is also the
9721 chroot and pidfile default location.
9723 3 March 2008: Wouter
9724 - Create 0.10 svn tag.
9725 - 0.11 version in trunk.
9726 - indentation nicer.
9728 29 February 2008: Wouter
9729 - documentation update.
9730 - fixup port to Solaris of perf test tool.
9731 - updated ldns-tarball with decl-after-statement fixes.
9733 28 February 2008: Wouter
9734 - fixed memory leaks in libunbound (during cancellation and wait).
9735 - libunbound returns the answer packet in full.
9736 - snprintf compat update.
9737 - harvest performs lookup.
9738 - ldns-tarball update with fix for ldns_dname_label.
9739 - installs to sbin by default.
9740 - install all manual pages (unbound-host and libunbound too).
9742 27 February 2008: Wouter
9743 - option to use caps for id randomness.
9744 - config file option use-caps-for-id: yes
9745 - harvest debug tool
9747 26 February 2008: Wouter
9748 - delay utility delays TCP as well. If the server that is forwarded
9749 to has a TCP error, the delay utility closes the connection.
9750 - delay does REUSE_ADDR, and can handle a server that closes its end.
9751 - answers use casing from query.
9753 25 February 2008: Wouter
9754 - delay utility works. Gets decent thoughput too (>20000).
9756 22 February 2008: Wouter
9757 - +2% for recursions, if identical queries (except for destination
9758 and query ID) in the reply list, avoid re-encoding the answer.
9759 - removed TODO items for optimizations that do not show up in
9761 - default is now minievent - not libevent. As its faster and
9762 not needed for regular installs, only for very large port ranges.
9763 - loop check different speedup pkt-dname-reading, 1% faster for
9764 nocache-recursion check.
9765 - less hashing during msg parse, 4% for recursion.
9766 - small speed fix for dname_count_size_labels, +1 or +2% recursion.
9767 - some speed results noted:
9768 optimization resulted in +40% for recursion (cache miss) and
9769 +70 to +80 for cache hits, and +96% for version.bind.
9770 zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4
9771 www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
9772 www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
9773 So, unbound can be about equal qps to NSD in cache hits.
9774 And about 3.4x faster than BIND in cache performance.
9775 - delay utility for testing.
9777 21 February 2008: Wouter
9778 - speedup of root-delegation message encoding by 15%.
9779 - minor speedup of compress tree_lookup, maybe 1%.
9780 - speedup of dname_lab_cmp and memlowercmp - the top functions in
9781 profiler output, maybe a couple percent when it matters.
9783 20 February 2008: Wouter
9784 - setup speec_cache for need-ldns-testns in dotests.
9785 - check number of queued replies on incoming queries to avoid overload
9787 - fptr whitelist checks are not disabled in optimize mode.
9788 - do-daemonize config file option.
9789 - minievent time share initializes time at start.
9790 - updated testdata for nsec3 new algorithm numbers (6, 7).
9791 - small performance test of packet encoding (root delegation).
9793 19 February 2008: Wouter
9794 - applied patch to unbound-host man page from Jan-Piet Mens.
9795 - fix donotquery-localhost: yes default (it erroneously was switched
9797 - time is only gotten once and the value is shared across unbound.
9798 - unittest cleans up crypto, so that it has no memory leaks.
9799 - mini_event shares the time value with unbound this results in
9800 +3% speed for cache responses and +9% for recursions.
9801 - ldns tarball update with new NSEC3 sign code numbers.
9802 - perform several reads per UDP operation. This improves performance
9803 in DoS conditions, and costs very little in normal conditions.
9804 improves cache response +50%, and recursions +10%.
9805 - modified asynclook test. because the callback from async is not
9806 in any sort of lock (and thus can use all library functions freely),
9807 this causes a tiny race condition window when the last lock is
9808 released for a callback and a new cancel() for that callback.
9809 The only way to remove this is by putting callbacks into some
9810 lock window. I'd rather have the small possibility of a callback
9811 for a cancelled function then no use of library functions in
9812 callbacks. Could be possible to only outlaw process(), wait(),
9813 cancel() from callbacks, by adding another lock, but I'd rather not.
9815 18 February 2008: Wouter
9816 - patch to unbound-host from Jan-Piet Mens.
9817 - unbound host prints errors if fails to configure context.
9818 - fixup perf to resend faster, so that long waiting requests do
9819 not hold up the queue, they become lost packets or SERVFAILs,
9820 or can be sent a little while later (i.e. processing time may
9821 take long, but throughput has to be high).
9822 - fixup iterator operating in no cache conditions (RD flag unset
9824 - streamlined code for RD flag setting.
9825 - profiled code and changed dname compares to be faster.
9826 The speedup is about +3% to +8% (depending on the test).
9827 - minievent tests for eintr and eagain.
9829 15 February 2008: Wouter
9830 - added FreeBSD rc.d script to contrib.
9831 - --prefix option for configure also changes directory: pidfile:
9832 and chroot: defaults in config file.
9833 - added cache speed test, for cache size OK and cache too small.
9835 14 February 2008: Wouter
9836 - start without a config file (will complain, but start with
9838 - perf test program works.
9840 13 February 2008: Wouter
9842 - 1.0 development. Printout ldns version on unbound -h.
9843 - start of perf tool.
9844 - bugfix to read empty lines from /etc/hosts.
9846 12 February 2008: Wouter
9847 - fixup problem with configure calling itself if ldns-src tarball
9850 11 February 2008: Wouter
9851 - changed library to use ub_ instead of ub_val_ as prefix.
9852 - statistics output text nice.
9853 - etc/hosts handling.
9854 - library function to put logging to a stream.
9855 - set any option interface.
9857 8 February 2008: Wouter
9858 - test program for multiple queries over a TCP channel.
9859 - tpkg test for stream tcp queries.
9860 - unbound replies to multiple TCP queries on a TCP channel.
9861 - fixup misclassification of root referral with NS in answer
9862 when validating a nonrec query.
9864 - layout of manpages, spelling fix in header, manpages process by
9865 makedist, list asynclook and tcpstream tests as ldns-testns
9868 7 February 2008: Wouter
9869 - moved up all current level 2 to be level 3. And 3 to 4.
9870 to make room for new debug level 2 for detailed information
9872 - verbosity level 2. Describes recursion and validation.
9873 - cleaner configure script and fixes for libevent solaris.
9874 - signedness for log output memory sizes in high verbosity.
9876 6 February 2008: Wouter
9877 - clearer explanation of threading configure options.
9878 - fixup asynclook test for nothreading (it creates only one process
9879 to do the extended test).
9880 - changed name of ub_val_result_free to ub_val_resolve_free.
9881 - removes warning message during library linking, renamed
9882 libunbound/unbound.c -> libunbound.c and worker to libworker.
9883 - fallback without EDNS if result is NOTIMPL as well as on FORMERR.
9885 5 February 2008: Wouter
9886 - statistics-interval: seconds option added.
9887 - test for statistics option
9888 - ignore errors making directories, these can occur in parallel builds
9889 - fixup Makefile strip command and libunbound docs typo.
9891 31 January 2008: Wouter
9892 - bg thread/process reads and writes the pipe nonblocking all the time
9893 so that even if the pipe is buffered or so, the bg thread does not
9894 block, and services both pipes and queries.
9896 30 January 2008: Wouter
9897 - check trailing / on chrootdir in checkconf.
9898 - check if root hints and anchor files are in chrootdir.
9899 - no route to host tcp error is verbosity level 2.
9900 - removed unused send_reply_iov. and its configure check.
9901 - added prints of 'remote address is 1.2.3.4 port 53' to errors
9902 from netevent; the basic socket errors.
9904 28 January 2008: Wouter
9905 - fixup uninit use of buffer by libunbound (query id, flags) for
9907 - fixup uninit warning from random.c; also seems to fix sporadic
9908 sigFPE coming out of openssl.
9909 - made openssl entropy warning more silent for library use. Needs
9911 - fixup forgotten locks for rbtree_searches on ctx->query tree.
9912 - random generator cleanup - RND_STATE_SIZE removed, and instead
9913 a super-rnd can be passed at init to chain init random states.
9914 - test also does lock checks if available.
9915 - protect config access in libworker_setup().
9916 - libevent doesn't like comm_base_exit outside of runloop.
9917 - close fds after removing commpoints only (for epoll, kqueue).
9919 25 January 2008: Wouter
9920 - added tpkg for asynclook and library use.
9921 - allows localhost to be queried when as a library.
9922 - fixup race condition between cancel and answer (in case of
9923 really fast answers that beat the cancel).
9924 - please doxygen, put doxygen comment in one place.
9925 - asynclook -b blocking mode and test.
9926 - refactor asynclook, nicer code.
9927 - fixup race problems from opensll in rand init from library, with
9928 a mutex around the rand init.
9929 - fix pass async_id=NULL to _async resolve().
9930 - rewrote _wait() routine, so that it is threadsafe.
9931 - cancelation is threadsafe.
9932 - asynclook extended test in tpkg.
9933 - fixed two races where forked bg process waits for (somehow shared?)
9934 locks, so does not service the query pipe on the bg side.
9935 Now those locks are only held for fg_threads and for bg_as_a_thread.
9937 24 January 2008: Wouter
9938 - tested the cancel() function.
9939 - asynclook -c (cancel) feature.
9940 - fix fail to allocate context actions.
9941 - make pipe nonblocking at start.
9942 - update plane for retry mode with caution to limit bandwidth.
9943 - fix Makefile for concurrent make of unbound-host.
9944 - renamed ub_val_ctx_wait/poll/process/fd to ub_val*.
9945 - new calls to set forwarding added to header and docs.
9947 23 January 2008: Wouter
9948 - removed debug prints from if-auto, verb-algo enables some.
9949 - libunbound QUIT setup, remove memory leaks, when using threads
9950 will share memory for passing results instead of writing it over
9951 the pipe, only writes ID number over the pipe (towards the handler
9952 thread that does process() ).
9954 22 January 2008: Wouter
9955 - library code for async in libunbound/unbound.c.
9956 - fix link testbound.
9957 - fixup exit bug in mini_event.
9958 - background worker query enter and result functions.
9959 - bg query test application asynclook, it looks up multiple
9960 hostaddresses (A records) at the same time.
9962 21 January 2008: Wouter
9963 - libworker work, netevent raw commpoints, write_msg, serialize.
9965 18 January 2008: Wouter
9966 - touch up of manpage for libunbound.
9967 - support for IP_RECVDSTADDR (for *BSD ip4).
9968 - fix for BSD, do not use ip4to6 mapping, make two sockets, once
9969 ip6 and once ip4, uses socket options.
9970 - goodbye ip4to6 mapping.
9971 - update ldns-testpkts with latest version from ldns-trunk.
9972 - updated makedist for relative ldns pathnames.
9973 - library API with more information inside the result structure.
9974 - work on background resolves.
9976 17 January 2008: Wouter
9977 - fixup configure in case -lldns is installed.
9978 - fixup a couple of doxygen warnings, about enum variables.
9979 - interface-automatic now copies the interface address from the
9980 PKT_INFO structure as well.
9981 - manual page with library API, all on one page 'man libunbound'.
9982 - rewrite of PKTINFO structure, it also captures IP4 PKTINFO.
9984 16 January 2008: Wouter
9985 - incoming queries to the server with TC bit on are replied FORMERR.
9986 - interface-automatic replied the wrong source address on localhost
9987 queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying
9988 to use ifnum=-1 to mean 'no interface, use kernel route'.
9990 15 January 2008: Wouter
9991 - interface-automatic feature. experimental. Nice for anycast.
9992 - tpkg test for ip6 ancillary data.
9993 - removed debug prints.
9994 - porting experience, define for Solaris, test refined for BSD
9995 compatibility. The feature probably will not work on OpenBSD.
9996 - makedist fixup for ldns-src in build-dir.
9998 14 January 2008: Wouter
9999 - in no debug sets NDEBUG to remove asserts.
10000 - configure --enable-debug is needed for dependency generation
10001 for assertions and for compiler warnings.
10002 - ldns.tgz updated with ldns-trunk (where buffer.h is updated).
10003 - fix lint, unit test in optimize mode.
10004 - default access control allows ::ffff:127.0.0.1 v6mapped localhost.
10006 11 January 2008: Wouter
10007 - man page, warning removed.
10008 - added text describing the use of stub zones for private zones.
10009 - checkconf tests for bad hostnames (IP address), and for doubled
10011 - memory sizes can be given with 'k', 'Kb', or M or G appended.
10013 10 January 2008: Wouter
10014 - typo in example.conf.
10015 - made using ldns-src that is included the package more portable
10016 by linking with .lo instead of .o files in the ldns package.
10017 - nicer do-ip6: yes/no documentation.
10018 - nicer linking of libevent .o files.
10019 - man pages render correctly on solaris.
10021 9 January 2008: Wouter
10022 - fixup openssl RAND problem, when the system is not configured to
10023 give entropy, and the rng needs to be seeded.
10025 8 January 2008: Wouter
10026 - print median and quartiles with extensive logging.
10028 4 January 2008: Wouter
10029 - document misconfiguration in private network.
10031 2 January 2008: Wouter
10032 - fixup typo in requirements.
10033 - document that 'refused' is a better choice than 'drop' for
10034 the access control list, as refused will stop retries.
10036 7 December 2007: Wouter
10037 - unbound-host has a -d option to show what happens. This can help
10038 with debugging (why do I get this answer).
10039 - fixup CNAME handling, on nodata, sets and display canonname.
10040 - dot removed from CNAME display.
10041 - respect -v for NXDOMAINs.
10042 - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes).
10043 - size_t to int for portability of the header file.
10044 - fixup bogus handling.
10045 - dependencies and lint for unbound-host.
10047 6 December 2007: Wouter
10048 - library resolution works in foreground mode, unbound-host app
10050 - unbound-host prints rdata using ldns.
10051 - unbound-host accepts trust anchors, and prints validation
10052 information when you give -v.
10054 5 December 2007: Wouter
10055 - locking in context_new() inside the function.
10056 - setup of libworker.
10058 4 December 2007: Wouter
10059 - minor Makefile fixup.
10060 - moved module-stack code out of daemon/daemon into services/modstack,
10061 preparing for code-reuse.
10062 - move context into own header file.
10063 - context query structure.
10064 - removed unused variable pwd from checkconf.
10065 - removed unused assignment from outside netw.
10066 - check timeval length of string.
10067 - fixup error in val_utils getsigner.
10068 - fixup same (*var) error in netblocktostr.
10069 - fixup memleak on parse error in localzone.
10070 - fixup memleak on packet parse error.
10071 - put ; after union in parser.y.
10072 - small hardening in iter_operate against iq==NULL.
10073 - hardening, if error reply with rcode=0 (noerror) send servfail.
10074 - fixup same (*var) error in find_rrset in msgparse, was harmless.
10075 - check return value of evtimer_add().
10076 - fixup lockorder in lruhash_reclaim(), building up a list of locked
10077 entries one at a time. Instead they are removed and unlocked.
10078 - fptr_wlist for markdelfunc.
10079 - removed is_locked param from lruhash delkeyfunc.
10080 - moved bin_unlock during bin_split purely to please.
10082 3 December 2007: Wouter
10083 - changed checkconf/ to smallapp/ to make room for more support tools.
10084 (such as unbound-host).
10085 - install dirs created with -m 755 because they need to be accessible.
10086 - library extensive featurelist added to TODO.
10087 - please doxygen, lint.
10088 - library test application, with basic functionality.
10089 - fix for building in a subdirectory.
10090 - link lib fix for Leopard.
10092 30 November 2007: Wouter
10093 - makefile that creates libunbound.la, basic file or libunbound.a
10094 when creating static executables (no libtool).
10097 29 November 2007: Wouter
10098 - 0.9 public API start.
10100 28 November 2007: Wouter
10101 - Changeup plan for 0.8 - no complication needed, a simple solution
10102 has been chosen for authoritative features.
10103 - you can use single quotes in the config file, so it is possible
10104 to specify TXT records in local data.
10105 - fixup small memory problem in implicit transparent zone creation.
10106 - test for implicit zone creation and multiple RR RRsets local data.
10107 - local-zone nodefault test.
10108 - show testbound testlist on commit.
10109 - iterator normalizer changes CNAME chains ending in NXDOMAIN where
10110 the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial
10112 - nicer verbosity: 0 and 1 levels.
10113 - lower nonRDquery chance of eliciting wrongly typed validation
10114 requiring message from the cache.
10115 - fix for nonRDquery validation typing; nodata is detected when
10116 SOA record in auth section (all validation-requiring nodata messages
10117 have a SOA record in authority, so this is OK for the validator),
10118 and NS record is needed to be a referral.
10119 - duplicate checking when adding NSECs for a CNAME, and test.
10120 - created svn tag 0.8, after completing testbed tests.
10122 27 November 2007: Wouter
10123 - per suggestion in rfc2308, replaced default max-ttl value with 1 day.
10124 - set size of msgparse lookup table to 32, from 1024, so that its size
10125 is below the 2048 regional large size threshold, and does not cause
10126 a call to malloc when a message is parsed.
10127 - update of memstats tool to print number of allocation calls.
10128 This is what is taking time (not space) and indicates the avg size
10129 of the allocations as well. region_alloc stat is removed.
10131 22 November 2007: Wouter
10132 - noted EDNS in-the-middle dropping trouble as a TODO.
10133 At this point theoretical, no user trouble has been reported.
10134 - added all default AS112 zones.
10135 - answers from local zone content.
10136 * positive answer, the rrset in question
10137 * nodata answer (exist, but not that type).
10138 * nxdomain answer (domain does not exist).
10139 * empty-nonterminal answer.
10140 * But not: wildcard, nsec, referral, rrsig, cname/dname,
10141 or additional section processing, NS put in auth.
10142 - test for correct working of static and transparent and couple
10143 of important defaults (localhost, as112, reverses).
10144 Also checks deny and refuse settings.
10145 - fixup implicit zone generation and AA bit for NXDOMAIN on localdata.
10147 21 November 2007: Wouter
10148 - local zone internal data setup.
10150 20 November 2007: Wouter
10151 - 0.8 - str2list config support for double string config options.
10152 - local-zone and local-data options, config storage and documentation.
10154 19 November 2007: Wouter
10155 - do not downcase NSEC and RRSIG for verification. Follows
10156 draft-ietf-dnsext-dnssec-bis-updates-06.txt.
10157 - fixup leaking unbound daemons at end of tests.
10158 - README file updated.
10159 - nice libevent not found error.
10160 - README talks about gnu make.
10161 - 0.8: unit test for addr_mask and fixups for it.
10162 and unit test for addr_in_common().
10163 - 0.8: access-control config file element.
10164 and unit test rpl replay file.
10165 - 0.8: fixup address reporting from netevent.
10167 16 November 2007: Wouter
10168 - privilege separation is not needed in unbound at this time.
10169 TODO item marked as such.
10170 - created beta-0.7 branch for support.
10171 - tagged 0.7 for beta release.
10172 - moved trunk to 0.8 for 0.8(auth features) development.
10173 - 0.8: access control list setup.
10175 15 November 2007: Wouter
10176 - review fixups from Jelte.
10178 14 November 2007: Wouter
10179 - testbed script does not recreate configure, since its in svn now.
10180 - fixup checkconf test so that it does not test
10181 /etc/unbound/unbound.conf.
10184 13 November 2007: Wouter
10185 - remove debug print.
10186 - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists.
10188 12 November 2007: Wouter
10189 - fixup signal handling where SIGTERM could be ignored if a SIGHUP
10191 - bugreports to unbound-bugs@nlnetlabs.nl
10192 - fixup testbound so it exits cleanly.
10193 - cleanup the caches on a reload, so that rrsetID numbers won't clash.
10195 9 November 2007: Wouter
10196 - took ldns snapshot in repo.
10197 - default config file is /etc/unbound/unbound.conf.
10198 If it doesn't exist, it is installed with the doc/example.conf file.
10199 The file is not deleted on uninstall.
10200 - default listening is not all, but localhost interfaces.
10202 8 November 2007: Wouter
10203 - Fixup chroot and drop user privileges.
10204 - new L root ip address in default hints.
10206 1 November 2007: Wouter
10207 - Fixup of crash on reload, due to anchors in env not NULLed after
10208 dealloc during deinit.
10209 - Fixup of chroot call. Happens after privileges are dropped, so
10210 that checking the passwd entry still works.
10211 - minor touch up of clear() hashtable function.
10212 - VERB_DETAIL prints out what chdir, username, chroot is being done.
10213 - when id numbers run out, caches are cleared, as in design notes.
10214 Tested with a mock setup with very few bits in id, it worked.
10215 - harden-dnssec-stripped: yes is now default. It insists on dnssec
10216 data for trust anchors. Included tests for the feature.
10218 31 October 2007: Wouter
10219 - cache-max-ttl config option.
10220 - building outside sourcedir works again.
10221 - defaults more secure:
10222 username: "unbound"
10223 chroot: "/etc/unbound"
10224 The operator can override them to be less secure ("") if necessary.
10225 - fix horrible oversight in sorting rrset references in a message,
10226 sort per reference key pointer, not on referencepointer itself.
10227 - pidfile: "/etc/unbound/unbound.pid" is now the default.
10228 - tests changed to reflect the updated default.
10229 - created hashtable clear() function that respects locks.
10231 30 October 2007: Wouter
10232 - fixup assertion failure that relied on compressed names to be
10233 smaller than uncompressed names. A packet from comrite.com was seen
10234 to be compressed to a larger size. Added it as unit test.
10235 - quieter logging at low verbosity level for common tcp messages.
10236 - no greedy TTL update.
10238 23 October 2007: Wouter
10239 - fixup (grand-)parent problem for dnssec-lameness detection.
10240 - fixup tests to do additional section processing for lame replies,
10241 since the detection needs that.
10242 - no longer trust in query section in reply during dnssec lame detect.
10243 - dnssec lameness does not make the server never ever queried, but
10244 non-preferred. If no other servers exist or answer, the dnssec lame
10245 server is used; the fastest dnssec lame server is chosen.
10246 - added test then when trust anchor cannot be primed (nodata), the
10247 insecure mode from unbound works.
10248 - Fixup max queries per thread, any more are dropped.
10250 22 October 2007: Wouter
10251 - added donotquerylocalhost config option. Can be turned off for
10253 - ISO C compat changes.
10254 - detect RA-no-AA lameness, as LAME.
10255 - DNSSEC-lameness detection, as LAME.
10256 See notes in requirements.txt for choices made.
10257 - tests for lameness detection.
10258 - added all to make test target; need unbound for fwd tests.
10259 - testbound does not pollute /etc/unbound.
10261 19 October 2007: Wouter
10262 - added configure (and its files) to svn, so that the trunk is easier
10263 to use. ./configure, config.guess, config.sub, ltmain.sh,
10265 - added yacc/lex generated files, util/configlexer.c,
10266 util/configparser.c util/configparser.h, to svn.
10267 - without lex no attempt to use it.
10268 - unsecure response validation collated into one block.
10269 - remove warning about const cast of cfgfile name.
10270 - outgoing-interfaces can be different from service interfaces.
10271 - ldns-src configure is done during unbound configure and
10272 ldns-src make is done during unbound make, and so inherits the
10273 make arguments from the unbound make invocation.
10274 - nicer error when libevent problem causes instant exit on signal.
10275 - read root hints from a root hint file (like BIND does).
10277 18 October 2007: Wouter
10278 - addresses are logged with errors.
10279 - fixup testcode fake event to remove pending before callback
10280 since the callback may create new pending items.
10281 - tests updated because retries are now in iterator module.
10282 - ldns-testpkts code is checked for differences between unbound
10283 and ldns by makedist.sh.
10284 - ldns trunk from today added in svn repo for fallback in case
10285 no ldns is installed on the system.
10286 make download_ldns refreshes the tarball with ldns svn trunk.
10287 - ldns-src.tar.gz is used if no ldns is found on the system, and
10288 statically linked into unbound.
10289 - start of regional allocator code.
10290 - regional uses less memory and variables, simplified code.
10291 - remove of region-allocator.
10292 - alloc cache keeps a cache of recently released regional blocks,
10294 - make unit test cleanly free memory.
10296 17 October 2007: Wouter
10297 - fixup another cycle detect and ns-addr timeout resolution bug.
10298 This time by refusing delegations from the cache without addresses
10299 when resolving a mandatory-glue nameserver-address for that zone.
10300 We're going to have to ask a TLD server anyway; might as well be
10301 the TLD server for this name. And this resolves a lot of cases where
10302 the other nameserver names lead to cycles or are not available.
10303 - changed random generator from random(3) clone to arc4random wrapped
10304 for thread safety. The random generator is initialised with
10305 entropy from the system.
10306 - fix crash where failure to prime DNSKEY tried to print null pointer
10307 in the log message.
10308 - removed some debug prints, only verb_algo (4) enables them.
10309 - fixup test; new random generator took new paths; such as one
10310 where no scripted answer was available.
10311 - mark insecure RRs as insecure.
10312 - fixup removal of nonsecure items from the additional.
10313 - reduced timeout values to more realistic, 376 msec (262 msec has
10314 90% of roundtrip times, 512 msec has 99% of roundtrip times.)
10315 - server selection failover to next server after timeout (376 msec).
10317 16 October 2007: Wouter
10318 - no malloc in log_hex.
10319 - assertions around system calls.
10320 - protect against gethostname without ending zero.
10321 - ntop output is null terminated by unbound.
10322 - pidfile content null termination
10323 - various snprintf use sizeof(stringbuf) instead of fixed constant.
10324 - changed loopdetect % 8 with & 0x7 since % can become negative for
10325 weird negative input and particular interpretation of integer math.
10326 - dname_pkt_copy checks length of result, to protect result buffers.
10327 prints an error, this should not happen. Bad strings should have
10328 been rejected earlier in the program.
10329 - remove a size_t underflow from msgreply size func.
10331 15 October 2007: Wouter
10333 - fix IP6 TCP, wrong definition check. With test package.
10334 - fixup the fact that the query section was not compressed to,
10335 the code was there but was called by value instead of by reference.
10336 And test for the case, uses xxd and nc.
10337 - more portable ip6 check for sockaddr types.
10339 8 October 2007: Wouter
10340 - --disable-rpath option in configure for 64bit systems with
10341 several dynamic lib dirs.
10343 7 October 2007: Wouter
10344 - fixup tests for no AD bit in non-DO queries.
10345 - test that makes sure AD bit is not set on non-DO query.
10347 6 October 2007: Wouter
10348 - removed logfile open early. It did not have the proper permissions;
10349 it was opened as root instead of the user. And we cannot change user
10350 id yet, since chroot and bind ports need to be done.
10351 - callback checks for event callbacks done from mini_event. Because
10352 of deletions cannot do this from netevent. This means when using
10353 libevent the protection does not work on event-callbacks.
10354 - fixup too small reply (did not zero counts).
10355 - fixup reply no longer AD bit when query without DO bit.
10357 5 October 2007: Wouter
10358 - function pointer whitelist.
10360 4 October 2007: Wouter
10361 - overwrite sensitive random seed value after use.
10362 - switch to logfile very soon if not -d (console attached).
10363 - error messages do not reveal the trustanchor contents.
10364 - start work on function pointer whitelists.
10366 3 October 2007: Wouter
10367 - fix for multiple empty nonterminals, after multiple DSes in the
10369 - mesh checks if modules are looping, and stops them.
10370 - refetch with CNAMEd nameserver address regression test added.
10371 - fixup line count bug in testcode, so testbound prints correct line
10372 number with parse errors.
10373 - unit test for multiple ENT case.
10374 - fix for cname out of validated unsec zone.
10375 - fixup nasty id=0 reuse. Also added assertions to detect its
10376 return (the assertion catches in the existing test cases).
10378 1 October 2007: Wouter
10379 - skip F77, CXX, objC tests in configure step.
10380 - fixup crash in refetch glue after a CNAME.
10381 and protection against similar failures (with error print).
10383 28 September 2007: Wouter
10384 - test case for unbound-checkconf, fixed so it also checks the
10385 interface: statements.
10387 26 September 2007: Wouter
10388 - SIGHUP will reopen the log file.
10389 - Option to log to syslog.
10390 - please lint, fixup tests (that went to syslog on open, oops).
10391 - config check program.
10393 25 September 2007: Wouter
10394 - tests for NSEC3. Fixup bitmap checks for NSEC3.
10395 - positive ANY response needs to check if wildcard expansion, and
10396 check that original data did not exist.
10397 - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure
10398 delegation, for abuse of child zone apex nsec3.
10399 - create 0.5 release tag.
10401 24 September 2007: Wouter
10402 - do not make test programs by default.
10403 - But 'make test' will perform all of the tests.
10404 - Advertise builtin select libevent alternative when no libevent
10406 - signit can generate NSEC3 hashes, for generating tests.
10407 - multiple nsec3 parameters in message test.
10408 - too high nsec3 iterations becomes insecure test.
10410 21 September 2007: Wouter
10411 - fixup empty_DS_name allocated in wrong region (port DEC Alpha).
10412 - fixup testcode lock safety (port FreeBSD).
10413 - removes subscript has type char warnings (port Solaris 9).
10414 - fixup of field with format type to int (port MacOS/X intel).
10415 - added test for infinite loop case in nonRD answer validation.
10416 It was a more general problem, but hard to reproduce. When an
10417 unsigned rrset is being validated and the key fetched, the DS
10418 sequence is followed, but if the final name has no DS, then no
10419 proof is possible - the signature has been stripped off.
10421 20 September 2007: Wouter
10422 - fixup and test for NSEC wildcard with empty nonterminals.
10423 - makedist.sh fixup for svn info.
10424 - acl features request in plan.
10425 - improved DS empty nonterminal handling.
10426 - compat with ANS nxdomain for empty nonterminals. Attempts the nodata
10427 proof anyway, which succeeds in ANS failure case.
10428 - striplab protection in case it becomes -1.
10429 - plans for static and blacklist config.
10431 19 September 2007: Wouter
10432 - comments about non-packed usage.
10433 - plan for overload support in 0.6.
10434 - added testbound tests for a failed resolution from the logs
10435 and for failed prime when missing glue.
10436 - fixup so useless delegation points are not returned from the
10437 cache. Also the safety belt is used if priming fails to complete.
10438 - fixup NSEC rdata not to be lowercased, bind compat.
10440 18 September 2007: Wouter
10441 - wildcard nsec3 testcases, and fixup to get correct wildcard name.
10442 - validator prints subtype classification for debug.
10444 17 September 2007: Wouter
10445 - NSEC3 hash cache unit test.
10446 - validator nsec3 nameerror test.
10448 14 September 2007: Wouter
10449 - nsec3 nodata proof, nods proof, wildcard proof.
10450 - nsec3 support for cname chain ending in noerror or nodata.
10451 - validator calls nsec3 proof routines if no NSECs prove anything.
10452 - fixup iterator bug where it stored the answer to a cname under
10453 the wrong qname into the cache. When prepending the cnames, the
10454 qname has to be reset to the original qname.
10456 13 September 2007: Wouter
10457 - nsec3 find matching and covering, ce proof, prove namerror msg.
10459 12 September 2007: Wouter
10460 - fixup of manual page warnings, like for NSD bugreport.
10461 - nsec3 work, config, max iterations, filter, and hash cache.
10463 6 September 2007: Wouter
10464 - fixup to find libevent on mac port install.
10465 - fixup size_t vs unsigned portability in validator/sigcrypt.
10466 - please compiler on different platforms, for unreachable code.
10468 - pthread_rwlock type is optional, in case of old pthread libs.
10470 5 September 2007: Wouter
10471 - cname, name error validator tests.
10472 - logging of qtype ANY works.
10473 - ANY type answers get RRSIG in answer section of replies (but not
10474 in other sections, unless DO bit is on).
10475 - testbound can replay a TCP query (set MATCH TCP in the QUERY).
10476 - DS and noDS referral validation test.
10477 - if you configure many trust anchors, parent trust anchors can
10478 securely deny existence of child trust anchors, if validated.
10479 - not all *.name NSECs are present because a wildcard was matched,
10480 and *.name NSECs can prove nodata for empty nonterminals.
10481 Also, for wildcard name NSECs, check they are not from the parent
10482 zone (for wildcarded zone cuts), and check absence of CNAME bit,
10483 for a nodata proof.
10484 - configure option for memory allocation debugging.
10485 - port configure option for memory allocation to solaris10.
10487 4 September 2007: Wouter
10488 - fixup of Leakage warning when serviced queries processed multiple
10489 callbacks for the same query from the same server.
10490 - testbound removes config file from /tmp on failed exit.
10491 - fixup for referral cleanup of the additional section.
10492 - tests for cname, referral validation.
10493 - neater testbound tpkg output.
10494 - DNAMEs no longer match their apex when synthesized from the cache.
10495 - find correct signer name for DNAME responses.
10496 - wildcarded DNAME test and fixup code to detect.
10497 - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs.
10498 So that wildcarded CNAMEs get their NSEC with them to the answer.
10499 - test for a CNAME to a DNAME to a CNAME to an answer, all from
10500 different domains, for key fetching and signature checking of
10503 3 September 2007: Wouter
10504 - Fixed error in iterator that would cause assertion failure in
10505 validator. CNAME to a NXDOMAIN response was collated into a response
10506 with both a CNAME and the NXDOMAIN rcode. Added a test that the
10507 rcode is changed to NOERROR (because of the CNAME).
10508 - timeout on tcp does not lead to spurious leakage detect.
10509 - account memory for name of lame zones, so that memory leakages does
10510 not show lame cache growth as a leakage growth.
10511 - config setting for lameness cache expressed in bytes, instead of
10513 - tool too summarize allocations per code line.
10515 31 August 2007: Wouter
10516 - can read bind trusted-keys { ... }; files, in a compatibility mode.
10517 - iterator should not detach target queries that it still could need.
10518 the protection against multiple outstanding queries is moved to a
10519 current_query num check.
10520 - validator nodata, positive, referral tests.
10521 - dname print can print '*' wildcard.
10523 30 August 2007: Wouter
10524 - fixup override date config option.
10525 - config options to control memory usage.
10526 - caught bad free of un-alloced data in worker_send error case.
10527 - memory accounting for key cache (trust anchors and temporary cache).
10528 - memory accounting fixup for outside network tcp pending waits.
10529 - memory accounting fixup for outside network tcp callbacks.
10530 - memory accounting for iterator fixed storage.
10531 - key cache size and slabs config options.
10532 - lib crypto cleanups at exit.
10534 29 August 2007: Wouter
10535 - test tool to sign rrsets for testing validator with.
10536 - added RSA and DSA test keys, public and private pairs, 512 bits.
10537 - default configuration is with validation enabled.
10538 Only a trust-anchor needs to be configured for DNSSEC to work.
10539 - do not convert to DER for DSA signature verification.
10540 - validator replay test file, for a DS to DNSKEY DSA key prime and
10543 28 August 2007: Wouter
10544 - removed double use for udp buffers, that could fail,
10545 instead performs a malloc to do the backup.
10546 - validator validates referral messages, by validating all the rrsets
10547 and stores the rrsets in the cache. Further referral (nonRD queries)
10548 replies are made from the rrset cache directly. Unless unchecked
10549 rrsets are encountered, there are then validated.
10550 - enforce that signing is done by a parent domain (or same domain).
10551 - adjust TTL downwards if rrset TTL bigger than signature allows.
10552 - permissive mode feature, sets AD bit for secure, but bogus does
10553 not give servfail (bogus is changed into indeterminate).
10554 - optimization of rrset verification. rr canonical sorting is reused,
10555 for the same rrset. canonical rrset image in buffer is reused for
10556 the same signature.
10557 - if the rrset is too big (64k exactly + large owner name) the
10558 canonicalization routine will fail if it does not fit in buffer.
10559 - faster verification for large sigsets.
10560 - verb_detail mode reports validation failures, but not the entire
10561 algorithm for validation. Key prime failures are reported as
10564 27 August 2007: Wouter
10565 - do not garble the edns if a cache answer fails.
10566 - answer norecursive from cache if possible.
10567 - honor clean_additional setting when returning secure non-recursive
10569 - do not store referral in msg cache for nonRD queries.
10570 - store verification status in the rrset cache to speed up future
10572 - mark rrsets indeterminate and insecure if they are found to be so.
10573 and store this in the cache.
10575 24 August 2007: Wouter
10576 - message is bogus if unsecure authority rrsets are present.
10577 - val-clean-additional option, so you can turn it off.
10578 - move rrset verification out of the specific proof types into one
10579 routine. This makes the proof routines prettier.
10580 - fixup cname handling in validator, cname-to-positive and cname-to-
10582 - Do not synthesize DNSKEY and DS responses from the rrset cache if
10583 the rrset is from the additional section. Signatures may have
10584 fallen off the packet, and cause validation failure.
10585 - more verbose signature date errors (with the date attached).
10586 - increased default infrastructure cache size. It is important for
10587 performance, and 1000 entries are only 212k (or a 400 k total cache
10588 size). To 10000 entries (for 2M entries, 4M cache size).
10590 23 August 2007: Wouter
10591 - CNAME handling - move needs_validation to before val_new().
10592 val_new() setups the chase-reply to be an edited copy of the msg.
10593 new classification, and find signer can find for it.
10594 removal of unsigned crap from additional, and query restart for
10596 - refuse to follow wildcarded DNAMEs when validating.
10597 But you can query for qtype ANY, or qtype DNAME and validate that.
10599 22 August 2007: Wouter
10601 - review - use val_error().
10603 21 August 2007: Wouter
10604 - ANY response validation.
10605 - store security status in cache.
10606 - check cache security status and either send the query to be
10607 validated, return the query to client, or send servfail to client.
10608 Sets AD bit on validated replies.
10609 - do not examine security status on an error reply in mesh_done.
10610 - construct DS, DNSKEY messages from rrset cache.
10611 - manual page entry for override-date.
10613 20 August 2007: Wouter
10614 - validate and positive validation, positive wildcard NSEC validation.
10615 - nodata validation, nxdomain validation.
10617 18 August 2007: Wouter
10618 - process DNSKEY response in FINDKEY state.
10620 17 August 2007: Wouter
10621 - work on DS2KE routine.
10622 - val_nsec.c for validator NSEC proofs.
10623 - unit test for NSEC bitmap reading.
10624 - dname iswild and canonical_compare with unit tests.
10626 16 August 2007: Wouter
10627 - DS sig unit test.
10628 - latest release libevent 1.3c and 1.3d have threading fixed.
10629 - key entry fixup data pointer and ttl absolute.
10630 - This makes a key-prime succeed in validator, with DS or DNSKEY as
10632 - fixup canonical compare byfield routine, fix bug and also neater.
10633 - fixed iterator response type classification for queries of type
10635 dig ANY gives sometimes NS rrset in AN and NS section, and parser
10636 removes the NS section duplicate. dig NS gives sometimes the NS
10637 in the answer section, as referral.
10638 - validator FINDKEY state.
10640 15 August 2007: Wouter
10641 - crypto calls to verify signatures.
10642 - unit test for rrsig verification.
10644 14 August 2007: Wouter
10645 - default outgoing ports changed to avoid port 2049 by default.
10646 This port is widely blocked by firewalls.
10647 - count infra lameness cache in memory size.
10648 - accounting of memory improved
10649 - outbound entries are allocated in the query region they are for.
10650 - extensive debugging for memory allocations.
10651 - --enable-lock-checks can be used to enable lock checking.
10652 - protect undefs in config.h from autoheaders ministrations.
10653 - print all received udp packets. log hex will print on multiple
10655 - fixed error in parser with backwards rrsig references.
10656 - mark cycle targets for iterator did not have CD flag so failed
10659 13 August 2007: Wouter
10660 - fixup makefile, if lexer is missing give nice error and do not
10661 mess up the dependencies.
10662 - canonical compare routine updated.
10663 - canonical hinfo compare.
10664 - printout list of the queries that the mesh is working on.
10666 10 August 2007: Wouter
10667 - malloc and free overrides that track total allocation and frees.
10668 for memory debugging.
10669 - work on canonical sort.
10671 9 August 2007: Wouter
10672 - canonicalization, signature checks
10673 - dname signature label count and unit test.
10674 - added debug heap size print to memory printout.
10675 - typo fixup in worker.c
10676 - -R needed on solaris.
10677 - validator override option for date check testing.
10679 8 August 2007: Wouter
10680 - ldns _raw routines created (in ldns trunk).
10681 - sigcrypt DS digest routines
10682 - val_utils uses sigcrypt to perform signature cryptography.
10683 - sigcrypt keyset processing
10685 7 August 2007: Wouter
10686 - security status type.
10687 - security status is copied when rdata is equal for rrsets.
10688 - rrset id is updated to invalidate all the message cache entries
10689 that refer to NSEC, NSEC3, DNAME rrsets that have changed.
10691 - val_sigcrypt file for validator signature checks.
10693 6 August 2007: Wouter
10694 - key cache for validator.
10695 - moved isroot and dellabel to own dname routines, with unit test.
10697 3 August 2007: Wouter
10699 - scrubber check section of lame NS set.
10700 - trust anchors can be in config file or read from zone file,
10701 DS and DNSKEY entries.
10702 - unit test trust anchor storage.
10703 - trust anchors converted to packed rrsets.
10704 - key entry definition.
10706 2 August 2007: Wouter
10707 - configure change for latest libevent trunk version (needs -lrt).
10708 - query_done and walk_supers are moved out of module interface.
10709 - fixup delegation point duplicates.
10710 - fixup iterator scrubber; lame NS set is let through the scrubber
10711 so that the classification is lame.
10712 - validator module exists, and does nothing but pass through,
10713 with calling of next module and return.
10716 1 August 2007: Wouter
10717 - set version to 0.5
10718 - module work for module to module interconnections.
10719 - config of modules.
10720 - detect cycle takes flags.
10722 31 July 2007: Wouter
10726 30 July 2007: Wouter
10727 - changed random state init, so that sequential process IDs are not
10728 cancelled out by sequential thread-ids in the random number seed.
10729 - the fwd_three test, which sends three queries to unbound, and
10730 unbound is kept waiting by ldns-testns for 3 seconds, failed
10731 because the retry timeout for default by unbound is 3 seconds too,
10732 it would hit that timeout and fail the test. Changed so that unbound
10733 is kept waiting for 2 seconds instead.
10735 27 July 2007: Wouter
10736 - removed useless -C debug option. It did not work.
10737 - text edit of documentation.
10738 - added doc/CREDITS file, referred to by the manpages.
10739 - updated planning.
10741 26 July 2007: Wouter
10742 - cycle detection, for query state dependencies. Will attempt to
10743 circumvent the cycle, but if no other targets available fails.
10744 - unit test for AXFR, IXFR response.
10745 - test for cycle detection.
10747 25 July 2007: Wouter
10748 - testbound read ADDRESS and check it.
10749 - test for version.bind and friends.
10750 - test for iterator chaining through several referrals.
10751 - test and fixup for refetch for glue. Refetch fails if glue
10752 is still not provided.
10754 24 July 2007: Wouter
10755 - Example section in config manual.
10756 - Addr stored for range and moment in replay.
10758 20 July 2007: Wouter
10759 - Check CNAME chain before returning cache entry with CNAMEs.
10760 - Option harden-glue, default is on. It will discard out of zone
10761 data. If disabled, performance is faster, but spoofing attempts
10762 become a possibility. Note that still normalize scrubbing is done,
10763 and that the potentially spoofed data is used for infrastructure
10764 and not returned to the client.
10765 - if glue times out, refetch by asking parent of delegation again.
10766 Much like asking for DS at the parent side.
10767 - TODO items from forgery-resilience draft.
10768 and on memory handling improvements.
10769 - renamed module_event_timeout to module_event_noreply.
10770 - memory reporting code; reports on memory usage after handling
10771 a network packet (not on cache replies).
10773 19 July 2007: Wouter
10774 - shuffle NS selection when getting nameserver target addresses.
10775 - fixup of deadlock warnings, yield cpu in checklock code so that
10776 freebsd scheduler selects correct process to run.
10777 - added identity and version config options and replies.
10778 - store cname messages complete answers.
10780 18 July 2007: Wouter
10781 - do not query addresses, 127.0.0.1, and ::1 by default.
10783 17 July 2007: Wouter
10784 - forward zone options in config file.
10785 - forward per zone in iterator. takes precedence over stubs.
10786 - fixup commithooks.
10787 - removed forward-to and forward-to-port features, subsumed by
10789 - fix parser to handle absent server: clause.
10790 - change untrusted rrset test to account for scrubber that is now
10791 applied during the test (which removes the poison, by the way).
10792 - feature, addresses can be specified with @portnumber, like nsd.conf.
10793 - test config files changed over to new forwarder syntax.
10795 27 June 2007: Wouter
10796 - delete of mesh does a postorder traverse of the tree.
10797 - found and fixed a memory leak. For TTL=0 messages, that would
10798 not be cached, instead the msg-replyinfo structure was leaked.
10799 - changed server selection so it will filter out hosts that are
10800 unresponsive. This is defined as a host with the maximum rto value.
10801 This means that unbound tried the host for retries up to 120 secs.
10802 The rto value will time out after host-ttl seconds from the cache.
10803 This keeps such unresolvable queries from taking up resources.
10804 - utility for keeping histogram.
10806 26 June 2007: Wouter
10807 - mesh is called by worker, and iterator uses it.
10808 This removes the hierarchical code.
10809 QueryTargets state and Finished state are merged for iterator.
10810 - forwarder mode no longer sets AA bit on first reply.
10811 - rcode in walk_supers is not needed.
10813 25 June 2007: Wouter
10815 - error encode routine for ease.
10817 22 June 2007: Wouter
10818 - removed unused _node iterator value from rbtree_t. Takes up space.
10819 - iterator can handle querytargets state without a delegation point
10820 set, so that a priming(stub) subquery error can be handled.
10821 - iterator stores if it is priming or not.
10822 - log_query_info() neater logging.
10823 - changed iterator so that it does not alter module_qstate.qinfo
10824 but keeps a chase query info. Also query_flags are not altered,
10825 the iterator uses chase_flags.
10826 - fixup crash in case no ports for the family exist.
10828 21 June 2007: Wouter
10829 - Fixup secondary buffer in case of error callback.
10830 - cleanup slumber list of runnable states.
10831 - module_subreq_depth fails to work in slumber list.
10832 - fixup query release for cached results to sub targets.
10833 - neater error for tcp connection failure, shows addr in verbose.
10834 - rbtree_init so that it can be used with preallocated memory.
10836 20 June 2007: Wouter
10837 - new -C option to enable coredumps after forking away.
10839 - fixup CNAME generation by scrubber, and memory allocation of it.
10840 - fixup deletion of serviced queries when all callbacks delete too.
10841 - set num target queries to 0 when you move them to slumber list.
10842 - typo in check caused subquery errors to be ignored, fixed.
10843 - make lint happy about rlim_t.
10844 - freeup of modules after freeup of module-states.
10845 - duplicate replies work, this uses secondary udp buffer in outnet.
10847 19 June 2007: Wouter
10848 - nicer layout in stats.c, review 0.3 change.
10849 - spelling improvement, review 0.3 change.
10850 - uncapped timeout for server selection, so that very fast or slow
10851 servers will stand out from the rest.
10852 - target-fetch-policy: "3 2 1 0 0" config setting.
10853 - fixup queries answered without RD bit (for root prime results).
10854 - refuse AXFR and IXFR requests.
10855 - fixup RD flag in error reply from iterator. fixup RA flag from
10856 worker error reply.
10857 - fixup encoding of very short edns buffer sizes, now sets TC bit.
10858 - config options harden-short-bufsize and harden-large-queries.
10860 18 June 2007: Wouter
10861 - same, move subqueries to slumber list when first has resolved.
10862 - fixup last fix for duplicate callbacks.
10863 - another offbyone in targetcounter. Also in Java prototype by the way.
10865 15 June 2007: Wouter
10866 - if a query asks to be notified of the same serviced query result
10867 multiple times, this will succeed. Only one callback will happen;
10868 multiple outbound-list entries result (but the double cleanup of it
10870 - when iterator moves on due to CNAME or referral, it will remove
10871 the subqueries (for other targets). These are put on the slumber
10873 - state module wait subq is OK with no new subqs, an old one may have
10874 stopped, with an error, and it is still waiting for other ones.
10875 - if a query loops, halt entire query (easy way to clean up properly).
10877 14 June 2007: Wouter
10878 - num query targets was > 0 , not >= 0 compared, so that fetch
10879 policy of 0 did nothing.
10881 13 June 2007: Wouter
10882 - debug option: configure --enable-static-exe for compile where
10883 ldns and libevent are linked statically. Default is off.
10884 - make install and make uninstall. Works with static-exe and without.
10885 installation of unbound binary and manual pages.
10886 - alignment problem fix on solaris 64.
10887 - fixup address in case of TCP error.
10889 12 June 2007: Wouter
10890 - num target queries was set to 0 at a bad time. Default it to 0 and
10891 increase as target queries are done.
10892 - synthesize CNAME and DNAME responses from the cache.
10893 - Updated doxygen config for doxygen 1.5.
10894 - aclocal newer version.
10895 - doxygen 1.5 fixes for comments (for the strict check on docs).
10897 11 June 2007: Wouter
10898 - replies on TCP queries have the address field set in replyinfo,
10899 for serviced queries, because the initiator does not know that
10900 a TCP fallback has occured.
10901 - omit DNSSEC types from nonDO replies, except if qtype is ANY or
10902 if qtype directly queries for the type (and then only show that
10903 'unknown type' in the answer section).
10904 - fixed message parsing where rrsigs on their own would be put
10905 in the signature list over the rrsig type.
10907 7 June 2007: Wouter
10908 - fixup error in double linked list insertion for subqueries and
10909 for outbound list of serviced queries for iterator module.
10910 - nicer printout of outgoing port selection.
10911 - fixup cname target readout.
10912 - nicer debug output.
10913 - fixup rrset counts when prepending CNAMEs to the answer.
10914 - fixup rrset TTL for prepended CNAMEs.
10915 - process better check for looping modules, and which submodule to
10917 - subreq insertion code fixup for slumber list.
10918 - VERB_DETAIL, verbosity: 2 level gives short but readable output.
10919 VERB_ALGO, verbosity: 3 gives extensive output.
10920 - fixup RA bit in cached replies.
10921 - fixup CNAME responses from the cache no longer partial response.
10922 - error in network send handled without leakage.
10923 - enable ip6 from config, and try ip6 addresses if available,
10924 if ip6 is not connected, skips to next server.
10926 5 June 2007: Wouter
10927 - iterator state finished.
10928 - subrequests without parent store in cache and stop.
10929 - worker slumber list for ongoing promiscuous queries.
10930 - subrequest error handling.
10931 - priming failure returns SERVFAIL.
10932 - priming gives LAME result, returns SERVFAIL.
10933 - debug routine to print dns_msg as handled by iterator.
10934 - memleak in config file stubs fixup.
10935 - more small bugs, in scrubber, query compare no ID for lookup,
10936 in dname validation for NS targets.
10937 - sets entry.key for new special allocs.
10938 - lognametypeclass can display unknown types and classes.
10940 4 June 2007: Wouter
10941 - random selection of equally preferred nameserver targets.
10942 - reply info copy routine. Reuses existing code.
10943 - cache lameness in response handling.
10944 - do not touch qstate after worker_process_query because it may have
10945 been deleted by that routine.
10946 - Prime response state.
10947 - Process target response state.
10948 - some memcmp changed to dname_compare for case preservation.
10950 1 June 2007: Wouter
10951 - normalize incoming messages. Like unbound-java, with CNAME chain
10952 checked, DNAME checked, CNAME's synthesized, glue checked.
10953 - sanitize incoming messages.
10954 - split msgreply encode functions into own file msgencode.c.
10955 - msg_parse to queryinfo/replyinfo conversion more versatile.
10956 - process_response, classify response, delegpt_from_message.
10958 31 May 2007: Wouter
10959 - querytargets state.
10960 - dname_subdomain_c() routine.
10961 - server selection, based on RTT. ip6 is filtered out if not available,
10962 and lameness is checked too.
10963 - delegation point copy routine.
10965 30 May 2007: Wouter
10966 - removed FLAG_CD from message and rrset caches. This was useful for
10967 an agnostic forwarder, but not for a sophisticated (trust value per
10968 rrset enabled) cache.
10969 - iterator response typing.
10970 - iterator cname handle.
10971 - iterator prime start.
10973 - processInitRequest and processInitRequest2.
10974 - cache synthesizes referral messages, with DS and NSEC.
10975 - processInitRequest3.
10976 - if a request creates multiple subrequests these are all activated.
10978 29 May 2007: Wouter
10979 - routines to lock and unlock array of rrsets moved to cache/rrset.
10980 - lookup message from msg cache (and copy to region).
10981 - fixed cast error in dns msg lookup.
10982 - message with duplicate rrset does not increase its TTLs twice.
10983 - 'qnamesize' changed to 'qname_len' for similar naming scheme.
10985 25 May 2007: Wouter
10986 - Acknowledge use of unbound-java code in iterator. Nicer readme.
10987 - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and
10988 rrset cache from module environment.
10989 - packed rrset key has type and class as easily accessible struct
10990 members. They are still kept in network format for fast msg encode.
10991 - dns cache find_delegation routine.
10992 - iterator main functions setup.
10993 - dns cache lookup setup.
10995 24 May 2007: Wouter
10996 - small changes to prepare for subqueries.
10997 - iterator forwarder feature separated out.
10998 - iterator hints stub code, config file stub code, so that first
10999 testing can proceed locally.
11000 - replay tests now have config option to enable forwarding mode.
11002 23 May 2007: Wouter
11003 - outside network does precise timers for roundtrip estimates for rtt
11004 and for setting timeout for UDP. Pending_udp takes milliseconds.
11005 - cleaner iterator sockaddr conversion of forwarder address.
11006 - iterator/iter_utils and iter_delegpt setup.
11009 22 May 2007: Wouter
11010 - outbound query list for modules and support to callback with the
11011 outbound entry to the module.
11012 - testbound support for new serviced queries.
11013 - test for retry to TCP cannot use testbound any longer.
11014 - testns test for EDNS fallback, test for TCP fallback already exists.
11015 - fixes for no-locking compile.
11016 - mini_event timer precision and fix for change in timeouts during
11017 timeout callback. Fix for fwd_three tests, performed nonexit query.
11019 21 May 2007: Wouter
11020 - small comment on hash table locking.
11021 - outside network serviced queries, contain edns and tcp fallback,
11022 and udp retries and rtt timing.
11024 16 May 2007: Wouter
11025 - lruhash_touch() would cause locking order problems. Fixup in
11026 lock-verify in case locking cycle is found.
11027 - services/cache/rrset.c for rrset cache code.
11028 - special rrset_cache LRU updating function that uses the rrset id.
11029 - no dependencies calculation when make clean is called.
11030 - config settings for infra cache.
11031 - daemon code slightly cleaner, only creates caches once.
11033 15 May 2007: Wouter
11035 - unit test for host cache.
11037 14 May 2007: Wouter
11038 - Port to OS/X and Dec Alpha. Printf format and alignment fixes.
11039 - extensive lock debug report on join timeout.
11040 - proper RTT calculation, in utility code.
11041 - setup of services/cache/infra, host cache.
11043 11 May 2007: Wouter
11044 - iterator/iterator.c module.
11045 - fixup to pass reply_info in testcode and in netevent.
11047 10 May 2007: Wouter
11048 - created release-0.3 svn tag.
11050 - fixed compression - no longer compresses root name.
11053 - outside network cleans up waiting tcp queries on exit.
11055 - testbound replay with retry in TCP mode.
11056 - tpkg test for retry in TCP mode, against ldns-testns server.
11057 - daemon checks max number of open files and complains if not enough.
11058 - test where data expires in the cache.
11059 - compiletests: fixed empty body ifstatements in alloc.c, in case
11060 locks are disabled.
11063 - outgoing network keeps list of available tcp buffers for outgoing
11065 - outgoing-num-tcp config option.
11066 - outgoing network keeps waiting list of queries waiting for buffer.
11067 - netevent supports outgoing tcp commpoints, nonblocking connects.
11070 - EDNS read from query, used to make reply smaller.
11071 - advertised edns value constants.
11072 - EDNS BADVERS response, if asked for too high edns version.
11073 - EDNS extended error responses once the EDNS record from the query
11074 has successfully been parsed.
11077 - msgreply sizefunc is more accurate.
11078 - config settings for rrset cache size and slabs.
11079 - hashtable insert takes argument so that a thread can use its own
11080 alloc cache to store released keys.
11081 - alloc cache special_release() locks if necessary.
11082 - rrset trustworthiness type added.
11083 - thread keeps a scratchpad region for handling messages.
11084 - writev used in netevent to write tcp length and data after another.
11085 This saves a roundtrip on tcp replies.
11086 - test for one rrset updated in the cache.
11087 - test for one rrset which is not updated, as it is not deemed
11088 trustworthy enough.
11089 - test for TTL refreshed in rrset.
11092 - fill refs. Use new parse and encode to answer queries.
11093 - stores rrsets in cache.
11094 - uses new msgreply format in cache.
11097 - dname unit tests in own file and spread out neatly in functions.
11098 - more dname unit tests.
11099 - message encoding creates truncated TC flagged messages if they do
11100 not fit, and will leave out (whole)rrsets from additional if needed.
11103 - decompress query section, extremely lenient acceptance.
11104 But only for answers from other servers, not for plain queries.
11105 - compression and decompression test cases.
11106 - some stats added.
11107 - example.conf interface: line is changed from 127.0.0.1 which leads
11108 to problems if used (restricting communication to the localhost),
11109 to a documentation and test address.
11111 27 April 2007: Wouter
11112 - removed iov usage, it is not good for dns message encoding.
11113 - owner name compression more optimal.
11114 - rrsig owner name compression.
11115 - rdata domain name compression.
11117 26 April 2007: Wouter
11118 - floating point exception fix in lock-verify.
11119 - lint uses make dependency
11120 - fixup lint in dname owner domain name compression code.
11121 - define for offset range that can be compressed to.
11123 25 April 2007: Wouter
11124 - prettier code; parse_rrset->type kept in host byte order.
11125 - datatype used for hashvalue of converted rrsig structure.
11126 - unit test compares edns section data too.
11128 24 April 2007: Wouter
11129 - ttl per RR, for RRSIG rrsets and others.
11130 - dname_print debug function.
11131 - if type is not known, size calc will skip DNAME decompression.
11132 - RRSIG parsing and storing and putting in messages.
11133 - dnssec enabled unit tests (from nlnetlabs.nl and se queries).
11134 - EDNS extraction routine.
11136 20 April 2007: Wouter
11137 - code comes through all of the unit tests now.
11138 - disabled warning about spurious extra data.
11139 - documented the RRSIG parse plan in msgparse.h.
11140 - rrsig reading and outputting.
11142 19 April 2007: Wouter
11143 - fix unit test to actually to tests.
11144 - fix write iov helper, and fakevent code.
11145 - extra builtin testcase (small packet).
11146 - ttl converted to network format in packets.
11147 - flags converted correctly
11148 - rdatalen off by 2 error fixup.
11149 - uses less iov space for header.
11151 18 April 2007: Wouter
11152 - review of msgparse code.
11153 - smaller test cases.
11155 17 April 2007: Wouter
11156 - copy and decompress dnames.
11157 - store calculated hash value too.
11158 - routine to create message out of stored information.
11159 - util/data/msgparse.c for message parsing code.
11160 - unit test, and first fixes because of test.
11161 * forgot rrset_count addition.
11162 * did & of ptr on stack for memory position calculation.
11163 * dname_pkt_copy forgot to read next label length.
11164 - test from file and fixes
11165 * double frees fixed in error conditions.
11166 * types with less than full rdata allowed by parser.
11167 Some dynamic update packets seem to use it.
11169 16 April 2007: Wouter
11170 - following a small change in LDNS, parsing code calculates the
11171 memory size to allocate for rrs.
11172 - code to handle ID creation.
11174 13 April 2007: Wouter
11175 - parse routines. Code that parses rrsets, rrs.
11177 12 April 2007: Wouter
11178 - dname compare routine that preserves case, with unit tests.
11180 11 April 2007: Wouter
11181 - parse work - dname packet parse, msgparse, querysection parse,
11182 start of sectionparse.
11184 10 April 2007: Wouter
11185 - Improved alignment of reply_info packet, nice for 32 and 64 bit.
11186 - Put RRset counts in reply_info, because the number of RRs can change
11187 due to RRset updates.
11188 - import of region-allocator code from nsd.
11189 - set alloc special type to ub_packed_rrset_key.
11190 Uses lruhash entry overflow chain next pointer in alloc cache.
11191 - doxygen documentation for region-allocator.
11192 - setup for parse scratch data.
11194 5 April 2007: Wouter
11195 - discussed packed rrset with Jelte.
11197 4 April 2007: Wouter
11198 - moved to version 0.3.
11199 - added util/data/dname.c
11200 - layout of memory for rrsets.
11202 3 April 2007: Wouter
11203 - detect sign of msghdr.msg_iovlen so that the cast to that type
11204 in netevent (which is there to please lint) can be correct.
11205 The type on several OSes ranges from int, int32, uint32, size_t.
11206 Detects unsigned or signed using math trick.
11207 - constants for DNS flags.
11208 - compilation without locks fixup.
11209 - removed include of unportable header from lookup3.c.
11210 - more portable use of struct msghdr.
11211 - casts for printf warning portability.
11212 - tweaks to tests to port them to the testbed.
11215 2 April 2007: Wouter
11216 - check sizes of udp received messages, not too short.
11217 - review changes. Some memmoves can be memcpys: 4byte aligned.
11218 set id correctly on cached answers.
11219 - review changes msgreply.c, memleak on error condition. AA flag
11220 clear on cached reply. Lowercase queries on hashing.
11221 unit test on lowercasing. Test AA bit not set on cached reply.
11222 Note that no TTLs are managed.
11224 29 March 2007: Wouter
11225 - writev or sendmsg used when answering from cache.
11226 This avoids a copy of the data.
11227 - do not do useless byteswap on query id. Store reply flags in uint16
11228 for easier access (and no repeated byteswapping).
11230 - configure detects and config.h includes sys/uio.h for writev decl.
11232 28 March 2007: Wouter
11233 - new config option: num-queries-per-thread.
11234 - added tpkg test for answering three queries at the same time
11235 using one thread (from the query service list).
11237 27 March 2007: Wouter
11238 - added test for cache and not cached answers, in testbound replays.
11239 - testbound can give config file and commandline options from the
11240 replay file to unbound.
11241 - created test that checks if items drop out of the cache.
11242 - added word 'partitioned hash table' to documentation on slab hash.
11243 A slab hash is a partitioned hash table.
11244 - worker can handle multiple queries at a time.
11246 26 March 2007: Wouter
11247 - config settings for slab hash message cache.
11248 - test for cached answer.
11249 - Fixup deleting fake answer from testbound list.
11251 23 March 2007: Wouter
11252 - review of yesterday's commits.
11253 - covered up memory leak of the entry locks.
11254 - answers from the cache correctly. Copies flags correctly.
11255 - sanity check for incoming query replies.
11256 - slabbed hash table. Much nicer contention, need dual cpu to see.
11258 22 March 2007: Wouter
11259 - AIX configure check.
11260 - lock-verify can handle references to locks that are created
11261 in files it has not yet read in.
11262 - threaded hash table test.
11263 - unit test runs lock-verify afterwards and checks result.
11264 - need writelock to update data on hash_insert.
11265 - message cache code, msgreply code.
11267 21 March 2007: Wouter
11268 - unit test of hash table, fixup locking problem in table_grow().
11269 - fixup accounting of sizes for removing items from hashtable.
11270 - unit test for hash table, single threaded test of integrity.
11271 - lock-verify reports errors nicely. More quiet in operation.
11273 16 March 2007: Wouter
11274 - lock-verifier, checks consistent order of locking.
11276 14 March 2007: Wouter
11277 - hash table insert (and subroutines) and lookup implemented.
11278 - hash table remove.
11279 - unit tests for hash internal bin, lru functions.
11281 13 March 2007: Wouter
11282 - lock_unprotect in checklocks.
11283 - util/storage/lruhash.h for LRU hash table structure.
11285 12 March 2007: Wouter
11286 - configure.ac moved to 0.2.
11287 - query_info and replymsg util/data structure.
11289 9 March 2007: Wouter
11290 - added rwlock writelock checking.
11291 So it will keep track of the writelock, and readlocks are enforced
11292 to not change protected memory areas.
11293 - log_hex function to dump hex strings to the logfile.
11294 - checklocks zeroes its destroyed lock after checking memory areas.
11295 - unit test for alloc.
11296 - identifier for union in checklocks to please older compilers.
11299 8 March 2007: Wouter
11300 - Reviewed checklock code.
11302 7 March 2007: Wouter
11303 - created a wrapper around thread calls that performs some basic
11304 checking for data race and deadlock, and basic performance
11305 contention measurement.
11307 6 March 2007: Wouter
11308 - Testbed works with threading (different machines, different options).
11309 - alloc work, does the special type.
11311 2 March 2007: Wouter
11312 - do not compile fork funcs unless needed. Otherwise will give
11313 type errors as their typedefs have not been enabled.
11314 - log shows thread numbers much more nicely (and portably).
11315 - even on systems with nonthreadsafe libevent signal handling,
11316 unbound will exit if given a signal.
11317 Reloads will not work, and exit is not graceful.
11318 - start of alloc framework layout.
11320 1 March 2007: Wouter
11321 - Signals, libevent and threads work well, with libevent patch and
11322 changes to code (close after event_del).
11323 - set ipc pipes nonblocking.
11325 27 February 2007: Wouter
11326 - ub_thread_join portable definition.
11327 - forking is used if no threading is available.
11328 Tested, it works, since pipes work across processes as well.
11329 Thread_join is replaced with waitpid.
11330 - During reloads the daemon will temporarily handle signals,
11331 so that they do not result in problems.
11332 - Also randomize the outgoing port range for tests.
11333 - If query list is full, will stop selecting listening ports for read.
11334 This makes all threads service incoming requests, instead of one.
11335 No memory is leaking during reloads, service of queries, etc.
11336 - test that uses ldns-testns -f to test threading. Have to answer
11337 three queries at the same time.
11338 - with verbose=0 operates quietly.
11340 26 February 2007: Wouter
11341 - ub_random code used to select ID and port.
11342 - log code prints thread id.
11343 - unbound can thread itself, with reload(HUP) and quit working
11345 - don't open pipes for #0, doesn't need it.
11346 - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload).
11348 23 February 2007: Wouter
11349 - Can do reloads on sigHUP. Everything is stopped, and freed,
11350 except the listening ports. Then the config file is reread.
11351 And everything is started again (and listening ports if needed).
11352 - Ports for queries are shared.
11353 - config file added interface:, chroot: and username:.
11354 - config file: directory, logfile, pidfile. And they work too.
11355 - will daemonize by default now. Use -d to stay in the foreground.
11356 - got BSD random[256 state] code, made it threadsafe. util/random.
11358 22 February 2007: Wouter
11359 - Have a config file. Removed commandline options, moved to config.
11360 - tests use config file.
11362 21 February 2007: Wouter
11363 - put -c option in man page.
11364 - minievent fd array capped by FD_SETSIZE.
11366 20 February 2007: Wouter
11367 - Added locks code and pthread spinlock detection.
11368 - can use no locks, or solaris native thread library.
11369 - added yacc and lex configure, and config file parsing code.
11370 also makedist.sh, and manpage.
11371 - put include errno.h in config.h
11373 19 February 2007: Wouter
11374 - Created 0.0 svn tag.
11375 - added acx_pthread.m4 autoconf check for pthreads from
11376 the autoconf archive. It is GPL-with-autoconf-exception Licensed.
11377 You can specify --with-pthreads, or --without-pthreads to configure.
11379 16 February 2007: Wouter
11380 - Updated testbed script, works better by using make on remote end.
11381 - removed check decls, we can compile without them.
11382 - makefile supports LIBOBJ replacements.
11383 - docs checks ignore compat code.
11384 - added util/mini-event.c and .h, a select based alternative used with
11385 ./configure --with-libevent=no
11386 It is limited to 1024 file descriptors, and has less features.
11387 - will not create ip6 sockets if ip6 not on the machine.
11389 15 February 2007: Wouter
11390 - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64,
11391 Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc.
11392 - malloc rndstate, so that it is aligned for access.
11393 - fixed rbtree cleanup with postorder traverse.
11394 - fixed pending messages are deleted when handled.
11395 - You can control verbosity; default is not verbose, every -v
11396 adds more verbosity.
11398 14 February 2007: Wouter
11399 - Included configure.ac changes from ldns.
11400 - detect (some) headers before the standards check.
11401 - do not use isblank to test c99, since its not available on solaris9.
11402 - review of testcode.
11403 * entries in a RANGE are no longer reversed.
11404 * print name of file with replay entry parse errors.
11405 - port to OSX: cast to int for some prints of sizet.
11406 - Makefile copies ldnstestpkts.c before doing dependencies on it.
11408 13 February 2007: Wouter
11409 - work on fake events, first fwd replay works.
11410 - events can do timeouts and errors on queries to servers.
11411 - test package that runs replay scenarios.
11413 12 February 2007: Wouter
11414 - work on fake events.
11416 9 February 2007: Wouter
11417 - replay file reading.
11418 - fake event setup, it creates fake structures, and teardowns,
11419 added signal callbacks to reply to be able to fake those,
11420 and main structure of event replay routines.
11422 8 February 2007: Wouter
11425 - testcode/fake_event work.
11427 7 February 2007: Wouter
11428 - return answer with the same ID as query was sent with.
11429 - created udp forwarder test. I've done some effort to make it perform
11430 quickly. After servers are created, no big sleep statements but
11431 it checks the logfiles to see if servers have come up. Takes 0.14s.
11432 - set addrlen value when calling recvfrom.
11433 - comparison of addrs more portable.
11434 - LIBEVENT option for testbed to set libevent directory.
11435 - work on tcp input.
11437 6 February 2007: Wouter
11438 - reviewed code and improved in places.
11440 5 February 2007: Wouter
11441 - Picked up stdc99 and other define tests from ldns. Improved
11442 POSIX define test to include getaddrinfo.
11443 - defined constants for netevent callback error code.
11444 - unit test for strisip6.
11446 2 February 2007: Wouter
11447 - Created udp4 and udp6 port arrays to provide service for both
11449 - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets.
11450 - listens on both ip4 and ip6 ports to provide correct return address.
11451 - worker fwder address filled correctly.
11452 - fixup timer code.
11453 - forwards udp queries and sends answer.
11455 1 February 2007: Wouter
11456 - outside network more UDP work.
11457 - moved * closer to type.
11458 - comm_timer object and events.
11460 31 January 2007: Wouter
11461 - Added makedist.sh script to make release tarball.
11462 - Removed listen callback layer, did not add anything.
11463 - Added UDP recv to netevent, worker callback for udp.
11464 - netevent communication reply storage structure.
11465 - minimal query header sanity checking for worker.
11466 - copied over rbtree implementation from NSD (BSD licensed too).
11467 - outgoing network query service work.
11469 30 January 2007: Wouter
11470 - links in example/ldns-testpkts.c and .h for premade packet support.
11471 - added callback argument to listen_dnsport and daemon/worker.
11473 29 January 2007: Wouter
11474 - unbound.8 a short manpage.
11476 26 January 2007: Wouter
11478 - make lint works on BSD and Linux (openssl defines).
11480 - testbound program start.
11482 25 January 2007: Wouter
11483 - fixed lint so it may work on BSD.
11484 - put license into header of every file.
11485 - created verbosity flag.
11486 - fixed libevent configure flag.
11487 - detects event_base_free() in new libevent 1.2 version.
11488 - getopt in daemon. fatal_exit() and verbose() logging funcs.
11489 - created log_assert, that throws assertions to the logfile.
11490 - listen_dnsport service. Binds ports.
11492 24 January 2007: Wouter
11493 - cleaned up configure.ac.
11495 23 January 2007: Wouter
11496 - added libevent to configure to link with.
11497 - util/netevent setup work.
11498 - configure searches for libevent.
11499 - search for libs at end of configure (when other headers and types
11501 - doxygen works with ATTR_UNUSED().
11502 - util/netevent implementation.
11504 22 January 2007: Wouter
11505 - Designed header file for network communication.
11507 16 January 2007: Wouter
11508 - added readme.svn and readme.tests.
11510 4 January 2007: Wouter
11511 - Testbed script (run on multiple platforms the test set).
11512 Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5.
11513 - added unit test tpkg.
11515 3 January 2007: Wouter
11516 - committed first set of files into subversion repository.
11517 svn co svn+ssh://unbound.net/svn/unbound
11518 You need a ssh login. There is no https access yet.
11519 - Added LICENSE, the BSD license.
11520 - Added doc/README with compile help.
11521 - main program stub and quiet makefile.
11522 - minimal logging service (to stderr).
11523 - added postcommit hook that serves emails.
11524 - added first test 00-lint. postcommit also checks if build succeeds.
11525 - 01-doc: doxygen doc target added for html docs. And stringent test
11526 on documented files, functions and parameters.
11528 15 December 2006: Wouter
11529 - Created Makefile.in and configure.ac.