2 - fastrpz.patch fix included.
5 - tag for release 1.8.1rc1.
7 27 September 2018: Wouter
8 - Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes
9 qname minimisation with a forwarder when connectivity has issues
10 from rejecting responses.
12 25 September 2018: Wouter
13 - Perform TLS SNI indication of the host that is being contacted
14 for DNS over TLS service. It sets the configured tls auth name.
15 This is useful for hosts that apart from the DNS over TLS services
16 also provide other (web) services.
17 - Fix #4149: Add SSL cleanup for tcp timeout.
19 17 September 2018: Wouter
20 - Fix compile on Mac for unbound, provide explicit_bzero when libc
22 - Fix unbound for openssl in FIPS mode, it uses the digests with
23 the EVP call contexts.
24 - Fix that with harden-below-nxdomain and qname minisation enabled
25 some iterator states for nonresponsive domains can get into a
26 state where they waited for an empty list.
27 - Stop UDP to TCP failover after timeouts that causes the ping count
28 to be reset by the TCP time measurement (that exists for TLS),
29 because that causes the UDP part to not be measured as timeout.
30 - Fix #4156: Fix systemd service manager state change notification.
32 13 September 2018: Wouter
33 - Fix seed for random backup code to use explicit zero when wiped.
34 - exit log routine is annotated as noreturn function.
35 - free memory leaks in config strlist and str2list insert functions.
36 - do not move unused argv variable after getopt.
37 - Remove unused if clause in testcode.
38 - in testcode, free async ids, initialise array, and check for null
39 pointer during test of the test. And use exit for return to note
40 irregular program stop.
41 - Free memory leak in config strlist append.
42 - make sure nsec3 comparison salt is initialized.
43 - unit test has clang analysis.
44 - remove unused variable assignment from iterator scrub routine.
45 - check for null in delegation point during iterator refetch
47 - neater pointer cast in libunbound context quit routine.
48 - initialize statistics totals for printout.
49 - in authzone check that node exists before adding rrset.
50 - in unbound-anchor, use readwrite memory BIO.
51 - assertion in autotrust that packed rrset is formed correctly.
52 - Fix memory leak when message parse fails partway through copy.
53 - remove unused udpsize assignment in message encode.
54 - nicer bio free code in unbound-anchor.
55 - annotate exit functions with noreturn in unbound-control.
57 11 September 2018: Wouter
58 - Fixed unused return value warnings in contrib/fastrpz.patch for
60 - Fix to squelch respip warning in unit test, it is printed at
61 higher verbosity settings.
62 - Fix spelling errors.
63 - Fix initialisation in remote.c
65 10 September 2018: Wouter
66 - 1.8.1 in svn trunk. (changes from 4,5,.. sep apply).
69 5 September 2018: Wouter
70 - Fix spelling error in header, from getdns commit by Andreas Gelmini.
72 4 September 2018: Ralph
73 - More explicitly mention the type of ratelimit when applying
76 4 September 2018: Wouter
77 - Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018.
79 31 August 2018: Wouter
80 - Disable minimal-responses in subnet unit tests.
82 30 August 2018: Wouter
83 - Fix that a local-zone with a local-zone-type that is transparent
84 in a view with view-first, makes queries check for answers from the
85 local-zones defined outside of views.
88 - Disable minimal-responses in ipsecmod unit tests.
89 - Added serve-expired-ttl and serve-expired-ttl-reset options.
91 27 August 2018: Wouter
92 - Set defaults to yes for a number of options to increase speed and
93 resilience of the server. The so-reuseport, harden-below-nxdomain,
94 and minimal-responses options are enabled by default. They used
95 to be disabled by default, waiting to make sure they worked. They
96 are enabled by default now, and can be disabled explicitly by
97 setting them to "no" in the unbound.conf config file. The reuseport
98 and minimal options increases speed of the server, and should be
99 otherwise harmless. The harden-below-nxdomain option works well
100 together with the recently default enabled qname minimisation, this
101 causes more fetches to use information from the cache.
102 - next release is called 1.8.0.
103 - Fix lintflags for lint on FreeBSD.
105 22 August 2018: George
106 - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This
107 gives access to reply information for the client's communication
108 point when the callback is called before the mesh state (modules).
109 Changes to C and Python's inplace_callback signatures were also
112 21 August 2018: Wouter
113 - log-local-actions: yes option for unbound.conf that logs all the
114 local zone actions, a patch from Saksham Manchanda (Secure64).
115 - #4146: num.query.subnet and num.query.subnet_cache counters.
116 - Fix only misc failure from log-servfail when val-log-level is not
119 17 August 2018: Ralph
120 - Fix classification for QTYPE=CNAME queries when QNAME minimisation is
123 17 August 2018: Wouter
124 - Set libunbound to increase current, because the libunbound change
125 to the event callback function signature. That needs programs,
126 that use it, to recompile against the new header definition.
127 - print servfail info to log as error.
128 - added more servfail printout statements, to the iterator.
129 - log-servfail: yes prints log lines that say why queries are
130 returning SERVFAIL to clients.
132 16 August 2018: Wouter
133 - Fix warning on compile without threads.
134 - Fix contrib/fastrpz.patch.
136 15 August 2018: Wouter
137 - Fix segfault in auth-zone read and reorder of RRSIGs.
139 14 August 2018: Wouter
140 - Fix that printout of error for cycle targets is a verbosity 4
141 printout and does not wrongly print it is a memory error.
142 - Upgraded crosscompile script to include libunbound DLL in the
145 10 August 2018: Wouter
146 - Fix #4144: dns64 module caches wrong (negative) information.
148 9 August 2018: Wouter
149 - unbound-checkconf checks if modules exist and prints if they are
150 not compiled in the name of the wrong module.
151 - document --enable-subnet in doc/README.
152 - Patch for stub-no-cache and forward-no-cache options that disable
153 caching for the contents of that stub or forward, for when you
154 want immediate changes visible, from Bjoern A. Zeeb.
157 - Make capsforid fallback QNAME minimisation aware.
159 7 August 2018: Wouter
160 - Fix #4142: unbound.service.in: improvements and fixes.
161 Add unit dependency ordering (based on systemd-resolved).
162 Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings
163 about missing privileges during startup). Add 'AF_INET6' to
164 'RestrictAddressFamilies' (without it IPV6 can't work). From
166 - Patch to implement tcp-connection-limit from Jim Hague (Sinodun).
167 This limits the number of simultaneous TCP client connections
168 from a nominated netblock.
169 - make depend, yacc, lex, doc, headers. And log the limit exceeded
170 message only on high verbosity, so as to not spam the logs when
173 6 August 2018: Wouter
174 - Fix for #4136: Fix to unconditionally call destroy in daemon.c.
176 3 August 2018: George
177 - Expose if a query (or a subquery) was ratelimited (not src IP
178 ratelimiting) to libunbound under 'ub_result.was_ratelimited'.
179 This also introduces a change to 'ub_event_callback_type' in
180 libunbound/unbound-event.h.
183 3 August 2018: Wouter
184 - Revert previous change for #4136: because it introduces build
186 - New fix for #4136: This one ignores lex without without
189 1 August 2018: Wouter
190 - Fix to remove systemd sockaddr function check, that is not
191 always present. Make socket activation more lenient. But not
192 different when socket activation is not used.
193 - iana port list update.
196 - Patches from Jim Hague (Sinodun) for EDNS KeepAlive.
197 - Sort out test runs when the build directory isn't the project
199 - Add config tcp-idle-timeout (default 30s). This applies to
200 client connections only; the timeout on TCP connections upstream
202 - Error if EDNS Keepalive received over UDP.
203 - Add edns-tcp-keepalive and edns-tcp-keepalive timeout options
204 and implement option in client responses.
205 - Correct and expand manual page entries for keepalive and idle timeout.
206 - Implement progressive backoff of TCP idle/keepalive timeout.
207 - Fix 'make depend' to work when build dir is not project root.
208 - Add delay parameter to streamtcp, -d secs.
209 To be used when testing idle timeout.
210 - From Wouter: make depend, the dependencies in the patches did not
211 apply cleanly. Also remade yacc and lex.
212 - Fix mesh.c incompatible pointer pass.
213 - Please doxygen so it passes.
214 - Fix #4139: Fix unbound-host leaks memory on ANY.
217 - Fix #4136: insufficiency from mismatch of FLEX capability between
218 released tarball and build host.
221 - Fix man page, say that chroot is enabled by default.
224 - Fix #4135: 64-bit Windows Installer Creates Entries Under The
225 Wrong Registry Key, reported by Brian White.
228 - Fix use-systemd readiness signalling, only when use-systemd is yes
229 and not in signal handler.
232 - Fix #4130: print text describing -dd and unbound-checkconf on
233 config file read error at startup, the errors may have been moved
234 away by the startup process.
235 - Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared.
238 - Fix #4129 unbound-control error message with wrong cert permissions
242 - Fix #4127 unbound -h does not list -p help.
243 - Print error if SSL name verification configured but not available
245 - Fix that ratelimit and ip-ratelimit are applied after reload of
247 - Resize ratelimit and ip-ratelimit caches if changed on reload.
250 - Fix qname minimisation NXDOMAIN validation lookup failures causing
251 error_supers assertion fails.
252 - Squelch can't bind socket errors with Permission denied unless
253 verbosity is 4 or higher, for UDP outgoing sockets.
256 - Fix to improve systemd socket activation code file descriptor
258 - Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more
259 easily changed to adjust default rtt assumptions.
262 - Note in documentation that the cert name match code needs
263 OpenSSL 1.1.0 or later to be enabled.
266 - Fix documentation ambiguity for tls-win-cert in tls-upstream and
267 forward-tls-upstream docs.
269 - Note RFC8162 support. SMIMEA record type can be read in by the
271 - Fix round robin for failed addresses with prefer-ip6: yes
274 - Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass
275 if DNSSEC is not enabled. New option -R allows fallback from
276 resolv.conf to direct queries.
279 - Better documentation for unblock-lan-zones and insecure-lan-zones
281 - Fix permission denied printed for auth zone probe random port nrs.
284 - Fix checking for libhiredis printout in configure output.
285 - Fix typo on man page in ip-address description.
286 - Update libunbound/python/examples/dnssec_test.py example code to
287 also set the 20326 trust anchor for the root in the example code.
290 - dns64-ignore-aaaa: config option to list domain names for which the
291 existing AAAA is ignored and dns64 processing is used on the A
295 - num.queries.tls counter for queries over TLS.
296 - log port number with err_addr logs.
299 - #4109: Fix that package config depends on python unconditionally.
300 - Patch, do not export python from pkg-config, from Petr Menšík.
303 - Partial fix for permission denied on IPv6 address on FreeBSD.
304 - Fix that auth-zone master reply with current SOA serial does not
305 stop scan of masters for an updated zone.
306 - Fix that auth-zone does not start the wait timer without checking
307 if the wait timer has already been started.
310 - #4108: systemd reload hang fix.
311 - Fix usage printout for unbound-host, hostname has to be last
312 argument on BSDs and Windows.
315 - Fix for unbound-control on Windows and set TCP socket parameters
317 This fix is part of 1.7.3.
318 - Windows example service.conf edited with more windows specific
320 - Fix windows unbound-control no cert bad file descriptor error.
321 This fix is part of 1.7.3.
324 - Fix that control-use-cert: no works for 127.0.0.1 to disable certs.
325 This fix is part of 1.7.3rc2.
326 - Fix unbound-checkconf for control-use-cert.
327 This fix is part of 1.7.3.
332 - unbound-control auth_zone_reload _zone_ option rereads the zonefile.
333 - unbound-control auth_zone_transfer _zone_ option starts the probe
334 sequence for a master to transfer the zone from and transfers when
335 a new zone version is available.
338 - #4103: Fix that auth-zone does not insist on SOA record first in
339 file for url downloads.
340 - Fix that first control-interface determines if TLS is used. Warn
341 when IP address interfaces are used without TLS.
342 - Fix nettle compile.
345 - Don't count CNAME response types received during qname minimisation as
349 - #4102 for NSD, but for Unbound. Named unix pipes do not use
350 certificate and key files, access can be restricted with file and
351 directory permissions. The option control-use-cert is no longer
352 used, and ignored if found in unbound.conf.
353 - Rename tls-additional-ports to tls-additional-port, because every
355 - Fix buffer size warning in unit test.
356 - remade dependencies in the Makefile.
359 - Patch to fix openwrt for mac os build darwin detection in configure.
362 - Fix crash if ratelimit taken into use with unbound-control
363 instead of with unbound.conf.
366 - Fix deadlock caused by incoming notify for auth-zone.
367 - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018,
368 trunk is 1.7.3 in development from this point.
369 - #4100: Fix stub reprime when it becomes useless.
372 - Rename additional-tls-port to tls-additional-ports.
373 The older name is accepted for backwards compatibility.
376 - Patch from Syzdek: Add ability to ignore RD bit and treat all
377 requests as if the RD bit is set.
380 - in compat/arc4random call getentropy_urandom when getentropy fails
382 - Fix that fallback for windows port.
385 - Fix windows tcp and tls spin on events.
386 - Add routine from getdns to add windows cert store to the SSL_CTX.
387 - tls-win-cert option that adds the system certificate store for
388 authenticating DNS-over-TLS connections. It can be used instead
389 of the tls-cert-bundle option, or with it to add certificates.
392 - For TCP and TLS connections that don't establish, perform address
393 update in infra cache, so future selections can exclude them.
394 - Fix that tcp sticky events are removed for closed fd on windows.
395 - Fix close events for tcp only.
398 - Fix that libunbound can do DNS-over-TLS, when configured.
399 - Fix that windows unbound service can use DNS-over-TLS.
400 - unbound-host initializes ssl (for potential DNS-over-TLS usage
401 inside libunbound), when ssl upstream or a cert-bundle is configured.
404 - Use accept4 to speed up incoming TCP (and TLS) connections,
405 available on Linux, FreeBSD and OpenBSD.
408 - Qname minimisation default changed to yes.
411 - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand.
414 - Fix contrib/libunbound.pc for libssl libcrypto references,
415 from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914
418 - Fix windows to not have sticky TLS events for TCP.
419 - Fix read of DNS over TLS length and data in one read call.
420 - Fix mesh state assertion failure due to callback removal.
423 - Fix that configure --with-libhiredis also turns on cachedb.
424 - Fix gcc 8 buffer warning in testcode.
425 - Fix function type cast warning in libunbound context callback type.
428 - Fix fail to reject dead peers in forward-zone, with ssl-upstream.
431 - Fix that unbound-control reload frees the rrset keys and returns
432 the memory pages to the system.
434 30 April 2018: Wouter
435 - Fix spelling error in man page and note defaults as no instead of
438 26 April 2018: Wouter
439 - Fix for crash in daemon_cleanup with dnstap during reload,
440 from Saksham Manchanda.
441 - Also that for dnscrypt.
442 - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk
443 is from here 1.7.2 in development.
446 - Fix memory leak when caching wildcard records for aggressive NSEC use
448 24 April 2018: Wouter
449 - Fix contrib/fastrpz.patch for this release.
450 - Fix auth https for libev.
453 - Added root-key-sentinel support
455 23 April 2018: Wouter
456 - makedist uses bz2 for expat code, instead of tar.gz.
457 - Fix #4092: libunbound: use-caps-for-id lacks colon in
459 - auth zone http download stores exact copy of downloaded file,
460 including comments in the file.
461 - Fix sldns parse failure for CDS alternate delete syntax empty hex.
462 - Attempt for auth zone fix; add of callback in mesh gets from
463 callback does not skip callback of result.
464 - Fix cname classification with qname minimisation enabled.
465 - list_auth_zones unbound-control command.
467 20 April 2018: Wouter
468 - man page documentation for dns-over-tls forward-addr '#' notation.
469 - removed free from failed parse case.
470 - Fix #4091: Fix that reload of auth-zone does not merge the zonefile
471 with the previous contents.
472 - Delete auth zone when removed from config.
474 19 April 2018: Wouter
475 - Can set tls authentication with forward-addr: IP#tls.auth.name
476 And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem".
477 such as forward-addr: 9.9.9.9@853#dns.quad9.net or
478 1.1.1.1@853#cloudflare-dns.com
479 - Fix #658: unbound using TLS in a forwarding configuration does not
480 verify the server's certificate (RFC 8310 support).
481 - For addr with #authname and no @port notation, the default is 853.
483 18 April 2018: Wouter
484 - Fix auth-zone retry timer to be on schedule with retry timeout,
485 with backoff. Also time a refresh at the zone expiry.
487 17 April 2018: Wouter
488 - auth zone notify work.
489 - allow-notify: config statement for auth-zones.
490 - unit test for allow-notify
492 16 April 2018: Wouter
493 - Fix auth zone target lookup iterator.
494 - auth zone notify with prefix
495 - auth zone notify work.
497 13 April 2018: Wouter
498 - Fix for max include depth for authzones.
499 - Fix memory free on fail for $INCLUDE in authzone.
500 - Fix that an internal error to look up the wrong rr type for
501 auth zone gets stopped, before trying to send there.
502 - auth zone notify work.
505 - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN
508 10 April 2018: Wouter
509 - documentation for low-rtt and low-rtt-pct.
510 - auth zone notify work.
513 - Fix that flush_zone sets prefetch ttl expired, so that with
514 serve-expired enabled it'll start prefetching those entries.
515 - num.query.authzone.up and num.query.authzone.down statistics counters.
516 - Fix downstream auth zone, only fallback when auth zone fails to
517 answer and fallback is enabled.
518 - Accept both option names with and without colon for get_option
520 - low-rtt and low-rtt-pct in unbound.conf enable the server selection
521 of fast servers for some percentage of the time.
524 - Combine write of tcp length and tcp query for dns over tls.
525 - nitpick fixes in example.conf.
526 - Fix above stub queries for type NS and useless delegation point.
527 - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3
528 tls_choose_sigalg routine does not allow the ciphers for the pipe,
533 - Fix #4043: make test fails due to v6 presentation issue in macOS.
534 - Fix unable to resolve after new WLAN connection, due to auth-zone
535 failing with a forwarder set. Now, auth-zone is only used for
536 answers (not referrals) when a forwarder is set.
539 - Check "result" in dup_all(), by Florian Obser.
542 - Fix unbound-control get_option aggressive-nsec
545 - Do not use cached NSEC records to generate negative answers for
546 domains under DNSSEC Negative Trust Anchors.
548 19 March 2018: Wouter
551 16 March 2018: Wouter
552 - corrected a minor typo in the changelog.
553 - move htobe64/be64toh portability code to cachedb.c.
555 15 March 2018: Wouter
556 - Add --with-libhiredis, unbound support for a new cachedb backend
557 that uses a Redis server as the storage. This implementation
558 depends on the hiredis client library (https://redislabs.com/lp/hiredis/).
559 And unbound should be built with both --enable-cachedb and
560 --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h
561 should exist). Patch from Jinmei Tatuya (Infoblox).
562 - Fix #3817: core dump happens in libunbound delete, when queued
563 servfail hits deleted message queue.
564 - Create additional tls service interfaces by opening them on other
565 portnumbers and listing the portnumbers as additional-tls-port: nr.
567 13 March 2018: Wouter
568 - Fix typo in documentation.
569 - Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually
570 flushed with serve-expired on.
572 12 March 2018: Wouter
573 - Added documentation for aggressive-nsec: yes.
574 - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk
575 now has 1.7.1 in development.
576 - Fix #3727: Protocol name is TLS, options have been renamed but
577 documentation is not consistent.
578 - Check IXFR start serial.
581 - Fix #3598: Fix swig build issue on rhel6 based system.
582 configure --disable-swig-version-check stops the swig version check.
588 - Fixed contrib/fastrpz.patch, even though this already applied
589 cleanly for me, now also for others.
590 - patch to log creates keytag queries, from A. Schulze.
591 - patch suggested by Debian lintian: allow to -> allow one to, from
593 - Attempt to remove warning about trailing whitespace.
596 - Reverted fix for #3512, this may not be the best way forward;
597 although it could be changed at a later time, to stay similar to
598 other implementations.
599 - svn trunk contains 1.7.0, this is the number for the next release.
600 - Fix for windows compile.
604 - Fix to check define of DSA for when openssl is without deprecated.
606 - Fix #3582: Squelch address already in use log when reuseaddr option
607 causes same port to be used twice for tcp connections.
609 27 February 2018: Wouter
610 - Fixup contrib/fastrpz.patch so that it applies.
611 - Fix compile without threads, and remove unused variable.
612 - Fix compile with staticexe and python module.
613 - Fix nettle compile.
615 22 February 2018: Ralph
616 - Save wildcard RRset from answer with original owner for use in
619 21 February 2018: Wouter
620 - Fix #3512: unbound incorrectly reports SERVFAIL for CAA query
621 when there is a CNAME loop.
622 - Fix validation for CNAME loops. When it detects a cname loop,
623 by finding the cname, cname in the existing list, it returns
624 the partial result with the validation result up to then.
625 - more robust cachedump rrset routine.
627 19 February 2018: Wouter
628 - Fix #3505: Documentation for default local zones references
630 - Fix #3494: local-zone noview can be used to break out of the view
631 to the global local zone contents, for queries for that zone.
632 - Fix for more maintainable code in localzone.
634 16 February 2018: Wouter
635 - Fixes for clang static analyzer, the missing ; in
636 edns-subnet/addrtree.c after the assert made clang analyzer
637 produce a failure to analyze it.
639 13 February 2018: Ralph
640 - Aggressive NSEC tests
642 13 February 2018: Wouter
643 - tls-cert-bundle option in unbound.conf enables TLS authentication.
646 12 February 2018: Wouter
647 - Unit test for auth zone https url download.
649 12 February 2018: Ralph
650 - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test)
651 - Processed aggressive NSEC code review remarks Wouter
653 8 February 2018: Ralph
654 - Aggressive use of NSEC implementation. Use cached NSEC records to
655 generate NXDOMAIN, NODATA and positive wildcard answers.
657 8 February 2018: Wouter
659 - auth zone url config.
661 5 February 2018: Wouter
662 - Fix #3451: dnstap not building when you have a separate build dir.
663 And removed protoc warning, set dnstap.proto syntax to proto2.
664 - auth-zone provides a way to configure RFC7706 from unbound.conf,
665 eg. with auth-zone: name: "." for-downstream: no for-upstream: yes
666 fallback-enabled: yes and masters or a zonefile with data.
668 2 February 2018: Wouter
669 - Fix unfreed locks in log and arc4random at exit of unbound.
670 - unit test with valgrind
671 - Fix lock race condition in dns cache dname synthesis.
672 - lock subnet new item before insertion to please checklocks,
673 no modification of critical regions outside of lock region.
675 1 February 2018: Wouter
676 - fix unaligned structure making a false positive in checklock
679 29 January 2018: Ralph
680 - Use NSEC with longest ce to prove wildcard absence.
681 - Only use *.ce to prove wildcard absence, no longer names.
683 25 January 2018: Wouter
684 - ltrace.conf file for libunbound in contrib.
686 23 January 2018: Wouter
687 - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file
688 for startup scripts to get the full pathname(s) of anchor file(s).
689 - Print fatal errors about remote control setup before log init,
690 so that it is printed to console.
692 22 January 2018: Wouter
693 - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is
694 also recognized and means the same. Also for tls-port,
695 tls-service-key, tls-service-pem, stub-tls-upstream and
696 forward-tls-upstream.
697 - Fix #3397: Fix that cachedb could return a partial CNAME chain.
698 - Fix #3397: Fix that when the cache contains an unsigned DNAME in
699 the middle of a cname chain, a result without the DNAME could
702 19 January 2018: Wouter
703 - tag 1.6.8 for release with CVE fix.
704 - trunk has 1.6.9 with fix and previous commits.
705 - patch for CVE-2017-15105: vulnerability in the processing of
706 wildcard synthesized NSEC records.
708 - make depend: code dependencies updated in Makefile.
710 4 January 2018: Ralph
711 - Copy query and correctly set flags on REFUSED answers when cache
712 snooping is not allowed.
714 3 January 2018: Ralph
715 - Fix queries being leaked above stub when refetching glue.
717 2 January 2017: Wouter
718 - Fix that DS queries with referral replies are answered straight
719 away, without a repeat query picking the DS from cache.
720 The correct reply should have been an answer, the reply is fixed
721 by the scrubber to have the answer in the answer section.
722 - Remove clang optimizer disable,
723 Fix that expiration date checks don't fail with clang -O2.
725 15 December 2017: Wouter
726 - Fix timestamp failure because of clang optimizer failure, by
727 disabling -O2 when the compiler --version is clang.
729 - Also disable -flto for clang, to make incep-expi signature check
732 12 December 2017: Ralph
733 - Fix qname-minimisation documentation (A QTYPE, not NS)
735 12 December 2017: Wouter
736 - authzone work, transfer connect.
738 7 December 2017: Ralph
739 - Check whether --with-libunbound-only is set when using --with-nettle
742 4 December 2017: Wouter
743 - Fix link failure on OmniOS.
745 1 December 2017: Wouter
748 30 November 2017: Wouter
749 - Fix #3299 - forward CNAME daisy chain is not working
751 14 November 2017: Wouter
752 - Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is
753 set for stub zone. It no longer searches for DNSSEC information.
754 - auth xfer work on probe timer and lookup.
756 13 November 2017: Wouter
757 - Fix #2801: Install libunbound.pc.
758 - Fix qname minimisation to send AAAA queries at zonecut like type A.
759 - reverted AAAA change.
761 7 November 2017: Wouter
762 - Fix #2492: Documentation libunbound.
764 3 November 2017: Wouter
765 - Fix #2362: TLS1.3/openssl-1.1.1 not working.
766 - Fix #2034 - Autoconf and -flto.
767 - Fix #2141 - for libsodium detect lack of entropy in chroot, print
770 2 November 2017: Wouter
771 - Fix #1913: ub_ctx_config is under circumstances thread-safe.
772 - make ip-transparent option work on OpenBSD.
774 31 October 2017: Wouter
775 - Document that errno is left informative on libunbound config read
780 25 October 2017: Ralph
781 - Fixed libunbound manual typo.
782 - Fix #1949: [dnscrypt] make provider name mismatch more obvious.
783 - Fix #2031: Double included headers
785 24 October 2017: Ralph
786 - Update B root ipv4 address.
788 19 October 2017: Wouter
789 - authzone work, probe timer setup.
791 18 October 2017: Wouter
792 - lint for recent authzone commit.
794 17 October 2017: Wouter
795 - Fix #1749: With harden-referral-path: performance drops, due to
796 circular dependency in NS and DS lookups.
797 - [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert
799 - [dnscrypt] introduce dnscrypt-provider-cert-rotated option,
801 This option allows handling multiple cert/key pairs while only
802 distributing some of them.
803 In order to reliably match a client magic with a given key without
804 strong assumption as to how those were generated, we need both key and
805 cert. Likewise, in order to know which ES version should be used.
806 On the other hand, when rotating a cert, it can be desirable to only
807 serve the new cert but still be able to handle clients that are still
808 using the old certs's public key.
809 The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not
810 publish the cert as part of the DNS's provider_name's TXT answer.
811 - Better documentation for cache-max-negative-ttl.
812 - Work on local root zone code.
814 10 October 2017: Wouter
816 - trunk has version 1.6.8.
818 6 October 2017: Wouter
819 - Fix spelling in unbound-control man page.
821 5 October 2017: Wouter
822 - Fix trust-anchor-signaling works in libunbound.
823 - Fix some more crpls in testdata for different signaling default.
826 5 October 2017: Ralph
827 - Set trust-anchor-signaling default to yes
828 - Use RCODE from A query on DNS64 synthesized answer.
830 2 October 2017: Wouter
831 - Fix param unused warning for windows exportsymbol compile.
833 25 September 2017: Ralph
834 - Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
837 21 September 2017: Ralph
838 - Log name of looping module
840 19 September 2017: Wouter
841 - use a cachedb answer even if it's "expired" when serve-expired is yes
842 (patch from Jinmei Tatuya).
843 - trigger refetching of the answer in that case (this will bypass
845 - allow storing a 0-TTL answer from cachedb in the in-memory message
846 cache when serve-expired is yes
847 - Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
849 18 September 2017: Ralph
850 - Fix #1400: allowing use of global cache on ECS-forwarding unless
853 18 September 2017: Wouter
854 - tag 1.6.6 (is 1.6.6rc2)
855 - Fix that looping modules always stop the query, and don't pass
857 - Fix #1435: Please allow UDP to be disabled separately upstream and
859 - Fix #1440: [dnscrypt] client nonce cache.
861 15 September 2017: Wouter
862 - Fix unbound-host to report error for DNSSEC state of failed lookups.
863 - Spelling fixes, from Josh Soref.
865 13 September 2017: Wouter
866 - tag 1.6.6rc2, became 1.6.6 on 18 sep. trunk 1.6.7 in development.
868 12 September 2017: Wouter
869 - Add dns64 for client-subnet in unbound-checkconf.
871 4 September 2017: Ralph
872 - Fix #1412: QNAME minimisation strict mode not honored
873 - Fix #1434: Fix windows openssl 1.1.0 linking.
875 4 September 2017: Wouter
877 - makedist fix for windows binaries, with openssl 1.1.0 windres fix,
878 and expat 2.2.4 install target fix.
880 1 September 2017: Wouter
881 - Recommend 1472 buffer size in unbound.conf
883 31 August 2017: Wouter
884 - Fix #1424: cachedb:testframe is not thread safe.
885 - For #1417: escape ; in dnscrypt tests.
886 - but reverted that, tests fails with that escape.
887 - Fix #1417: [dnscrypt] shared secret cache counters, and works when
888 dnscrypt is not enabled. And cache size configuration option.
890 - Fix #1418: [ip ratelimit] initialize slabhash using
893 30 August 2017: Wouter
894 - updated contrib/fastrpz.patch to apply with configparser changes.
895 - Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
897 29 August 2017: Wouter
898 - Fix #1414: fix segfault on parse failure and log_replies.
899 - zero qinfo in handle_request, this zeroes local_alias and also the
901 - new keys and certs for dnscrypt tests.
902 - fixup WKS test on buildhost without servicebyname.
904 28 August 2017: Wouter
905 - Fix #1415: patch to free dnscrypt environment on reload.
906 - iana portlist update
907 - Fix #1415: [dnscrypt] shared secret cache, patch from
909 - Small fixes for the shared secret cache patch.
910 - Fix WKS records on kvm autobuild host, with default protobyname
911 entries for udp and tcp.
913 23 August 2017: Wouter
914 - Fix #1407: Add ECS options check to unbound-checkconf.
916 - Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
919 22 August 2017: Wouter
920 - Fix install of trust anchor when two anchors are present, makes both
921 valid. Checks hash of DS but not signature of new key. This fixes
922 the root.key file if created when unbound is installed between
923 sep11 and oct11 2017.
924 - tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix).
925 - trunk version 1.6.6 in development.
926 - Fix issue on macOX 10.10 where TCP fast open is detected but not
927 implemented causing TCP to fail. The fix allows fallback to regular
928 TCP in this case and is also more robust for cases where connectx()
929 fails for some reason.
930 - Fix #1402: squelch invalid argument error for fd_set_block on windows.
932 10 August 2017: Wouter
933 - Patch to show DNSCrypt status in help output, from Carsten
936 8 August 2017: Wouter
937 - Fix #1398: make cachedb secret configurable.
938 - Remove spaces from Makefile.
940 7 August 2017: Wouter
941 - Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
944 - Remove unused iter_env member (ip6arpa_dname)
945 - Do not reset rrset.bogus stats when called using stats_noreset.
946 - Added stats for queries that have been ratelimited by domain
948 - Do not add rrset_bogus and query ratelimiting stats per thread, these
949 module stats are global.
951 3 August 2017: Wouter
952 - Fix #1394: mix of serve-expired and response-ip could cause a crash.
955 - upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
956 config.sub(2016-09-05).
957 - annotate case statement fallthrough for gcc 7.1.1.
958 - flex output from flex 2.6.1.
959 - snprintf of thread number does not warn about truncated string.
960 - squelch TCP fast open error on FreeBSD when kernel has it disabled,
961 unless verbosity is high.
962 - remove warning from windows compile.
963 - Fix compile with libnettle
964 - Fix DSA configure switch (--disable dsa) for libnettle and libnss.
965 - Fix #1365: Add Ed25519 support using libnettle.
966 - iana portlist update
969 - Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
970 - Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
971 With the -p option unbound does not create a pidfile.
974 - Fix #1344: RFC6761-reserved domains: test. and invalid.
975 - Redirect all localhost names to localhost address for RFC6761.
978 - Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
979 - Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists)..
982 - Fix 1332: Bump verbosity of failed chown'ing of the control socket.
985 - Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
987 - Fix #1331: libunbound segfault in threaded mode when context is
989 - Fix pythonmod link line option flag.
990 - Fix openssl 1.1.0 load of ssl error strings from ssl init.
993 - Fix python example0 return module wait instead of error for pass.
994 - iana portlist update
995 - enhancement for hardened-tls for DNS over TLS. Removed duplicated
999 - Tag 1.6.4 is created with the 1.6.4rc2 contents.
1000 - Trunk contains 1.6.5, with changes from 26, 27 june.
1001 - Remove signed unsigned warning from authzone.
1002 - Fix that infra cache host hash does not change after reconfig.
1004 26 June 2017: Wouter
1006 Better fixup of dnscrypt_cert_chacha test for different escapes.
1007 - First fix for zero b64 and hex text zone format in sldns.
1008 - unbound-control dump_infra prints port number for address if not 53.
1010 23 June 2017: Wouter
1011 - (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
1013 22 June 2017: Wouter
1017 - Added fastrpz patch to contrib
1019 21 June 2017: Wouter
1020 - Fix #1316: heap read buffer overflow in parse_edns_options.
1022 20 June 2017: Wouter
1023 - Fix warning in pythonmod under clang compiler.
1028 - Fix #1277: disable domain ratelimit by setting value to 0.
1030 16 June 2017: Wouter
1031 - Fix #1301: memory leak in respip and tests.
1032 - Free callback in edns-subnetmod on exit and restart.
1033 - Fix memory leak in sldns_buffer_new_frm_data.
1034 - Fix memory leak in dnscrypt config read.
1035 - Fix dnscrypt chacha cert support ifdefs.
1036 - Fix dnscrypt chacha cert unit test escapes in grep.
1037 - Remove asynclook tests that cause test and purifier problems.
1038 - Fix to unlock view in view test.
1040 15 June 2017: Wouter
1041 - Fix stub zone queries leaking to the internet for
1042 harden-referral-path ns checks.
1043 - Fix query for refetch_glue of stub leaking to internet.
1045 13 June 2017: Wouter
1046 - Fix #1279: Memory leak on reload when python module is enabled.
1047 - Fix #1280: Unbound fails assert when response from authoritative
1048 contains malformed qname. When 0x20 caps-for-id is enabled, when
1049 assertions are not enabled the malformed qname is handled correctly.
1050 - 1.6.3 tag created, with only #1280 fix, trunk is 1.6.4 development.
1051 - More fixes in depth for buffer checks in 0x20 qname checks.
1053 12 June 2017: Wouter
1054 - Fix #1278: Incomplete wildcard proof.
1057 - Added domain name based ECS whitelist.
1060 - Detect chacha for dnscrypt at configure time.
1061 - dnscrypt unit tests with chacha.
1064 - Fix that unbound-control can set val_clean_additional and val_permissive_mode.
1065 - Add dnscrypt XChaCha20 tests.
1068 - Add an explicit type cast for TCP FASTOPEN fix.
1069 - renumbering B-Root's IPv6 address to 2001:500:200::b.
1070 - Fix #1275: cached data in cachedb is never used.
1071 - Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
1074 - Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
1075 (from Manu Bretelle).
1078 - Fix fastopen EPIPE fallthrough to perform connect.
1081 - Also use global local-zones when there is a matching view that does
1082 not have any local-zone specified.
1085 - Fix #1273: cachedb.c doesn't compile with -Wextra.
1086 - If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
1089 - Fix #1269: inconsistent use of built-in local zones with views.
1090 - Add defaults for new local-zone trees added to views using
1094 - Support for openssl EVP_DigestVerify.
1095 - Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
1098 - Fix assertion for low buffer size and big edns payload when worker
1102 - Added redirect-bogus.patch to contrib directory.
1105 - Fix #1270: unitauth.c doesn't compile with higher warning level
1107 - exec_prefix is by default equal to prefix.
1108 - printout localzone for duplicate local-zone warnings.
1111 - authzone cname chain, no rrset duplicates, wildcard doesn't change
1112 rrsets added for cname chain.
1115 - first services/authzone check in, it compiles and reads and writes
1117 - iana portlist update
1120 - Fix #1268: SIGSEGV after log_reopen.
1123 - Fix #1265 to use /bin/kill.
1124 - Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
1125 and compatibility with BoringSSL.
1128 - Fix #1265: contrib/unbound.service contains hardcoded path.
1131 - Use qstate's region for IPSECKEY rrset (ipsecmod).
1134 - Implemented opportunistic IPsec support module (ipsecmod).
1135 - Some whitespace fixup.
1138 - updated dependencies in the makefile.
1139 - document trust-anchor-signaling in example config file.
1140 - updated configure, dependencies and flex output.
1141 - better module memory lookup, fix of unbound-control shm names for
1142 module memory printout of statistics.
1143 - Fix type AVC sldns rrdef.
1146 - Adjust servfail by iterator to not store in cache when serve-expired
1147 is enabled, to avoid overwriting useful information there.
1148 - Fix queries for nameservers under a stub leaking to the internet.
1151 - Add 'c' to getopt() in testbound.
1152 - iana portlist update
1155 - Fix tcp-mss failure printout text.
1156 - Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
1157 connect limited tcp connections. With the option tcp connections
1158 can share the same source port (for different destinations).
1161 - Added mesh_add_sub to add detached mesh entries.
1162 - Use mesh_add_sub for key tag signaling query.
1165 - Added test for leak of stub information.
1166 - Fix sldns wire2str printout of RR type CAA tags.
1167 - Fix sldns int16_data parse.
1168 - Fix sldns parse and printout of TSIG RRs.
1169 - sldns SMIMEA and AVC definitions, same as getdns definitions.
1172 - Fix #1259: "--disable-ecdsa" argument overwritten
1173 by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
1174 - iana portlist update
1175 - Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
1176 and fix that 64bit getting installed in C:\Program Files (x86).
1178 26 April 2017: Ralph
1179 - Implemented trust anchor signaling using key tag query.
1181 26 April 2017: Wouter
1182 - Based on #1257: check parse limit before t increment in sldns RR
1183 string parse routine.
1185 24 April 2017: Wouter
1186 - unbound-checkconf -o allows query of dnstap config variables.
1187 Also unbound-control get_option. Also for dnscrypt.
1188 - trunk contains 1.6.3 version number (changes from 1.6.2 back from
1189 when the 1.6.2rc1 tag has been created).
1191 21 April 2017: Ralph
1192 - Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
1193 - iana portlist update
1195 18 April 2017: Ralph
1196 - Fix #1252: more indentation inconsistencies.
1197 - Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
1199 13 April 2017: Ralph
1200 - Added ECS unit test (from Manu Bretelle).
1201 - ECS documentation fix (from Manu Bretelle).
1203 13 April 2017: Wouter
1204 - Fix #1250: inconsistent indentation in services/listen_dnsport.c.
1206 - (for 1.6.3:) unbound.h exports the shm stats structures. They use
1207 type long long and no ifdefs, and ub_ before the typenames.
1209 12 April 2017: Wouter
1210 - subnet mem value is available in shm, also when not enabled,
1211 to make the struct easier to memmap by other applications,
1212 independent of the configuration of unbound.
1214 12 April 2017: Ralph
1215 - Fix #1247: unbound does not shorten source prefix length when
1217 - Properly check for allocation failure in local_data_find_tag_datas.
1218 - Fix #1249: unbound doesn't return FORMERR to bogus ECS.
1219 - Set SHM ECS memory usage to 0 when module not loaded.
1221 11 April 2017: Ralph
1222 - Display ECS module memory usage.
1224 10 April 2017: Wouter
1225 - harden-algo-downgrade: no also makes unbound more lenient about
1226 digest algorithms in DS records.
1228 10 April 2017: Ralph
1229 - Remove ECS option after REFUSED answer.
1230 - Fix small memory leak in edns_opt_copy_alloc.
1231 - Respip dereference after NULL check.
1232 - Zero initialize addrtree allocation.
1233 - Use correct identifier for SHM destroy.
1235 7 April 2017: George
1236 - Fix pythonmod for cb changes.
1237 - Some whitespace fixup.
1240 - Unlock view in respip unit test
1243 - Generalise inplace callback (de)registration
1244 - (de)register inplace callbacks for module id
1245 - No unbound-control set_option for ECS options
1246 - Deprecated client-subnet-opcode config option
1247 - Introduced client-subnet-always-forward config option
1248 - Changed max-client-subnet-ipv6 default to 56 (as in RFC)
1249 - Removed extern ECS config options
1250 - module_restart_next now calls clear on all following modules
1251 - Also create ECS module qstate on module_event_pass event
1252 - remove malloc from inplace_cb_register
1254 6 April 2017: Wouter
1255 - Small fixup for documentation.
1256 - iana portlist update
1257 - Fix respip for braces when locks arent used.
1258 - Fix pythonmod for cb changes.
1260 4 April 2017: Wouter
1261 - Fix #1244: document that use of chroot requires trust anchor file to
1263 - iana portlist update
1266 - Do not add current time twice to TTL before ECS cache store.
1267 - Do not touch rrset cache after ECS cache message generation.
1268 - Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode.
1270 3 April 2017: Wouter
1271 - Fix #1217: Add metrics to unbound-control interface showing
1272 crypted, cert request, plaintext and malformed queries (from
1274 - iana portlist update
1276 27 March 2017: Wouter
1277 - Remove (now unused) event2 include from dnscrypt code.
1279 24 March 2017: George
1280 - Fix to prevent non-referal query from being cached as referal when the
1281 no_cache_store flag was set.
1283 23 March 2017: Wouter
1284 - Fix #1239: configure fails to find python distutils if python
1287 22 March 2017: Wouter
1288 - Fix #1238: segmentation fault when adding through the remote
1289 interface a per-view local zone to a view with no previous
1290 (configured) local zones.
1291 - Fix #1229: Systemd service sandboxing, options in wrong sections.
1293 21 March 2017: Ralph
1294 - Merge EDNS Client subnet implementation from feature branch into main
1295 branch, using new EDNS processing framework.
1297 21 March 2017: Wouter
1298 - Fix doxygen for dnscrypt files.
1300 20 March 2017: Wouter
1301 - #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then
1302 enabled in the config file from Manu Bretelle.
1303 - make depend, autoconf, remove warnings about statement before var.
1304 - lru_demote and lruhash_insert_or_retrieve functions for getdns.
1305 - fixup for lruhash (whitespace and header file comment).
1308 17 March 2017: Wouter
1309 - Patch for view functionality for local-data-ptr from Björn Ketelaars.
1310 - Fix #1237 - Wrong resolving in chain, for norec queries that get
1313 16 March 2017: Wouter
1314 - Fix that SHM is not inited if not enabled.
1315 - Add trustanchor.unbound CH TXT that gets a response with a number
1316 of TXT RRs with a string like "example.com. 2345 1234" with
1317 the trust anchors and their keytags.
1318 - Fix that looped DNAMEs do not cause unbound to spend effort.
1319 - trustanchor tags are sorted. reusable routine to fetch taglist.
1321 13 March 2017: Wouter
1322 - testbound understands Deckard MATCH rcode question answer commands.
1323 - Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead
1324 of YXDOMAIN + query loop, reported by Petr Spacek.
1326 10 March 2017: Wouter
1327 - Fix #1234: shortening DNAME loop produces duplicate DNAME records
1330 9 March 2017: Wouter
1331 - --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and
1332 DS records. NSEC3 is not disabled.
1333 - fake-sha1 test option; print warning if used. To make unit tests.
1334 - unbound-control list local zone and data commands listed in the
1337 8 March 2017: Wouter
1338 - make depend for build dependencies.
1339 - swig version 2.0.1 required.
1340 - fix enum conversion warnings
1342 7 March 2017: Wouter
1343 - Fix #1230: swig version 2.0.0 is required for pythonmod, with
1344 1.3.40 it crashes when running repeatly unbound-control reload.
1345 - Response actions based on IP address from Jinmei Tatuya (Infoblox).
1347 6 March 2017: Wouter
1348 - Fix #1229: Systemd service sandboxing in contrib/unbound.service.
1349 - iana portlist update
1351 28 February 2017: Ralph
1352 - Fix testpkts.c, check if DO bit is set, not only if there is an OPT
1355 28 February 2017: Wouter
1356 - For #1227: if we have sha256, set the cipher list to have no
1359 27 February 2017: Wouter
1360 - Fix #1227: Fix that Unbound control allows weak ciphersuits.
1361 - Fix #1226: provide official 32bit binary for windows.
1363 24 February 2017: Wouter
1364 - include sys/time.h for new shm code on NetBSD.
1366 23 February 2017: Wouter
1367 - Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to
1369 - Patch from Luiz Fernando Softov for Stats Shared Memory.
1370 - unbound-control stats_shm command prints stats using shared memory,
1371 which uses less cpu.
1372 - make depend, autoconf, doxygen and lint fixed up.
1374 22 February 2017: Wouter
1375 - Fix #1224: Fix that defaults should not fall back to "Program Files
1376 (x86) if Unbound is 64bit by default on windows.
1378 21 February 2017: Wouter
1379 - iana portlist update
1381 16 February 2017: Wouter
1382 - sldns updated for vfixed and buffer resize indication from getdns.
1384 15 February 2017: Wouter
1385 - sldns has ED25519 and ED448 algorithm number and name for display.
1387 14 February 2017: Wouter
1388 - tag 1.6.1rc3. -- which became 1.6.1 on 21feb, trunk has 1.6.2
1390 13 February 2017: Wouter
1391 - Fix autoconf of systemd check for lack of pkg-config.
1393 10 February 2017: Wouter
1394 - Fix pythonmod for typedef changes.
1395 - Fix dnstap for warning of set but not used.
1398 9 February 2017: Wouter
1401 8 February 2017: Wouter
1402 - Fix for type name change and fix warning on windows compile.
1404 7 February 2017: Wouter
1405 - Include root trust anchor id 20326 in unbound-anchor.
1407 6 February 2017: Wouter
1408 - Fix compile on solaris of the fix to use $host detect.
1410 4 February 2017: Wouter
1411 - fix root_anchor test for updated icannbundle.pem lower certificates.
1413 26 January 2017: Wouter
1414 - Fix 1211: Fix can't enable interface-automatic if no IPv6 with
1415 more helpful error message.
1417 20 January 2017: Wouter
1418 - Increase MAX_MODULE to 16.
1420 19 January 2017: Wouter
1421 - Fix to Rename ub_callback_t to ub_callback_type, because POSIX
1422 reserves _t typedefs.
1423 - Fix to rename internally used types from _t to _type, because _t
1424 type names are reserved by POSIX.
1425 - iana portlist update
1427 12 January 2017: Wouter
1428 - Fix to also block meta types 128 through to 248 with formerr.
1429 - Fix #1206: Some view-related commands are missing from 'unbound-control -h'
1431 9 January 2017: Wouter
1432 - Fix #1202: Fix code comment that packed_rrset_data is not always
1435 6 January 2017: Wouter
1436 - Fix #1201: Fix missing unlock in answer_from_cache error condition.
1438 5 January 2017: Wouter
1439 - Fix to return formerr for queries for meta-types, to avoid
1440 packet amplification if this meta-type is sent on to upstream.
1441 - Fix #1184: Log DNS replies. This includes the same logging
1442 information that DNS queries and response code and response size,
1443 patch from Larissa Feng.
1444 - Fix #1187: Source IP rate limiting, patch from Larissa Feng.
1446 3 January 2017: Wouter
1447 - configure --enable-systemd and lets unbound use systemd sockets if
1448 you enable use-systemd: yes in unbound.conf.
1449 Also there are contrib/unbound.socket and contrib/unbound.service:
1450 systemd files for unbound, install them in /usr/lib/systemd/system.
1451 Contributed by Sami Kerola and Pavel Odintsov.
1452 - Fix reload chdir failure when also chrooted to that directory.
1454 2 January 2017: Wouter
1455 - Fix #1194: Cross build fails when $host isn't `uname` for getentropy.
1457 23 December 2016: Ralph
1458 - Fix #1190: Do not echo back EDNS options in local-zone error response.
1459 - iana portlist update
1461 21 December 2016: Ralph
1462 - Fix #1188: Unresolved symbol 'fake_dsa' in libunbound.so when built
1465 19 December 2016: Ralph
1466 - Fix #1191: remove comment about view deletion.
1468 15 December 2016: Wouter
1469 - iana portlist update
1470 - 64bit is default for windows builds.
1471 - Fix inet_ntop and inet_pton warnings in windows compile.
1473 14 December 2016: Wouter
1474 - Fix #1178: attempt to fix setup error at end, pop result values
1477 13 December 2016: Wouter
1478 - Fix #1182: Fix Resource leak (socket), at startup.
1479 - Fix unbound-control and ipv6 only.
1481 9 December 2016: Wouter
1482 - Fix #1176: stack size too small for Alpine Linux.
1484 8 December 2016: Wouter
1485 - Fix downcast warnings from visual studio in sldns code.
1486 - tag 1.6.0rc1 which became 1.6.0 on 15 dec, and trunk is 1.6.1.
1488 7 December 2016: Ralph
1489 - Add DSA support for OpenSSL 1.1.0
1490 - Fix remote control without cert for LibreSSL
1492 6 December 2016: George
1493 - Added generic EDNS code for registering known EDNS option codes,
1494 bypassing the cache response stage and uniquifying mesh states. Four EDNS
1495 option lists were added to module_qstate (module_qstate.edns_opts_*) to
1496 store EDNS options from/to front/back side.
1497 - Added two flags to module_qstate (no_cache_lookup, no_cache_store) that
1498 control the modules' cache interactions.
1499 - Added code for registering inplace callback functions. The registered
1500 functions can be called just before replying with local data or Chaos,
1501 replying from cache, replying with SERVFAIL, replying with a resolved
1502 query, sending a query to a nameserver. The functions can inspect the
1503 available data and maybe change response/query related data (i.e. append
1505 - Updated Python module for the above.
1506 - Updated Python documentation.
1508 5 December 2016: Ralph
1509 - Fix #1173: differ local-zone type deny from unset
1510 tag_actions element.
1512 5 December 2016: Wouter
1513 - Fix #1170: document that 'inform' local-zone uses local-data.
1515 1 December 2016: Ralph
1516 - hyphen as minus fix, by Andreas Schulze
1518 30 November 2016: Ralph
1519 - Added local-zones and local-data bulk addition and removal
1520 functionality in unbound-control (local_zones, local_zones_remove,
1521 local_datas and local_datas_remove).
1522 - iana portlist update
1524 29 November 2016: Wouter
1525 - version 1.6.0 is in the development branch.
1526 - braces in view.c around lock statements.
1528 28 November 2016: Wouter
1531 25 November 2016: Wouter
1532 - Fix that with openssl 1.1 control-use-cert: no uses less cpu, by
1533 using no encryption over the unix socket.
1535 22 Novenber 2016: Ralph
1536 - Make access-control-tag-data RDATA absolute. This makes the RDATA
1537 origin consistent between local-data and access-control-tag-data.
1538 - Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
1539 subdomain of the NSEC owner.
1540 - QNAME minimisation uses QTYPE=A, therefore always check cache for
1541 this type in harden-below-nxdomain functionality.
1542 - Added unit test for QNAME minimisation + harden below nxdomain
1545 22 November 2016: Wouter
1546 - iana portlist update.
1547 - Fix unit tests for DS hash processing for fake-dsa test option.
1548 - patch from Dag-Erling Smorgrav that removes code that relies
1551 21 November 2016: Wouter
1552 - Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
1553 Underneath" for the harden-below-nxdomain option.
1555 10 November 2016: Ralph
1556 - Fix #1155: test status code of unbound-control in 04-checkconf,
1557 not the status code from the tee command.
1559 4 November 2016: Ralph
1560 - Added stub-ssl-upstream and forward-ssl-upstream options.
1562 4 November 2016: Wouter
1563 - configure detects ssl security level API function in the autoconf
1564 manner. Every function on its own, so that other libraries (eg.
1565 LibreSSL) can develop their API without hindrance.
1566 - Fix #1154: segfault when reading config with duplicate zones.
1567 - Note that for harden-below-nxdomain the nxdomain must be secure,
1568 this means nsec3 with optout is insufficient.
1570 3 November 2016: Ralph
1571 - Set OpenSSL security level to 0 when using aNULL ciphers.
1573 3 November 2016: Wouter
1574 - .gitattributes line for githubs code language display.
1575 - log-identity: config option to set sys log identity, patch from
1576 "Robin H. Johnson" <robbat2@gentoo.org>
1578 2 November 2016: Wouter
1579 - iana portlist update.
1581 31 October 2016: Wouter
1582 - Fix failure to build on arm64 with no sbrk.
1583 - iana portlist update.
1585 28 October 2016: Wouter
1586 - Patch for server.num.zero_ttl stats for count of expired replies,
1587 from Pavel Odintsov.
1589 26 October 2016: Wouter
1590 - Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled
1591 with the undocumented switch 'fake-dsa'. It logs a warning.
1593 25 October 2016: Wouter
1594 - Fix #1134: unbound-control set_option -- val-override-date: -1 works
1595 immediately to ignore datetime, or back to 0 to enable it again.
1596 The -- is to ignore the '-1' as an option flag.
1598 24 October 2016: Wouter
1599 - serve-expired config option: serve expired responses with TTL 0.
1600 - g.root-servers.net has AAAA address.
1602 21 October 2016: Wouter
1603 - Ported tests for local_cname unit test to testbound framework.
1605 20 October 2016: Wouter
1606 - suppress compile warning in lex files.
1607 - init lzt variable, for older gcc compiler warnings.
1608 - fix --enable-dsa to work, instead of copying ecdsa enable.
1609 - Fix DNSSEC validation of query type ANY with DNAME answers.
1610 - Fixup query_info local_alias init.
1612 19 October 2016: Wouter
1613 - Fix #1130: whitespace in example.conf.in more consistent.
1615 18 October 2016: Wouter
1616 - Patch that resolves CNAMEs entered in local-data conf statements that
1617 point to data on the internet, from Jinmei Tatuya (Infoblox).
1618 - Removed patch comments from acllist.c and msgencode.c
1619 - Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf,
1620 from Jinmei Tatuya (Infoblox).
1621 - Fix #1125: unbound could reuse an answer packet incorrectly for
1622 clients with different EDNS parameters, from Jinmei Tatuya.
1623 - Fix #1118: libunbound.pc sets strange Libs, Libs.private values.
1624 - Added Requires line to libunbound.pc
1625 - Please doxygen by modifying mesh.h
1627 17 October 2016: Wouter
1628 - Re-fix #839 from view commit overwrite.
1629 - Fixup const void cast warning.
1631 12 October 2016: Ralph
1632 - Free view config elements.
1634 11 October 2016: Ralph
1635 - Added qname-minimisation-strict config option.
1636 - iana portlist update.
1637 - fix memoryleak logfile when in debug mode.
1639 5 October 2016: Ralph
1640 - Added views functionality.
1641 - Fix #1117: spelling errors, from Robert Edmonds.
1643 30 September 2016: Wouter
1644 - Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.
1646 29 September 2016: Wouter
1647 - Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
1648 - Fix #839: Memory grows unexpectedly with large RPZ files.
1649 - Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile.
1650 - Fix #841: big local-zone's make it consume large amounts of memory.
1652 27 September 2016: Wouter
1653 - tag for 1.5.10 release
1654 - trunk contains 1.5.11 in development.
1655 - Fix dnstap relaying "random" messages instead of resolver/forwarder
1656 responses, from Nikolay Edigaryev.
1657 - Fix #836: unbound could echo back EDNS options in an error response.
1659 20 September 2016: Wouter
1660 - iana portlist update.
1661 - Fix #835: fix --disable-dsa with nettle verify.
1662 - tag for 1.5.10rc1 release.
1664 15 September 2016: Wouter
1665 - Fix 883: error for duplicate local zone entry.
1666 - Test for openssl init_crypto and init_ssl functions.
1668 15 September 2016: Ralph
1669 - fix potential memory leak in daemon/remote.c and nullpointer
1670 dereference in validator/autotrust.
1671 - iana portlist update.
1673 13 September 2016: Wouter
1674 - Silenced flex-generated sign-unsigned warning print with gcc
1676 - Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len.
1678 9 September 2016: Wouter
1679 - Fix #831: workaround for spurious fread_chk warning against petal.c
1681 5 September 2016: Ralph
1682 - Take configured minimum TTL into consideration when reducing TTL
1683 to original TTL from RRSIG.
1685 5 September 2016: Wouter
1686 - Fix #829: doc of sldns_wire2str_rdata_buf() return value has an
1687 off-by-one typo, from Jinmei Tatuya (Infoblox).
1688 - Fix incomplete prototypes reported by Dag-Erling Smørgrav.
1689 - Fix #828: missing type in access-control-tag-action redirect results
1692 2 September 2016: Wouter
1693 - Fix compile with openssl 1.1.0 with api=1.1.0.
1695 1 September 2016: Wouter
1696 - RFC 7958 is now out, updated docs for unbound-anchor.
1697 - Fix for compile without warnings with openssl 1.1.0.
1698 - Fix #826: Fix refuse_non_local could result in a broken response.
1699 - iana portlist update.
1701 29 August 2016: Wouter
1702 - Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A.
1704 - Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
1706 25 August 2016: Ralph
1707 - Clarify local-zone-override entry in unbound.conf.5
1709 25 August 2016: Wouter
1710 - 64bit build option for makedist windows compile, -w64.
1712 24 August 2016: Ralph
1713 - Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter
1714 in each iteration in find_tag_datas().
1715 - unbound.conf.5 entries for define-tag, access-control-tag,
1716 access-control-tag-action, access-control-tag-data, local-zone-tag,
1717 and local-zone-override.
1719 23 August 2016: Wouter
1720 - Fix #804: unbound stops responding after outage. Fixes queries
1721 that attempt to wait for an empty list of subqueries.
1722 - Fix #804: lower num_target_queries for iterator also for failed
1725 8 August 2016: Wouter
1726 - Note that OPENPGPKEY type is RFC 7929.
1728 4 August 2016: Wouter
1729 - Fix #807: workaround for possible some "unused" function parameters
1730 in test code, from Jinmei Tatuya.
1732 3 August 2016: Wouter
1733 - use sendmsg instead of sendto for TFO.
1735 28 July 2016: Wouter
1736 - Fix #806: wrong comment removed.
1738 26 July 2016: Wouter
1739 - nicer ratelimit-below-domain explanation.
1741 22 July 2016: Wouter
1742 - Fix #801: missing error condition handling in
1743 daemon_create_workers().
1744 - Fix #802: workaround for function parameters that are "unused"
1746 - Fix #803: confusing (and incorrect) code comment in daemon_cleanup().
1748 20 July 2016: Wouter
1749 - Fix typo in unbound.conf.
1751 18 July 2016: Wouter
1752 - Fix #798: Client-side TCP fast open fails (Linux).
1754 14 July 2016: Wouter
1755 - TCP Fast open patch from Sara Dickinson.
1756 - Fixed unbound.doxygen for 1.8.11.
1759 - access-control-tag-data implemented. verbose(4) prints tag debug.
1762 - Fix dynamic link of anchor-update.exe on windows.
1763 - Fix detect of mingw for MXE package build.
1764 - Fixes for 64bit windows compile.
1765 - Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and
1766 --with-libunbound-only --with-nettle.
1769 - For #787: prefer-ip6 option for unbound.conf prefers to send
1770 upstream queries to ipv6 servers.
1771 - Fix #787: outgoing-interface netblock/64 ipv6 option to use linux
1772 freebind to use 64bits of entropy for every query with random local
1775 30 June 2016: Wouter
1776 - Document always_transparent, always_refuse, always_nxdomain types.
1778 29 June 2016: Wouter
1779 - Fix static compile on windows missing gdi32.
1781 28 June 2016: Wouter
1782 - Create a pkg-config file for libunbound in contrib.
1784 27 June 2016: Wouter
1785 - Fix #784: Build configure assumess that having getpwnam means there
1786 is endpwent function available.
1787 - Updated repository with newer flex and bison output.
1790 - Possibility to specify local-zone type for an acl/tag pair
1791 - Possibility to specify (override) local-zone type for a source address
1794 - Decrease dp attempts at each QNAME minimisation iteration
1796 16 June 2016: Wouter
1797 - Fix tcp timeouts in tv.usec.
1799 15 June 2016: Wouter
1800 - TCP_TIMEOUT is specified in milliseconds.
1801 - If more than half of tcp connections are in use, a shorter timeout
1802 is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
1805 - QNAME minimisation unit test for dropped QTYPE=A queries.
1807 14 June 2016: Wouter
1808 - Fix 775: unbound-host and unbound-anchor crash on windows, ignore
1809 null delete for wsaevent.
1810 - Fix spelling in freebind option man page text.
1811 - Fix windows link of ssl with crypt32.
1812 - Fix 779: Union casting is non-portable.
1813 - Fix 780: MAP_ANON not defined in HP-UX 11.31.
1814 - Fix 781: prealloc() is an HP-UX system library call.
1817 - Use QTYPE=A for QNAME minimisation.
1818 - Keep track of number of time-outs when performing QNAME minimisation.
1819 Stop minimising when number of time-outs for a QNAME/QTYPE pair is
1822 13 June 2016: Wouter
1823 - Fix #778: unbound 1.5.9: -h segfault (null deref).
1824 - Fix directory: fix for unbound-checkconf, it restores cwd.
1826 10 June 2016: Wouter
1827 - And delete service.conf.shipped on uninstall.
1828 - In unbound.conf directory: dir immediately changes to that directory,
1829 so that include: file below that is relative to that directory.
1830 With chroot, make the directory an absolute path inside chroot.
1831 - keep debug symbols in windows build.
1832 - do not delete service.conf on windows uninstall.
1833 - document directory immediate fix and allow EXECUTABLE syntax in it
1837 - Trunk is called 1.5.10 (with previous fixes already in there to 2
1839 - Revert fix for NetworkService account on windows due to breakage
1841 - Fix that windows install will not overwrite existing service.conf
1842 file (and ignore gui config choices if it exists).
1845 - Lookup localzones by taglist from acl.
1846 - Possibility to lookup local_zone, regardless the taglist.
1847 - Added local_zone/taglist/acl unit test.
1850 - Fix #773: Non-standard Python location build failure with pyunbound.
1851 - Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
1854 - Better help text from -h (from Ray Griffith).
1855 - access-control-tag config directive.
1856 - local-zone-override config directive.
1857 - access-control-tag-action and access-control-tag-data config
1859 - free acl-tags, acltag-action and acltag-data config lists during
1860 initialisation to free up memory for more entries.
1863 - Fix to not ignore return value of chown() in daemon startup.
1866 - Fix libubound for edns optlist feature.
1867 - Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc.
1868 - Fix #752: retry resource temporarily unavailable on control pipe.
1869 - un-document localzone tags.
1870 - tag for release 1.5.9rc1.
1871 And this also became release 1.5.9.
1872 - Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to
1873 Program Files with (x86) appended.
1874 - re-documented localzone tags in example.conf.
1877 - Fix windows service to be created run with limited rights, as a
1878 network service account, from Mario Turschmann.
1879 - compat strsep implementation.
1880 - generic edns option parse and store code.
1881 - and also generic edns options for upstream messages (and replies).
1882 after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID),
1883 to insert use edns_opt_append(edns, region, code, len, bindata) on
1884 the opt_list passed to send_query, or in edns_opt_inplace_reply.
1887 - Fix time in case answer comes from cache in ub_resolve_event().
1888 - Attempted fix for #765: _unboundmodule missing for python3.
1891 - Fix #770: Small subgroup attack on DH used in unix pipe on localhost
1892 if unbound control uses a unix local named pipe.
1893 - Document write permission to directory of trust anchor needed.
1894 - Fix #768: Unbound Service Sometimes Can Not Shutdown
1895 Completely, WER Report Shown Up. Close handle before closing WSA.
1898 - Updated patch from Charles Walker.
1901 - disable-dnssec-lame-check config option from Charles Walker.
1902 - remove memory leak from lame-check patch.
1903 - iana portlist update.
1906 - Fix #767: Reference to an expired Internet-Draft in
1907 harden-below-nxdomain documentation.
1910 - No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC
1912 - iana portlist update.
1915 - Fix #766: dns64 should synthesize results on timeout/errors.
1918 - Fix #761: DNSSEC LAME false positive resolving nic.club.
1921 - trunk updated with output of flex 2.6.0.
1924 - Fix memory leak in out-of-memory conditions of local zone add.
1926 29 April 2016: Wouter
1927 - Fix sldns with static checking fixes copied from getdns.
1929 28 April 2016: Wouter
1930 - Fix #759: 0x20 capsforid no longer checks type PTR, for
1931 compatibility with cisco dns guard. This lowers false positives.
1933 18 April 2016: Wouter
1934 - Fix some malformed responses to edns queries get fallback to nonedns.
1936 15 April 2016: Wouter
1937 - cachedb module event handling design.
1939 14 April 2016: Wouter
1940 - cachedb module framework (empty).
1941 - iana portlist update.
1943 12 April 2016: Wouter
1944 - Fix #753: document dump_requestlist is for first thread.
1946 24 March 2016: Wouter
1947 - Document permit-small-holddown for 5011 debug.
1948 - Fix #749: unbound-checkconf gets SIGSEGV when use against a
1949 malformatted conf file.
1951 23 March 2016: Wouter
1952 - OpenSSL 1.1.0 portability, --disable-dsa configure option.
1954 21 March 2016: Wouter
1955 - Fix compile of getentropy_linux for SLES11 servicepack 4.
1956 - Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev.
1957 - Fix test for openssl to use HMAC_Update for 1.1.0.
1958 - acx_nlnetlabs.m4 to v33, with HMAC_Update.
1959 - acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto.
1960 - ERR_remove_state deprecated since openssl 1.0.0.
1961 - OPENSSL_config is deprecated, removing.
1963 18 March 2016: Ralph
1964 - Validate QNAME minimised NXDOMAIN responses.
1965 - If QNAME minimisation is enabled, do cache lookup for QTYPE NS in
1966 harden-below-nxdomain.
1968 17 March 2016: Ralph
1969 - Limit number of QNAME minimisation iterations.
1971 17 March 2016: Wouter
1972 - Fix #746: Fix unbound sets CD bit on all forwards.
1973 If no trust anchors, it'll not set CD bit when forwarding to another
1974 server. If a trust anchor, no CD bit on the first attempt to a
1975 forwarder, but CD bit thereafter on repeated attempts to get DNSSEC.
1976 - iana portlist update.
1978 16 March 2016: Wouter
1979 - Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma.
1980 - Fix ip-transparent for tcp on freebsd.
1982 15 March 2016: Wouter
1983 - ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for
1984 binding to an IP address while the interface or address is down.
1986 14 March 2016: Wouter
1987 - Fix warnings in ifdef corner case, older or unknown libevent.
1988 - Fix compile for ub_event code with older libev.
1990 11 March 2016: Wouter
1991 - Remove warning about unused parameter in event_pluggable.c.
1992 - Fix libev usage of dispatch return value.
1993 - No side effects in tolower() call, in case it is a macro.
1994 - For test put free in pluggable api in parenthesis.
1996 10 March 2016: Wouter
1997 - Fixup backend2str for libev.
1999 09 March 2016: Willem
2000 - User defined pluggable event API for libunbound
2001 - Fixup of compile fix for pluggable event API from P.Y. Adi
2004 09 March 2016: Wouter
2005 - Updated configure and ltmain.sh.
2006 - Updated L root IPv6 address.
2008 07 March 2016: Wouter
2009 - Fix #747: assert in outnet_serviced_query_stop.
2010 - iana ports fetched via https.
2011 - iana portlist update.
2013 03 March 2016: Wouter
2014 - configure tests for the weak attribute support by the compiler.
2016 02 March 2016: Wouter
2018 - trunk contains 1.5.9 in development.
2019 - iana portlist update.
2020 - Fix #745: unbound.py - idn2dname throws UnicodeError when idnname
2021 contains trailing dot.
2023 24 February 2016: Wouter
2024 - Fix OpenBSD asynclook lock free that gets used later (fix test code).
2025 - Fix that NSEC3 negative cache is used when there is no salt.
2027 23 February 2016: Wouter
2028 - ub_ctx_set_stub() function for libunbound to config stub zones.
2029 - sorted ubsyms.def file with exported libunbound functions.
2031 19 February 2016: Wouter
2032 - Print understandable debug log when unusable DS record is seen.
2033 - load gost algorithm if digest is seen before key algorithm.
2034 - iana portlist update.
2036 17 February 2016: Wouter
2037 - Fix that "make install" fails due to "text file busy" error.
2039 16 February 2016: Wouter
2040 - Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
2042 15 February 2016: Wouter
2043 - ip-transparent option for FreeBSD with IP_BINDANY socket option.
2044 - wait for sendto to drain socket buffers when they are full.
2046 9 February 2016: Wouter
2047 - Test for type OPENPGPKEY.
2048 - insecure-lan-zones: yesno config option, patch from Dag-Erling
2051 8 February 2016: Wouter
2052 - Fix patch typo in prevuous commit for 734 from Adi Prasaja.
2053 - RR Type CSYNC support RFC 7477, in debug printout and config input.
2054 - RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
2056 29 January 2016: Wouter
2057 - Neater cmdline_verbose increment patch from Edgar Pettijohn.
2059 27 January 2016: Wouter
2060 - Made netbsd sendmsg test nonfatal, in case of false positives.
2061 - Fix #741: log message for dnstap socket connection is more clear.
2063 26 January 2016: Wouter
2064 - Fix #734: chown the pidfile if it resides inside the chroot.
2065 - Use arc4random instead of random in tests (because it is
2066 available, possibly as compat, anyway).
2067 - Fix cmsg alignment for argument to sendmsg on NetBSD.
2068 - Fix that unbound complains about unimplemented IP_PKTINFO for
2069 sendmsg on NetBSD (for interface-automatic).
2071 25 January 2016: Wouter
2072 - Fix #738: Swig should not be invoked with CPPFLAGS.
2074 19 January 2016: Wouter
2075 - Squelch 'cannot assign requested address' log messages unless
2076 verbosity is high, it was spammed after network down.
2078 14 January 2016: Wouter
2079 - Fix to simplify empty string checking from Michael McConville.
2080 - iana portlist update.
2082 12 January 2016: Wouter
2083 - Fix #734: Do not log an error when the PID file cannot be chown'ed.
2084 Patch from Simon Deziel.
2086 11 January 2016: Wouter
2087 - Fix test if -pthreads unused to use better grep for portability.
2089 06 January 2016: Wouter
2090 - Fix mingw crosscompile for recent mingw.
2091 - Update aclocal, autoconf output with new versions (1.15, 2.4.6).
2093 05 January 2016: Wouter
2094 - #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch
2095 from Daisuke Higashi.
2096 - Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
2097 by default, and can be unblocked with "nodefault" localzone config.
2099 04 January 2016: Wouter
2100 - Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
2101 for Linux glibc 2.20.
2102 - Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
2103 source code, so it applies cleanly again. Removed unused variable
2106 15 December 2015: Ralph
2107 - Fix #729: omit use of escape sequences in echo since they are not
2108 portable (unbound-control-setup).
2110 11 December 2015: Wouter
2111 - remove NULL-checks before free, patch from Michael McConville.
2112 - updated ax_pthread.m4 to version 21 with clang support, this
2113 removes a warning from compilation.
2114 - OSX portability, detect if sbrk is deprecated.
2115 - OSX clang, stop -pthread unused during link stage warnings.
2116 - OSX clang new flto check.
2118 10 December 2015: Wouter
2120 - trunk has 1.5.8 in development.
2122 8 December 2015: Wouter
2123 - Fixup 724 for unbound-control.
2125 7 December 2015: Ralph
2126 - Do not minimise forwarded requests.
2128 4 December 2015: Wouter
2129 - Removed unneeded whitespace from example.conf.
2131 3 December 2015: Ralph
2133 - Committed fix to qname minimisation and unit test case for it.
2135 3 December 2015: Wouter
2136 - iana portlist update.
2137 - 1.5.7rc1 prerelease tag.
2139 2 December 2015: Wouter
2140 - Fixup 724: Fix PCA prompt for unbound-service-install.exe.
2141 re-enable stdout printout.
2142 - For 724: Add Changelog to windows binary dist.
2144 1 December 2015: Ralph
2145 - Qname minimisation review fixes
2147 1 December 2015: Wouter
2148 - Fixup 724 fix for fname_after_chroot() calls.
2149 - Remove stdout printout for unbound-service-install.exe
2150 - .gitignore for git users.
2152 30 November 2015: Ralph
2153 - Implemented qname minimisation
2155 30 November 2015: Wouter
2156 - Fix for #724: conf syntax to read files from run dir (on Windows).
2158 25 November 2015: Wouter
2159 - Fix for #720, fix unbound-control-setup windows batch file.
2161 24 November 2015: Wouter
2162 - Fix #720: add windows scripts to zip bundle.
2163 - iana portlist update.
2165 20 November 2015: Wouter
2166 - Added assert on rrset cache correctness.
2167 - Fix that malformed EDNS query gets a response without malformed EDNS.
2169 18 November 2015: Wouter
2170 - newer acx_nlnetlabs.m4.
2171 - spelling fixes from Igor Sobrado Delgado.
2173 17 November 2015: Wouter
2174 - Fix #594. libunbound: optionally use libnettle for crypto.
2175 Contributed by Luca Bruno. Added --with-nettle for use with
2176 --with-libunbound-only.
2177 - refactor nsec3 hash implementation to be more library-portable.
2178 - iana portlist update.
2179 - Fixup DER encoded DSA signatures for libnettle.
2181 16 November 2015: Wouter
2182 - Fix for lenient accept of reverse order DNAME and CNAME.
2184 6 November 2015: Wouter
2185 - Change example.conf: ftp.internic.net to https://www.internic.net
2187 5 November 2015: Wouter
2188 - ACX_SSL_CHECKS no longer adds -ldl needlessly.
2190 3 November 2015: Wouter
2191 - Fix #718: Fix unbound-control-setup with support for env
2192 without HEREDOC bash support.
2194 29 October 2015: Wouter
2195 - patch from Doug Hogan for SSL_OP_NO_SSLvx options.
2196 - Fix #716: nodata proof with empty non-terminals and wildcards.
2198 28 October 2015: Wouter
2199 - Fix checklock testcode for linux threads on exit.
2201 27 October 2015: Wouter
2202 - isblank() compat implementation.
2203 - detect libexpat without xml_StopParser function.
2204 - portability fixes.
2205 - portability, replace snprintf if return value broken.
2207 23 October 2015: Wouter
2208 - Fix #714: Document config to block private-address for IPv4
2209 mapped IPv6 addresses.
2211 22 October 2015: Wouter
2212 - Fix #712: unbound-anchor appears to not fsync root.key.
2214 20 October 2015: Wouter
2216 - trunk tracks development of 1.5.7.
2218 15 October 2015: Wouter
2219 - Fix segfault in the dns64 module in the formaterror error path.
2220 - Fix sldns_wire2str_rdata_scan for malformed RRs.
2221 - tag for 1.5.6rc1 release.
2223 14 October 2015: Wouter
2224 - ANY responses include DNAME records if present, as per Evan Hunt's
2226 - Fix manpage to suggest using SIGTERM to terminate the server.
2228 9 October 2015: Wouter
2229 - Default for ssl-port is port 853, the temporary port assignment
2230 for secure domain name system traffic.
2231 If you used to rely on the older default of port 443, you have
2232 to put a clause in unbound.conf for that. The new value is likely
2233 going to be the standardised port number for this traffic.
2234 - iana portlist update.
2236 6 October 2015: Wouter
2238 - trunk tracks the development of 1.5.6.
2240 28 September 2015: Wouter
2241 - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution
2243 - tag for 1.5.5rc1 release.
2244 - makedist.sh: pgp sig echo commands.
2246 25 September 2015: Wouter
2247 - Fix unbound-control flush that does not succeed in removing data.
2249 22 September 2015: Wouter
2250 - Fix config globbed include chroot treatment, this fixes reload of
2251 globs (patch from Dag-Erling Smørgrav).
2252 - iana portlist update.
2253 - Fix #702: New IPs for for h.root-servers.net.
2254 - Remove confusion comment from canonical_compare() function.
2255 - Fix #705: ub_ctx_set_fwd() return value mishandled on windows.
2256 - testbound selftest also works in non-debug mode.
2257 - Fix minor error in unbound.conf.5.in
2258 - Fix unbound.conf(5) access-control description for precedence
2261 31 August 2015: Wouter
2262 - changed windows setup compression to be more transparent.
2264 28 August 2015: Wouter
2265 - Fix #697: Get PY_MAJOR_VERSION failure at configure for python
2267 - Feature #699: --enable-pie option to that builds PIE binary.
2268 - Feature #700: --enable-relro-now option that enables full read-only
2271 24 August 2015: Wouter
2272 - Fix deadlock for local data add and zone add when unbound-control
2273 list_local_data printout is interrupted.
2274 - iana portlist update.
2275 - Change default of harden-algo-downgrade to off. This is lenient
2276 for algorithm rollover.
2278 13 August 2015: Wouter
2279 - 5011 implementation does not insist on all algorithms, when
2280 harden-algo-downgrade is turned off.
2281 - Reap the child process that libunbound spawns.
2283 11 August 2015: Wouter
2284 - Fix #694: configure script does not detect LibreSSL 2.2.2
2286 4 August 2015: Wouter
2287 - Document that local-zone nodefault matches exactly and transparent
2288 can be used to release a subzone.
2290 3 August 2015: Wouter
2291 - Document in the manual more text about configuring locally served
2293 - Fix 5011 anchor update timer after reload.
2294 - Fix mktime in unbound-anchor not using UTC.
2296 30 July 2015: Wouter
2297 - please afl-gcc (llvm) for uninitialised variable warning.
2298 - Added permit-small-holddown config to debug fast 5011 rollover.
2300 24 July 2015: Wouter
2301 - Fix #690: Reload fails when so-reuseport is yes after changing
2303 - iana portlist update.
2305 21 July 2015: Wouter
2306 - Fix configure to detect SSL_CTX_set_ecdh_auto.
2307 - iana portlist update.
2309 20 July 2015: Wouter
2310 - Enable ECDHE for servers. Where available, use
2311 SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to
2312 enable ECDHE. Otherwise, manually offer curve p256.
2313 Client connections should automatically use ECDHE when available.
2314 (thanks Daniel Kahn Gillmor)
2316 18 July 2015: Willem
2317 - Allow certificate chain files to allow for intermediate certificates.
2318 (thanks Daniel Kahn Gillmor)
2320 13 July 2015: Wouter
2321 - makedist produces sha1 and sha256 files for created binaries too.
2325 - trunk has 1.5.5 in development.
2326 - Fix #681: Setting forwarders with unbound-control forward
2327 implicitly turns on forward-first.
2329 29 June 2015: Wouter
2330 - iana portlist update.
2331 - Fix alloc with log for allocation size checks.
2333 26 June 2015: Wouter
2334 - Fix #677 Fix DNAME responses from cache that failed internal chain
2336 - iana portlist update.
2338 22 June 2015: Wouter
2339 - Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly
2340 and was therefore always synthesized (thanks to Valentin Dietrich).
2343 - RFC 7553 RR type URI support, is now enabled by default.
2346 - Fix #674: Do not free pointers given by getenv.
2349 - Fix that unparseable error responses are ratelimited.
2350 - SOA negative TTL is capped at minimumttl in its rdata section.
2351 - cache-max-negative-ttl config option, default 3600.
2354 - Document that ratelimit works with unbound-control set_option.
2357 - iana portlist update.
2358 - documentation proposes ratelimit of 1000 (closer to what upstream
2359 servers expect from us).
2362 - DLV is going to be decommissioned. Advice to stop using it, and
2363 put text in the example configuration and man page to that effect.
2366 - Change syntax of particular validator error to be easier for
2367 machine parse, swap rrset and ip adres info so it looks like:
2368 validation failure <www.example.nl. TXT IN>: signature crypto
2369 failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
2372 - caps-whitelist in unbound.conf allows whitelist of loadbalancers
2373 that cannot work with caps-for-id or its fallback.
2375 30 April 2015: Wouter
2376 - Unit test for type ANY synthesis.
2378 22 April 2015: Wouter
2379 - Removed contrib/unbound_unixsock.diff, because it has been
2380 integrated, use control-interface: /path in unbound.conf.
2381 - iana portlist update.
2383 17 April 2015: Wouter
2384 - Synthesize ANY responses from cache. Does not search exhaustively,
2385 but MX,A,AAAA,SOA,NS also CNAME.
2386 - Fix leaked dns64prefix configuration string.
2388 16 April 2015: Wouter
2389 - Add local-zone type inform_deny, that logs query and drops answer.
2390 - Ratelimit does not apply to prefetched queries, and ratelimit-factor
2391 is default 10. Repeated normal queries get resolved and with
2392 prefetch stay in the cache.
2393 - Fix bug#664: libunbound python3 related fixes (from Tomas Hozza)
2394 Use print_function also for Python2.
2395 libunbound examples: produce sorted output.
2396 libunbound-Python: libldns is not used anymore.
2397 Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
2399 10 April 2015: Wouter
2400 - unbound-control ratelimit_list lists high rate domains.
2401 - ratelimit feature, ratelimit: 100, or some sensible qps, can be
2402 used to turn it on. It ratelimits recursion effort per zone.
2403 For particular names you can configure exceptions in unbound.conf.
2404 - Fix that get_option for cache-sizes does not print double newline.
2405 - Fix#663: ssl handshake fails when using unix socket because dh size
2408 8 April 2015: Wouter
2409 - Fix crash in dnstap: Do not try to log TCP responses after timeout.
2411 7 April 2015: Wouter
2412 - Libunbound skips dos-line-endings from etc/hosts.
2413 - Unbound exits with a fatal error when the auto-trust-anchor-file
2414 fails to be writable. This is seconds after startup. You can
2415 load a readonly auto-trust-anchor-file with trust-anchor-file.
2416 The file has to be writable to notice the trust anchor change,
2417 without it, a trust anchor change will be unnoticed and the system
2418 will then become inoperable.
2419 - unbound-control list_insecure command shows the negative trust
2420 anchors currently configured, patch from Jelte Jansen.
2422 2 April 2015: Wouter
2423 - Fix #660: Fix interface-automatic broken in the presence of
2426 26 March 2015: Wouter
2427 - remote.c probedelay line is easier to read.
2428 - rename ldns subdirectory to sldns to avoid name collision.
2430 25 March 2015: Wouter
2431 - Fix #657: libunbound(3) recommends deprecated
2432 CRYPTO_set_id_callback.
2433 - If unknown trust anchor algorithm, and libressl is used, error
2434 message encourages upgrade of the libressl package.
2436 23 March 2015: Wouter
2437 - Fix segfault on user not found at startup (from Maciej Soltysiak).
2439 20 March 2015: Wouter
2440 - Fixed to add integer overflow checks on allocation (defense in depth).
2442 19 March 2015: Wouter
2443 - Add ip-transparent config option for bind to non-local addresses.
2445 17 March 2015: Wouter
2446 - Use reallocarray for integer overflow protection, patch submitted
2447 by Loganaden Velvindron.
2449 16 March 2015: Wouter
2450 - Fixup compile on cygwin, more portable openssl thread id.
2452 12 March 2015: Wouter
2453 - Updated default keylength in unbound-control-setup to 3k.
2455 10 March 2015: Wouter
2456 - Fix lintian warning in unbound-checkconf man page (from Andreas
2458 - print svnroot when building windows dist.
2459 - iana portlist update.
2460 - Fix warning on sign compare in getentropy_linux.
2462 9 March 2015: Wouter
2463 - Fix #644: harden-algo-downgrade option, if turned off, fixes the
2464 reported excessive validation failure when multiple algorithms
2465 are present. It allows the weakest algorithm to validate the zone.
2466 - iana portlist update.
2468 5 March 2015: Wouter
2469 - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
2470 scripts. Contributed by Yuri Voinov.
2471 - Document that incoming-num-tcp increase is good for large servers.
2472 - stats reports tcp usage, of incoming-num-tcp buffers.
2474 4 March 2015: Wouter
2475 - Patch from Brad Smith that syncs compat/getentropy_linux with
2476 OpenBSD's version (2015-03-04).
2477 - 0x20 fallback improved: servfail responses do not count as missing
2478 comparisons (except if all responses are errors),
2479 inability to find nameservers does not fail equality comparisons,
2480 many nameservers does not try to compare more than max-sent-count,
2481 parse failures start 0x20 fallback procedure.
2482 - store caps_response with best response in case downgrade response
2483 happens to be the last one.
2484 - Document windows 8 tests.
2486 3 March 2015: Wouter
2488 [ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ]
2490 2 March 2015: Wouter
2491 - iana portlist update.
2493 20 February 2015: Wouter
2494 - Use the getrandom syscall introduced in Linux 3.17 (from Heiner
2496 - Fix #645 Portability to Solaris 10, use AF_LOCAL.
2497 - Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
2498 - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after
2501 19 February 2015: Wouter
2502 - 1.5.2 release tag.
2503 - svn trunk contains 1.5.3 under development.
2505 13 February 2015: Wouter
2506 - Fix #643: doc/example.conf.in: unnecessary whitespace.
2508 12 February 2015: Wouter
2511 11 February 2015: Wouter
2512 - iana portlist update.
2514 10 February 2015: Wouter
2515 - Fix scrubber with harden-glue turned off to reject NS (and other
2516 not-address) records.
2518 9 February 2015: Wouter
2519 - Fix validation failure in case upstream forwarder (ISC BIND) does
2520 not have the same trust anchors and decides to insert unsigned NS
2521 record in authority section.
2523 2 February 2015: Wouter
2524 - infra-cache-min-rtt patch from Florian Riehm, for expected long
2525 uplink roundtrip times.
2527 30 January 2015: Wouter
2528 - Fix 0x20 capsforid fallback to omit gratuitous NS and additional
2530 - Portability fix for Solaris ('sun' is not usable for a variable).
2532 29 January 2015: Wouter
2533 - Fix pyunbound byte string representation for python3.
2535 26 January 2015: Wouter
2536 - Fix unintended use of gcc extension for incomplete enum types,
2537 compile with pedantic c99 compliance (from Daniel Dickman).
2539 23 January 2015: Wouter
2540 - windows port fixes, no AF_LOCAL, no chown, no chmod(grp).
2542 16 January 2015: Wouter
2543 - unit test for local unix connection. Documentation and log_addr
2544 does not inspect port for AF_LOCAL.
2545 - unbound-checkconf -f prints chroot with pidfile path.
2547 13 January 2015: Wouter
2548 - iana portlist update.
2550 12 January 2015: Wouter
2551 - Cast sun_len sizeof to socklen_t.
2552 - Fix pyunbound ord call, portable for python 2 and 3.
2554 7 January 2015: Wouter
2555 - Fix warnings in pythonmod changes.
2557 6 January 2015: Wouter
2558 - iana portlist update.
2559 - patch for remote control over local sockets, from Dag-Erling
2560 Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and
2561 control-use-cert: no.
2562 - Fixup that patch and uid lookup (only for daemon).
2563 - coded the default of control-use-cert, to yes.
2565 5 January 2015: Wouter
2566 - getauxval test for ppc64 linux compatibility.
2567 - make strip works for unbound-host and unbound-anchor.
2568 - patch from Stephane Lapie that adds to the python API, that
2569 exposes struct delegpt, and adds the find_delegation function.
2570 - print query name when max target count is exceeded.
2571 - patch from Stuart Henderson that fixes DESTDIR in
2572 unbound-control-setup for installs where config is not in
2573 the prefix location.
2574 - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing
2575 IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne).
2576 - Updated contrib warmup.cmd/sh to support two modes - load
2577 from pre-defined list of domains or (with filename as argument)
2578 load from user-specified list of domains, and updated contrib
2579 unbound_cache.sh/cmd to support loading/save/reload cache to/from
2580 default path or (with secondary argument) arbitrary path/filename,
2582 - Patch from Philip Paeps to contrib/unbound_munin_ that uses
2583 type ABSOLUTE. Allows munin.conf: [idleserver.example.net]
2584 unbound_munin_hits.graph_period minute
2586 9 December 2014: Wouter
2587 - svn trunk has 1.5.2 in development.
2588 - config.guess and config.sub update from libtoolize.
2589 - local-zone: example.com inform makes unbound log a message with
2590 client IP for queries in that zone. Eg. for finding infected hosts.
2592 8 December 2014: Wouter
2593 - Fix CVE-2014-8602: denial of service by making resolver chase
2594 endless series of delegations.
2596 1 December 2014: Wouter
2597 - Fix bug#632: unbound fails to build on AArch64, protects
2598 getentropy compat code from calling sysctl if it is has been removed.
2600 29 November 2014: Wouter
2601 - Add include to getentropy_linux.c, hopefully fixing debian build.
2603 28 November 2014: Wouter
2604 - Fix makefile for build from noexec source tree.
2606 26 November 2014: Wouter
2607 - Fix libunbound undefined symbol errors for main.
2608 Referencing main does not seem to be possible for libunbound.
2610 24 November 2014: Wouter
2611 - Fix log at high verbosity and memory allocation failure.
2612 - iana portlist update.
2614 21 November 2014: Wouter
2615 - Fix crash on multiple thread random usage on systems without
2618 20 November 2014: Wouter
2619 - fix compat/getentropy_win.c check if CryptGenRandom works and no
2620 immediate exit on windows.
2622 19 November 2014: Wouter
2623 - Fix cdflag dns64 processing.
2625 18 November 2014: Wouter
2626 - Fix that CD flag disables DNS64 processing, returning the DNSSEC
2628 - iana portlist update.
2630 17 November 2014: Wouter
2631 - Fix #627: SSL_CTX_load_verify_locations return code not properly
2634 14 November 2014: Wouter
2635 - parser with bison 2.7
2637 13 November 2014: Wouter
2638 - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter,
2639 added to contrib/aaaa-filter-iterator.patch.
2641 12 November 2014: Wouter
2642 - trunk has 1.5.1 in development.
2643 - Patch from Robert Edmonds to build pyunbound python module
2644 differently. No versioninfo, with -shared and without $(LIBS).
2645 - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page.
2646 - Removed 'increased limit open files' log message that is written
2647 to console. It is only written on verbosity 4 and higher.
2648 This keeps system bootup console cleaner.
2649 - Patch from James Raftery, always print stats for rcodes 0..5.
2651 11 November 2014: Wouter
2652 - iana portlist update.
2653 - Fix bug where forward or stub addresses with same address but
2654 different port number were not tried.
2655 - version number in svn trunk is 1.5.0
2657 - review fix from Ralph.
2659 7 November 2014: Wouter
2660 - dnstap fixes by Robert Edmonds:
2661 dnstap/dnstap.m4: cosmetic fixes
2662 dnstap/: Remove compiled protoc-c output files
2663 dnstap/dnstap.m4: Error out if required libraries are not found
2664 dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of
2666 dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0)
2668 4 November 2014: Wouter
2669 - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically
2670 tracked trust anchor to libunbound.
2671 - Redefine internal minievent symbols to unique symbols that helps
2672 linking on platforms where the linker leaks names across modules.
2674 27 October 2014: Wouter
2675 - Disabled use of SSLv3 in remote-control and ssl-upstream.
2676 - iana portlist update.
2678 16 October 2014: Wouter
2679 - Documented dns64 configuration in unbound.conf man page.
2681 13 October 2014: Wouter
2682 - Fix #617: in ldns in unbound, lowercase WKS services.
2683 - Fix ctype invocation casts.
2685 10 October 2014: Wouter
2686 - Fix unbound-checkconf check for module config with dns64 module.
2687 - Fix unbound capsforid fallback, it ignores TTLs in comparison.
2689 6 October 2014: Wouter
2690 - Fix #614: man page variable substitution bug.
2691 6 October 2014: Willem
2692 - Whitespaces after $ORIGIN are not part of the origin dname (ldns).
2693 - $TTL's value starts at position 5 (ldns).
2695 1 October 2014: Wouter
2696 - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire).
2698 29 September 2014: Wouter
2699 - Fix #612: create service with service.conf in present directory and
2701 - Fix for mingw compile openssl ranlib.
2703 25 September 2014: Wouter
2704 - updated configure and aclocal with newer autoconf 1.13.
2706 22 September 2014: Wouter
2707 - Fix swig and python examples for Python 3.x.
2708 - Fix for mingw compile with openssl-1.0.1i.
2710 19 September 2014: Wouter
2711 - improve python configuration detection to build on Fedora 22.
2713 18 September 2014: Wouter
2714 - patches to also build with Python 3.x (from Pavel Simerda).
2716 16 September 2014: Wouter
2717 - Fix tcp timer waiting list removal code.
2718 - iana portlist update.
2719 - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue
2720 is longer and more tcp connections can be handled.
2722 15 September 2014: Wouter
2723 - Fix unit test for CDS typecode.
2725 5 September 2014: Wouter
2726 - type CDS and CDNSKEY types in sldns.
2728 25 August 2014: Wouter
2729 - Fixup checklock code for log lock and its mutual initialization
2731 - iana portlist update.
2732 - Removed necessity for pkg-config from the dnstap.m4, new are
2733 the --with-libfstrm and --with-protobuf-c configure options.
2735 19 August 2014: Wouter
2736 - Update unbound manpage with more explanation (from Florian Obser).
2738 18 August 2014: Wouter
2739 - Fix #603: unbound-checkconf -o <option> should skip verification
2741 - iana portlist update.
2742 - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings.
2744 5 August 2014: Wouter
2745 - dnstap support, with a patch from Farsight Security, written by
2746 Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c.
2747 It is BSD licensed (see dnstap/dnstap.c).
2748 Building with --enable-dnstap needs pkg-config with this patch.
2749 - Noted dnstap in doc/README and doc/CREDITS.
2750 - Changes to the dnstap patch.
2752 - dnstap/dnstap_config.h should not have been added to the repo,
2753 because is it generated.
2755 1 August 2014: Wouter
2756 - Patch add msg, rrset, infra and key cache sizes to stats command
2757 from Maciej Soltysiak.
2758 - iana portlist update.
2760 31 July 2014: Wouter
2761 - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault.
2762 Initial commit of the patch from the FreeBSD base (with its fixes).
2763 This adds a module (for module-config in unbound.conf) dns64 that
2764 performs DNS64 processing, see README.DNS64.
2765 - Changes from DNS64:
2766 strcpy changed to memmove.
2767 arraybound check fixed from prefix_net/8/4 to prefix_net/8+4.
2768 allocation of result consistently in the correct region.
2769 time_t is now used for ttl in unbound (since the patch's version).
2770 - testdata/dns64_lookup.rpl for unit test for dns64 functionality.
2772 29 July 2014: Wouter
2773 - Patch from Dag-Erling Smorgrav that implements feature, unbound -dd
2774 does not fork in the background and also logs to stderr.
2776 21 July 2014: Wouter
2777 - Fix endian.h include for OpenBSD.
2779 16 July 2014: Wouter
2780 - And Fix#596: Bail out of unbound-control dump_infra when ssl
2783 15 July 2014: Wouter
2784 - Fix #596: Bail out of unbound-control list_local_zones when ssl
2786 - iana portlist update.
2788 13 July 2014: Wouter
2789 - Configure tests if main can be linked to from getentropy compat.
2791 12 July 2014: Wouter
2792 - Fix getentropy compat code, function refs were not portable.
2793 - Fix to check openssl version number only for OpenSSL.
2794 - LibreSSL provides compat items, check for that in configure.
2795 - Fix bug in fix for log locks that caused deadlock in signal handler.
2796 - update compat/getentropy and arc4random to the most recent ones from OpenBSD.
2798 11 July 2014: Matthijs
2799 - fake-rfc2553 patch (thanks Benjamin Baier).
2801 11 July 2014: Wouter
2802 - arc4random in compat/ and getentropy, explicit_bzero, chacha for
2803 dependencies, from OpenBSD. arc4_lock and sha512 in compat.
2804 This makes arc4random available on all platforms, except when
2805 compiled with LIBNSS (it uses libNSS crypto random).
2806 - fix strptime implicit declaration error on OpenBSD.
2807 - arc4random, getentropy and explicit_bzero compat for Windows.
2810 - Fix #593: segfault or crash upon rotating logfile.
2814 - signit tool fixup for compile with libldns library.
2815 - iana portlist updated.
2817 27 June 2014: Wouter
2818 - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X.
2820 26 June 2014: Wouter
2821 - unbound-control status reports if so-reuseport was successful.
2822 - iana portlist updated.
2824 24 June 2014: Wouter
2825 - Fix caps-for-id fallback, and added fallback attempt when servers
2826 drop 0x20 perturbed queries.
2827 - Fixup testsetup for VM tests (run testcode/run_vm.sh).
2829 17 June 2014: Wouter
2830 - iana portlist updated.
2833 - Add AAAA for B root server to default root hints.
2836 - Remove unused define from iterator.h
2839 - Fixup sldns_enum_edns_option typedef definition.
2842 - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue
2843 fixes from FreeBSD's copy of Unbound, he notes:
2844 Generate unbound-control-setup.sh at build time so it respects
2845 prefix and sysconfdir from the configure script. Also fix the
2846 umask to match the comment, and the comment to match the umask.
2847 Add const and static where needed. Use unions instead of
2848 playing pointer poker. Move declarations that are needed in
2849 multiple source files into a shared header. Move sldns_bgetc()
2850 from parse.c to buffer.c where it belongs. Introduce a new
2851 header file, worker.h, which declares the callbacks that
2852 all workers must define. Remove those declarations from
2853 libworker.h. Include the correct headers in the correct places.
2854 Fix a few dummy callbacks that don't match their prototype.
2855 Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK.
2856 Remove a useless printf which breaks reproducible builds.
2857 Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're
2858 no longer used. Add unbound-control-setup.sh to the list of
2859 generated files. The prototype for libworker_event_done_cb()
2860 needs to be moved from libunbound/libworker.h to
2861 libunbound/worker.h.
2862 - Fixup out-of-directory compile with unbound-control-setup.sh.in.
2866 - unbound-host -D enabled dnssec and reads root trust anchor from
2867 the default root key file that was compiled in.
2870 - Feature, unblock-lan-zones: yesno that you can use to make unbound
2871 perform 10.0.0.0/8 and other reverse lookups normally, for use if
2872 unbound is running service for localhost on localhost.
2875 - Updated create_unbound_ad_servers and unbound_cache scripts from
2876 Yuri Voinov in the source/contrib directory. Added
2877 warmup.cmd (and .sh): warm up the DNS cache with your MRU domains.
2880 - Implement draft-ietf-dnsop-rfc6598-rfc6303-01.
2881 - iana portlist updated.
2884 - Contrib windows scripts from Yuri Voinov added to src/contrib:
2885 create_unbound_ad_servers.cmd: enters anti-ad server lists.
2886 unbound_cache.cmd: saves and loads the cache.
2887 - Added unbound-control-setup.cmd from Yuri Voinov to the windows
2888 unbound distribution set. It requires openssl installed in %PATH%.
2891 - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier.
2894 - More #567: remove : from output of stub and forward lists, this is
2897 29 April 2014: Wouter
2898 - iana portlist updated.
2899 - Add unbound-control flush_negative that flushed nxdomains, nodata,
2900 and errors from the cache. For dnssec-trigger and NetworkManager,
2901 fixes cases where network changes have localdata that was already
2902 negatively cached from the previous network.
2904 23 April 2014: Wouter
2905 - Patch from Jeremie Courreges-Anglas to use arc4random_uniform
2906 if available on the OS, it gets entropy from the OS.
2908 15 April 2014: Wouter
2909 - Fix compile with libevent2 on FreeBSD.
2911 11 April 2014: Wouter
2912 - Fix #502: explain that do-ip6 disable does not stop AAAA lookups,
2913 but it stops the use of the ipv6 transport layer for DNS traffic.
2914 - iana portlist updated.
2916 10 April 2014: Wouter
2917 - iana portlist updated.
2918 - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation
2919 option for DNS fragmentation defense.
2920 - Document that dump_requestlist only prints queries from thread 0.
2921 - unbound-control stats prints num.query.tcpout with number of TCP
2922 outgoing queries made in the previous statistics interval.
2923 - Fix #567: unbound lists if forward zone is secure or insecure with
2924 +i annotation in output of list_forwards, also for list_stubs
2925 (for NetworkManager integration.)
2926 - Fix #554: use unsigned long to print 64bit statistics counters on
2928 - Fix #558: failed prefetch lookup does not remove cached response
2929 but delays next prefetch (in lieu of caching a SERVFAIL).
2930 - Fix #545: improved logging, the ip address of the error is printed
2931 on the same log-line as the error.
2933 8 April 2014: Wouter
2934 - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control
2935 in testbound scripts.
2936 - iana portlist updated.
2938 7 April 2014: Wouter
2939 - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root
2940 hints (patch from Anand Buddhdev).
2941 - Fix #572: Fix unit test failure for systems with different
2944 28 March 2014: Wouter
2945 - Fix #569: do_tcp is do-tcp in unbound.conf man page.
2947 25 March 2014: Wouter
2948 - Patch from Stuart Henderson to build unbound-host man from .1.in.
2950 24 March 2014: Wouter
2951 - Fix print filename of encompassing config file on read failure.
2953 12 March 2014: Wouter
2955 - trunk has 1.4.23 in development.
2957 10 March 2014: Wouter
2958 - Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes
2959 because of spelling. Patch from Chris Coates.
2961 27 February 2014: Wouter
2964 21 February 2014: Wouter
2965 - iana portlist updated.
2967 20 February 2014: Matthijs
2968 - Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is
2969 received. This is okay according 4035, but not after revising
2970 existence in 4592. NSEC empty non-terminals exist and thus the
2971 RCODE should have been NOERROR. If this occurs, and the RRsets
2972 are secure, we set the RCODE to NOERROR and the security status
2973 of the response is also considered secure.
2975 14 February 2014: Wouter
2976 - Works on Minix (3.2.1).
2978 11 February 2014: Wouter
2979 - Fix parse of #553(NSD) string in sldns, quotes without spaces.
2981 7 February 2014: Wouter
2982 - iana portlist updated.
2983 - add body to ifstatement if locks disabled.
2984 - add TXT string"string" test case to unit test.
2985 - Fix #551: License change "Regents" to "Copyright holder", matching
2986 the BSD license on opensource.org.
2988 6 February 2014: Wouter
2989 - sldns has type HIP.
2990 - code documentation on the module interface.
2992 5 February 2014: Wouter
2993 - Fix sldns parse tests on osx.
2995 3 February 2014: Wouter
2996 - Detect libevent2 install automatically by configure.
2997 - Fixup link with lib/event2 subdir.
2998 - Fix parse in sldns of quoted parenthesized text strings.
3000 31 January 2014: Wouter
3001 - unit test for ldns wire to str and back with zones, root, nlnetlabs
3003 - Fix for hex to string in unknown, atma and nsap.
3004 - fixup nss compile (no ldns in it).
3005 - fixup warning in unitldns
3006 - fixup WKS and rdata type service to print unsigned because strings
3007 are not portable; they cannot be read (for sure) on other computers.
3008 - fixup type EUI48 and EUI64, type APL and type IPSECKEY in string
3011 30 January 2014: Wouter
3012 - delay-close does not act if there are udp-wait queries, so that
3013 it does not make a socketdrain DoS easier.
3015 28 January 2014: Wouter
3016 - iana portlist updated.
3017 - iana portlist test updated so it does not touch the source
3018 if there are no changes.
3019 - delay-close: msec option that delays closing ports for which
3020 the UDP reply has timed out. Keeps the port open, only accepts
3021 the correct reply. This correct reply is not used, but the port
3022 is open so that no port-denied ICMPs are generated.
3024 27 January 2014: Wouter
3025 - reuseport is attempted, then fallback to without on failure.
3027 24 January 2014: Wouter
3028 - Change unbound-event.h to use void* buffer, length idiom.
3029 - iana portlist updated.
3030 - unbound-event.h is installed if you configure --enable-event-api.
3031 - speed up unbound (reports say it could be up to 10%), by reducing
3032 lock contention on localzones.lock. It is changed to an rwlock.
3033 - so-reuseport: yesno option to distribute queries evenly over
3034 threads on Linux (Thanks Robert Edmonds).
3037 21 January 2014: Wouter
3038 - Fix #547: no trustanchor written if filesystem full, fclose checked.
3040 17 January 2014: Wouter
3041 - Fix isprint() portability in sldns, uses unsigned int.
3042 - iana portlist updated.
3044 16 January 2014: Wouter
3045 - fix #544: Fixed +i causes segfault when running with module conf
3047 - Windows port, adjust %lld to %I64d, and warning in win_event.c.
3049 14 January 2014: Wouter
3050 - iana portlist updated.
3053 - Fix bug in cachedump that uses sldns.
3054 - update pythonmod for ldns_ to sldns_ name change.
3057 - Fix sldns to use sldns_ prefix for all ldns_ variables.
3058 - Fix windows compile to compile with sldns.
3061 - Fix sldns to make globals use sldns_ prefix. This fixes
3062 linking with libldns that uses global variables ldns_ .
3065 - Fix bug#537: compile python plugin without ldns library.
3068 - Fix bug#536: acl_deny_non_local and refuse_non_local added.
3071 - Patch from Neel Goyal to fix async id assignment if callback
3072 is called by libunbound in the mesh attach.
3073 - Accept ip-address: as an alternative for interface: for
3074 consistency with nsd.conf syntax.
3077 - Patch from Neel Goyal to fix callback in libunbound.
3080 - if configured --with-libunbound-only fix make install.
3083 - Fix #531: Set SO_REUSEADDR so that the wildcard interface and a
3084 more specific interface port 53 can be used at the same time, and
3085 one of the daemons is unbound.
3086 - iana portlist update.
3087 - separate ldns into core ldns inside ldns/ subdirectory. No more
3088 --with-ldns is needed and unbound does not rely on libldns.
3089 - portability fixes for new USE_SLDNS ldns subdir codebase.
3092 - Patch from Neel Goyal: Add an API call to set an event base on an
3093 existing ub_ctx. This basically just destroys the current worker and
3094 sets the event base to the current. And fix a deadlock in
3095 ub_resolve_event – the cfglock is held when libworker_create is
3096 called. This ends up trying to acquire the lock again in
3097 context_obtain_alloc in the call chain.
3098 - Fix #528: if very high logging (4 or more) segfault on allow_snoop.
3101 - unbound-event.h is installed if configured --with-libevent. It
3102 contains low-level library calls, that use libevent's event_base
3103 and an ldns_buffer for the wire return packet to perform async
3104 resolution in the client's eventloop.
3107 - 1.4.21 tag created.
3108 - trunk has 1.4.22 number inside it.
3109 - iana portlist updated.
3110 - acx_nlnetlabs.m4 to 26; improve FLTO help text.
3113 - Fix#524: max-udp-size not effective to non-EDNS0 queries, from
3117 - MIN_TTL and MAX_TTL also in time_t.
3118 - tag 1.4.21rc1 made again.
3121 - More fixes for bug#519: for the threaded case test if the bg
3122 thread has been killed, on ub_ctx_delete, to avoid hangs.
3125 - more fixes that I overlooked.
3126 - review fixes from Willem.
3129 - Fix#520: Errors found by static analysis from Tomas Hozza(redhat).
3132 - Fix for 2038, with time_t instead of uint32_t.
3135 - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound).
3138 - Fix uninit variable in fix#516.
3141 - Fix#516 dnssec lameness detection for answers that are improper.
3147 - Fix#512 memleak in testcode for testbound (if it fails).
3148 - Fix#512 NSS returned arrays out of setup function to be statics.
3151 - max include of 100.000 files (depth and globbed at one time).
3152 This is to preserve system memory in bug cases, or endless cases.
3153 - iana portlist updated.
3156 - streamtcp man page, contributed by Tomas Hozza.
3157 - iana portlist updated.
3158 - libunbound documentation on how to avoid openssl race conditions.
3161 - Squelch sendto-permission denied errors when the network is
3162 not connected, to avoid spamming syslog.
3163 - configure --disable-flto option (from Robert Edmonds).
3166 - Fix for const string literals in C++ for libunbound, from Karel
3168 - iana portlist updated.
3171 - Fixup manpage syntax.
3174 - get_option and set_option support for log-time-ascii, python-script
3175 val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect
3176 immediately. The others are mostly useful for libunbound users.
3179 - get_option, set_option, unbound-checkconf -o and libunbound
3180 getoption and setoption support cache-min-ttl and cache-max-ttl.
3183 - Fix#501: forward-first does not recurse, when forward name is ".".
3184 - iana portlist update.
3185 - Max include depth is unlimited.
3188 - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply
3189 patch to it to not fail when -Werror is also specified, from the
3191 - iana portlist update.
3194 - Explain bogus and secure flags in libunbound more.
3197 - Fix#499 use-after-free in out-of-memory handling code (thanks Jake
3199 - Fix#500 use on non-initialised values on socket bind failures.
3202 - Fix round-robin doesn't work with some Windows clients (from Ilya
3206 - update acx_nlnetlabs.m4 to v23, sleep w32 fix.
3208 26 April 2013: Wouter
3209 - add unbound-control insecure_add and insecure_remove for the
3210 administration of negative trust anchors.
3212 25 April 2013: Wouter
3213 - Implement max-udp-size config option, default 4096 (thanks
3215 - Robust checks on dname validity from rdata for dname compare.
3216 - updated iana portlist.
3218 19 April 2013: Wouter
3219 - Fixup snprintf return value usage, fixed libunbound_get_option.
3221 18 April 2013: Wouter
3222 - fix bug #491: pick program name (0th argument) as syslog identity.
3223 - own implementation of compat/snprintf.c.
3225 15 April 2013: Wouter
3226 - Fix so that for a configuration line of include: "*.conf" it is not
3227 an error if there are no files matching the glob pattern.
3228 - unbound-anchor review: BIO_write can return 0 successfully if it
3229 has successfully appended a zero length string.
3231 11 April 2013: Wouter
3232 - Fix queries leaking up for stubs and forwards, if the configured
3233 nameservers all fail to answer.
3235 10 April 2013: Wouter
3236 - code improve for minimal responses, small speed increase.
3238 9 April 2013: Wouter
3239 - updated iana portlist.
3240 - Fix crash in previous private address fixup of 22 March.
3242 28 March 2013: Wouter
3243 - Make reverse zones easier by documenting the nodefault statements
3244 commented-out in the example config file.
3246 26 March 2013: Wouter
3247 - more fixes to lookup3.c endianness detection.
3249 25 March 2013: Wouter
3250 - #492: Fix endianness detection, revert to older lookup3.c detection
3251 and put new detect lines after previous tests, to avoid regressions
3252 but allow new detections to succeed.
3253 And add detection for machine/endian.h to it.
3255 22 March 2013: Wouter
3256 - Fix resolve of names that use a mix of public and private addresses.
3257 - iana portlist update.
3258 - Fix makedist for new svn for -d option.
3259 - unbound.h header file has UNBOUND_VERSION_MAJOR define.
3260 - Fix windows RSRC version for long version numbers.
3262 21 March 2013: Wouter
3265 - committed libunbound version 4:1:2 for binary API updated in 1.4.20
3266 - install copy of unbound-control.8 man page for unbound-control-setup
3268 14 March 2013: Wouter
3269 - iana portlist update.
3272 12 March 2013: Wouter
3273 - Fixup makedist.sh for windows compile.
3275 11 March 2013: Wouter
3276 - iana portlist update.
3277 - testcode/ldns-testpkts.c check for makedist is informational.
3279 15 February 2013: Wouter
3280 - fix defines in lookup3 for bigendian bsd alpha
3282 11 February 2013: Wouter
3283 - Fixup openssl_thread init code to only run if compiled with SSL.
3285 7 February 2013: Wouter
3286 - detect endianness in lookup3 on BSD.
3287 - add libunbound.ttl at end of result structure, version bump for
3288 libunbound and binary backwards compatible, but 1.4.19 is not
3289 forward compatible with 1.4.20.
3290 - update iana port list.
3292 30 January 2013: Wouter
3293 - includes and have_ssl fixes for nss.
3295 29 January 2013: Wouter
3296 - printout name of zone with duplicate fwd and hint errors.
3298 28 January 2013: Wouter
3299 - updated fwd_zero for newer nc. Updated common.sh for newer netstat.
3301 17 January 2013: Wouter
3302 - unbound-anchors checks the emailAddress of the signer of the
3303 root.xml file, default is dnssec@iana.org. It also checks that
3304 the signer has the correct key usage for a digital signature.
3305 - update iana port list.
3307 3 January 2013: Wouter
3308 - Test that unbound-control checks client credentials.
3309 - Test that unbound can handle a CNAME at an intermediate node in
3310 the chain of trust (where it seeks a DS record).
3311 - Check the commonName of the signer of the root.xml file in
3312 unbound-anchor, default is dnssec@iana.org.
3314 2 January 2013: Wouter
3315 - Fix openssl lock free on exit (reported by Robert Fleischman).
3316 - iana portlist updated.
3317 - Tested that unbound implements the RFC5155 Technical Errata id 3441.
3318 Unbound already implements insecure classification of an empty
3319 nonterminal in NSEC3 optout zone.
3321 20 December 2012: Wouter
3322 - Fix unbound-anchor xml parse of entity declarations for safety.
3324 19 December 2012: Wouter
3325 - iana portlist updated.
3327 18 December 2012: Wouter
3328 - iana portlist updated.
3330 14 December 2012: Wouter
3331 - Change of D.ROOT-SERVERS.NET A address in default root hints.
3333 12 December 2012: Wouter
3335 - trunk has 1.4.20 under development.
3337 5 December 2012: Wouter
3338 - note support for AAAA RR type RFC.
3340 4 December 2012: Wouter
3343 30 November 2012: Wouter
3344 - bug 481: fix python example0.
3345 - iana portlist updated.
3347 27 November 2012: Wouter
3348 - iana portlist updated.
3350 9 November 2012: Wouter
3351 - Fix unbound-control forward disables configured stubs below it.
3353 7 November 2012: Wouter
3354 - Fixup ldns-testpkts, identical to ldns/examples.
3355 - iana portlist updated.
3357 30 October 2012: Wouter
3358 - Fix bug #477: unbound-anchor segfaults if EDNS is blocked.
3360 29 October 2012: Matthijs
3361 - Fix validation for responses with both CNAME and wildcard
3362 expanded CNAME records in answer section.
3364 8 October 2012: Wouter
3365 - update ldns-testpkts.c to ldns 1.6.14 version.
3366 - fix build of pythonmod in objdir, for unbound.py.
3367 - make clean and makerealclean remove generated python and docs.
3369 5 October 2012: Wouter
3370 - fix build of pythonmod in objdir (thanks Jakob Schlyter).
3372 3 October 2012: Wouter
3373 - fix text in unbound-anchor man page.
3375 1 October 2012: Wouter
3376 - ignore trusted-keys globs that have no files (from Paul Wouters).
3378 27 September 2012: Wouter
3379 - include: directive in config file accepts wildcards. Patch from
3380 Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*"
3381 - unbound-control -q option is quiet, patch from Mariano Absatz.
3382 - iana portlist updated.
3383 - updated contrib/unbound.spec, patch from Valentin Bud.
3385 21 September 2012: Wouter
3386 - chdir to / after chroot call (suggested by Camiel Dobbelaar).
3388 17 September 2012: Wouter
3389 - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation
3390 otherwise it is treated as insecure. The RSAMD5 algorithm is
3391 deprecated (RFC6725). The MD5 hash is considered weak for some
3392 purposes, if you want to sign your zone, then RSASHA256 is an
3395 30 August 2012: Wouter
3396 - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled.
3397 - iana portlist updated.
3399 29 August 2012: Wouter
3400 - Nicer comments outgoing-port-avoid, thanks Stu (bug #465).
3402 22 August 2012: Wouter
3403 - Fallback to 1472 and 1232, one fragment size without headers.
3405 21 August 2012: Wouter
3406 - Fix timeouts so that when a server has been offline for a while
3407 and is probed to see it works, it becomes fully available for
3408 server selection again.
3410 17 August 2012: Wouter
3411 - Add documentation to libunbound for default nonuse of resolv.conf.
3413 2 August 2012: Wouter
3414 - trunk has 1.4.19 under development (fixes from 1 aug and 31 july
3416 - iana portlist updated.
3418 1 August 2012: Wouter
3419 - Fix openssl race condition, initializes openssl locks, reported
3420 by Einar Lonn and Patrik Wallstrom.
3422 31 July 2012: Wouter
3423 - Improved forward-first and stub-first documentation.
3424 - Fix that enables modules to register twice for the same
3425 serviced_query, without race conditions or administration issues.
3426 This should not happen with the current codebase, but it is robust.
3427 - Fix forward-first option where it sets the RD flag wrongly.
3428 - added manpage links for libunbound calls (Thanks Paul Wouters).
3430 30 July 2012: Wouter
3431 - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012).
3433 27 July 2012: Wouter
3434 - unbound-host works with libNSS
3435 - fix bogus nodata cname chain not reported as bogus by validator,
3436 (Thanks Peter van Dijk).
3438 26 July 2012: Wouter
3439 - iana portlist updated.
3442 25 July 2012: Wouter
3443 - review fix for libnss, check hash prefix allocation size.
3445 23 July 2012: Wouter
3446 - fix missing break for GOST DS hash function.
3447 - implemented forward_first for the root.
3449 20 July 2012: Wouter
3450 - Fix bug#452 and another assertion failure in mesh.c, makes
3451 assertions in mesh.c resist duplicates. Fixes DS NS search to
3452 not generate duplicate sub queries.
3454 19 July 2012: Willem
3455 - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac,
3456 if CFLAGS is specified at configure time then '-g -O2' is not
3457 appended to CFLAGS, so that the user can override them.
3459 18 July 2012: Willem
3460 - Fix libunbound report of errors when in background mode.
3462 11 July 2012: Willem
3463 - updated iana ports list.
3466 - Add flush_bogus option for unbound-control
3469 - Fix validation of qtype DS queries that result in no data for
3470 non-optout NSEC3 zones.
3473 - compile libunbound with libnss on Suse, passes regression tests.
3476 - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.
3479 - updated iana ports list.
3481 29 June 2012: Wouter
3482 - patch for unbound_munin_ script to handle arbitrary thread count by
3485 28 June 2012: Wouter
3486 - detect if openssl has FIPS_mode.
3487 - code review: return value of cache_store can be ignored for better
3488 performance in out of memory conditions.
3489 - fix edns-buffer-size and msg-buffer-size manpage documentation.
3490 - updated iana ports list.
3492 25 June 2012: Wouter
3493 - disable RSAMD5 if in FIPS mode (for openssl and for libnss).
3495 22 June 2012: Wouter
3496 - implement DS records, NSEC3 and ECDSA for compile with libnss.
3498 21 June 2012: Wouter
3499 - fix error handling of alloc failure during rrsig verification.
3500 - nss check for verification failure.
3501 - nss crypto works for RSA and DSA.
3503 20 June 2012: Wouter
3504 - work on --with-nss build option (for now, --with-libunbound-only).
3506 19 June 2012: Wouter
3507 - --with-libunbound-only build option, only builds the library and
3508 not the daemon and other tools.
3510 18 June 2012: Wouter
3513 15 June 2012: Wouter
3514 - implement log-time-ascii on windows.
3515 - The key-cache bad key ttl is now 60 seconds.
3516 - updated iana ports list.
3519 11 June 2012: Wouter
3520 - bug #452: fix crash on assert in mesh_state_attachment.
3523 - silence warning from swig-generated code (md set but not used in
3524 swig initmodule, due to ifdefs in swig-generated code).
3527 - Fix debian-bugs-658021: Please enable hardened build flags.
3530 - updated iana ports list.
3533 - tag for 1.4.17 release.
3534 - trunk is 1.4.18 in development.
3537 - Review comments, removed duplicate memset to zero in delegpt.
3540 - Updated doc/FEATURES with RFCs that are implemented but not listed.
3541 - Protect if statements in val_anchor for compile without locks.
3542 - tag for 1.4.17rc1.
3545 - fix configure ECDSA support in ldns detection for windows compile.
3546 - fix possible uninitialised variable in windows pipe implementation.
3549 - Fix alignment problem in util/random on sparc64/freebsd.
3552 - Fix for accept spinning reported by OpenBSD.
3553 - iana portlist updated.
3556 - Fix validation of nodata for DS query in NSEC zones, reported by
3559 13 April 2012: Wouter
3560 - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older
3563 10 April 2012: Wouter
3564 - Applied patch from Daisuke HIGASHI for rrset-roundrobin and
3565 minimal-responses features.
3566 - iana portlist updated.
3568 5 April 2012: Wouter
3569 - fix bug #443: --with-chroot-dir not honoured by configure.
3570 - fix bug #444: setusercontext was called too late (thanks Bjorn
3573 27 March 2012: Wouter
3574 - fix bug #442: Fix that Makefile depends on pythonmod headers
3575 even using --without-pythonmodule.
3577 22 March 2012: Wouter
3578 - contrib/validation-reporter follows rotated log file (patch from
3581 21 March 2012: Wouter
3582 - new approach to NS fetches for DS lookup that works with
3583 cornercases, and is more robust and considers forwarders.
3585 19 March 2012: Wouter
3586 - iana portlist updated.
3587 - fix to locate nameservers for DS lookup with NS fetches.
3589 16 March 2012: Wouter
3590 - Patch for access to full DNS packet data in unbound python module
3593 9 March 2012: Wouter
3594 - Applied line-buffer patch from Augie Schwer to validation.reporter.sh.
3596 2 March 2012: Wouter
3597 - flush_infra cleans timeouted servers from the cache too.
3598 - removed warning from --enable-ecdsa.
3600 1 March 2012: Wouter
3601 - forward-first option. Tries without forward if a query fails.
3602 Also stub-first option that is similar.
3604 28 February 2012: Wouter
3605 - Fix from code review, if EINPROGRESS not defined chain if statement
3608 27 February 2012: Wouter
3609 - Fix bug#434: on windows check registry for config file location
3610 for unbound-control.exe, and unbound-checkconf.exe.
3612 23 February 2012: Wouter
3613 - Fix to squelch 'network unreachable' errors from tcp connect in
3614 logs, high verbosity will show them.
3616 16 February 2012: Wouter
3617 - iter_hints is now thread-owned in module env, and thus threadsafe.
3618 - Fix prefetch and sticky NS, now the prefetch works. It picks
3619 nameservers that 'would be valid in the future', and if this makes
3620 the NS timeout, it updates that NS by asking delegation from the
3621 parent again. If child NS has longer TTL, that TTL does not get
3622 refreshed from the lookup to the child nameserver.
3624 15 February 2012: Wouter
3625 - Fix forward-zone memory, uses malloc and frees original root dp.
3626 - iter hints (stubs) uses malloc inside for more dynamicity.
3627 - unbound-control forward_add, forward_remove, stub_add, stub_remove
3628 can modify stubs and forwards for running unbound (on mobile computer)
3629 they can also add and remove domain-insecure for the zone.
3631 14 February 2012: Wouter
3632 - Fix sticky NS (ghost domain problem) if prefetch is yes.
3633 - iter forwards uses malloc inside for more dynamicity.
3635 13 February 2012: Wouter
3636 - RT#2955. Fix for cygwin compilation.
3637 - iana portlist updated.
3639 10 February 2012: Wouter
3640 - Slightly smaller critical region in one case in infra cache.
3641 - Fix timeouts to keep track of query type, A, AAAA and other, if
3642 another has caused timeout blacklist, different type can still probe.
3643 - unit test fix for nomem_cnametopos.rpl race condition.
3645 9 February 2012: Wouter
3646 - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h.
3648 8 February 2012: Wouter
3649 - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This
3650 implementation is experimental at this time and not recommended
3651 for use on the public internet (the protocol numbers have not
3652 been assigned). Needs recent ldns with --enable-ecdsa.
3653 - fix memory leak in errorcase for DSA signatures.
3654 - iana portlist updated.
3655 - workaround for openssl 0.9.8 ecdsa sha2 and evp problem.
3657 3 February 2012: Wouter
3658 - fix for windows, rename() is not posix compliant on windows.
3660 2 February 2012: Wouter
3661 - 1.4.16 release tag.
3662 - svn trunk is 1.4.17 in development.
3663 - iana portlist updated.
3665 1 February 2012: Wouter
3666 - Fix validation failures (like: validation failure xx: no NSEC3
3667 closest encloser from yy for DS zz. while building chain of trust,
3668 because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata
3669 for an NSEC3. Now it does not change rdata, and fixes TTL.
3671 30 January 2012: Wouter
3672 - Fix version-number in libtool to be version-info so it produces
3673 libunbound.so.2 like it should.
3675 26 January 2012: Wouter
3676 - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release.
3677 - trunk 1.4.16; includes changes memset testcode, #424 openindiana,
3678 and keyfile write fixup.
3679 - applied patch to support outgoing-interface with ub_ctx_set_option.
3681 23 January 2012: Wouter
3682 - Fix memset in test code.
3684 20 January 2012: Wouter
3685 - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2.
3687 19 January 2012: Wouter
3688 - Fix to write key files completely to a temporary file, and if that
3689 succeeds, replace the real key file. So failures leave a useful file.
3691 18 January 2012: Wouter
3692 - tag 1.4.15rc1 created
3693 - updated libunbound/ubsyms.def and remade tag 1.4.15rc1.
3695 17 January 2012: Wouter
3696 - Fix bug where canonical_compare of RRSIG did not downcase the
3697 signer-name. This is mostly harmless because RRSIGs do not have
3698 to be sorted in canonical order, usually.
3700 12 January 2012: Wouter
3701 - bug#428: add ub_version() call to libunbound. API version increase,
3702 with (binary) backwards compatibility for the previous version.
3704 10 January 2012: Wouter
3705 - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL
3706 that would be permissible by the RFCs but it is not the TTL in the
3708 - iana portlist updated.
3709 - uninitialised variable in reprobe for rtt blocked domains fixed.
3710 - lintfix and new flex output.
3712 2 January 2012: Wouter
3713 - Fix to randomize hash function, based on 28c3 congress, reported
3716 24 December 2011: Wouter
3717 - Fix for memory leak (about 20 bytes when a tcp or udp send operation
3718 towards authority servers failed, takes about 50.000 such failures to
3719 leak one Mb, such failures are also usually logged), reported by
3721 - iana portlist updated.
3723 19 December 2011: Wouter
3724 - Fix for VU#209659 CVE-2011-4528: Unbound denial of service
3725 vulnerabilities from nonstandard redirection and denial of existence
3726 http://www.unbound.net/downloads/CVE-2011-4528.txt
3727 - robust checks for next-closer NSEC3s.
3728 - tag 1.4.14 created.
3729 - trunk has 1.4.15 in development.
3731 15 December 2011: Wouter
3732 - remove uninit warning from cachedump code.
3733 - Fix parse error on negative SOA RRSIGs if badly ordered in the packet.
3735 13 December 2011: Wouter
3736 - iana portlist updated.
3738 - fix infra cache comparison.
3739 - Fix to constrain signer_name to be a parent of the lookupname.
3741 5 December 2011: Wouter
3742 - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
3743 - Fix warnings with gcc 4.6 in compat/inet_ntop.c.
3744 - Fix warning unused in compat/strptime.c.
3745 - Fix malloc detection and double definition.
3747 2 December 2011: Wouter
3748 - configure generated with autoconf 2.68.
3750 30 November 2011: Wouter
3751 - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes
3752 SERVFAILs. Also fixed for UDP (but less likely).
3754 28 November 2011: Wouter
3755 - Fix quartile time estimate, it was too low, (thanks Jan Komissar).
3756 - iana ports updated.
3758 11 November 2011: Wouter
3759 - Makefile compat with SunOS make, BSD make and GNU make.
3760 - iana ports updated.
3762 10 November 2011: Wouter
3763 - Makefile changed for BSD make compatibility.
3765 9 November 2011: Wouter
3766 - added unit test for SSL service and SSL-upstream.
3768 8 November 2011: Wouter
3769 - can configure ssl service to one port number, and not on others.
3770 - fixup windows compile with ssl support.
3771 - Fix double free in unbound-host, reported by Steve Grubb.
3772 - iana portlist updated.
3774 1 November 2011: Wouter
3775 - dns over ssl support as a client, ssl-upstream yes turns it on.
3776 It performs an SSL transaction for every DNS query (250 msec).
3777 - documentation for new options: ssl-upstream, ssl-service-key and
3779 - iana portlist updated.
3780 - fix -flto detection on Lion for llvm-gcc.
3782 31 October 2011: Wouter
3783 - dns over ssl support, ssl-service-pem and ssl-service-key files
3784 can be given and then TCP queries are serviced wrapped in SSL.
3786 27 October 2011: Wouter
3787 - lame-ttl and lame-size options no longer exist, it is integrated
3788 with the host info. They are ignored (with verbose warning) if
3789 encountered to keep the config file backwards compatible.
3790 - fix iana-update for changing gzip compression of results.
3791 - fix export-all-symbols on OSX.
3793 26 October 2011: Wouter
3794 - iana portlist updated.
3795 - Infra cache stores information about ping and lameness per IP, zone.
3796 This fixes bug #416.
3797 - fix iana_update target for gzipped file on iana site.
3799 24 October 2011: Wouter
3800 - Fix resolve of partners.extranet.microsoft.com with a fix for the
3801 server selection for choosing out of a (particular) list of bad
3803 - Fix make_new_space function so that the incoming query is not
3804 overwritten if a jostled out query causes a waiting query to be
3805 resumed that then fails and sends an error message. (Thanks to
3808 21 October 2011: Wouter
3809 - fix --enable-allsymbols, fptr wlist is disabled on windows with this
3810 option enabled because of memory layout exe vs dll.
3812 19 October 2011: Wouter
3813 - fix unbound-anchor for broken strptime on OSX lion, detected
3815 - Detect if GOST really works, openssl1.0 on OSX fails.
3816 - Implement ipv6%interface notation for scope_id usage.
3818 17 October 2011: Wouter
3819 - better documentation for inform_super (Thanks Yang Zhe).
3821 14 October 2011: Wouter
3822 - Fix for out-of-memory condition in libunbound (thanks
3825 13 October 2011: Wouter
3826 - Fix --enable-allsymbols, it depended on link specifics of the
3827 target platform, or fptr_wlist assertion failures could occur.
3829 12 October 2011: Wouter
3830 - updated contrib/unbound_munin_ to family=auto so that it works with
3831 munin-node-configure automatically (if installed as
3832 /usr/local/share/munin/plugins/unbound_munin_ ).
3834 27 September 2011: Wouter
3835 - unbound.exe -w windows option for start and stop service.
3837 23 September 2011: Wouter
3838 - TCP-upstream calculates tcp-ping so server selection works if there
3841 20 September 2011: Wouter
3842 - Fix classification of NS set in answer section, where there is a
3843 parent-child server, and the answer has the AA flag for dir.slb.com.
3844 Thanks to Amanda Constant from Secure64.
3846 16 September 2011: Wouter
3847 - fix bug #408: accept patch from Steve Snyder that comments out
3848 unused functions in lookup3.c.
3849 - iana portlist updated.
3850 - fix EDNS1480 change memleak and TCP fallback.
3851 - fix various compiler warnings (reported by Paul Wouters).
3852 - max sent count. EDNS1480 only for rtt < 5000. No promiscuous
3853 fetch if sentcount > 3, stop query if sentcount > 16. Count is
3854 reset when referral or CNAME happens. This makes unbound better
3855 at managing large NS sets, they are explored when there is continued
3856 interest (in the form of queries).
3858 15 September 2011: Wouter
3860 - trunk contains 1.4.14 in development.
3861 - Unbound probes at EDNS1480 if there an EDNS0 timeout.
3863 12 September 2011: Wouter
3864 - Reverted dns EDNS backoff fix, it did not help and needs
3865 fragmentation fixes instead.
3868 7 September 2011: Wouter
3869 - Fix operation in ipv6 only (do-ip4: no) mode.
3871 6 September 2011: Wouter
3872 - fedora specfile updated.
3874 5 September 2011: Wouter
3877 2 September 2011: Wouter
3878 - iana portlist updated.
3880 26 August 2011: Wouter
3881 - Fix num-threads 0 does not segfault, reported by Simon Deziel.
3882 - Fix validation failures due to EDNS backoff retries, the retry
3883 for fetch of data has want_dnssec because the iter_indicate_dnssec
3884 function returns true when validation failure retry happens, and
3885 then the serviced query code does not fallback to noEDNS, even if
3886 the cache says it has this. This helps for DLV deployment when
3887 the DNSSEC status is not known for sure before the lookup concludes.
3889 24 August 2011: Wouter
3890 - Applied patch from Karel Slany that fixes a memory leak in the
3891 unbound python module, in string conversions.
3893 22 August 2011: Wouter
3894 - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy
3895 Zhang and Luo Ce). Unbound responds with the RR types that are
3896 available at the name for qtype ANY and validates those RR types.
3897 It does not test for completeness (i.e. with NSEC or NSEC3 query),
3898 and it does not follow the CNAME or DNAME to another name (with
3899 even more data for the already large response).
3900 - Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
3901 - Documented the options that work with control set_option command.
3902 - tcp-upstream yes/no option (works with set_option) for tunnels.
3904 18 August 2011: Wouter
3905 - fix autoconf call in makedist crosscompile to RC or snapshot.
3907 17 August 2011: Wouter
3908 - Fix validation of . DS query.
3909 - new xml format at IANA, new awk for iana_update.
3910 - iana portlist updated.
3912 10 August 2011: Wouter
3913 - Fix python site-packages path to /usr/lib64.
3914 - updated patch from Tom.
3915 - fix memory and fd leak after out-of-memory condition.
3917 9 August 2011: Wouter
3918 - patch from Tom Hendrikx fixes load of python modules.
3920 8 August 2011: Wouter
3921 - make clean had ldns-src reference, removed.
3923 1 August 2011: Wouter
3924 - Fix autoconf 2.68 warnings
3926 14 July 2011: Wouter
3927 - Unbound implements RFC6303 (since version 1.4.7).
3928 - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
3929 meantime, those are for 1.4.13).
3930 - iana portlist updated.
3932 13 July 2011: Wouter
3933 - Quick fix for contrib/unbound.spec example, no ldns-builtin any more.
3935 11 July 2011: Wouter
3936 - Fix wildcard expansion no-data reply under an optout NSEC3 zone is
3937 validated as insecure, reported by Jia Li (lijia@cnnic.cn).
3940 - 1.4.12rc1 tag created.
3943 - version number in example config file.
3944 - fix that --enable-static-exe does not complain about it unknown.
3946 30 June 2011: Wouter
3947 - tag relase 1.4.11, trunk is 1.4.12 development.
3948 - iana portlist updated.
3949 - fix bug#395: id bits of other query may leak out under conditions
3950 - fix replyaddr count wrong after jostled queries, which leads to
3951 eventual starvation where the daemon has no replyaddrs left to use.
3952 - fix comment about rndc port, that referred to the old port number.
3953 - fix that the listening socket is not closed when too many remote
3954 control connections are made at the same time.
3955 - removed ldns-src tarball inside the unbound tarball.
3957 23 June 2011: Wouter
3958 - Changed -flto check to support clang compiler.
3959 - tag 1.4.11rc3 created.
3961 17 June 2011: Wouter
3962 - tag 1.4.11rc1 created.
3963 - remove warning about signed/unsigned from flex (other flex version).
3964 - updated aclocal.m4 and libtool to match.
3965 - tag 1.4.11rc2 created.
3967 16 June 2011: Wouter
3968 - log-queries: yesno option, default is no, prints querylog.
3969 - version is 1.4.11.
3971 14 June 2011: Wouter
3972 - Use -flto compiler flag for link time optimization, if supported.
3973 - iana portlist updated.
3975 12 June 2011: Wouter
3976 - IPv6 service address for d.root-servers.net (2001:500:2D::D).
3978 10 June 2011: Wouter
3979 - unbound-control has version number in the header,
3980 UBCT[version]_space_ is the header sent by the client now.
3981 - Unbound control port number is registered with IANA:
3982 ub-dns-control 8953/tcp unbound dns nameserver control
3983 This is the new default for the control-port config setting.
3984 - statistics-interval prints the number of jostled queries to log.
3987 - Fix Makefile for U in environment, since wrong U is more common than
3988 deansification necessity.
3989 - iana portlist updated.
3990 - updated ldns tarball to 1.6.10rc2 snapshot of today.
3993 - Fix assertion failure when unbound generates an empty error reply
3994 in response to a query, CVE-2011-1922 VU#531342.
3995 - This fix is in tag 1.4.10.
3996 - defense in depth against the above bug, an error is printed to log
3997 instead of an assertion failure.
4000 - bug#386: --enable-allsymbols option links all binaries to libunbound
4001 and reduces install size significantly.
4002 - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
4003 - iana portlist updated.
4004 - Fix TTL of SOA so negative TTL is separately cached from normal TTL.
4006 14 April 2011: Wouter
4007 - configure created with newer autoconf 2.66.
4009 12 April 2011: Wouter
4010 - bug#378: Fix that configure checks for ldns_get_random presence.
4012 8 April 2011: Wouter
4013 - iana portlist updated.
4014 - queries with CD flag set cause DNSSEC validation, but the answer is
4015 not withheld if it is bogus. Thus, unbound will retry if it is bad
4016 and curb the TTL if it is bad, thus protecting the cache for use by
4017 downstream validators.
4018 - val-override-date: -1 ignores dates entirely, for NTP usage.
4020 29 March 2011: Wouter
4021 - harden-below-nxdomain: changed so that it activates when the
4022 cached nxdomain is dnssec secure. This avoids backwards
4023 incompatibility because those old servers do not have dnssec.
4025 24 March 2011: Wouter
4026 - iana portlist updated.
4030 17 March 2011: Wouter
4031 - bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
4032 Applied but did not do the --disable-gost.
4034 10 March 2011: Wouter
4035 - tag 1.4.9 release candidate 1 created.
4037 3 March 2011: Wouter
4038 - updated ldns to today.
4040 1 March 2011: Wouter
4041 - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
4042 - give config parse error for multiple names on a stub or forward zone.
4043 - updated ldns tarball to 1.6.9(todays snapshot).
4045 24 February 2011: Wouter
4046 - bug #361: Fix, time.elapsed variable not reset with stats_noreset.
4048 23 February 2011: Wouter
4049 - iana portlist updated.
4050 - common.sh to version 3.
4052 18 February 2011: Wouter
4053 - common.sh in testdata updated to version 2.
4055 15 February 2011: Wouter
4056 - Added explicit note on unbound-anchor usage:
4057 Please note usage of unbound-anchor root anchor is at your own risk
4058 and under the terms of our LICENSE (see that file in the source).
4060 11 February 2011: Wouter
4061 - iana portlist updated.
4062 - tpkg updated with common.sh for common functionality.
4064 7 February 2011: Wouter
4065 - Added regression test for addition of a .net DS to the root, and
4066 cache effects with different TTL for glue and DNSKEY.
4067 - iana portlist updated.
4069 28 January 2011: Wouter
4070 - Fix remove private address does not throw away entire response.
4072 24 January 2011: Wouter
4075 19 January 2011: Wouter
4076 - fix bug#349: no -L/usr for ldns.
4078 18 January 2011: Wouter
4079 - ldns 1.6.8 tarball included.
4082 17 January 2011: Wouter
4083 - add get and set option for harden-below-nxdomain feature.
4084 - iana portlist updated.
4086 14 January 2011: Wouter
4087 - Fix so a changed NS RRset does not get moved name stuck on old
4088 server, for type NS the TTL is not increased.
4090 13 January 2011: Wouter
4091 - Fix prefetch so it does not get stuck on old server for moved names.
4093 12 January 2011: Wouter
4094 - iana portlist updated.
4096 11 January 2011: Wouter
4097 - Fix insecure CNAME sequence marked as secure, reported by Bert
4100 10 January 2011: Wouter
4101 - faster lruhash get_mem routine.
4103 4 January 2011: Wouter
4104 - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root.
4105 - iana portlist updated.
4107 23 December 2010: Wouter
4108 - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
4110 21 December 2010: Wouter
4111 - algorithm compromise protection using the algorithms signalled in
4112 the DS record. Also, trust anchors, DLV, and RFC5011 receive this,
4113 and thus, if you have multiple algorithms in your trust-anchor-file
4114 then it will now behave different than before. Also, 5011 rollover
4115 for algorithms needs to be double-signature until the old algorithm
4117 It is not an option, because I see no use to turn the security off.
4118 - iana portlist updated.
4120 17 December 2010: Wouter
4121 - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them).
4122 - fix validation in this case: CNAME to nodata for co-hosted opt-in
4123 NSEC3 insecure delegation, was bogus, fixed to be insecure.
4125 16 December 2010: Wouter
4126 - Fix our 'BDS' license (typo reported by Xavier Belanger).
4128 10 December 2010: Wouter
4129 - iana portlist updated.
4130 - review changes for unbound-anchor.
4132 2 December 2010: Wouter
4133 - feature typetransparent localzone, does not block other RR types.
4135 1 December 2010: Wouter
4136 - Fix bug#338: print address when socket creation fails.
4138 30 November 2010: Wouter
4139 - Fix storage of EDNS failures in the infra cache.
4140 - iana portlist updated.
4142 18 November 2010: Wouter
4143 - harden-below-nxdomain option, default off (because very old
4144 software may be incompatible). We could enable it by default in
4147 17 November 2010: Wouter
4148 - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
4149 - make test output nicer.
4151 15 November 2010: Wouter
4152 - silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
4153 - iana portlist updated.
4154 - so-sndbuf option for very busy servers, a bit like so-rcvbuf.
4156 9 November 2010: Wouter
4157 - unbound-anchor compiles with openssl 0.9.7.
4159 8 November 2010: Wouter
4160 - release tag 1.4.7.
4161 - trunk is version 1.4.8.
4162 - Be lenient and accept imgw.pl malformed packet (like BIND).
4164 5 November 2010: Wouter
4165 - do not synthesize a CNAME message from cache for qtype DS.
4167 4 November 2010: Wouter
4168 - Use central entropy to seed threads.
4170 3 November 2010: Wouter
4171 - Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
4173 2 November 2010: Wouter
4177 1 November 2010: Wouter
4178 - GOST code enabled by default (RFC 5933).
4180 27 October 2010: Wouter
4181 - Fix uninit value in dump_infra print.
4182 - Fix validation failure for parent and child on same server with an
4183 insecure childzone and a CNAME from parent to child.
4184 - Configure detects libev-4.00.
4186 26 October 2010: Wouter
4187 - dump_infra and flush_infra commands for unbound-control.
4188 - no timeout backoff if meanwhile a query succeeded.
4189 - Change of timeout code. No more lost and backoff in blockage.
4190 At 12sec timeout (and at least 2x lost before) one probe per IP
4191 is allowed only. At 120sec, the IP is blocked. After 15min, a
4192 120sec entry has a single retry packet.
4194 25 October 2010: Wouter
4195 - Configure errors if ldns is not found.
4197 22 October 2010: Wouter
4198 - Windows 7 fix for the installer.
4200 21 October 2010: Wouter
4201 - Fix bug where fallback_tcp causes wrong roundtrip and edns
4202 observation to be noted in cache. Fix bug where EDNSprobe halted
4203 exponential backoff if EDNS status unknown.
4204 - new unresponsive host method, exponentially increasing block backoff.
4205 - iana portlist updated.
4207 20 October 2010: Wouter
4208 - interface automatic works for some people with ip6 disabled.
4209 Therefore the error check is removed, so they can use the option.
4211 19 October 2010: Wouter
4212 - Fix for request list growth, if a server has long timeout but the
4213 lost counter is low, then its effective rtt is the one without
4214 exponential backoff applied. Because the backoff is not working.
4215 The lost counter can then increase and the server is blacklisted,
4216 or the lost counter does not increase and the server is working
4219 18 October 2010: Wouter
4220 - iana portlist updated.
4222 13 October 2010: Wouter
4223 - Fix TCP so it uses a random outgoing-interface.
4224 - unbound-anchor handles ADDPEND keystate.
4226 11 October 2010: Wouter
4227 - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where
4228 the zone has a secure delegation hosted on the same server did not
4229 verify as secure (it was insecure by mistake).
4230 - iana portlist updated.
4231 - ldns tarball updated (for reading cachedumps with bad RR data).
4233 1 October 2010: Wouter
4234 - test for unbound-anchor. fix for reading certs.
4235 - Fix alloc_reg_release for longer uptime in out of memory conditions.
4237 28 September 2010: Wouter
4238 - unbound-anchor working, it creates or updates a root.key file.
4239 Use it before you start the validator (e.g. at system boot time).
4241 27 September 2010: Wouter
4242 - iana portlist updated.
4244 24 September 2010: Wouter
4245 - bug#329: in example.conf show correct ipv4 link-local 169.254/16.
4247 23 September 2010: Wouter
4248 - unbound-anchor app, unbound requires libexpat (xml parser library).
4250 22 September 2010: Wouter
4251 - compliance with draft-ietf-dnsop-default-local-zones-14, removed
4252 reverse ipv6 orchid prefix from builtin list.
4253 - iana portlist updated.
4255 17 September 2010: Wouter
4256 - DLV has downgrade protection again, because the RFC says so.
4257 - iana portlist updated.
4259 16 September 2010: Wouter
4260 - Algorithm rollover operational reality intrudes, for trust-anchor,
4261 5011-store, and DLV-anchor if one key matches it's good enough.
4262 - iana portlist updated.
4263 - Fix reported validation error in out of memory condition.
4265 15 September 2010: Wouter
4266 - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
4268 14 September 2010: Wouter
4269 - increased mesh-max-activation from 1000 to 3000 for crazy domains
4270 like _tcp.slb.com with 262 servers.
4271 - iana portlist updated.
4273 13 September 2010: Wouter
4274 - bug#327: Fix for cannot access stub zones until the root is primed.
4276 9 September 2010: Wouter
4277 - unresponsive servers are not completely blacklisted (because of
4278 firewalls), but also not probed all the time (because of the request
4279 list size it generates). The probe rate is 1%.
4280 - iana portlist updated.
4282 20 August 2010: Wouter
4283 - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
4284 iterator get_mem includes priv_get_mem. delegpt nodup removed.
4285 listen_pushback, query_info_allocqname, write_socket, send_packet,
4286 comm_point_set_cb_arg and listen_resume removed.
4288 19 August 2010: Wouter
4289 - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20.
4290 Delegpt structures checked for duplicates always.
4291 No more nameserver lookups generated when depth is full anyway.
4292 - example.conf notes how to do DNSSEC validation and track the root.
4293 - iana portlist updated.
4295 18 August 2010: Wouter
4296 - Fix bug#322: configure does not respect CFLAGS on Solaris.
4297 Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line
4298 if use sun-cc, but some systems need different flags.
4300 16 August 2010: Wouter
4301 - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP
4302 changes, uses m4_bpatsubst now.
4303 - make test (or make check) should be more portable and run the unit
4304 test and testbound scripts. (make longtest has special requirements).
4306 13 August 2010: Wouter
4307 - More pleasant remote control command parsing.
4308 - documentation added for return values reported by doxygen 1.7.1.
4309 - iana portlist updated.
4311 9 August 2010: Wouter
4312 - Fix name of rrset printed that failed validation.
4314 5 August 2010: Wouter
4315 - Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
4317 4 August 2010: Wouter
4318 - Fix validation in case a trust anchor enters into a zone with
4319 unsupported algorithms.
4321 3 August 2010: Wouter
4322 - updated ldns tarball with bugfixes.
4323 - release tag 1.4.6.
4324 - trunk becomes 1.4.7 develop.
4325 - iana portlist updated.
4327 22 July 2010: Wouter
4328 - more error details on failed remote control connection.
4330 15 July 2010: Wouter
4331 - rlimit adjustments for select and ulimit can happen at the same time.
4333 14 July 2010: Wouter
4334 - Donation text added to README.
4335 - Fix integer underflow in prefetch ttl creation from cache. This
4336 fixes a potential negative prefetch ttl.
4338 12 July 2010: Wouter
4339 - Changed the defaults for num-queries-per-thread/outgoing-range.
4340 For builtin-select: 512/960, for libevent 1024/4096 and for
4341 windows 24/48 (because of win api). This makes the ratio this way
4342 to improve resilience under heavy load. For high performance, use
4343 libevent and possibly higher numbers.
4345 10 July 2010: Wouter
4346 - GOST enabled if SSL is recent and ldns has GOST enabled too.
4347 - ldns tarball updated.
4350 - iana portlist updated.
4351 - Fix validation of qtype DNSKEY when a key-cache entry exists but
4352 no rr-cache entry is used (it expired or prefetch), it then goes
4353 back up to the DS or trust-anchor to validate the DNSKEY.
4356 - Neat function prototypes, unshadowed local declarations.
4359 - failure to chown the pidfile is not fatal any more.
4360 - testbound uses UTC timezone.
4361 - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add
4362 /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake.
4365 - log if a server is skipped because it is on the donotquery list,
4366 at verbosity 4, to enable diagnosis why no queries to 127.0.0.1.
4367 - added feature to print configure date, target and options with -h.
4368 - added feature to print event backend system details with -h.
4369 - wdiff is not actually required by make test, updated requirements.
4372 - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex
4373 must be signed with all algorithms from the DS rrset at the parent.
4374 This is now checked and becomes bogus if not.
4376 28 June 2010: Wouter
4377 - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps
4378 in overload situations to be about 5 qps for the class of shortly
4380 The capacity of the resolver is then about (numqueriesperthread / 2)
4381 / (average time for such long queries) qps for long queries.
4382 And about (numqueriesperthread / 2)/(jostletimeout in whole seconds)
4383 qps for short queries, per thread.
4384 - Fix the max number of reply-address count to be applied for duplicate
4385 queries, and not for new query list entries. This raises the memory
4386 usage to a max of (16+1)*numqueriesperthread reply addresses.
4388 25 June 2010: Wouter
4389 - Fix handling of corner case reply from lame server, follows rfc2308.
4390 It could lead to a nodata reply getting into the cache if the search
4391 for a non-lame server turned up other misconfigured servers.
4392 - unbound.h has extern "C" statement for easier include in c++.
4394 23 June 2010: Wouter
4395 - iana portlist updated.
4396 - makedist upgraded cross compile openssl option, like this:
4397 ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost
4399 22 June 2010: Wouter
4400 - Unbound reports libev or libevent correctly in logs in verbose mode.
4401 - Fix to unload gost dynamic library module for leak testing.
4403 18 June 2010: Wouter
4404 - iana portlist updated.
4406 17 June 2010: Wouter
4407 - Add AAAA to root hints for I.ROOT-SERVERS.NET.
4409 16 June 2010: Wouter
4410 - Fix assertion failure reported by Kai Storbeck from XS4ALL, the
4411 assertion was wrong.
4412 - updated ldns tarball.
4414 15 June 2010: Wouter
4415 - tag 1.4.5 created.
4416 - trunk contains 1.4.6 in development.
4417 - Fix TCPreply on systems with no writev, if just 1 byte could be sent.
4418 - Fix to use one pointer less for iterator query state store_parent_NS.
4419 - makedist crosscompile to windows uses builtin ldns not host ldns.
4420 - Max referral count from 30 to 130, because 128 one character domains
4422 - added documentation for the histogram printout to syslog.
4424 11 June 2010: Wouter
4425 - When retry to parent the retrycount is not wiped, so failed
4426 nameservers are not tried again.
4427 - iana portlist updated.
4429 10 June 2010: Wouter
4430 - Fix bug where a long loop could be entered, now cycle detection
4431 has a loop-counter and maximum search amount.
4434 - iana portlist updated.
4435 - 1.4.5rc1 tag created.
4438 - ldns tarball updated, 1.6.5.
4439 - review comments, split dependency cycle tracking for parentside
4440 last resort lookups for A and AAAA so there are more lookup options.
4443 - Fix compile warning if compiled without threads.
4444 - updated ldns-tarball with current ldns svn (pre 1.6.5).
4445 - GOST disabled-by-default, the algorithm number is allocated but the
4446 RFC is still has to pass AUTH48 at the IETF.
4449 - Ignore Z flag in incoming messages too.
4450 - Fix storage of negative parent glue if that last resort fails.
4451 - libtoolize 2.2.6b, autoconf 2.65 applied to configure.
4452 - new splint flags for newer splint install.
4455 - Fix AD flag handling, it could in some cases mistakenly copy the AD
4456 flag from upstream servers.
4457 - alloc_special_obtain out of memory is not a fatal error any more,
4458 enabling unbound to continue longer in out of memory conditions.
4459 - parentside names are dispreferred but not said to be dnssec-lame.
4460 - parentside check for cached newname glue.
4461 - fix parentside and querytargets modulestate, for dump_requestlist.
4462 - unbound-control-setup makes keys -rw-r--- so not all users permitted.
4463 - fix parentside from cache to be marked dispreferred for bad names.
4466 - iana portlist updated.
4467 - parent-child disagreement approach altered. Older fixes are
4468 removed in place of a more exhaustive search for misconfigured data
4469 available via the parent of a delegation.
4470 This is designed to be throttled by cache entries, with TTL from the
4471 parent if possible. Additionally the loop-counter is used.
4472 It also tests for NS RRset differences between parent and child.
4473 The fetch of misconfigured data should be more reliable and thorough.
4474 It should work reliably even with no or only partial data in cache.
4475 Data received from the child (as always) is deemed more
4476 authoritative than information received from the delegation parent.
4477 The search for misconfigured data is not performed normally.
4480 - Contribution from Migiel de Vos (Surfnet): nagios patch for
4481 unbound-host, in contrib/ (in the source tarball). Makes
4482 unbound-host suitable for monitoring dnssec(-chain) status.
4485 - EDNS timeout code will not fire if EDNS status already known.
4486 - EDNS failure not stored if EDNS status known to work.
4489 - Fix resolution for domains like safesvc.com.cn. If the iterator
4490 can not recurse further and it finds the delegation in a state
4491 where it would otherwise have rejected it outhand if so received
4492 from a cache lookup, then it can try to ask higherup (with loop
4494 - Fix comments in iter_utils:dp_is_useless.
4497 - Fix various compiler warnings from the clang llvm compiler.
4498 - iana portlist updated.
4501 - Fix bug#308: spelling error in variable name in parser and lexer.
4504 - Fix dnssec-missing detection that was turned off by server selection.
4505 - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default
4506 reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa,
4507 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa.
4509 29 April 2010: Wouter
4510 - Fix for dnssec lameness detection to use the key cache.
4511 - infra cache entries that are expired are wiped clean. Previously
4512 it was possible to not expire host data (if accessed often).
4514 28 April 2010: Wouter
4515 - ldns tarball updated and GOST support is detected and then enabled.
4516 - iana portlist updated.
4517 - Fix detection of gost support in ldns (reported by Chris Smith).
4519 27 April 2010: Wouter
4520 - unbound-control get_option domain-insecure shows config file items.
4521 - fix retry sequence if prime hints are recursion-lame.
4522 - autotrust anchor file can be initialized with a ZSK key as well.
4523 - harden-referral-path does not result in failures due to max-depth.
4524 You can increase the max-depth by adding numbers (' 0') after the
4525 target-fetch-policy, this increases the depth to which is checked.
4527 26 April 2010: Wouter
4528 - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use
4529 CPPFLAGS during configure process.
4530 - if libev is installed on the base system (not libevent), detect
4531 it from the event.h header file and link with -lev.
4532 - configlexer.lex gets config.h, and configyyrename.h added by make,
4533 no more double include.
4534 - More strict scrubber (Thanks to George Barwood for the idea):
4535 NS set must be pertinent to the query (qname subdomain nsname).
4536 - Fix bug#307: In 0x20 backoff fix fallback so the number of
4537 outstanding queries does not become -1 and block the request.
4538 Fixed handling of recursion-lame in combination with 0x20 fallback.
4539 Fix so RRsets are compared canonicalized and sorted if the immediate
4540 comparison fails, this makes it work around round-robin sites.
4542 23 April 2010: Wouter
4543 - Squelch log message: sendto failed permission denied for
4544 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2).
4545 - Fix to fetch data as last resort more tenaciously. When cycle
4546 targets cause the server selection to believe there are more options
4547 when they really are not there, the server selection is reinitiated.
4548 - Fix fetch from blacklisted dnssec lame servers as last resort. The
4549 server's IP address is then given in validator errors as well.
4550 - Fix local-zone type redirect that did not use the query name for
4553 22 April 2010: Wouter
4555 - trunk contains 1.4.5 in development.
4556 - Fix validation failure for qtype ANY caused by a RRSIG parse failure.
4557 The validator error message was 'no signatures from ...'.
4559 16 April 2010: Wouter
4560 - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
4563 15 April 2010: Wouter
4564 - ECC-GOST algorithm number 12 that is assigned by IANA. New test
4565 example key and signatures for GOST. GOST requires openssl-1.0.0.
4566 GOST is still disabled by default.
4568 9 April 2010: Wouter
4569 - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
4570 get into an endless loop, if 0x20 was enabled, and buffers are small
4571 or particular broken packets are received.
4572 - Fix chain of trust with CNAME at an intermediate step, for the DS
4575 8 April 2010: Wouter
4576 - Fix validation of queries with wildcard names (*.example).
4578 6 April 2010: Wouter
4579 - Fix EDNS probe for .de DNSSEC testbed failure, where the infra
4580 cache timeout coincided with a server update, the current EDNS
4581 backoff is less sensitive, and does not cache the backoff unless
4582 the backoff actually works and the domain is not expecting DNSSEC.
4583 - GOST support with correct algorithm numbers.
4585 1 April 2010: Wouter
4586 - iana portlist updated.
4588 24 March 2010: Wouter
4589 - unbound control flushed items are not counted when flushed again.
4591 23 March 2010: Wouter
4592 - iana portlist updated.
4594 22 March 2010: Wouter
4595 - unbound-host disables use-syslog from config file so that the
4596 config file for the main server can be used more easily.
4597 - fix bug#301: unbound-checkconf could not parse interface
4598 '0.0.0.0@5353', even though unbound itself worked fine.
4600 19 March 2010: Wouter
4601 - fix fwd_ancil test to pass if the socket options are not supported.
4603 18 March 2010: Wouter
4604 - Fixed random numbers for port, interface and server selection.
4605 Removed very small bias.
4606 - Refer to the listing in unbound-control man page in the extended
4607 statistics entry in the unbound.conf man page.
4609 16 March 2010: Wouter
4610 - Fix interface-automatic for OpenBSD: msg.controllen was too small,
4611 also assertions on ancillary data buffer.
4612 - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
4613 - for NSEC3 check if signatures are cached.
4615 15 March 2010: Wouter
4616 - unit test for util/regional.c.
4618 12 March 2010: Wouter
4619 - Reordered configure checks so fork and -lnsl -lsocket checks are
4620 earlier, and thus later checks benefit from and do not hinder them.
4621 - iana portlist updated.
4622 - ldns tarball updated.
4623 - Fix python use when multithreaded.
4624 - Fix solaris python compile.
4625 - Include less in config.h and include per code file for ldns, ssl.
4627 11 March 2010: Wouter
4628 - another memory allocation option: --enable-alloc-nonregional.
4629 exposes the regional allocations to other memory purifiers.
4630 - fix for memory alignment in struct sock_list allocation.
4631 - Fix for MacPorts ldns without ssl default, unbound checks if ldns
4632 has dnssec functionality and uses the builtin if not.
4633 - Fix daemonize on Solaris 10, it did not detach from terminal.
4634 - tag 1.4.3 created.
4635 - trunk is 1.4.4 in development.
4636 - spelling fix in validation error involving cnames.
4638 10 March 2010: Wouter
4639 - --enable-alloc-lite works with test set.
4640 - portability in the testset: printf format conversions, prototypes.
4642 9 March 2010: Wouter
4643 - tag 1.4.2 created.
4644 - trunk is 1.4.3 in development.
4645 - --enable-alloc-lite debug option.
4647 8 March 2010: Wouter
4648 - iana portlist updated.
4650 4 March 2010: Wouter
4651 - Fix crash in control channel code.
4653 3 March 2010: Wouter
4654 - better casts in pipe code, brackets placed wrongly.
4655 - iana portlist updated.
4657 1 March 2010: Wouter
4658 - make install depends on make all.
4659 - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs.
4660 - --enable-checking: enables assertions but does not look nonproduction.
4661 - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with
4662 nxdomain and nodata distinguished.
4663 - ldns tarball updated.
4664 - --disable-rpath fixed for libtool not found errors.
4665 - new fedora specfile from Fedora13 in contrib from Paul Wouters.
4667 26 February 2010: Wouter
4668 - Fixup prototype for lexer cleanup in daemon code.
4669 - unbound-control list_stubs, list_forwards, list_local_zones and
4672 24 February 2010: Wouter
4673 - Fix scrubber bug that potentially let NS records through. Reported
4675 - Also delete potential poison references from additional.
4676 - Fix: no classification of a forwarder as lame, throw away instead.
4678 23 February 2010: Wouter
4679 - libunbound ub_ctx_get_option() added.
4680 - unbound-control set_option and get_option commands.
4681 - iana portlist updated.
4683 18 February 2010: Wouter
4684 - A little more strict DS scrubbing.
4685 - No more blacklisting of unresponsive servers, a 2 minute timeout
4687 - RD flag not enabled for dnssec-blacklisted tries, unless necessary.
4688 - pickup ldns compile fix, libdl for libcrypto.
4689 - log 'tcp connect: connection timed out' only in high verbosity.
4690 - unbound-control log_reopen command.
4691 - moved get_option code from unbound-checkconf to util/config_file.c
4693 17 February 2010: Wouter
4694 - Disregard DNSKEY from authority section for chain of trust.
4695 DS records that are irrelevant to a referral scrubbed. Anti-poison.
4696 - iana portlist updated.
4698 16 February 2010: Wouter
4699 - Check for 'no space left on device' (or other errors) when
4700 writing updated autotrust anchors and print errno to log.
4702 15 February 2010: Wouter
4703 - Fixed the requery protection, the TTL was 0, it is now 900 seconds,
4704 hardcoded. We made the choice to send out more conservatively,
4705 protecting against an aggregate effect more than protecting a
4706 single user (from their own folly, perhaps in case of misconfig).
4708 12 February 2010: Wouter
4709 - Re-query pattern changed on validation failure. To protect troubled
4710 authority servers, unbound caches a failure for the DNSKEY or DS
4711 records for the entire zone, and only retries that 900 seconds later.
4712 This implies that only a handful of packets are sent extra to the
4713 authority if the zone fails.
4715 11 February 2010: Wouter
4716 - ldns tarball update for long label length syntax error fix.
4717 - iana portlist updated.
4719 9 February 2010: Wouter
4720 - Fixup in compat snprintf routine, %f 1.02 and %g support.
4721 - include math.h for testbound test compile portability.
4723 2 February 2010: Wouter
4724 - Updated url of IANA itar, interim trust anchor repository, in script.
4726 1 February 2010: Wouter
4727 - iana portlist updated.
4728 - configure test for memcmp portability.
4730 27 January 2010: Wouter
4731 - removed warning on format string in validator error log statement.
4732 - iana portlist updated.
4734 22 January 2010: Wouter
4735 - libtool finish the install of unbound python dynamic library.
4737 21 January 2010: Wouter
4738 - acx_nlnetlabs.m4 synchronised with nsd's version.
4740 20 January 2010: Wouter
4741 - Fixup lookup trouble for parent-child domains on the first query.
4743 14 January 2010: Wouter
4744 - Fixup ldns detection to also check for header files.
4746 13 January 2010: Wouter
4747 - prefetch-key option that performs DNSKEY queries earlier in the
4748 validation process, and that could halve the latency on DNSSEC
4749 queries. It takes some extra processing (CPU, a cache is needed).
4751 12 January 2010: Wouter
4752 - Fix unbound-checkconf for auto-trust-anchor-file present checks.
4754 8 January 2010: Wouter
4755 - Fix for parent-child disagreement code which could have trouble
4756 when (a) ipv6 was disabled and (b) the TTL for parent and child
4757 were different. There were two bugs, the parent-side information
4758 is fixed to no longer block lookup of child side information and
4759 the iterator is fixed to no longer attempt to get ipv6 when it is
4760 not enabled and then give up in failure.
4761 - test and fixes to make prefetch actually store the answer in the
4762 cache. Considers some rrsets 'already expired' but does not allow
4763 overwriting of rrsets considered more secure.
4765 7 January 2010: Wouter
4766 - Fixup python documentation (thanks Leo Vandewoestijne).
4767 - Work on cache prefetch feature.
4768 - Stats for prefetch, in log print stats, unbound-control stats
4769 and in unbound_munin plugin.
4771 6 January 2010: Wouter
4772 - iana portlist updated.
4773 - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length.
4774 - verbose output includes parent-side-address notion for lameness.
4775 - documented val-log-level: 2 setting in example.conf and man page.
4776 - change unbound-control-setup from 1024(sha1) to 1536(sha256).
4778 1 January 2010: Wouter
4779 - iana portlist updated.
4781 22 December 2009: Wouter
4782 - configure with newer libtool 2.2.6b.
4784 17 December 2009: Wouter
4787 - trunk to version 1.4.2.
4789 15 December 2009: Wouter
4790 - Answer to qclass=ANY queries, with class IN contents.
4791 Test that validation also works.
4792 - updated ldns snapshot tarball with latest fixes (parsing records).
4794 11 December 2009: Wouter
4795 - on IPv4 UDP turn off DF flag.
4797 10 December 2009: Wouter
4798 - requirements.txt updated with design choice explanations.
4799 - Reading fixes: fix to set unlame when child confirms parent glue,
4800 and fix to avoid duplicate addresses in delegation point.
4801 - verify_rrsig routine checks expiration last.
4803 9 December 2009: Wouter
4804 - Fix Bug#287(reopened): update of ldns tarball with fix for parse
4805 errors generated for domain names like '.example.com'.
4806 - Fix SOA excluded from negative DS responses. Reported by Hauke
4807 Lampe. The negative cache did not include proper SOA records for
4808 negative qtype DS responses which makes BIND barf on it, such
4809 responses are now only used internally.
4810 - Fix negative cache lookup of closestencloser check of DS type bit.
4812 8 December 2009: Wouter
4813 - Fix for lookup of parent-child disagreement domains, where the
4814 parent-side glue works but it does not provide proper NS, A or AAAA
4815 for itself, fixing domains such as motorcaravanners.eu.
4816 - Feature: you can specify a port number in the interface: line, so
4817 you can bind the same interface multiple times at different ports.
4819 7 December 2009: Wouter
4820 - Bug#287: Fix segfault when unbound-control remove nonexistent local
4821 data. Added check to tests.
4823 1 December 2009: Wouter
4824 - Fix crash with module-config "iterator".
4825 - Added unit test that has "iterator" module-config.
4827 30 November 2009: Wouter
4828 - bug#284: fix parse of # without end-of-line at end-of-file.
4830 26 November 2009: Wouter
4831 - updated ldns with release candidate for version 1.6.3.
4832 - tag for 1.4.0 release.
4833 - 1.4.1 version in trunk.
4834 - Fixup major libtool version to 2 because of why_bogus change.
4835 It was 1:5:0 but should have been 2:0:0.
4837 23 November 2009: Wouter
4838 - Patch from David Hubbard for libunbound manual page.
4839 - Fixup endless spinning in unbound-control stats reported by
4840 Attila Nagy. Probably caused by clock reversal.
4842 20 November 2009: Wouter
4843 - contrib/split-itar.sh contributed by Tom Hendrikx.
4845 19 November 2009: Wouter
4846 - better argument help for unbound-control.
4847 - iana portlist updated.
4849 17 November 2009: Wouter
4850 - noted multiple entries for multiple domain names in example.conf.
4851 - iana portlist updated.
4853 16 November 2009: Wouter
4854 - Fixed signer detection of CNAME responses without signatures.
4855 - Fix#282 libunbound memleak on error condition by Eric Sesterhenn.
4856 - Tests for CNAMEs to deeper trust anchors, secure and bogus.
4857 - svn tag 1.4.0rc1 made.
4859 13 November 2009: Wouter
4860 - Fixed validation failure for CNAME to optout NSEC3 nodata answer.
4861 - unbound-host does not fail on type ANY.
4862 - Fixed wireparse failure to put RRSIGs together with data in some
4863 long ANY mix cases, which fixes validation failures.
4865 12 November 2009: Wouter
4866 - iana portlist updated.
4867 - fix manpage errors reported by debian lintian.
4869 - fixup very long vallog2 level error strings.
4871 11 November 2009: Wouter
4872 - ldns tarball updated (to 1.6.2).
4875 10 November 2009: Wouter
4876 - Thanks to Surfnet found bug in new dnssec-retry code that failed
4877 to combine well when combined with DLV and a particular failure.
4878 - Fixed unbound-control -h output about argument optionality.
4881 5 November 2009: Wouter
4882 - lint fixes and portability tests.
4883 - better error text for multiple domain keys in one autotrust file.
4885 2 November 2009: Wouter
4886 - Fix bug where autotrust does not work when started with a DS.
4887 - Updated GOST unit tests for unofficial algorithm number 249
4888 and DNSKEY-format changes in draft version -01.
4890 29 October 2009: Wouter
4891 - iana portlist updated.
4892 - edns-buffer-size option, default 4096.
4895 28 October 2009: Wouter
4896 - removed abort on prealloc failure, error still printed but softfail.
4897 - iana portlist updated.
4898 - RFC 5702: RSASHA256 and RSASHA512 support enabled by default.
4899 - ldns tarball updated (which also enables rsasha256 support).
4901 27 October 2009: Wouter
4902 - iana portlist updated.
4904 8 October 2009: Wouter
4906 - add val-log-level print to corner case (nameserver.epost.bg).
4907 - more detail to errors from insecure delegation checks.
4908 - Fix double time subtraction in negative cache reported by
4909 Amanda Constant and Hugh Mahon.
4910 - Made new validator error string available from libunbound for
4911 applications. It is in result->why_bogus, a zero-terminated string.
4912 unbound-host prints it by default if a result is bogus.
4913 Also the errinf is public in module_qstate (for other modules).
4915 7 October 2009: Wouter
4916 - retry for validation failure in DS and prime results. Less mem use.
4917 unit test. Provisioning in other tests for requeries.
4918 - retry for validation failure in DNSKEY in middle of chain of trust.
4920 - retry for empty non terminals in chain of trust and unit test.
4921 - Fixed security bug where the signatures for NSEC3 records were not
4922 checked when checking for absence of DS records. This could have
4923 enabled the substitution of an insecure delegation.
4924 - moved version number to 1.4.0 because of 1.3.4 release with only
4925 the NSEC3 patch from the entry above.
4926 - val-log-level: 2 shows extended error information for validation
4927 failures, but still one (longish) line per failure. For example:
4928 validation failure <example.com. DNSKEY IN>: signature expired from
4929 192.0.2.4 for trust anchor example.com. while building chain of trust
4930 validation failure <www.example.com. A IN>: no signatures from
4931 192.0.2.6 for key example.com. while building chain of trust
4933 6 October 2009: Wouter
4934 - Test set updated to provide additional ns lookup result.
4935 The retry would attempt to fetch the data from other nameservers
4936 for bogus data, and this needed to be provisioned in the tests.
4938 5 October 2009: Wouter
4939 - first validation failure retry code. Retries for data failures.
4942 2 October 2009: Wouter
4943 - improve 5011 modularization.
4944 - fix unbound-host so -d can be given before -C.
4945 - iana portlist updated.
4947 28 September 2009: Wouter
4948 - autotrust-anchor-file can read multiline input and $ORIGIN.
4949 - prevent integer overflow in holddown calculation. review fixes.
4950 - fixed race condition in trust point revocation. review fix.
4951 - review fixes to comments, removed unused code.
4953 25 September 2009: Wouter
4954 - so-rcvbuf: 4m option added. Set this on large busy servers to not
4955 drop the occasional packet in spikes due to full socket buffers.
4956 netstat -su keeps a counter of UDP dropped due to full buffers.
4957 - review of validator/autotrust.c, small fixes and comments.
4959 23 September 2009: Wouter
4960 - 5011 query failed counts verification failures, not lookup failures.
4961 - 5011 probe failure handling fixup.
4962 - test unbound reading of original autotrust data.
4963 The metadata per-key, such as key state (PENDING, MISSING, VALID) is
4964 picked up, otherwise performs initial probe like usual.
4966 22 September 2009: Wouter
4967 - autotrust test with algorithm rollover, new ordering of checks
4968 assists in orderly rollover.
4969 - autotrust test with algorithm rollover to unknown algorithm.
4970 checks if new keys are supported before adding them.
4971 - autotrust test with trust point revocation, becomes unsigned.
4972 - fix DNSSEC-missing-signature detection for minimal responses
4973 for qtype DNSKEY (assumes DNSKEY occurs at zone apex).
4975 18 September 2009: Wouter
4976 - autotrust tests, fix trustpoint timer deletion code.
4977 fix count of valid anchors during missing remove.
4978 - autotrust: pick up REVOKE even if not signed with known other keys.
4980 17 September 2009: Wouter
4981 - fix compile of unbound-host when --enable-alloc-checks.
4982 - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis.
4983 - Manual page fixes reported by Tony Finch.
4985 16 September 2009: Wouter
4986 - Fix memory leak reported by Tao Ma.
4987 - Fix memstats test tool for log-time-ascii log format.
4989 15 September 2009: Wouter
4990 - iana portlist updated.
4992 10 September 2009: Wouter
4993 - increased MAXSYSLOGLEN so .bg key can be printed in debug output.
4994 - use linebuffering for log-file: output, this can be significantly
4995 faster than the previous fflush method and enable some class of
4996 resolvers to use high verbosity (for short periods).
4997 Not on windows, because line buffering does not work there.
4999 9 September 2009: Wouter
5000 - Fix bug where DNSSEC-bogus messages were marked with too high TTL.
5001 The RRsets would still expire at the normal time, but this would
5002 keep messages bogus in the cache for too long.
5003 - regression test for that bug.
5004 - documented that load_cache is meant for debugging.
5006 8 September 2009: Wouter
5007 - fixup printing errors when load_cache, they were printed to the
5008 SSL connection which broke, now to the log.
5009 - new ldns - with fixed parse of large SOA values.
5011 7 September 2009: Wouter
5012 - autotrust testbound scenarios.
5013 - autotrust fix that failure count is written to file.
5014 - autotrust fix that keys may become valid after add holddown time
5015 alone, before the probe returns.
5017 4 September 2009: Wouter
5018 - Changes to make unbound work with libevent-2.0.3 alpha. (in
5019 configure detection due to new ssl dependency in libevent)
5020 - do not call sphinx for documentation when python is disabled.
5021 - remove EV_PERSIST from libevent timeout code to make the code
5022 compatible with the libevent-2.0. Works with older libevent too.
5023 - fix memory leak in python code.
5025 3 September 2009: Wouter
5026 - Got a patch from Luca Bruno for libunbound support on windows to
5027 pick up the system resolvconf nameservers and hosts there.
5028 - included ldns updated (enum warning fixed).
5029 - makefile fix for parallel makes.
5030 - Patch from Zdenek Vasicek and Attila Nagy for using the source IP
5031 from python scripts. See pythonmod/examples/resip.py.
5032 - doxygen comment fixes.
5034 2 September 2009: Wouter
5035 - TRAFFIC keyword for testbound. Simplifies test generation.
5036 ${range lower val upper} to check probe timeout values.
5037 - test with 5011-prepublish rollover and revocation.
5038 - fix revocation of RR for autotrust, stray exclamation mark.
5040 1 September 2009: Wouter
5041 - testbound variable arithmetic.
5042 - autotrust probe time is randomised.
5043 - autotrust: the probe is active and does not fetch from cache.
5045 31 August 2009: Wouter
5046 - testbound variable processing.
5048 28 August 2009: Wouter
5049 - fixup unbound-control lookup to print forward and stub servers.
5051 27 August 2009: Wouter
5052 - autotrust: mesh answer callback is empty.
5054 26 August 2009: Wouter
5055 - autotrust probing.
5056 - iana portlist updated.
5058 25 August 2009: Wouter
5059 - fixup memleak in trust anchor unsupported algorithm check.
5060 - iana portlist updated.
5061 - autotrust options: add-holddown, del-holddown, keep-missing.
5062 - autotrust store revoked status of trust points.
5063 - ctime_r compat definition.
5064 - detect yylex_destroy() in configure.
5065 - detect SSL_get_compression_methods declaration in configure.
5066 - fixup DS lookup at anchor point with unsigned parent.
5067 - fixup DLV lookup for DS queries to unsigned domains.
5069 24 August 2009: Wouter
5070 - cleaner memory allocation on exit. autotrust test routines.
5071 - free all memory on program exit, fix for ssl and flex.
5073 21 August 2009: Wouter
5074 - autotrust: debug routines. Read,write and conversions work.
5076 20 August 2009: Wouter
5077 - autotrust: save and read trustpoint variables.
5079 19 August 2009: Wouter
5080 - autotrust: state table updates.
5081 - iana portlist updated.
5083 17 August 2009: Wouter
5084 - autotrust: process events.
5086 17 August 2009: Wouter
5087 - Fix so that servers are only blacklisted if they fail to reply
5088 to 16 queries in a row and the timeout gets above 2 minutes.
5089 - autotrust work, split up DS verification of DNSKEYs.
5091 14 August 2009: Wouter
5092 - unbound-control lookup prints out infra cache information, like RTT.
5093 - Fix bug in DLV lookup reported by Amanda from Secure64.
5094 It could sometimes wrongly classify a domain as unsigned, which
5095 does not give the AD bit on replies.
5097 13 August 2009: Wouter
5098 - autotrust read anchor files. locked trust anchors.
5100 12 August 2009: Wouter
5101 - autotrust import work.
5103 11 August 2009: Wouter
5104 - Check for openssl compatible with gost if enabled.
5105 - updated unit test for GOST=211 code.
5106 Nicer naming of test files.
5107 - iana portlist updated.
5109 7 August 2009: Wouter
5110 - call OPENSSL_config() in unbound and unit test so that the
5111 operator can use openssl.cnf for configuration options.
5112 - removed small memory leak from config file reader.
5114 6 August 2009: Wouter
5115 - configure --enable-gost for GOST support, experimental
5116 implementation of draft-dolmatov-dnsext-dnssec-gost-01.
5117 - iana portlist updated.
5118 - ldns tarball updated (with GOST support).
5120 5 August 2009: Wouter
5121 - trunk moved to 1.3.4.
5123 4 August 2009: Wouter
5124 - Added test that the examples from draft rsasha256-14 verify.
5125 - iana portlist updated.
5128 3 August 2009: Wouter
5129 - nicer warning when algorithm not supported, tells you to upgrade.
5130 - iana portlist updated.
5132 27 July 2009: Wouter
5133 - Updated unbound-cacti contribution from Dmitriy Demidov, with
5134 the queue statistics displayed in its own graph.
5135 - iana portlist updated.
5137 22 July 2009: Wouter
5138 - Fix bug found by Michael Tokarev where unbound would try to
5139 prime the root servers even though forwarders are configured for
5143 21 July 2009: Wouter
5144 - Fix server selection, so that it waits for open target queries when
5145 faced with lameness.
5147 20 July 2009: Wouter
5148 - Ignore transient sendto errors, no route to host, and host, net down.
5149 - contrib/update-anchor.sh has -r option for root-hints.
5150 - feature val-log-level: 1 prints validation failures so you can
5151 keep track of them during dnssec deployment.
5153 16 July 2009: Wouter
5154 - fix replacement malloc code. Used in crosscompile.
5155 - makedist -w creates crosscompiled setup.exe on fedora11.
5157 15 July 2009: Wouter
5158 - dependencies for compat items, for crosscompile.
5159 - mingw32 crosscompile changes, dependencies and zipfile creation.
5160 and with System.dll from the windows NSIS you can make setup.exe.
5161 - package libgcc_s_sjlj exception handler for NSISdl.dll.
5163 14 July 2009: Wouter
5164 - updated ldns tarball for solaris x64 compile assistance.
5165 - no need to define RAND_MAX from config.h.
5166 - iana portlist updated.
5167 - configure changes and ldns update for mingw32 crosscompile.
5169 13 July 2009: Wouter
5170 - Fix for crash at start on windows.
5171 - tag for release 1.3.2.
5172 - trunk has version 1.3.3.
5173 - Fix for ID bits on windows to use all 16. RAND_MAX was not
5174 defined like you'd expect on mingw. Reported by Mees de Roo.
5177 - tag for release 1.3.1.
5178 - trunk has version 1.3.2.
5181 - iana portlist updated.
5184 - prettier error handling in SSL setup.
5185 - makedist.sh uname fix (same as ldns).
5186 - updated fedora spec file.
5189 - fixup linking when ldnsdir is "".
5191 30 June 2009: Wouter
5192 - more lenient truncation checks.
5194 29 June 2009: Wouter
5195 - ldns trunk r2959 imported as tarball, because of solaris cc compile
5196 support for c99. r2960 for better configure.
5197 - better wrongly_truncated check.
5198 - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to
5199 avoid dropped packets at routers.
5201 26 June 2009: Wouter
5202 - Fix EDNS fallback when EDNS works for short answers but long answers
5205 22 June 2009: Wouter
5206 - fixup iter priv strict aliasing while preserving size of sockaddr.
5207 - iana portlist updated. (one less port allocated, one more fraction
5208 of a bit for security!)
5209 - updated fedora specfile in contrib from Paul Wouters.
5211 19 June 2009: Wouter
5212 - Fixup strict aliasing warning in iter priv code.
5213 and config_file code.
5214 - iana portlist updated.
5215 - harden-referral-path: handle cases where NS is in answer section.
5217 18 June 2009: Wouter
5218 - Fix of message parse bug where (specifically) an NSEC and RRSIG
5219 in the wrong order would be parsed, but put wrongly into internal
5220 structures so that later validation would fail.
5221 - Extreme lenience for wrongly truncated replies where a positive
5222 reply has an NS in the authority but no signatures. They are
5223 turned into minimal responses with only the (secure) answer.
5224 - autoconf 2.63 for configure.
5225 - python warnings suppress. Keep python API away from header files.
5227 17 June 2009: Wouter
5228 - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was
5229 used for the python code in unbound. (http://www.nic.cz/vip/ in cz).
5231 16 June 2009: Wouter
5232 - Fixup opportunistic target query generation to it does not
5233 generate queries that are known to fail.
5234 - Touchup on munin total memory report.
5235 - messages picked out of the cache by the iterator are checked
5236 if their cname chain is still correct and if validation status
5237 has to be reexamined.
5239 15 June 2009: Wouter
5240 - iana portlist updated.
5242 14 June 2009: Wouter
5243 - Fixed bug where cached responses would lose their security
5244 status on second validation, which especially impacted dlv
5245 lookups. Reported by Hauke Lampe.
5247 13 June 2009: Wouter
5248 - bug #254. removed random whitespace from example.conf.
5250 12 June 2009: Wouter
5251 - Fixup potential wrong NSEC picked out of the cache.
5252 - If unfulfilled callbacks are deleted they are called with an error.
5253 - fptr wlist checks for mesh callbacks.
5254 - fwd above stub in configuration works.
5256 11 June 2009: Wouter
5257 - Fix queries for type DS when forward or stub zones are there.
5258 They are performed to higherup domains, and thus treated as if
5259 going to higher zones when looking up the right forward or stub
5260 server. This makes a stub pointing to a local server that has
5261 a local view of example.com signed with the same keys as are
5262 publicly used work. Reported by Johan Ihren.
5263 - Added build-unbound-localzone-from-hosts.pl to contrib, from
5264 Dennis DeDonatis. It converts /etc/hosts into config statements.
5265 - same thing fixed for forward-zone and DS, chain of trust from
5266 public internet into the forward-zone works now. Added unit test.
5269 - openssl key files are opened apache-style, when user is root and
5270 before chrooting. This makes permissions on remote-control key
5271 files easier to set up. Fixes bug #251.
5272 - flush_type and flush_name remove msg cache entries.
5273 - codereview - dp copy bogus setting fix.
5276 - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause
5277 inadvertant behaviour.
5278 - 1.3.0 tarball for release created.
5279 - 1.3.1 development in svn trunk.
5280 - iana portlist updated.
5281 - fix lint from complaining on ldns/sha.h.
5282 - help compiler figure out aliasing in priv_rrset_bad() routine.
5283 - fail to configure with python if swig is not found.
5284 - unbound_munin_ in contrib uses ps to show rss if sbrk does not work.
5287 - fixup bad free() when wrongly encoded DSA signature is seen.
5288 Reported by Paul Wouters.
5289 - review comments from Matthijs.
5292 - --enable-sha2 option. The draft rsasha256 changed its algorithm
5293 numbers too often. Therefore it is more prudent to disable the
5294 RSASHA256 and RSASHA512 support by default.
5295 - ldns trunk included as new tarball.
5296 - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point.
5299 - fixup doc bug in README reported by Matthew Dempsky.
5302 - update iana port list
5303 - update ldns lib tarball
5306 - detect lack of IPv6 support on XP (with a different error code).
5307 - Fixup a crash-on-exit which was triggered by a very long queue.
5308 Unbound would try to re-use ports that came free, but this is
5309 of course not really possible because everything is deleted.
5310 Most easily triggered on XP (not Vista), maybe because of the
5311 network stack encouraging large messages backlogs.
5312 - change in debug statements.
5313 - Fixed bug that could cause a crash if root prime failed when there
5314 were message backlogs.
5317 - Thanks again to Brett Carr, found an assertion that was not true.
5318 Assertion checked if recursion parent query still existed.
5320 29 April 2009: Wouter
5321 - Thanks to Brett Carr, caught windows resource leak, use
5322 closesocket() and not close() on sockets or else the network stack
5323 starts to leak handles.
5324 - Removed usage of windows Mutex because windows cannot handle enough
5325 mutexes open. Provide own mutex implementation using primitives.
5327 28 April 2009: Wouter
5328 - created svn tag for 1.3.0.
5330 27 April 2009: Wouter
5331 - optimised cname from cache.
5332 - ifdef windows functions in testbound.
5334 23 April 2009: Wouter
5335 - fix for threadsafety in solaris thr_key_create() in tests.
5336 - iana portlist updated.
5337 - fix pylib test for Darwin.
5338 - fix pymod test for Darwin and a python threading bug in pymod init.
5339 - check python >= 2.4 in configure.
5340 - -ldl check for libcrypto 1.0.0beta.
5342 21 April 2009: Wouter
5343 - fix for build outside sourcedir.
5344 - fix for configure script swig detection.
5346 17 April 2009: Wouter
5347 - Fix reentrant in minievent handler for unix. Could have resulted
5348 in spurious event callbacks.
5349 - timers do not take up a fd slot for winsock handler.
5350 - faster fix for winsock reentrant check.
5351 - fix rsasha512 unit test for new (interim) algorithm number.
5352 - fix test:ldns doesn't like DOS line endings in keyfiles on unix.
5353 - fix compile warning on ubuntu (configlexer fwrite return value).
5354 - move python include directives into CPPFLAGS instead of CFLAGS.
5356 16 April 2009: Wouter
5357 - winsock event handler exit very quickly on signal, even if
5359 - iana portlist updated.
5360 - fixup windows winsock handler reentrant problem.
5362 14 April 2009: Wouter
5363 - bug #245: fix munin plugin, perform cleanup of stale lockfiles.
5364 - makedist.sh; better help text.
5365 - cache-min-ttl option and tests.
5366 - mingw detect error condition on TCP sockets (NOTCONN).
5368 9 April 2009: Wouter
5369 - Fix for removal of RSASHA256_NSEC3 protonumber from ldns.
5370 - ldns tarball updated.
5371 - iana portlist update.
5372 - detect GOST support in openssl-1.0.0-beta1, and fix compile problem
5373 because that openssl defines the name STRING for itself.
5375 6 April 2009: Wouter
5376 - windows compile fix.
5377 - Detect FreeBSD jail without ipv6 addresses assigned.
5378 - python libunbound wrapper unit test.
5379 - installs the following files. Default is to not build them.
5380 from configure --with-pythonmodule:
5381 /usr/lib/python2.x/site-packages/unboundmodule.py
5382 from configure --with-pyunbound:
5383 /usr/lib/python2.x/site-packages/unbound.py
5384 /usr/lib/python2.x/site-packages/_unbound.so*
5385 The example python scripts (pythonmod/examples and
5386 libunbound/python/examples) are not installed.
5387 - python invalidate routine respects packed rrset ids and locks.
5388 - clock skew checks in unbound, config statements.
5389 - nxdomain ttl considerations in requirements.txt
5391 3 April 2009: Wouter
5392 - Fixed a bug that caused messages to be stored in the cache too
5393 long. Hard to trigger, but NXDOMAINs for nameservers or CNAME
5394 targets have been more vulnerable to the TTL miscalculation bug.
5395 - documentation test fixed for python addition.
5397 2 April 2009: Wouter
5398 - pyunbound (libunbound python plugin) compiles using libtool.
5399 - documentation for pythonmod and pyunbound is generated in doc/html.
5400 - iana portlist updated.
5401 - fixed bug in unbound-control flush_zone where it would not flush
5402 every message in the target domain. This especially impacted
5403 NXDOMAIN messages which could remain in the cache regardless.
5404 - python module test package.
5406 1 April 2009: Wouter
5407 - suppress errors when trying to contact authority servers that gave
5408 ipv6 AAAA records for their nameservers with ipv4 mapped contents.
5409 Still tries to do so, could work when deployed in intranet.
5410 Higher verbosity shows the error.
5411 - new libunbound calls documented.
5412 - pyunbound in libunbound/python. Removed compile warnings.
5413 Makefile to make it.
5415 30 March 2009: Wouter
5416 - Fixup LDFLAGS from libevent sourcedir compile configure restore.
5417 - Fixup so no non-absolute rpaths are added.
5418 - Fixup validation of RRSIG queries, they are let through.
5419 - read /dev/random before chroot
5420 - checkconf fix no python checks when no python module enabled.
5421 - fix configure, pthread first, so other libs do not change outcome.
5423 27 March 2009: Wouter
5424 - nicer -h output. report linked libraries and modules.
5425 - prints modules in intuitive order (config file friendly).
5426 - python compiles easily on BSD.
5428 26 March 2009: Wouter
5429 - ignore swig varargs warnings with gcc.
5430 - remove duplicate example.conf text from python example configs.
5431 - outofdir compile fix for python.
5433 - print modules compiled in on -h. manpage.
5435 25 March 2009: Wouter
5436 - initial import of the python contribution from Zdenek Vasicek and
5438 - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0.
5440 24 March 2009: Wouter
5441 - more neat configure.ac. Removed duplicate config.h includes.
5442 - neater config.h.in.
5443 - iana portlist updated.
5444 - fix util/configlexer.c and solaris -std=c99 flag.
5445 - fix postcommit aclocal errors.
5446 - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R.
5447 - swap order of host detect and libtool generation.
5449 23 March 2009: Wouter
5450 - added launchd plist example file for MacOSX to contrib.
5451 - deprecation test for daemon(3).
5452 - moved common configure actions to m4 include, prettier Makefile.
5454 20 March 2009: Wouter
5455 - bug #239: module-config entries order is important. Documented.
5456 - build fix for test asynclook.
5458 19 March 2009: Wouter
5459 - winrc/README.txt dos-format text file.
5460 - iana portlist updated.
5461 - use _beginthreadex() when available (performs stack alignment).
5462 - defaults for windows baked into configure.ac (used if on mingw).
5464 18 March 2009: Wouter
5465 - Added tests, unknown algorithms become insecure. fallback works.
5466 - Fix for and test for unknown algorithms in a trust anchor
5467 definition. Trust anchors with no supported algos are ignored.
5468 This means a (higher)DS or DLV entry for them could succeed, and
5469 otherwise they are treated as insecure.
5470 - domain-insecure: "example.com" statement added. Sets domain
5471 insecure regardless of chain of trust DSs or DLVs. The inverse
5474 17 March 2009: Wouter
5475 - unit test for unsupported algorithm in anchor warning.
5476 - fixed so queries do not fail on opportunistic target queries.
5478 16 March 2009: Wouter
5479 - fixup diff error printout in contrib/update-itar.sh.
5480 - added contrib/unbound_cacti for statistics support in cacti,
5481 contributed by Dmitriy Demidov.
5483 13 March 2009: Wouter
5484 - doxygen and lex/yacc on linux.
5485 - strip update-anchor on makedist -w.
5486 - fix testbound on windows.
5487 - default log to syslog for windows.
5488 - uninstaller can stop unbound - changed text on it to reflect that.
5489 - remove debugging from windows 'cron' actions.
5491 12 March 2009: Wouter
5492 - log to App.logs on windows prints executable identity.
5494 - munin plugin fix benign locking error printout.
5495 - anchor-update for windows, called every 24 hours; unbound reloads.
5497 11 March 2009: Wouter
5498 - winsock event handler resets WSAevents after signalled.
5499 - winsock event handler tests if signals are really signalled.
5500 - install and service with log to file works on XP and Vista on
5501 default install location.
5502 - on windows logging to the Application logbook works (as a service).
5503 - fix RUN_DIR on windows compile setting in makedist.
5504 - windows registry has Software\Unbound\ConfigFile element.
5505 If does not exist, the default is used. The -c switch overrides it.
5506 - fix makedist version cleanup function.
5508 10 March 2009: Wouter
5509 - makedist -w strips out old rc.. and snapshot info from version.
5510 - setup.exe starts and stops unbound after install, before uninstall.
5511 - unbound-checkconf recognizes absolute pathnames on windows (C:...).
5513 9 March 2009: Wouter
5514 - Nullsoft NSIS installer creation script.
5516 5 March 2009: Wouter
5517 - fixup memory leak introduced on 18feb in mesh reentrant fix.
5519 3 March 2009: Wouter
5520 - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8).
5521 - service works on xp/vista, no config necessary (using defaults).
5522 - windows registry settings.
5524 2 March 2009: Wouter
5525 - fixup --export-symbols to be -export-symbls for libtool.
5526 This should fix extraneous symbols exported from libunbound.
5527 Thanks to Ondrej Sury and Robert Edmonds for finding it.
5528 - iana portlist updated.
5529 - document FAQ entry on stub/forward zones and default blocking.
5530 - fix asynclook test app for libunbound not exporting symbols.
5531 - service install and remove utils that work with vista UAC.
5533 27 February 2009: Wouter
5534 - Fixup lexer, to not give warnings about fwrite. Appeared in
5536 - makedistro functionality for mingw. Has RC support.
5537 - support spaces and backslashes in configured defaults paths.
5538 - register, deregister in service control manager.
5540 25 February 2009: Wouter
5541 - windres usage for application resources.
5543 24 February 2009: Wouter
5544 - isc moved their dlv key download location.
5545 - fixup warning on vista/mingw.
5546 - makedist -w for window zip distribution first version.
5548 20 February 2009: Wouter
5549 - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped.
5550 Nicer script layout. Added url to site in -h output.
5552 19 February 2009: Wouter
5553 - unbound-checkconf and unbound print warnings when trust anchors
5554 have unsupported algorithms.
5555 - added contrib/update-itar.sh This script is similar to
5556 update-anchor.sh, and updates from the IANA ITAR repository.
5557 You can provide your own PGP key and trust repo, or can use the
5558 builtin. The program uses wget and gpg to work.
5559 - iana portlist updated.
5560 - update-itar.sh: using ftp:// urls because https godaddy certificate
5561 is not available everywhere and then gives fatal errors. The
5562 security is provided by pgp signature.
5564 18 February 2009: Wouter
5565 - more cycle detection. Also for target queries.
5566 - fixup bug where during deletion of the mesh queries the callbacks
5567 that were reentrant caused assertion failures. Keep the mesh in
5568 a reentrant safe state. Affects libunbound, reload of server,
5569 on quit and flush_requestlist.
5570 - iana portlist updated.
5572 13 February 2009: Wouter
5573 - forwarder information now per-thread duplicated.
5574 This keeps it read only for speed, with no locking necessary.
5575 - forward command for unbound control to change forwarders to use
5577 - document that unbound-host reads no config file by default.
5578 - updated iana portlist.
5580 12 February 2009: Wouter
5581 - call setusercontext if available (on BSD).
5582 - small refactor of stats clearing.
5583 - #227: flush_stats feature for unbound-control.
5584 - stats_noreset feature for unbound-control.
5585 - flush_requestlist feature for unbound-control.
5586 - libunbound version upped API (was changed 5 feb).
5587 - unbound-control status shows if root forwarding is in use.
5588 - slightly nicer memory management in iter-fwd code.
5590 10 February 2009: Wouter
5591 - keys with rfc5011 REVOKE flag are skipped and not considered when
5593 - iana portlist updated
5594 - #226: dump_requestlist feature for unbound-control.
5596 6 February 2009: Wouter
5597 - contrib contains specfile for fedora 1.2.1 (from Paul Wouters).
5598 - iana portlist updated.
5599 - fixup EOL in include directive (reported by Paul Wouters).
5600 You can no longer specify newlines in the names of included files.
5601 - config parser changed. Gives some syntax errors closer to where they
5602 occurred. Does not enforce a space after keyword anymore.
5603 Does not allow literal newlines inside quoted strings anymore.
5604 - verbosity level 5 logs customer IP for new requestlist entries.
5605 - test fix, lexer and cancel test.
5606 - new option log-time-ascii: yes if you enable it prints timestamps
5607 in the log file as Feb 06 13:45:26 (like syslog does).
5608 - detect event_base_new in libevent-1.4.1 and later and use it.
5609 - #231 unbound-checkconf -o option prints that value from config file.
5610 Useful for scripting in management scripts and the like.
5612 5 February 2009: Wouter
5613 - ldns 1.5.0 rc as tarball included.
5614 - 1.3.0 development continues:
5615 change in libunbound API: ub_cancel can return an error, that
5616 the async_id did not exist, or that it was already delivered.
5617 The result could have been delivered just before the cancel
5618 routine managed to acquire the lock, so a caller may get the
5619 result at the same time they call cancel. For this case,
5620 ub_cancel tries to return an error code.
5621 Fixes race condition in ub_cancel() libunbound function.
5622 - MacOSX Leopard cleaner text output from configure.
5623 - initgroups(3) is called to drop secondary group permissions, if
5625 - configure option --with-ldns-builtin forces the use of the
5626 inluded ldns package with the unbound source. The -I include
5627 is put before the others, so it avoids bad include files from
5628 an older ldns install.
5629 - daemon(3) posix call is used when available.
5630 - testbound test for older fix added.
5632 4 February 2009: Wouter
5633 - tag for release 1.2.1.
5634 - trunk setup for 1.3.0 development.
5636 3 February 2009: Wouter
5637 - noted feature requests in doc/TODO.
5638 - printout more detailed errors on ssl certificate loading failures.
5639 - updated IANA portlist.
5641 16 January 2009: Wouter
5642 - more quiet about ipv6 network failures, i.e. when ipv6 is not
5643 available (network unreachable). Debug still printed on high
5645 - unbound-host -4 and -6 options. Stops annoying ipv6 errors when
5646 debugging with unbound-host -4 -d ...
5647 - more cycle detection for NS-check, addr-check, root-prime and
5648 stub-prime queries in the iterator. Avoids possible deadlock
5651 15 January 2009: Wouter
5652 - bug #229: fixup configure checks for compilation with Solaris
5653 Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc
5654 - fixup suncc warnings.
5655 - fix bug where unbound could crash using libevent 1.3 and older.
5656 - update testset for recent retry change.
5658 14 January 2009: Wouter
5659 - 1.2.1 feature: negative caching for failed queries.
5660 Queries that failed are cached for 5 seconds (NORR_TTL).
5661 If the failure is local, like out of memory, it is not cached.
5662 - the TTL comparison for the cache used different comparisons,
5663 causing many cache responses that used the iterator and validator
5664 state machines unnecessarily.
5665 - retry from 4 to 5 so that EDNS drop retry is part of the first
5666 query resolve attempt, and cached error does not stop EDNS fallback.
5667 - remove debug prints that protect against bad referrals.
5668 - honor QUIET=no on make commandline (or QUIET=yes ).
5670 13 January 2009: Wouter
5671 - fixed bug in lameness marking, removed printouts.
5672 - find NS rrset more cleanly for qtype NS.
5673 - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for
5675 - 1.2.1 feature: stops resolving AAAAs promiscuously when they
5676 are in the negative cache.
5678 12 January 2009: Wouter
5679 - fixed bug in infrastructure lameness cache, did not lowercase
5680 name of zone to hash when setting lame.
5681 - lameness debugging printouts.
5683 9 January 2009: Wouter
5684 - created svn tag for 1.2.0 release.
5685 - svn trunk contains 1.2.1 version number.
5686 - iana portlist updated for todays list.
5687 - removed debug print.
5689 8 January 2009: Wouter
5690 - new version of ldns-trunk (today) included as tarball, fixed
5691 bug #224, building with -j race condition.
5692 - remove possible race condition in the test for race conditions.
5694 7 January 2009: Wouter
5695 - version 1.2.0 in preparation.
5696 - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file
5697 statements. (Adapted from patch by Paul Wouters).
5698 - typo fix and iana portlist updated.
5699 - porting testsuite; unused var warning, and type fixup.
5701 6 January 2009: Wouter
5702 - fixup packet-of-death when compiled with --enable-debug.
5703 A malformed packet could cause an internal assertion failure.
5704 - added test for HINFO canonicalisation behaviour.
5705 - fixup reported problem with transparent local-zone data where
5706 queries with different type could get nxdomain. Now queries
5707 with a different name get resolved normally, with different type
5708 get a correct NOERROR/NODATA answer.
5709 - HINFO no longer downcased for validation, making unbound compatible
5711 - fix reading included config files when chrooted.
5712 Give full path names for include files.
5713 Relative path names work if the start dir equals the working dir.
5714 - fix libunbound message transport when no packet buffer is available.
5716 5 January 2009: Wouter
5717 - fixup getaddrinfo failure handling for remote control port.
5718 - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints.
5719 - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/
5720 - comm_timer_set performs base_set operation after event_add.
5722 18 December 2008: Wouter
5723 - fixed bug reported by Duane Wessels: error in DLV lookup, would make
5724 some zones that had correct DLV keys as insecure.
5725 - follows -rc makedist from ldns changes (no _rc).
5726 - ldns tarball updated with 1.4.1rc for DLV unit test.
5727 - verbose prints about recursion lame detection and server selection.
5728 - fixup BSD port for infra host storage. It hashed wrongly.
5729 - fixup makedist snapshot name generation.
5730 - do not reopen syslog to avoid dev/log dependency.
5732 17 December 2008: Wouter
5733 - follows ldns makedist.sh. -rc option. autom4te dir removed.
5734 - unbound-control status command.
5735 - extended statistics has a number of ipv6 queries counter.
5736 contrib/unbound_munin_ was updated to draw ipv6 in the hits graph.
5738 16 December 2008: Wouter
5739 - follow makedist improvements from ldns, for maintainers prereleases.
5740 - snapshot version uses _ not - to help rpm distinguish the
5743 11 December 2008: Wouter
5744 - better fix for bug #219: use LOG_NDELAY with openlog() call.
5745 Thanks to Tamas Tevesz.
5747 9 December 2008: Wouter
5748 - bug #221 fixed: unbound checkconf checks if key files exist if
5749 remote control is enabled. Also fixed NULL printf when not chrooted.
5750 - iana portlist updated.
5752 3 December 2008: Wouter
5753 - Fix problem reported by Jaco Engelbrecht where unbound-control stats
5754 freezes up unbound if this was compiled without threading, and
5755 was using multiple processes.
5756 - iana portlist updated.
5757 - test for remote control with interprocess communication.
5758 - created command distribution mechanism so that remote control
5759 commands other than 'stats' work on all processes in a nonthreaded
5760 compiled version. dump/load cache work, on the first process.
5761 - fixup remote control local_data addition memory corruption bug.
5763 1 December 2008: Wouter
5764 - SElinux policy files in contrib/selinux for the unbound daemon,
5765 by Paul Wouters and Adam Tkac.
5767 25 November 2008: Wouter
5768 - configure complains when --without-ssl is given (bug #220).
5769 - skip unsupported feature tests on vista/mingw.
5770 - fixup testcode/streamtcp to work on vista/mingw.
5771 - root-hints test checks version of dig required.
5772 - blacklisted servers are polled at a low rate (1%) to see if they
5773 come back up. But not if there is some other working server.
5775 24 November 2008: Wouter
5776 - document that the user of the server daemon needs read privileges
5777 on the keys and certificates generated by unbound-control-setup.
5778 This is different per system or distribution, usually, running the
5779 script under the same username as the server uses suffices.
5780 i.e. sudo -u unbound unbound-control-setup
5781 - testset port to vista/mingw.
5782 - tcp_sigpipe to freebsd port.
5784 21 November 2008: Wouter
5785 - fixed tcp accept, errors were printed when they should not.
5786 - unbound-control-setup.sh removes read/write permissions other
5787 from the keys it creates (as suggested by Dmitriy Demidov).
5789 20 November 2008: Wouter
5790 - fixup fatal error due to faulty error checking after tcp accept.
5791 - add check in rlimit to avoid integer underflow.
5792 - rlimit check with new formula; better estimate for number interfaces
5793 - nicer comments in rlimit check.
5794 - tag 1.1.1 created in svn.
5795 - trunk label is 1.1.2
5797 19 November 2008: Wouter
5798 - bug #219: fixed so that syslog which delays opening until the first
5799 log line is written, gets a log line while not chroot'ed yet.
5801 18 November 2008: Wouter
5802 - iana portlist updated.
5803 - removed cast in unit test debug print that was not 64bit safe.
5804 - trunk back to 1.1.0; copied to tags 1.1.0 release.
5805 - trunk to has version number 1.1.1 again.
5806 - in 1.1.1; make clean nicer. grammar in manpage.
5808 17 November 2008: Wouter
5809 - theoretical fix for problems reported on mailing list.
5810 If a delegation point has no A but only AAAA and do-ip6 is no,
5811 resolution would fail. Fixed to ask for the A and AAAA records.
5812 It has to ask for both always, so that it can fail quietly, from
5813 TLD perspective, when a zone is only reachable on one transport.
5814 - test for above, only AAAA and doip6 is no. Fix causes A record
5815 for nameserver to be fetched.
5816 - fixup address duplication on cache fillup for delegation points.
5817 - testset updated for new query answer requirements.
5819 14 November 2008: Wouter
5820 - created 1.1.0 release tag in svn.
5821 - trunk moved to 1.1.1
5822 - fixup unittest-neg for locking.
5824 13 November 2008: Wouter
5825 - added fedora init and specfile to contrib (by Paul Wouters).
5826 - added configure check for ldns 1.4.0 (using its compat funcs).
5827 - neater comments in worker.h.
5828 - removed doc/plan and updated doc/TODO.
5829 - silenced EHOSTDOWN (verbosity 2 or higher to see it).
5830 - review comments from Jelte, Matthijs. Neater code.
5832 12 November 2008: Wouter
5833 - add unbound-control manpage to makedist replace list.
5835 11 November 2008: Wouter
5836 - unit test for negative cache, stress tests the refcounting.
5837 - fix for refcounting error that could cause fptr_wlist fatal exit
5838 in the negative cache rbtree (upcoming 1.1 feature). (Thanks to
5839 Attila Nagy for testing).
5840 - nicer comments in cachedump about failed RR to string conversion.
5841 - fix 32bit wrap around when printing large (4G and more) mem usage
5842 for extended statistics.
5844 10 November 2008: Wouter
5845 - fixup the getaddrinfo compat code rename.
5847 8 November 2008: Wouter
5848 - added configure check for eee build warning.
5850 7 November 2008: Wouter
5851 - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4.
5852 - detect nonblocking problems in network stack in configure script.
5854 6 November 2008: Wouter
5855 - dname_priv must decompress the name before comparison.
5856 - iana portlist updated.
5858 5 November 2008: Wouter
5859 - fixed possible memory leak in key_entry_key deletion.
5860 Would leak a couple bytes when trust anchors were replaced.
5861 - if query and reply qname overlap, the bytes are skipped not copied.
5862 - fixed file descriptor leak when messages were jostled out that
5863 had outstanding (TCP) replies.
5864 - DNAMEs used from cache have their synthesized CNAMEs initialized
5866 - fixed file descriptor leak for localzone type deny (for TCP).
5867 - fixed memleak at exit for nsec3 negative cached zones.
5868 - fixed memleak for the keyword 'nodefault' when reading config.
5869 - made verbosity of 'edns incapable peer' warning higher, so you
5870 do not get spammed by it.
5871 - caught elusive Bad file descriptor error bug, that would print the
5872 error while unnecessarily try to listen to a closed fd. Fixed.
5874 4 November 2008: Wouter
5875 - fixed -Wwrite-strings warnings that result in better code.
5877 3 November 2008: Wouter
5878 - fixup build process for Mac OSX linker, use ldns b32 compat funcs.
5879 - generated configure with autoconf-2.61.
5880 - iana portlist updated.
5881 - detect if libssl needs libdl. For static linking with libssl.
5882 - changed to use new algorithm identifiers for sha256/sha512
5883 from ldns 1.4.0 (need very latest version).
5884 - updated the included ldns tarball.
5885 - proper detection of SHA256 and SHA512 functions (not just sizes).
5887 23 October 2008: Wouter
5888 - a little more debug info for failure on signer names. prints names.
5890 22 October 2008: Wouter
5891 - CFLAGS are picked up by configure from the environment.
5892 - iana portlist updated.
5893 - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too.
5894 - new stub-prime: yesno option. Default is off, so it does not prime.
5895 can be turned on to get same behaviour as previous unbound release.
5896 - made automated test that checks if builtin root hints are uptodate.
5897 - finished draft-wijngaards-dnsext-resolver-side-mitigation
5898 implementation. The unwanted-reply-threshold can be set.
5899 - fixup so fptr_whitelist test in alloc.c works.
5901 21 October 2008: Wouter
5902 - fix update-anchors.sh, so it does not report different RR order
5903 as an update. Sorts the keys in the file. Updated copyright.
5904 - fixup testbound on windows, the command control pipe doesn't exist.
5905 - skip 08hostlib test on windows, no fork() available.
5906 - made unbound-remote work on windows.
5908 20 October 2008: Wouter
5909 - quench a log message that is debug only.
5910 - iana portlist updated.
5911 - do not query bogus nameservers. It is like nameservers that have
5912 the NS or A or AAAA record bogus are listed as donotquery.
5913 - if server selection is faced with only bad choices, it will
5914 attempt to get more options to be fetched.
5915 - changed bogus-ttl default value from 900 to 60 seconds.
5916 In anticipation that operator caused failures are more likely than
5917 actual attacks at this time. And thus repeated validation helps
5918 the operators get the problem fixed sooner. It makes validation
5919 failures go away sooner (60 seconds after the zone is fixed).
5920 Also it is likely to try different nameserver targets every minute,
5921 so that if a zone is bad on one server but not another, it is
5922 likely to pick up the 'correct' one after a couple minutes,
5923 and if the TTL is big enough that solves validation for the zone.
5924 - fixup unbound-control compilation on windows.
5926 17 October 2008: Wouter
5927 - port Leopard/G5: fixup type conversion size_t/uint32.
5928 please ranlib, stop file without symbols warning.
5929 - harden referral path now also validates the root after priming.
5930 It looks up the root NS authoritatively as well as the root servers
5931 and attemps to validate the entries.
5933 16 October 2008: Wouter
5934 - Fixup negative TTL values appearing (reported by Attila Nagy).
5936 15 October 2008: Wouter
5937 - better documentation for 0x20; remove fallback TODO, it is done.
5938 - harden-referral-path feature includes A, AAAA queries for glue,
5939 as well as very careful NS caching (only when doing NS query).
5940 A, AAAA use the delegation from the NS-query.
5942 14 October 2008: Wouter
5943 - fwd_three.tpkg test was flaky. If the three requests hit the
5944 wrong threads by chance (or bad OS) then the test would fail.
5945 Made less flaky by increasing number of retries.
5946 - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs.
5947 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014).
5948 Which includes the ldns_dname_absolute fix.
5949 - fwd_three test remains flaky now that unbound does not stop
5950 listening when full. Thus, removed timeout problem.
5951 It may be serviced by three threads, or maybe by one.
5952 Mostly only useful for lock-check testing now.
5954 13 October 2008: Wouter
5955 - fixed recursion servers deployed as authoritative detection, so
5956 that as a last resort, a +RD query is sent there to get the
5958 - iana port list update.
5959 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013).
5961 10 October 2008: Wouter
5962 - fixup tests - the negative cache contained the correct NSEC3s for
5963 two tests that are supposed to fail to validate.
5965 9 October 2008: Wouter
5966 - negative cache caps max iterations of NSEC3 done.
5967 - NSEC3 negative cache for qtype DS works.
5969 8 October 2008: Wouter
5970 - NSEC negative cache for DS.
5972 6 October 2008: Wouter
5973 - jostle-timeout option, so you can config for slow links.
5974 - 0x20 fallback code. Tries 3xnumber of nameserver addresses
5975 queries that must all be the same. Sent to random nameservers.
5976 - documented choices for DoS, EDNS, 0x20.
5978 2 October 2008: Wouter
5979 - fixup unlink of pidfile.
5980 - fixup SHA256 algorithm collation code.
5981 - contrib/update-anchor.sh does not overwrite anchors if not needed.
5982 exits 0 when a restart is needed, other values if not.
5983 so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart
5984 can restart unbound exactly when needed.
5986 30 September 2008: Wouter
5987 - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1.
5988 - tests for sha256 support and downgrade resistance.
5989 - RSASHA256 and RSASHA512 support (using the draft in dnsext),
5990 using the drafted protocol numbers.
5991 - when using stub on localhost (127.0.0.1@10053) unbound works.
5992 Like when running NSD to host a local zone, on the same machine.
5993 The noprime feature. manpages more explanation. Added a test for it.
5994 - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com"
5996 29 September 2008: Wouter
5997 - EDNS lameness detection, if EDNS packets are dropped this is
5998 detected, eventually.
5999 - multiple query timeout rtt backoff does not backoff too much.
6001 26 September 2008: Wouter
6002 - tests for remote-control.
6003 - small memory leak in exception during remote control fixed.
6004 - fixup for lock checking but not unchecking in remote control.
6005 - iana portlist updated.
6007 23 September 2008: Wouter
6008 - Msg cache is loaded. A cache load enables cache responses.
6009 - unbound-control flush [name], flush_type and flush_zone.
6011 22 September 2008: Wouter
6012 - dump_cache and load_cache statements in unbound-control.
6013 RRsets are dumped and loaded correctly.
6014 Msg cache is dumped.
6016 19 September 2008: Wouter
6017 - locking on the localdata structure.
6018 - add and remove local zone and data with unbound-control.
6019 - ldns trunk snapshot updated, make tests work again.
6021 18 September 2008: Wouter
6022 - fixup error in time calculation.
6023 - munin plugin improvements.
6024 - nicer abbreviations for high query types values (ixfr, axfr, any...)
6025 - documented the statistics output in unbound-control man page.
6026 - extended statistics prints out histogram, over unbound-control.
6028 17 September 2008: Wouter
6029 - locking for threadsafe bogus rrset counter.
6030 - ldns trunk no longer exports b32 functions, provide compat.
6031 - ldns tarball updated.
6032 - testcode/ldns-testpkts.c const fixups.
6033 - fixed rcode stat printout.
6034 - munin plugin in contrib.
6035 - stats always printout uptime, because stats plugins need it.
6037 16 September 2008: Wouter
6038 - extended-statistics: yesno config option.
6039 - unwanted replies spoof nearmiss detector.
6040 - iana portlist updated.
6042 15 September 2008: Wouter
6043 - working start, stop, reload commands for unbound-control.
6044 - test for unbound-control working; better exit value for control.
6045 - verbosity control via unbound-control.
6046 - unbound-control stats.
6048 12 September 2008: Wouter
6049 - removed browser control mentions. Proto speccy.
6051 11 September 2008: Wouter
6052 - set nonblocking on new TCP streams, because linux does not inherit
6053 the socket options to the accepted socket.
6055 - SSL protected connection between server and unbound-control.
6057 10 September 2008: Wouter
6058 - remove memleak in privacy addresses on reloads and quits.
6059 - remote control work.
6061 9 September 2008: Wouter
6062 - smallapp/unbound-control-setup.sh script to set up certificates.
6064 4 September 2008: Wouter
6065 - scrubber scrubs away private addresses.
6066 - test for private addresses. man page entry.
6067 - code refactored for name and address tree lookups.
6069 3 September 2008: Wouter
6070 - options for 'DNS Rebinding' protection: private-address and
6072 - dnstree for reuse of routines that help with domain, addr lookups.
6073 - private-address and private-domain config option read, stored.
6075 2 September 2008: Wouter
6076 - DoS protection features. Queries are jostled out to make room.
6077 - testbound can pass time, increasing the internal timer.
6078 - do not mark unsigned additionals bogus, leave unchecked, which
6081 1 September 2008: Wouter
6082 - disallow nonrecursive queries for cache snooping by default.
6083 You can allow is using access-control: <subnet> allow_snoop.
6084 The defaults do allow access no authoritative data without RD bit.
6085 - two tests for it and fixups of tests for nonrec refused.
6087 29 August 2008: Wouter
6088 - version 1.1 number in trunk.
6089 - harden-referral-path option for query for NS records.
6090 Default turns off expensive, experimental option.
6092 28 August 2008: Wouter
6093 - fixup logfile handling; it is created with correct permissions
6094 again. (from bugfix#199).
6095 Some errors are not written to logfile (pidfile writing, forking),
6096 and these are only visible by using the -d commandline flag.
6098 27 August 2008: Wouter
6099 - daemon(3) is causing problems for people. Reverting the patch.
6100 bug#200, and 199 and 203 contain sideline discussion on it.
6101 - bug#199 fixed: pidfile can be outside chroot. openlog is done before
6102 chroot and drop permissions.
6103 - config option to set size of aggressive negative cache,
6105 - bug#203 fixed: dlv has been implemented.
6107 26 August 2008: Wouter
6108 - test for insecure zone when DLV is in use, also does negative cache.
6109 - test for trustanchor when DLV is in use (the anchor works).
6110 - test for DLV used for a zone below a trustanchor.
6111 - added scrub filter for overreaching NSEC records and unit test.
6112 - iana portlist update
6113 - use of setresuid or setreuid when available.
6114 - use daemon(3) if available.
6116 25 August 2008: Wouter
6117 - realclean patch from Robert Edmonds.
6119 22 August 2008: Wouter
6120 - nicer debuglogging of DLV.
6121 - test with secure delegation inside the DLV repository.
6123 21 August 2008: Wouter
6124 - negative cache code linked into validator, for DLV use.
6125 negative cache works for DLV.
6126 - iana portlist update.
6127 - dlv-anchor option for unit tests.
6128 - fixup NSEC_AT_APEX classification for short typemaps.
6129 - ldns-testns has subdomain checks, for unit tests.
6131 20 August 2008: Wouter
6132 - negative cache code, reviewed.
6134 18 August 2008: Wouter
6135 - changes info: in logfile to notice: info: or debug: depending on
6136 the verbosity of the statements. Better logfile message
6138 - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd.
6140 15 August 2008: Wouter
6141 - DLV nsec code fixed for better detection of closest existing
6142 enclosers from NSEC responses.
6143 - DLV works, straight to the dlv repository, so not for production.
6146 14 August 2008: Wouter
6147 - synthesize DLV messages from the rrset cache, like done for DS.
6149 13 August 2008: Wouter
6150 - bug #203: nicer do-auto log message when user sets incompatible
6152 - bug #204: variable name ameliorated in log.c.
6153 - bug #206: in iana_update, no egrep, but awk use.
6154 - ldns snapshot r2699 taken (includes DLV type).
6155 - DLV work, config file element, trust anchor read in.
6157 12 August 2008: Wouter
6158 - finished adjusting testset to provide qtype NS answers.
6160 11 August 2008: Wouter
6161 - Fixup rrset security updates overwriting 2181 trust status.
6162 This makes validated to be insecure data just as worthless as
6163 nonvalidated data, and 2181 rules prevent cache overwrites to them.
6164 - Fix assertion fail on bogus key handling.
6165 - dnssec lameness detection works on first query at trust apex.
6166 - NS queries get proper cache and dnssec lameness treatment.
6167 - fixup compilation without pthreads on linux.
6169 8 August 2008: Wouter
6170 - NS queries are done after every referral.
6171 validator is used on those NS records (if anchors enabled).
6173 7 August 2008: Wouter
6174 - Scrubber more strict. CNAME chains, DNAMEs from cache, other
6175 irrelevant rrsets removed.
6176 - 1.0.2 released from 1.0 support branch.
6177 - fixup update-anchor.sh to work both in BSD shell and bash.
6179 5 August 2008: Wouter
6180 - fixup DS test so apex nodata works again.
6182 4 August 2008: Wouter
6185 - fix bug 201: null ptr deref on cleanup while udp pkts wait for port.
6186 - added explanatory text for outgoing-port-permit in manpage.
6188 30 July 2008: Wouter
6189 - fixup bug qtype DS for unsigned zone and signed parent validation.
6191 25 July 2008: Wouter
6192 - added original copyright statement of OpenBSD arc4random code.
6193 - created tube signaling solution on windows, as a pipe replacement.
6194 this makes background asynchronous resolution work on windows.
6195 - removed very insecure socketpair compat code. It also did not
6196 work with event_waiting. Solved by pipe replacement.
6197 - unbound -h prints openssl version number as well.
6199 22 July 2008: Wouter
6200 - moved pipe actions to util/tube.c. easier porting and shared code.
6201 - check _raw() commpoint callbacks with fptr_wlist.
6204 21 July 2008: Wouter
6205 - #198: nicer entropy warning message. manpage OS hints.
6207 19 July 2008: Wouter
6208 - #198: fixup man page to suggest chroot entropy fix.
6210 18 July 2008: Wouter
6211 - branch for 1.0 support.
6212 - trunk work on tube.c.
6214 17 July 2008: Wouter
6215 - fix bug #196, compile outside source tree.
6216 - fix bug #195, add --with-username=user configure option.
6217 - print error and exit if started with config that requires more
6218 fds than the builtin minievent can handle.
6220 16 July 2008: Wouter
6221 - made svn tag 1.0.1, trunk now 1.0.2
6222 - sha256 checksums enabled in makedist.sh
6224 15 July 2008: Wouter
6225 - Follow draft-ietf-dnsop-default-local-zones-06 added reverse
6226 IPv6 example prefix to AS112 default blocklist.
6227 - fixup lookup of DS records by client with trustanchor for same.
6228 - libunbound ub_resolve, fix handling of error condition during setup.
6229 - lowered log_hex blocksize to fit through BSD syslog linesize.
6230 - no useless initialisation if getpwnam not available.
6231 - iana, ldns snapshot updated.
6234 - Matthijs fixed memory leaks in root hints file reading.
6236 26 June 2008: Wouter
6237 - fixup streamtcp bounds setting for udp mode, in the test framework.
6238 - contrib item for updating trust anchors.
6240 25 June 2008: Wouter
6241 - fixup fwd_ancil test typos.
6242 - Fix for newegg lameness : ok for qtype=A, but lame for others.
6243 - fixup unit test for infra cache, test lame merging.
6244 - porting to mingw, bind, listen, getsockopt and setsockopt error
6247 24 June 2008: Wouter
6248 - removed testcode/checklocks from production code compilation path.
6249 - streamtcp can use UDP mode (connected UDP socket), for testing IPv6
6251 - fwd_ancil test fails if platform support is lacking.
6253 23 June 2008: Wouter
6254 - fixup minitpkg to cleanup on windows with its file locking troubles.
6255 - minitpkg shows skipped tests in report.
6256 - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not
6258 - winsock event handler keeps track of sticky TCP events, that have
6259 not been fully handled yet. when interest in the event(s) resumes,
6260 they are sent again. When WOULDBLOCK is returned events are cleared.
6261 - skip tests that need signals when testing on mingw.
6263 18 June 2008: Wouter
6264 - open testbound replay files in binary mode, because fseek/ftell
6265 do not work in ascii-mode on windows. The b does nothing on unix.
6266 unittest and testbound tests work on windows (xp too).
6267 - ioctlsocket prints nicer error message.
6268 - fixed up some TCP porting for winsock.
6269 - lack of IPv6 gives a warning, no fatal error.
6270 - use WSAGetLastError() on windows instead of errno for some errors.
6272 17 June 2008: Wouter
6273 - outgoing num fds 32 by default on windows ; it supports less
6274 fds for waiting on than unixes.
6275 - winsock_event minievent handler for windows. (you could also
6276 attempt to link with libevent/libev ports for windows).
6277 - neater crypto check and gdi32 detection.
6278 - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista.
6280 16 June 2008: Wouter
6281 - on windows, use windows threads, mutex and thread-local-storage(Tls).
6282 - detect if openssl needs gdi32.
6283 - if no threading, THREADS_DISABLED is defined for use in the code.
6284 - sets USE_WINSOCK if using ws2_32 on windows.
6285 - wsa_strerror() function for more readable errors.
6286 - WSA Startup and Cleanup called in unbound.exe.
6288 13 June 2008: Wouter
6289 - port mingw32, more signal ifdefs, detect sleep, usleep,
6290 random, srandom (used inside the tests).
6291 - signed or unsigned FD_SET is cast.
6293 10 June 2008: Wouter
6294 - fixup warnings compiling on eeepc xandros linux.
6297 - in iteration response type code
6298 * first check for SOA record (negative answer) before NS record
6300 * check if no AA bit for non-forwarder, and thus lame zone.
6301 In response to error report by Richard Doty for mail.opusnet.com.
6302 - fixup unput warning from lexer on freeBSD.
6303 - bug#183. pidfile, rundir, and chroot configure options. Also the
6304 example.conf and manual pages get the configured defaults.
6305 You can use: (or accept the defaults to /usr/local/etc/unbound/)
6306 --with-conf-file=filename
6307 --with-pidfile=filename
6309 --with-chroot-dir=path
6312 - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug.
6313 Reported by Robert Edmonds.
6314 - iana port updated.
6317 - updated libtool files with newer version.
6318 - iana portlist updated.
6321 - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the
6322 trailing dot is not used during comparison.
6325 - Jelte fixed bugs in my absence
6326 - bug 178: fixed unportable shell usage in configure (relied on
6328 - bug 180: fixed buffer overflow in unbound-checkconf use of strncat.
6329 - bug 181: fixed buffer overflow in ldns (called by unbound to parse
6332 - bug 177: fixed compilation failure on opensuse, the
6333 --disable-static configure flag caused problems. (Patch from
6335 - bug 179: same fix as 177.
6336 - bug 185: --disable-shared not passed along to ldns included with
6337 unbound. Fixed so that configure parameters are passed to the
6338 subdir configure script.
6339 fixed that ./libtool is used always, you can still override
6340 manually with ./configure libtool=mylibtool or set $libtool in
6342 - update of the ldns tarball to current ldns svn version (fix 181).
6343 - bug 184: -r option for unbound-host, read resolv.conf for
6344 forwarder. (Note that forwarder must support DNSSEC for validation
6349 - test for sys/wait.h
6350 - WSAEWOULDBLOCK test after nonblocking TCP connect.
6351 - write_iov_buffer removed: unused and no struct iov on windows.
6352 - signed/unsigned warning fixup mini_event.
6353 - use ioctlsocket to set nonblocking I/O if fnctl is unavailable.
6354 - skip signals that are not defined
6356 - detect getpwnam, getrlimit, setsid, sbrk, chroot.
6357 - default config has no chroot if chroot() unavailable.
6358 - if no kill() then no pidfile is read or written.
6359 - gmtime_r is replaced by nonthreadsafe alternative if unavail.
6360 used in rrsig time validation errors.
6363 - contrib unbound.spec from Patrick Vande Walle.
6364 - fixup bug#175: call tzset before chroot to have correct timestamps
6366 - do not generate lex input and lex unput functions.
6367 - mingw port. replacement functions labelled _unbound.
6368 - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed.
6371 - fedora 9, check in6_pktinfo define in configure.
6372 - CREDITS fixup of history.
6373 - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative.
6376 - fixup for MacOSX hosts file reading (reported by John Dickinson).
6377 - created 1.0.0 svn tag.
6378 - trunk version 1.0.1.
6381 - accepted patch from Ondrej Sury for library version libtool option.
6382 - configure --disable-rpath fixes up libtool for rpath trouble.
6383 Adapted from debian package patch file.
6386 - Added root ipv6 addresses to builtin root hints.
6387 - TODO modified for post 1.0 plans.
6388 - trunk version set to 1.0.0.
6389 - no unnecessary linking with librt (only when libevent/libev used).
6392 - fixup no-ip4 problem with error callback in outside network.
6394 25 April 2008: Wouter
6395 - DESTDIR is honored by the Makefile for rpms.
6396 - contrib files unbound.spec and unbound.init, builds working RPM
6397 on FC7 Linux, a chrooted caching resolver, and libunbound.
6398 - iana ports update.
6400 24 April 2008: Wouter
6401 - chroot checks improved. working directory relative to chroot.
6402 checks if config file path is inside chroot. Documentation on it.
6403 - nicer example.conf text.
6406 23 April 2008: Wouter
6407 - parseunbound.pl contrib update from Kai Storbeck for threads.
6410 22 April 2008: Wouter
6412 - unit test for SIGPIPE ignore.
6414 21 April 2008: Wouter
6415 - FEATURES document.
6416 - fixup reread of config file if it was given as a full path
6417 and chroot was used.
6419 16 April 2008: Wouter
6420 - requirements doc, updated clean query returns.
6421 - parseunbound.pl update from Kai Storbeck.
6422 - sunos4 porting changes.
6424 15 April 2008: Wouter
6425 - fixup default rc.d pidfile location to /usr/local/etc.
6426 - iana ports updated.
6427 - copyright updated in ldns-testpkts to keep same as in ldns.
6428 - fixup checkconf chroot tests a bit more, chdir must be inside
6430 - documented 'gcc: unrecognized -KPIC option' errors on Solaris.
6431 - example.conf values changed to /usr/local/etc/unbound
6433 - DSA signatures: unbound is compatible with both encodings found.
6434 It will detect and convert when necessary.
6436 14 April 2008: Wouter
6437 - got update for parseunbound.pl statistics script from Kai Storbeck.
6438 - tpkg tests for udp wait list.
6439 - documented 0x20 status.
6440 - fixup chroot and checkconf, it is much smarter now.
6441 - fixup DSA EVP signature decoding. Solution that Jelte found copied.
6442 - and check first sig byte for the encoding type.
6444 11 April 2008: Wouter
6445 - random port selection out of the configged ports.
6446 - fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
6447 - removed base_port.
6448 - created 256-port ephemeral space for the OS, 59802 available.
6449 - fixup consistency of port_if out array during heavy use.
6451 10 April 2008: Wouter
6452 - --with-libevent works with latest libevent 1.4.99-trunk.
6453 - added log file statistics perl script to contrib.
6454 - automatic iana ports update from makefile. 60058 available.
6456 9 April 2008: Wouter
6457 - configure can detect libev(from its build directory) when passed
6458 --with-libevent=/home/wouter/libev-3.2
6459 libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
6460 - unused commpoints not listed in epoll list.
6461 - statistics-cumulative option so that the values are not reset.
6462 - config creates array of available ports, 61841 available,
6463 it excludes <1024 and iana assigned numbers.
6464 config statements to modify the available port numbers.
6466 8 April 2008: Wouter
6467 - unbound tries to set the ulimit fds when started as server.
6468 if that does not work, it will scale back its requirements.
6470 27 March 2008: Wouter
6471 - documented /dev/random symlink from chrootdir as FAQ entry.
6473 26 March 2008: Wouter
6474 - implemented AD bit signaling. If a query sets AD bit (but not DO)
6475 then the AD bit is set in the reply if the answer validated.
6476 Without including DNSSEC signatures. Useful if you have a trusted
6477 path from the client to the resolver. Follows dnssec-updates draft.
6479 25 March 2008: Wouter
6480 - implemented check that for NXDOMAIN and NOERROR answers a query
6481 section must be present in the reply (by the scrubber). And it must
6482 be equal to the question sent, at least lowercase folded.
6483 Previously this feature happened because the cache code refused
6484 to store such messages. However blocking by the scrubber makes
6485 sure nothing gets into the RRset cache. Also, this looks like a
6486 timeout (instead of an allocation failure) and this retries are
6487 done (which is useful in a spoofing situation).
6488 - RTT banding. Band size 400 msec, this makes band around zero (fast)
6489 include unknown servers. This makes unbound explore unknown servers.
6491 7 March 2008: Wouter
6492 - -C config feature for harvest program.
6493 - harvest handles CNAMEs too.
6495 5 March 2008: Wouter
6496 - patch from Hugo Koji Kobayashi for iterator logs spelling.
6498 4 March 2008: Wouter
6499 - From report by Jinmei Tatuya, rfc2181 trust value for remainder
6500 of a cname trust chain is lower; not full answer_AA.
6501 - test for this fix.
6502 - default config file location is /usr/local/etc/unbound.
6503 Thus prefix is used to determine the location. This is also the
6504 chroot and pidfile default location.
6506 3 March 2008: Wouter
6507 - Create 0.10 svn tag.
6508 - 0.11 version in trunk.
6509 - indentation nicer.
6511 29 February 2008: Wouter
6512 - documentation update.
6513 - fixup port to Solaris of perf test tool.
6514 - updated ldns-tarball with decl-after-statement fixes.
6516 28 February 2008: Wouter
6517 - fixed memory leaks in libunbound (during cancellation and wait).
6518 - libunbound returns the answer packet in full.
6519 - snprintf compat update.
6520 - harvest performs lookup.
6521 - ldns-tarball update with fix for ldns_dname_label.
6522 - installs to sbin by default.
6523 - install all manual pages (unbound-host and libunbound too).
6525 27 February 2008: Wouter
6526 - option to use caps for id randomness.
6527 - config file option use-caps-for-id: yes
6528 - harvest debug tool
6530 26 February 2008: Wouter
6531 - delay utility delays TCP as well. If the server that is forwarded
6532 to has a TCP error, the delay utility closes the connection.
6533 - delay does REUSE_ADDR, and can handle a server that closes its end.
6534 - answers use casing from query.
6536 25 February 2008: Wouter
6537 - delay utility works. Gets decent thoughput too (>20000).
6539 22 February 2008: Wouter
6540 - +2% for recursions, if identical queries (except for destination
6541 and query ID) in the reply list, avoid re-encoding the answer.
6542 - removed TODO items for optimizations that do not show up in
6544 - default is now minievent - not libevent. As its faster and
6545 not needed for regular installs, only for very large port ranges.
6546 - loop check different speedup pkt-dname-reading, 1% faster for
6547 nocache-recursion check.
6548 - less hashing during msg parse, 4% for recursion.
6549 - small speed fix for dname_count_size_labels, +1 or +2% recursion.
6550 - some speed results noted:
6551 optimization resulted in +40% for recursion (cache miss) and
6552 +70 to +80 for cache hits, and +96% for version.bind.
6553 zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4
6554 www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
6555 www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
6556 So, unbound can be about equal qps to NSD in cache hits.
6557 And about 3.4x faster than BIND in cache performance.
6558 - delay utility for testing.
6560 21 February 2008: Wouter
6561 - speedup of root-delegation message encoding by 15%.
6562 - minor speedup of compress tree_lookup, maybe 1%.
6563 - speedup of dname_lab_cmp and memlowercmp - the top functions in
6564 profiler output, maybe a couple percent when it matters.
6566 20 February 2008: Wouter
6567 - setup speec_cache for need-ldns-testns in dotests.
6568 - check number of queued replies on incoming queries to avoid overload
6570 - fptr whitelist checks are not disabled in optimize mode.
6571 - do-daemonize config file option.
6572 - minievent time share initializes time at start.
6573 - updated testdata for nsec3 new algorithm numbers (6, 7).
6574 - small performance test of packet encoding (root delegation).
6576 19 February 2008: Wouter
6577 - applied patch to unbound-host man page from Jan-Piet Mens.
6578 - fix donotquery-localhost: yes default (it erroneously was switched
6580 - time is only gotten once and the value is shared across unbound.
6581 - unittest cleans up crypto, so that it has no memory leaks.
6582 - mini_event shares the time value with unbound this results in
6583 +3% speed for cache responses and +9% for recursions.
6584 - ldns tarball update with new NSEC3 sign code numbers.
6585 - perform several reads per UDP operation. This improves performance
6586 in DoS conditions, and costs very little in normal conditions.
6587 improves cache response +50%, and recursions +10%.
6588 - modified asynclook test. because the callback from async is not
6589 in any sort of lock (and thus can use all library functions freely),
6590 this causes a tiny race condition window when the last lock is
6591 released for a callback and a new cancel() for that callback.
6592 The only way to remove this is by putting callbacks into some
6593 lock window. I'd rather have the small possibility of a callback
6594 for a cancelled function then no use of library functions in
6595 callbacks. Could be possible to only outlaw process(), wait(),
6596 cancel() from callbacks, by adding another lock, but I'd rather not.
6598 18 February 2008: Wouter
6599 - patch to unbound-host from Jan-Piet Mens.
6600 - unbound host prints errors if fails to configure context.
6601 - fixup perf to resend faster, so that long waiting requests do
6602 not hold up the queue, they become lost packets or SERVFAILs,
6603 or can be sent a little while later (i.e. processing time may
6604 take long, but throughput has to be high).
6605 - fixup iterator operating in no cache conditions (RD flag unset
6607 - streamlined code for RD flag setting.
6608 - profiled code and changed dname compares to be faster.
6609 The speedup is about +3% to +8% (depending on the test).
6610 - minievent tests for eintr and eagain.
6612 15 February 2008: Wouter
6613 - added FreeBSD rc.d script to contrib.
6614 - --prefix option for configure also changes directory: pidfile:
6615 and chroot: defaults in config file.
6616 - added cache speed test, for cache size OK and cache too small.
6618 14 February 2008: Wouter
6619 - start without a config file (will complain, but start with
6621 - perf test program works.
6623 13 February 2008: Wouter
6625 - 1.0 development. Printout ldns version on unbound -h.
6626 - start of perf tool.
6627 - bugfix to read empty lines from /etc/hosts.
6629 12 February 2008: Wouter
6630 - fixup problem with configure calling itself if ldns-src tarball
6633 11 February 2008: Wouter
6634 - changed library to use ub_ instead of ub_val_ as prefix.
6635 - statistics output text nice.
6636 - etc/hosts handling.
6637 - library function to put logging to a stream.
6638 - set any option interface.
6640 8 February 2008: Wouter
6641 - test program for multiple queries over a TCP channel.
6642 - tpkg test for stream tcp queries.
6643 - unbound replies to multiple TCP queries on a TCP channel.
6644 - fixup misclassification of root referral with NS in answer
6645 when validating a nonrec query.
6647 - layout of manpages, spelling fix in header, manpages process by
6648 makedist, list asynclook and tcpstream tests as ldns-testns
6651 7 February 2008: Wouter
6652 - moved up all current level 2 to be level 3. And 3 to 4.
6653 to make room for new debug level 2 for detailed information
6655 - verbosity level 2. Describes recursion and validation.
6656 - cleaner configure script and fixes for libevent solaris.
6657 - signedness for log output memory sizes in high verbosity.
6659 6 February 2008: Wouter
6660 - clearer explanation of threading configure options.
6661 - fixup asynclook test for nothreading (it creates only one process
6662 to do the extended test).
6663 - changed name of ub_val_result_free to ub_val_resolve_free.
6664 - removes warning message during library linking, renamed
6665 libunbound/unbound.c -> libunbound.c and worker to libworker.
6666 - fallback without EDNS if result is NOTIMPL as well as on FORMERR.
6668 5 February 2008: Wouter
6669 - statistics-interval: seconds option added.
6670 - test for statistics option
6671 - ignore errors making directories, these can occur in parallel builds
6672 - fixup Makefile strip command and libunbound docs typo.
6674 31 January 2008: Wouter
6675 - bg thread/process reads and writes the pipe nonblocking all the time
6676 so that even if the pipe is buffered or so, the bg thread does not
6677 block, and services both pipes and queries.
6679 30 January 2008: Wouter
6680 - check trailing / on chrootdir in checkconf.
6681 - check if root hints and anchor files are in chrootdir.
6682 - no route to host tcp error is verbosity level 2.
6683 - removed unused send_reply_iov. and its configure check.
6684 - added prints of 'remote address is 1.2.3.4 port 53' to errors
6685 from netevent; the basic socket errors.
6687 28 January 2008: Wouter
6688 - fixup uninit use of buffer by libunbound (query id, flags) for
6690 - fixup uninit warning from random.c; also seems to fix sporadic
6691 sigFPE coming out of openssl.
6692 - made openssl entropy warning more silent for library use. Needs
6694 - fixup forgotten locks for rbtree_searches on ctx->query tree.
6695 - random generator cleanup - RND_STATE_SIZE removed, and instead
6696 a super-rnd can be passed at init to chain init random states.
6697 - test also does lock checks if available.
6698 - protect config access in libworker_setup().
6699 - libevent doesn't like comm_base_exit outside of runloop.
6700 - close fds after removing commpoints only (for epoll, kqueue).
6702 25 January 2008: Wouter
6703 - added tpkg for asynclook and library use.
6704 - allows localhost to be queried when as a library.
6705 - fixup race condition between cancel and answer (in case of
6706 really fast answers that beat the cancel).
6707 - please doxygen, put doxygen comment in one place.
6708 - asynclook -b blocking mode and test.
6709 - refactor asynclook, nicer code.
6710 - fixup race problems from opensll in rand init from library, with
6711 a mutex around the rand init.
6712 - fix pass async_id=NULL to _async resolve().
6713 - rewrote _wait() routine, so that it is threadsafe.
6714 - cancelation is threadsafe.
6715 - asynclook extended test in tpkg.
6716 - fixed two races where forked bg process waits for (somehow shared?)
6717 locks, so does not service the query pipe on the bg side.
6718 Now those locks are only held for fg_threads and for bg_as_a_thread.
6720 24 January 2008: Wouter
6721 - tested the cancel() function.
6722 - asynclook -c (cancel) feature.
6723 - fix fail to allocate context actions.
6724 - make pipe nonblocking at start.
6725 - update plane for retry mode with caution to limit bandwidth.
6726 - fix Makefile for concurrent make of unbound-host.
6727 - renamed ub_val_ctx_wait/poll/process/fd to ub_val*.
6728 - new calls to set forwarding added to header and docs.
6730 23 January 2008: Wouter
6731 - removed debug prints from if-auto, verb-algo enables some.
6732 - libunbound QUIT setup, remove memory leaks, when using threads
6733 will share memory for passing results instead of writing it over
6734 the pipe, only writes ID number over the pipe (towards the handler
6735 thread that does process() ).
6737 22 January 2008: Wouter
6738 - library code for async in libunbound/unbound.c.
6739 - fix link testbound.
6740 - fixup exit bug in mini_event.
6741 - background worker query enter and result functions.
6742 - bg query test application asynclook, it looks up multiple
6743 hostaddresses (A records) at the same time.
6745 21 January 2008: Wouter
6746 - libworker work, netevent raw commpoints, write_msg, serialize.
6748 18 January 2008: Wouter
6749 - touch up of manpage for libunbound.
6750 - support for IP_RECVDSTADDR (for *BSD ip4).
6751 - fix for BSD, do not use ip4to6 mapping, make two sockets, once
6752 ip6 and once ip4, uses socket options.
6753 - goodbye ip4to6 mapping.
6754 - update ldns-testpkts with latest version from ldns-trunk.
6755 - updated makedist for relative ldns pathnames.
6756 - library API with more information inside the result structure.
6757 - work on background resolves.
6759 17 January 2008: Wouter
6760 - fixup configure in case -lldns is installed.
6761 - fixup a couple of doxygen warnings, about enum variables.
6762 - interface-automatic now copies the interface address from the
6763 PKT_INFO structure as well.
6764 - manual page with library API, all on one page 'man libunbound'.
6765 - rewrite of PKTINFO structure, it also captures IP4 PKTINFO.
6767 16 January 2008: Wouter
6768 - incoming queries to the server with TC bit on are replied FORMERR.
6769 - interface-automatic replied the wrong source address on localhost
6770 queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying
6771 to use ifnum=-1 to mean 'no interface, use kernel route'.
6773 15 January 2008: Wouter
6774 - interface-automatic feature. experimental. Nice for anycast.
6775 - tpkg test for ip6 ancillary data.
6776 - removed debug prints.
6777 - porting experience, define for Solaris, test refined for BSD
6778 compatibility. The feature probably will not work on OpenBSD.
6779 - makedist fixup for ldns-src in build-dir.
6781 14 January 2008: Wouter
6782 - in no debug sets NDEBUG to remove asserts.
6783 - configure --enable-debug is needed for dependency generation
6784 for assertions and for compiler warnings.
6785 - ldns.tgz updated with ldns-trunk (where buffer.h is updated).
6786 - fix lint, unit test in optimize mode.
6787 - default access control allows ::ffff:127.0.0.1 v6mapped localhost.
6789 11 January 2008: Wouter
6790 - man page, warning removed.
6791 - added text describing the use of stub zones for private zones.
6792 - checkconf tests for bad hostnames (IP address), and for doubled
6794 - memory sizes can be given with 'k', 'Kb', or M or G appended.
6796 10 January 2008: Wouter
6797 - typo in example.conf.
6798 - made using ldns-src that is included the package more portable
6799 by linking with .lo instead of .o files in the ldns package.
6800 - nicer do-ip6: yes/no documentation.
6801 - nicer linking of libevent .o files.
6802 - man pages render correctly on solaris.
6804 9 January 2008: Wouter
6805 - fixup openssl RAND problem, when the system is not configured to
6806 give entropy, and the rng needs to be seeded.
6808 8 January 2008: Wouter
6809 - print median and quartiles with extensive logging.
6811 4 January 2008: Wouter
6812 - document misconfiguration in private network.
6814 2 January 2008: Wouter
6815 - fixup typo in requirements.
6816 - document that 'refused' is a better choice than 'drop' for
6817 the access control list, as refused will stop retries.
6819 7 December 2007: Wouter
6820 - unbound-host has a -d option to show what happens. This can help
6821 with debugging (why do I get this answer).
6822 - fixup CNAME handling, on nodata, sets and display canonname.
6823 - dot removed from CNAME display.
6824 - respect -v for NXDOMAINs.
6825 - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes).
6826 - size_t to int for portability of the header file.
6827 - fixup bogus handling.
6828 - dependencies and lint for unbound-host.
6830 6 December 2007: Wouter
6831 - library resolution works in foreground mode, unbound-host app
6833 - unbound-host prints rdata using ldns.
6834 - unbound-host accepts trust anchors, and prints validation
6835 information when you give -v.
6837 5 December 2007: Wouter
6838 - locking in context_new() inside the function.
6839 - setup of libworker.
6841 4 December 2007: Wouter
6842 - minor Makefile fixup.
6843 - moved module-stack code out of daemon/daemon into services/modstack,
6844 preparing for code-reuse.
6845 - move context into own header file.
6846 - context query structure.
6847 - removed unused variable pwd from checkconf.
6848 - removed unused assignment from outside netw.
6849 - check timeval length of string.
6850 - fixup error in val_utils getsigner.
6851 - fixup same (*var) error in netblocktostr.
6852 - fixup memleak on parse error in localzone.
6853 - fixup memleak on packet parse error.
6854 - put ; after union in parser.y.
6855 - small hardening in iter_operate against iq==NULL.
6856 - hardening, if error reply with rcode=0 (noerror) send servfail.
6857 - fixup same (*var) error in find_rrset in msgparse, was harmless.
6858 - check return value of evtimer_add().
6859 - fixup lockorder in lruhash_reclaim(), building up a list of locked
6860 entries one at a time. Instead they are removed and unlocked.
6861 - fptr_wlist for markdelfunc.
6862 - removed is_locked param from lruhash delkeyfunc.
6863 - moved bin_unlock during bin_split purely to please.
6865 3 December 2007: Wouter
6866 - changed checkconf/ to smallapp/ to make room for more support tools.
6867 (such as unbound-host).
6868 - install dirs created with -m 755 because they need to be accessible.
6869 - library extensive featurelist added to TODO.
6870 - please doxygen, lint.
6871 - library test application, with basic functionality.
6872 - fix for building in a subdirectory.
6873 - link lib fix for Leopard.
6875 30 November 2007: Wouter
6876 - makefile that creates libunbound.la, basic file or libunbound.a
6877 when creating static executables (no libtool).
6880 29 November 2007: Wouter
6881 - 0.9 public API start.
6883 28 November 2007: Wouter
6884 - Changeup plan for 0.8 - no complication needed, a simple solution
6885 has been chosen for authoritative features.
6886 - you can use single quotes in the config file, so it is possible
6887 to specify TXT records in local data.
6888 - fixup small memory problem in implicit transparent zone creation.
6889 - test for implicit zone creation and multiple RR RRsets local data.
6890 - local-zone nodefault test.
6891 - show testbound testlist on commit.
6892 - iterator normalizer changes CNAME chains ending in NXDOMAIN where
6893 the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial
6895 - nicer verbosity: 0 and 1 levels.
6896 - lower nonRDquery chance of eliciting wrongly typed validation
6897 requiring message from the cache.
6898 - fix for nonRDquery validation typing; nodata is detected when
6899 SOA record in auth section (all validation-requiring nodata messages
6900 have a SOA record in authority, so this is OK for the validator),
6901 and NS record is needed to be a referral.
6902 - duplicate checking when adding NSECs for a CNAME, and test.
6903 - created svn tag 0.8, after completing testbed tests.
6905 27 November 2007: Wouter
6906 - per suggestion in rfc2308, replaced default max-ttl value with 1 day.
6907 - set size of msgparse lookup table to 32, from 1024, so that its size
6908 is below the 2048 regional large size threshold, and does not cause
6909 a call to malloc when a message is parsed.
6910 - update of memstats tool to print number of allocation calls.
6911 This is what is taking time (not space) and indicates the avg size
6912 of the allocations as well. region_alloc stat is removed.
6914 22 November 2007: Wouter
6915 - noted EDNS in-the-middle dropping trouble as a TODO.
6916 At this point theoretical, no user trouble has been reported.
6917 - added all default AS112 zones.
6918 - answers from local zone content.
6919 * positive answer, the rrset in question
6920 * nodata answer (exist, but not that type).
6921 * nxdomain answer (domain does not exist).
6922 * empty-nonterminal answer.
6923 * But not: wildcard, nsec, referral, rrsig, cname/dname,
6924 or additional section processing, NS put in auth.
6925 - test for correct working of static and transparent and couple
6926 of important defaults (localhost, as112, reverses).
6927 Also checks deny and refuse settings.
6928 - fixup implicit zone generation and AA bit for NXDOMAIN on localdata.
6930 21 November 2007: Wouter
6931 - local zone internal data setup.
6933 20 November 2007: Wouter
6934 - 0.8 - str2list config support for double string config options.
6935 - local-zone and local-data options, config storage and documentation.
6937 19 November 2007: Wouter
6938 - do not downcase NSEC and RRSIG for verification. Follows
6939 draft-ietf-dnsext-dnssec-bis-updates-06.txt.
6940 - fixup leaking unbound daemons at end of tests.
6941 - README file updated.
6942 - nice libevent not found error.
6943 - README talks about gnu make.
6944 - 0.8: unit test for addr_mask and fixups for it.
6945 and unit test for addr_in_common().
6946 - 0.8: access-control config file element.
6947 and unit test rpl replay file.
6948 - 0.8: fixup address reporting from netevent.
6950 16 November 2007: Wouter
6951 - privilege separation is not needed in unbound at this time.
6952 TODO item marked as such.
6953 - created beta-0.7 branch for support.
6954 - tagged 0.7 for beta release.
6955 - moved trunk to 0.8 for 0.8(auth features) development.
6956 - 0.8: access control list setup.
6958 15 November 2007: Wouter
6959 - review fixups from Jelte.
6961 14 November 2007: Wouter
6962 - testbed script does not recreate configure, since its in svn now.
6963 - fixup checkconf test so that it does not test
6964 /etc/unbound/unbound.conf.
6967 13 November 2007: Wouter
6968 - remove debug print.
6969 - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists.
6971 12 November 2007: Wouter
6972 - fixup signal handling where SIGTERM could be ignored if a SIGHUP
6974 - bugreports to unbound-bugs@nlnetlabs.nl
6975 - fixup testbound so it exits cleanly.
6976 - cleanup the caches on a reload, so that rrsetID numbers won't clash.
6978 9 November 2007: Wouter
6979 - took ldns snapshot in repo.
6980 - default config file is /etc/unbound/unbound.conf.
6981 If it doesn't exist, it is installed with the doc/example.conf file.
6982 The file is not deleted on uninstall.
6983 - default listening is not all, but localhost interfaces.
6985 8 November 2007: Wouter
6986 - Fixup chroot and drop user privileges.
6987 - new L root ip address in default hints.
6989 1 November 2007: Wouter
6990 - Fixup of crash on reload, due to anchors in env not NULLed after
6991 dealloc during deinit.
6992 - Fixup of chroot call. Happens after privileges are dropped, so
6993 that checking the passwd entry still works.
6994 - minor touch up of clear() hashtable function.
6995 - VERB_DETAIL prints out what chdir, username, chroot is being done.
6996 - when id numbers run out, caches are cleared, as in design notes.
6997 Tested with a mock setup with very few bits in id, it worked.
6998 - harden-dnssec-stripped: yes is now default. It insists on dnssec
6999 data for trust anchors. Included tests for the feature.
7001 31 October 2007: Wouter
7002 - cache-max-ttl config option.
7003 - building outside sourcedir works again.
7004 - defaults more secure:
7006 chroot: "/etc/unbound"
7007 The operator can override them to be less secure ("") if necessary.
7008 - fix horrible oversight in sorting rrset references in a message,
7009 sort per reference key pointer, not on referencepointer itself.
7010 - pidfile: "/etc/unbound/unbound.pid" is now the default.
7011 - tests changed to reflect the updated default.
7012 - created hashtable clear() function that respects locks.
7014 30 October 2007: Wouter
7015 - fixup assertion failure that relied on compressed names to be
7016 smaller than uncompressed names. A packet from comrite.com was seen
7017 to be compressed to a larger size. Added it as unit test.
7018 - quieter logging at low verbosity level for common tcp messages.
7019 - no greedy TTL update.
7021 23 October 2007: Wouter
7022 - fixup (grand-)parent problem for dnssec-lameness detection.
7023 - fixup tests to do additional section processing for lame replies,
7024 since the detection needs that.
7025 - no longer trust in query section in reply during dnssec lame detect.
7026 - dnssec lameness does not make the server never ever queried, but
7027 non-preferred. If no other servers exist or answer, the dnssec lame
7028 server is used; the fastest dnssec lame server is chosen.
7029 - added test then when trust anchor cannot be primed (nodata), the
7030 insecure mode from unbound works.
7031 - Fixup max queries per thread, any more are dropped.
7033 22 October 2007: Wouter
7034 - added donotquerylocalhost config option. Can be turned off for
7036 - ISO C compat changes.
7037 - detect RA-no-AA lameness, as LAME.
7038 - DNSSEC-lameness detection, as LAME.
7039 See notes in requirements.txt for choices made.
7040 - tests for lameness detection.
7041 - added all to make test target; need unbound for fwd tests.
7042 - testbound does not pollute /etc/unbound.
7044 19 October 2007: Wouter
7045 - added configure (and its files) to svn, so that the trunk is easier
7046 to use. ./configure, config.guess, config.sub, ltmain.sh,
7048 - added yacc/lex generated files, util/configlexer.c,
7049 util/configparser.c util/configparser.h, to svn.
7050 - without lex no attempt to use it.
7051 - unsecure response validation collated into one block.
7052 - remove warning about const cast of cfgfile name.
7053 - outgoing-interfaces can be different from service interfaces.
7054 - ldns-src configure is done during unbound configure and
7055 ldns-src make is done during unbound make, and so inherits the
7056 make arguments from the unbound make invocation.
7057 - nicer error when libevent problem causes instant exit on signal.
7058 - read root hints from a root hint file (like BIND does).
7060 18 October 2007: Wouter
7061 - addresses are logged with errors.
7062 - fixup testcode fake event to remove pending before callback
7063 since the callback may create new pending items.
7064 - tests updated because retries are now in iterator module.
7065 - ldns-testpkts code is checked for differences between unbound
7066 and ldns by makedist.sh.
7067 - ldns trunk from today added in svn repo for fallback in case
7068 no ldns is installed on the system.
7069 make download_ldns refreshes the tarball with ldns svn trunk.
7070 - ldns-src.tar.gz is used if no ldns is found on the system, and
7071 statically linked into unbound.
7072 - start of regional allocator code.
7073 - regional uses less memory and variables, simplified code.
7074 - remove of region-allocator.
7075 - alloc cache keeps a cache of recently released regional blocks,
7077 - make unit test cleanly free memory.
7079 17 October 2007: Wouter
7080 - fixup another cycle detect and ns-addr timeout resolution bug.
7081 This time by refusing delegations from the cache without addresses
7082 when resolving a mandatory-glue nameserver-address for that zone.
7083 We're going to have to ask a TLD server anyway; might as well be
7084 the TLD server for this name. And this resolves a lot of cases where
7085 the other nameserver names lead to cycles or are not available.
7086 - changed random generator from random(3) clone to arc4random wrapped
7087 for thread safety. The random generator is initialised with
7088 entropy from the system.
7089 - fix crash where failure to prime DNSKEY tried to print null pointer
7091 - removed some debug prints, only verb_algo (4) enables them.
7092 - fixup test; new random generator took new paths; such as one
7093 where no scripted answer was available.
7094 - mark insecure RRs as insecure.
7095 - fixup removal of nonsecure items from the additional.
7096 - reduced timeout values to more realistic, 376 msec (262 msec has
7097 90% of roundtrip times, 512 msec has 99% of roundtrip times.)
7098 - server selection failover to next server after timeout (376 msec).
7100 16 October 2007: Wouter
7101 - no malloc in log_hex.
7102 - assertions around system calls.
7103 - protect against gethostname without ending zero.
7104 - ntop output is null terminated by unbound.
7105 - pidfile content null termination
7106 - various snprintf use sizeof(stringbuf) instead of fixed constant.
7107 - changed loopdetect % 8 with & 0x7 since % can become negative for
7108 weird negative input and particular interpretation of integer math.
7109 - dname_pkt_copy checks length of result, to protect result buffers.
7110 prints an error, this should not happen. Bad strings should have
7111 been rejected earlier in the program.
7112 - remove a size_t underflow from msgreply size func.
7114 15 October 2007: Wouter
7116 - fix IP6 TCP, wrong definition check. With test package.
7117 - fixup the fact that the query section was not compressed to,
7118 the code was there but was called by value instead of by reference.
7119 And test for the case, uses xxd and nc.
7120 - more portable ip6 check for sockaddr types.
7122 8 October 2007: Wouter
7123 - --disable-rpath option in configure for 64bit systems with
7124 several dynamic lib dirs.
7126 7 October 2007: Wouter
7127 - fixup tests for no AD bit in non-DO queries.
7128 - test that makes sure AD bit is not set on non-DO query.
7130 6 October 2007: Wouter
7131 - removed logfile open early. It did not have the proper permissions;
7132 it was opened as root instead of the user. And we cannot change user
7133 id yet, since chroot and bind ports need to be done.
7134 - callback checks for event callbacks done from mini_event. Because
7135 of deletions cannot do this from netevent. This means when using
7136 libevent the protection does not work on event-callbacks.
7137 - fixup too small reply (did not zero counts).
7138 - fixup reply no longer AD bit when query without DO bit.
7140 5 October 2007: Wouter
7141 - function pointer whitelist.
7143 4 October 2007: Wouter
7144 - overwrite sensitive random seed value after use.
7145 - switch to logfile very soon if not -d (console attached).
7146 - error messages do not reveal the trustanchor contents.
7147 - start work on function pointer whitelists.
7149 3 October 2007: Wouter
7150 - fix for multiple empty nonterminals, after multiple DSes in the
7152 - mesh checks if modules are looping, and stops them.
7153 - refetch with CNAMEd nameserver address regression test added.
7154 - fixup line count bug in testcode, so testbound prints correct line
7155 number with parse errors.
7156 - unit test for multiple ENT case.
7157 - fix for cname out of validated unsec zone.
7158 - fixup nasty id=0 reuse. Also added assertions to detect its
7159 return (the assertion catches in the existing test cases).
7161 1 October 2007: Wouter
7162 - skip F77, CXX, objC tests in configure step.
7163 - fixup crash in refetch glue after a CNAME.
7164 and protection against similar failures (with error print).
7166 28 September 2007: Wouter
7167 - test case for unbound-checkconf, fixed so it also checks the
7168 interface: statements.
7170 26 September 2007: Wouter
7171 - SIGHUP will reopen the log file.
7172 - Option to log to syslog.
7173 - please lint, fixup tests (that went to syslog on open, oops).
7174 - config check program.
7176 25 September 2007: Wouter
7177 - tests for NSEC3. Fixup bitmap checks for NSEC3.
7178 - positive ANY response needs to check if wildcard expansion, and
7179 check that original data did not exist.
7180 - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure
7181 delegation, for abuse of child zone apex nsec3.
7182 - create 0.5 release tag.
7184 24 September 2007: Wouter
7185 - do not make test programs by default.
7186 - But 'make test' will perform all of the tests.
7187 - Advertise builtin select libevent alternative when no libevent
7189 - signit can generate NSEC3 hashes, for generating tests.
7190 - multiple nsec3 parameters in message test.
7191 - too high nsec3 iterations becomes insecure test.
7193 21 September 2007: Wouter
7194 - fixup empty_DS_name allocated in wrong region (port DEC Alpha).
7195 - fixup testcode lock safety (port FreeBSD).
7196 - removes subscript has type char warnings (port Solaris 9).
7197 - fixup of field with format type to int (port MacOS/X intel).
7198 - added test for infinite loop case in nonRD answer validation.
7199 It was a more general problem, but hard to reproduce. When an
7200 unsigned rrset is being validated and the key fetched, the DS
7201 sequence is followed, but if the final name has no DS, then no
7202 proof is possible - the signature has been stripped off.
7204 20 September 2007: Wouter
7205 - fixup and test for NSEC wildcard with empty nonterminals.
7206 - makedist.sh fixup for svn info.
7207 - acl features request in plan.
7208 - improved DS empty nonterminal handling.
7209 - compat with ANS nxdomain for empty nonterminals. Attempts the nodata
7210 proof anyway, which succeeds in ANS failure case.
7211 - striplab protection in case it becomes -1.
7212 - plans for static and blacklist config.
7214 19 September 2007: Wouter
7215 - comments about non-packed usage.
7216 - plan for overload support in 0.6.
7217 - added testbound tests for a failed resolution from the logs
7218 and for failed prime when missing glue.
7219 - fixup so useless delegation points are not returned from the
7220 cache. Also the safety belt is used if priming fails to complete.
7221 - fixup NSEC rdata not to be lowercased, bind compat.
7223 18 September 2007: Wouter
7224 - wildcard nsec3 testcases, and fixup to get correct wildcard name.
7225 - validator prints subtype classification for debug.
7227 17 September 2007: Wouter
7228 - NSEC3 hash cache unit test.
7229 - validator nsec3 nameerror test.
7231 14 September 2007: Wouter
7232 - nsec3 nodata proof, nods proof, wildcard proof.
7233 - nsec3 support for cname chain ending in noerror or nodata.
7234 - validator calls nsec3 proof routines if no NSECs prove anything.
7235 - fixup iterator bug where it stored the answer to a cname under
7236 the wrong qname into the cache. When prepending the cnames, the
7237 qname has to be reset to the original qname.
7239 13 September 2007: Wouter
7240 - nsec3 find matching and covering, ce proof, prove namerror msg.
7242 12 September 2007: Wouter
7243 - fixup of manual page warnings, like for NSD bugreport.
7244 - nsec3 work, config, max iterations, filter, and hash cache.
7246 6 September 2007: Wouter
7247 - fixup to find libevent on mac port install.
7248 - fixup size_t vs unsigned portability in validator/sigcrypt.
7249 - please compiler on different platforms, for unreachable code.
7251 - pthread_rwlock type is optional, in case of old pthread libs.
7253 5 September 2007: Wouter
7254 - cname, name error validator tests.
7255 - logging of qtype ANY works.
7256 - ANY type answers get RRSIG in answer section of replies (but not
7257 in other sections, unless DO bit is on).
7258 - testbound can replay a TCP query (set MATCH TCP in the QUERY).
7259 - DS and noDS referral validation test.
7260 - if you configure many trust anchors, parent trust anchors can
7261 securely deny existence of child trust anchors, if validated.
7262 - not all *.name NSECs are present because a wildcard was matched,
7263 and *.name NSECs can prove nodata for empty nonterminals.
7264 Also, for wildcard name NSECs, check they are not from the parent
7265 zone (for wildcarded zone cuts), and check absence of CNAME bit,
7267 - configure option for memory allocation debugging.
7268 - port configure option for memory allocation to solaris10.
7270 4 September 2007: Wouter
7271 - fixup of Leakage warning when serviced queries processed multiple
7272 callbacks for the same query from the same server.
7273 - testbound removes config file from /tmp on failed exit.
7274 - fixup for referral cleanup of the additional section.
7275 - tests for cname, referral validation.
7276 - neater testbound tpkg output.
7277 - DNAMEs no longer match their apex when synthesized from the cache.
7278 - find correct signer name for DNAME responses.
7279 - wildcarded DNAME test and fixup code to detect.
7280 - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs.
7281 So that wildcarded CNAMEs get their NSEC with them to the answer.
7282 - test for a CNAME to a DNAME to a CNAME to an answer, all from
7283 different domains, for key fetching and signature checking of
7286 3 September 2007: Wouter
7287 - Fixed error in iterator that would cause assertion failure in
7288 validator. CNAME to a NXDOMAIN response was collated into a response
7289 with both a CNAME and the NXDOMAIN rcode. Added a test that the
7290 rcode is changed to NOERROR (because of the CNAME).
7291 - timeout on tcp does not lead to spurious leakage detect.
7292 - account memory for name of lame zones, so that memory leakages does
7293 not show lame cache growth as a leakage growth.
7294 - config setting for lameness cache expressed in bytes, instead of
7296 - tool too summarize allocations per code line.
7298 31 August 2007: Wouter
7299 - can read bind trusted-keys { ... }; files, in a compatibility mode.
7300 - iterator should not detach target queries that it still could need.
7301 the protection against multiple outstanding queries is moved to a
7302 current_query num check.
7303 - validator nodata, positive, referral tests.
7304 - dname print can print '*' wildcard.
7306 30 August 2007: Wouter
7307 - fixup override date config option.
7308 - config options to control memory usage.
7309 - caught bad free of un-alloced data in worker_send error case.
7310 - memory accounting for key cache (trust anchors and temporary cache).
7311 - memory accounting fixup for outside network tcp pending waits.
7312 - memory accounting fixup for outside network tcp callbacks.
7313 - memory accounting for iterator fixed storage.
7314 - key cache size and slabs config options.
7315 - lib crypto cleanups at exit.
7317 29 August 2007: Wouter
7318 - test tool to sign rrsets for testing validator with.
7319 - added RSA and DSA test keys, public and private pairs, 512 bits.
7320 - default configuration is with validation enabled.
7321 Only a trust-anchor needs to be configured for DNSSEC to work.
7322 - do not convert to DER for DSA signature verification.
7323 - validator replay test file, for a DS to DNSKEY DSA key prime and
7326 28 August 2007: Wouter
7327 - removed double use for udp buffers, that could fail,
7328 instead performs a malloc to do the backup.
7329 - validator validates referral messages, by validating all the rrsets
7330 and stores the rrsets in the cache. Further referral (nonRD queries)
7331 replies are made from the rrset cache directly. Unless unchecked
7332 rrsets are encountered, there are then validated.
7333 - enforce that signing is done by a parent domain (or same domain).
7334 - adjust TTL downwards if rrset TTL bigger than signature allows.
7335 - permissive mode feature, sets AD bit for secure, but bogus does
7336 not give servfail (bogus is changed into indeterminate).
7337 - optimization of rrset verification. rr canonical sorting is reused,
7338 for the same rrset. canonical rrset image in buffer is reused for
7340 - if the rrset is too big (64k exactly + large owner name) the
7341 canonicalization routine will fail if it does not fit in buffer.
7342 - faster verification for large sigsets.
7343 - verb_detail mode reports validation failures, but not the entire
7344 algorithm for validation. Key prime failures are reported as
7347 27 August 2007: Wouter
7348 - do not garble the edns if a cache answer fails.
7349 - answer norecursive from cache if possible.
7350 - honor clean_additional setting when returning secure non-recursive
7352 - do not store referral in msg cache for nonRD queries.
7353 - store verification status in the rrset cache to speed up future
7355 - mark rrsets indeterminate and insecure if they are found to be so.
7356 and store this in the cache.
7358 24 August 2007: Wouter
7359 - message is bogus if unsecure authority rrsets are present.
7360 - val-clean-additional option, so you can turn it off.
7361 - move rrset verification out of the specific proof types into one
7362 routine. This makes the proof routines prettier.
7363 - fixup cname handling in validator, cname-to-positive and cname-to-
7365 - Do not synthesize DNSKEY and DS responses from the rrset cache if
7366 the rrset is from the additional section. Signatures may have
7367 fallen off the packet, and cause validation failure.
7368 - more verbose signature date errors (with the date attached).
7369 - increased default infrastructure cache size. It is important for
7370 performance, and 1000 entries are only 212k (or a 400 k total cache
7371 size). To 10000 entries (for 2M entries, 4M cache size).
7373 23 August 2007: Wouter
7374 - CNAME handling - move needs_validation to before val_new().
7375 val_new() setups the chase-reply to be an edited copy of the msg.
7376 new classification, and find signer can find for it.
7377 removal of unsigned crap from additional, and query restart for
7379 - refuse to follow wildcarded DNAMEs when validating.
7380 But you can query for qtype ANY, or qtype DNAME and validate that.
7382 22 August 2007: Wouter
7384 - review - use val_error().
7386 21 August 2007: Wouter
7387 - ANY response validation.
7388 - store security status in cache.
7389 - check cache security status and either send the query to be
7390 validated, return the query to client, or send servfail to client.
7391 Sets AD bit on validated replies.
7392 - do not examine security status on an error reply in mesh_done.
7393 - construct DS, DNSKEY messages from rrset cache.
7394 - manual page entry for override-date.
7396 20 August 2007: Wouter
7397 - validate and positive validation, positive wildcard NSEC validation.
7398 - nodata validation, nxdomain validation.
7400 18 August 2007: Wouter
7401 - process DNSKEY response in FINDKEY state.
7403 17 August 2007: Wouter
7404 - work on DS2KE routine.
7405 - val_nsec.c for validator NSEC proofs.
7406 - unit test for NSEC bitmap reading.
7407 - dname iswild and canonical_compare with unit tests.
7409 16 August 2007: Wouter
7411 - latest release libevent 1.3c and 1.3d have threading fixed.
7412 - key entry fixup data pointer and ttl absolute.
7413 - This makes a key-prime succeed in validator, with DS or DNSKEY as
7415 - fixup canonical compare byfield routine, fix bug and also neater.
7416 - fixed iterator response type classification for queries of type
7418 dig ANY gives sometimes NS rrset in AN and NS section, and parser
7419 removes the NS section duplicate. dig NS gives sometimes the NS
7420 in the answer section, as referral.
7421 - validator FINDKEY state.
7423 15 August 2007: Wouter
7424 - crypto calls to verify signatures.
7425 - unit test for rrsig verification.
7427 14 August 2007: Wouter
7428 - default outgoing ports changed to avoid port 2049 by default.
7429 This port is widely blocked by firewalls.
7430 - count infra lameness cache in memory size.
7431 - accounting of memory improved
7432 - outbound entries are allocated in the query region they are for.
7433 - extensive debugging for memory allocations.
7434 - --enable-lock-checks can be used to enable lock checking.
7435 - protect undefs in config.h from autoheaders ministrations.
7436 - print all received udp packets. log hex will print on multiple
7438 - fixed error in parser with backwards rrsig references.
7439 - mark cycle targets for iterator did not have CD flag so failed
7442 13 August 2007: Wouter
7443 - fixup makefile, if lexer is missing give nice error and do not
7444 mess up the dependencies.
7445 - canonical compare routine updated.
7446 - canonical hinfo compare.
7447 - printout list of the queries that the mesh is working on.
7449 10 August 2007: Wouter
7450 - malloc and free overrides that track total allocation and frees.
7451 for memory debugging.
7452 - work on canonical sort.
7454 9 August 2007: Wouter
7455 - canonicalization, signature checks
7456 - dname signature label count and unit test.
7457 - added debug heap size print to memory printout.
7458 - typo fixup in worker.c
7459 - -R needed on solaris.
7460 - validator override option for date check testing.
7462 8 August 2007: Wouter
7463 - ldns _raw routines created (in ldns trunk).
7464 - sigcrypt DS digest routines
7465 - val_utils uses sigcrypt to perform signature cryptography.
7466 - sigcrypt keyset processing
7468 7 August 2007: Wouter
7469 - security status type.
7470 - security status is copied when rdata is equal for rrsets.
7471 - rrset id is updated to invalidate all the message cache entries
7472 that refer to NSEC, NSEC3, DNAME rrsets that have changed.
7474 - val_sigcrypt file for validator signature checks.
7476 6 August 2007: Wouter
7477 - key cache for validator.
7478 - moved isroot and dellabel to own dname routines, with unit test.
7480 3 August 2007: Wouter
7482 - scrubber check section of lame NS set.
7483 - trust anchors can be in config file or read from zone file,
7484 DS and DNSKEY entries.
7485 - unit test trust anchor storage.
7486 - trust anchors converted to packed rrsets.
7487 - key entry definition.
7489 2 August 2007: Wouter
7490 - configure change for latest libevent trunk version (needs -lrt).
7491 - query_done and walk_supers are moved out of module interface.
7492 - fixup delegation point duplicates.
7493 - fixup iterator scrubber; lame NS set is let through the scrubber
7494 so that the classification is lame.
7495 - validator module exists, and does nothing but pass through,
7496 with calling of next module and return.
7499 1 August 2007: Wouter
7500 - set version to 0.5
7501 - module work for module to module interconnections.
7502 - config of modules.
7503 - detect cycle takes flags.
7505 31 July 2007: Wouter
7509 30 July 2007: Wouter
7510 - changed random state init, so that sequential process IDs are not
7511 cancelled out by sequential thread-ids in the random number seed.
7512 - the fwd_three test, which sends three queries to unbound, and
7513 unbound is kept waiting by ldns-testns for 3 seconds, failed
7514 because the retry timeout for default by unbound is 3 seconds too,
7515 it would hit that timeout and fail the test. Changed so that unbound
7516 is kept waiting for 2 seconds instead.
7518 27 July 2007: Wouter
7519 - removed useless -C debug option. It did not work.
7520 - text edit of documentation.
7521 - added doc/CREDITS file, referred to by the manpages.
7524 26 July 2007: Wouter
7525 - cycle detection, for query state dependencies. Will attempt to
7526 circumvent the cycle, but if no other targets available fails.
7527 - unit test for AXFR, IXFR response.
7528 - test for cycle detection.
7530 25 July 2007: Wouter
7531 - testbound read ADDRESS and check it.
7532 - test for version.bind and friends.
7533 - test for iterator chaining through several referrals.
7534 - test and fixup for refetch for glue. Refetch fails if glue
7535 is still not provided.
7537 24 July 2007: Wouter
7538 - Example section in config manual.
7539 - Addr stored for range and moment in replay.
7541 20 July 2007: Wouter
7542 - Check CNAME chain before returning cache entry with CNAMEs.
7543 - Option harden-glue, default is on. It will discard out of zone
7544 data. If disabled, performance is faster, but spoofing attempts
7545 become a possibility. Note that still normalize scrubbing is done,
7546 and that the potentially spoofed data is used for infrastructure
7547 and not returned to the client.
7548 - if glue times out, refetch by asking parent of delegation again.
7549 Much like asking for DS at the parent side.
7550 - TODO items from forgery-resilience draft.
7551 and on memory handling improvements.
7552 - renamed module_event_timeout to module_event_noreply.
7553 - memory reporting code; reports on memory usage after handling
7554 a network packet (not on cache replies).
7556 19 July 2007: Wouter
7557 - shuffle NS selection when getting nameserver target addresses.
7558 - fixup of deadlock warnings, yield cpu in checklock code so that
7559 freebsd scheduler selects correct process to run.
7560 - added identity and version config options and replies.
7561 - store cname messages complete answers.
7563 18 July 2007: Wouter
7564 - do not query addresses, 127.0.0.1, and ::1 by default.
7566 17 July 2007: Wouter
7567 - forward zone options in config file.
7568 - forward per zone in iterator. takes precedence over stubs.
7569 - fixup commithooks.
7570 - removed forward-to and forward-to-port features, subsumed by
7572 - fix parser to handle absent server: clause.
7573 - change untrusted rrset test to account for scrubber that is now
7574 applied during the test (which removes the poison, by the way).
7575 - feature, addresses can be specified with @portnumber, like nsd.conf.
7576 - test config files changed over to new forwarder syntax.
7578 27 June 2007: Wouter
7579 - delete of mesh does a postorder traverse of the tree.
7580 - found and fixed a memory leak. For TTL=0 messages, that would
7581 not be cached, instead the msg-replyinfo structure was leaked.
7582 - changed server selection so it will filter out hosts that are
7583 unresponsive. This is defined as a host with the maximum rto value.
7584 This means that unbound tried the host for retries up to 120 secs.
7585 The rto value will time out after host-ttl seconds from the cache.
7586 This keeps such unresolvable queries from taking up resources.
7587 - utility for keeping histogram.
7589 26 June 2007: Wouter
7590 - mesh is called by worker, and iterator uses it.
7591 This removes the hierarchical code.
7592 QueryTargets state and Finished state are merged for iterator.
7593 - forwarder mode no longer sets AA bit on first reply.
7594 - rcode in walk_supers is not needed.
7596 25 June 2007: Wouter
7598 - error encode routine for ease.
7600 22 June 2007: Wouter
7601 - removed unused _node iterator value from rbtree_t. Takes up space.
7602 - iterator can handle querytargets state without a delegation point
7603 set, so that a priming(stub) subquery error can be handled.
7604 - iterator stores if it is priming or not.
7605 - log_query_info() neater logging.
7606 - changed iterator so that it does not alter module_qstate.qinfo
7607 but keeps a chase query info. Also query_flags are not altered,
7608 the iterator uses chase_flags.
7609 - fixup crash in case no ports for the family exist.
7611 21 June 2007: Wouter
7612 - Fixup secondary buffer in case of error callback.
7613 - cleanup slumber list of runnable states.
7614 - module_subreq_depth fails to work in slumber list.
7615 - fixup query release for cached results to sub targets.
7616 - neater error for tcp connection failure, shows addr in verbose.
7617 - rbtree_init so that it can be used with preallocated memory.
7619 20 June 2007: Wouter
7620 - new -C option to enable coredumps after forking away.
7622 - fixup CNAME generation by scrubber, and memory allocation of it.
7623 - fixup deletion of serviced queries when all callbacks delete too.
7624 - set num target queries to 0 when you move them to slumber list.
7625 - typo in check caused subquery errors to be ignored, fixed.
7626 - make lint happy about rlim_t.
7627 - freeup of modules after freeup of module-states.
7628 - duplicate replies work, this uses secondary udp buffer in outnet.
7630 19 June 2007: Wouter
7631 - nicer layout in stats.c, review 0.3 change.
7632 - spelling improvement, review 0.3 change.
7633 - uncapped timeout for server selection, so that very fast or slow
7634 servers will stand out from the rest.
7635 - target-fetch-policy: "3 2 1 0 0" config setting.
7636 - fixup queries answered without RD bit (for root prime results).
7637 - refuse AXFR and IXFR requests.
7638 - fixup RD flag in error reply from iterator. fixup RA flag from
7640 - fixup encoding of very short edns buffer sizes, now sets TC bit.
7641 - config options harden-short-bufsize and harden-large-queries.
7643 18 June 2007: Wouter
7644 - same, move subqueries to slumber list when first has resolved.
7645 - fixup last fix for duplicate callbacks.
7646 - another offbyone in targetcounter. Also in Java prototype by the way.
7648 15 June 2007: Wouter
7649 - if a query asks to be notified of the same serviced query result
7650 multiple times, this will succeed. Only one callback will happen;
7651 multiple outbound-list entries result (but the double cleanup of it
7653 - when iterator moves on due to CNAME or referral, it will remove
7654 the subqueries (for other targets). These are put on the slumber
7656 - state module wait subq is OK with no new subqs, an old one may have
7657 stopped, with an error, and it is still waiting for other ones.
7658 - if a query loops, halt entire query (easy way to clean up properly).
7660 14 June 2007: Wouter
7661 - num query targets was > 0 , not >= 0 compared, so that fetch
7662 policy of 0 did nothing.
7664 13 June 2007: Wouter
7665 - debug option: configure --enable-static-exe for compile where
7666 ldns and libevent are linked statically. Default is off.
7667 - make install and make uninstall. Works with static-exe and without.
7668 installation of unbound binary and manual pages.
7669 - alignment problem fix on solaris 64.
7670 - fixup address in case of TCP error.
7672 12 June 2007: Wouter
7673 - num target queries was set to 0 at a bad time. Default it to 0 and
7674 increase as target queries are done.
7675 - synthesize CNAME and DNAME responses from the cache.
7676 - Updated doxygen config for doxygen 1.5.
7677 - aclocal newer version.
7678 - doxygen 1.5 fixes for comments (for the strict check on docs).
7680 11 June 2007: Wouter
7681 - replies on TCP queries have the address field set in replyinfo,
7682 for serviced queries, because the initiator does not know that
7683 a TCP fallback has occured.
7684 - omit DNSSEC types from nonDO replies, except if qtype is ANY or
7685 if qtype directly queries for the type (and then only show that
7686 'unknown type' in the answer section).
7687 - fixed message parsing where rrsigs on their own would be put
7688 in the signature list over the rrsig type.
7691 - fixup error in double linked list insertion for subqueries and
7692 for outbound list of serviced queries for iterator module.
7693 - nicer printout of outgoing port selection.
7694 - fixup cname target readout.
7695 - nicer debug output.
7696 - fixup rrset counts when prepending CNAMEs to the answer.
7697 - fixup rrset TTL for prepended CNAMEs.
7698 - process better check for looping modules, and which submodule to
7700 - subreq insertion code fixup for slumber list.
7701 - VERB_DETAIL, verbosity: 2 level gives short but readable output.
7702 VERB_ALGO, verbosity: 3 gives extensive output.
7703 - fixup RA bit in cached replies.
7704 - fixup CNAME responses from the cache no longer partial response.
7705 - error in network send handled without leakage.
7706 - enable ip6 from config, and try ip6 addresses if available,
7707 if ip6 is not connected, skips to next server.
7710 - iterator state finished.
7711 - subrequests without parent store in cache and stop.
7712 - worker slumber list for ongoing promiscuous queries.
7713 - subrequest error handling.
7714 - priming failure returns SERVFAIL.
7715 - priming gives LAME result, returns SERVFAIL.
7716 - debug routine to print dns_msg as handled by iterator.
7717 - memleak in config file stubs fixup.
7718 - more small bugs, in scrubber, query compare no ID for lookup,
7719 in dname validation for NS targets.
7720 - sets entry.key for new special allocs.
7721 - lognametypeclass can display unknown types and classes.
7724 - random selection of equally preferred nameserver targets.
7725 - reply info copy routine. Reuses existing code.
7726 - cache lameness in response handling.
7727 - do not touch qstate after worker_process_query because it may have
7728 been deleted by that routine.
7729 - Prime response state.
7730 - Process target response state.
7731 - some memcmp changed to dname_compare for case preservation.
7734 - normalize incoming messages. Like unbound-java, with CNAME chain
7735 checked, DNAME checked, CNAME's synthesized, glue checked.
7736 - sanitize incoming messages.
7737 - split msgreply encode functions into own file msgencode.c.
7738 - msg_parse to queryinfo/replyinfo conversion more versatile.
7739 - process_response, classify response, delegpt_from_message.
7742 - querytargets state.
7743 - dname_subdomain_c() routine.
7744 - server selection, based on RTT. ip6 is filtered out if not available,
7745 and lameness is checked too.
7746 - delegation point copy routine.
7749 - removed FLAG_CD from message and rrset caches. This was useful for
7750 an agnostic forwarder, but not for a sophisticated (trust value per
7751 rrset enabled) cache.
7752 - iterator response typing.
7753 - iterator cname handle.
7754 - iterator prime start.
7756 - processInitRequest and processInitRequest2.
7757 - cache synthesizes referral messages, with DS and NSEC.
7758 - processInitRequest3.
7759 - if a request creates multiple subrequests these are all activated.
7762 - routines to lock and unlock array of rrsets moved to cache/rrset.
7763 - lookup message from msg cache (and copy to region).
7764 - fixed cast error in dns msg lookup.
7765 - message with duplicate rrset does not increase its TTLs twice.
7766 - 'qnamesize' changed to 'qname_len' for similar naming scheme.
7769 - Acknowledge use of unbound-java code in iterator. Nicer readme.
7770 - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and
7771 rrset cache from module environment.
7772 - packed rrset key has type and class as easily accessible struct
7773 members. They are still kept in network format for fast msg encode.
7774 - dns cache find_delegation routine.
7775 - iterator main functions setup.
7776 - dns cache lookup setup.
7779 - small changes to prepare for subqueries.
7780 - iterator forwarder feature separated out.
7781 - iterator hints stub code, config file stub code, so that first
7782 testing can proceed locally.
7783 - replay tests now have config option to enable forwarding mode.
7786 - outside network does precise timers for roundtrip estimates for rtt
7787 and for setting timeout for UDP. Pending_udp takes milliseconds.
7788 - cleaner iterator sockaddr conversion of forwarder address.
7789 - iterator/iter_utils and iter_delegpt setup.
7793 - outbound query list for modules and support to callback with the
7794 outbound entry to the module.
7795 - testbound support for new serviced queries.
7796 - test for retry to TCP cannot use testbound any longer.
7797 - testns test for EDNS fallback, test for TCP fallback already exists.
7798 - fixes for no-locking compile.
7799 - mini_event timer precision and fix for change in timeouts during
7800 timeout callback. Fix for fwd_three tests, performed nonexit query.
7803 - small comment on hash table locking.
7804 - outside network serviced queries, contain edns and tcp fallback,
7805 and udp retries and rtt timing.
7808 - lruhash_touch() would cause locking order problems. Fixup in
7809 lock-verify in case locking cycle is found.
7810 - services/cache/rrset.c for rrset cache code.
7811 - special rrset_cache LRU updating function that uses the rrset id.
7812 - no dependencies calculation when make clean is called.
7813 - config settings for infra cache.
7814 - daemon code slightly cleaner, only creates caches once.
7818 - unit test for host cache.
7821 - Port to OS/X and Dec Alpha. Printf format and alignment fixes.
7822 - extensive lock debug report on join timeout.
7823 - proper RTT calculation, in utility code.
7824 - setup of services/cache/infra, host cache.
7827 - iterator/iterator.c module.
7828 - fixup to pass reply_info in testcode and in netevent.
7831 - created release-0.3 svn tag.
7833 - fixed compression - no longer compresses root name.
7836 - outside network cleans up waiting tcp queries on exit.
7838 - testbound replay with retry in TCP mode.
7839 - tpkg test for retry in TCP mode, against ldns-testns server.
7840 - daemon checks max number of open files and complains if not enough.
7841 - test where data expires in the cache.
7842 - compiletests: fixed empty body ifstatements in alloc.c, in case
7846 - outgoing network keeps list of available tcp buffers for outgoing
7848 - outgoing-num-tcp config option.
7849 - outgoing network keeps waiting list of queries waiting for buffer.
7850 - netevent supports outgoing tcp commpoints, nonblocking connects.
7853 - EDNS read from query, used to make reply smaller.
7854 - advertised edns value constants.
7855 - EDNS BADVERS response, if asked for too high edns version.
7856 - EDNS extended error responses once the EDNS record from the query
7857 has successfully been parsed.
7860 - msgreply sizefunc is more accurate.
7861 - config settings for rrset cache size and slabs.
7862 - hashtable insert takes argument so that a thread can use its own
7863 alloc cache to store released keys.
7864 - alloc cache special_release() locks if necessary.
7865 - rrset trustworthiness type added.
7866 - thread keeps a scratchpad region for handling messages.
7867 - writev used in netevent to write tcp length and data after another.
7868 This saves a roundtrip on tcp replies.
7869 - test for one rrset updated in the cache.
7870 - test for one rrset which is not updated, as it is not deemed
7872 - test for TTL refreshed in rrset.
7875 - fill refs. Use new parse and encode to answer queries.
7876 - stores rrsets in cache.
7877 - uses new msgreply format in cache.
7880 - dname unit tests in own file and spread out neatly in functions.
7881 - more dname unit tests.
7882 - message encoding creates truncated TC flagged messages if they do
7883 not fit, and will leave out (whole)rrsets from additional if needed.
7886 - decompress query section, extremely lenient acceptance.
7887 But only for answers from other servers, not for plain queries.
7888 - compression and decompression test cases.
7890 - example.conf interface: line is changed from 127.0.0.1 which leads
7891 to problems if used (restricting communication to the localhost),
7892 to a documentation and test address.
7894 27 April 2007: Wouter
7895 - removed iov usage, it is not good for dns message encoding.
7896 - owner name compression more optimal.
7897 - rrsig owner name compression.
7898 - rdata domain name compression.
7900 26 April 2007: Wouter
7901 - floating point exception fix in lock-verify.
7902 - lint uses make dependency
7903 - fixup lint in dname owner domain name compression code.
7904 - define for offset range that can be compressed to.
7906 25 April 2007: Wouter
7907 - prettier code; parse_rrset->type kept in host byte order.
7908 - datatype used for hashvalue of converted rrsig structure.
7909 - unit test compares edns section data too.
7911 24 April 2007: Wouter
7912 - ttl per RR, for RRSIG rrsets and others.
7913 - dname_print debug function.
7914 - if type is not known, size calc will skip DNAME decompression.
7915 - RRSIG parsing and storing and putting in messages.
7916 - dnssec enabled unit tests (from nlnetlabs.nl and se queries).
7917 - EDNS extraction routine.
7919 20 April 2007: Wouter
7920 - code comes through all of the unit tests now.
7921 - disabled warning about spurious extra data.
7922 - documented the RRSIG parse plan in msgparse.h.
7923 - rrsig reading and outputting.
7925 19 April 2007: Wouter
7926 - fix unit test to actually to tests.
7927 - fix write iov helper, and fakevent code.
7928 - extra builtin testcase (small packet).
7929 - ttl converted to network format in packets.
7930 - flags converted correctly
7931 - rdatalen off by 2 error fixup.
7932 - uses less iov space for header.
7934 18 April 2007: Wouter
7935 - review of msgparse code.
7936 - smaller test cases.
7938 17 April 2007: Wouter
7939 - copy and decompress dnames.
7940 - store calculated hash value too.
7941 - routine to create message out of stored information.
7942 - util/data/msgparse.c for message parsing code.
7943 - unit test, and first fixes because of test.
7944 * forgot rrset_count addition.
7945 * did & of ptr on stack for memory position calculation.
7946 * dname_pkt_copy forgot to read next label length.
7947 - test from file and fixes
7948 * double frees fixed in error conditions.
7949 * types with less than full rdata allowed by parser.
7950 Some dynamic update packets seem to use it.
7952 16 April 2007: Wouter
7953 - following a small change in LDNS, parsing code calculates the
7954 memory size to allocate for rrs.
7955 - code to handle ID creation.
7957 13 April 2007: Wouter
7958 - parse routines. Code that parses rrsets, rrs.
7960 12 April 2007: Wouter
7961 - dname compare routine that preserves case, with unit tests.
7963 11 April 2007: Wouter
7964 - parse work - dname packet parse, msgparse, querysection parse,
7965 start of sectionparse.
7967 10 April 2007: Wouter
7968 - Improved alignment of reply_info packet, nice for 32 and 64 bit.
7969 - Put RRset counts in reply_info, because the number of RRs can change
7970 due to RRset updates.
7971 - import of region-allocator code from nsd.
7972 - set alloc special type to ub_packed_rrset_key.
7973 Uses lruhash entry overflow chain next pointer in alloc cache.
7974 - doxygen documentation for region-allocator.
7975 - setup for parse scratch data.
7977 5 April 2007: Wouter
7978 - discussed packed rrset with Jelte.
7980 4 April 2007: Wouter
7981 - moved to version 0.3.
7982 - added util/data/dname.c
7983 - layout of memory for rrsets.
7985 3 April 2007: Wouter
7986 - detect sign of msghdr.msg_iovlen so that the cast to that type
7987 in netevent (which is there to please lint) can be correct.
7988 The type on several OSes ranges from int, int32, uint32, size_t.
7989 Detects unsigned or signed using math trick.
7990 - constants for DNS flags.
7991 - compilation without locks fixup.
7992 - removed include of unportable header from lookup3.c.
7993 - more portable use of struct msghdr.
7994 - casts for printf warning portability.
7995 - tweaks to tests to port them to the testbed.
7998 2 April 2007: Wouter
7999 - check sizes of udp received messages, not too short.
8000 - review changes. Some memmoves can be memcpys: 4byte aligned.
8001 set id correctly on cached answers.
8002 - review changes msgreply.c, memleak on error condition. AA flag
8003 clear on cached reply. Lowercase queries on hashing.
8004 unit test on lowercasing. Test AA bit not set on cached reply.
8005 Note that no TTLs are managed.
8007 29 March 2007: Wouter
8008 - writev or sendmsg used when answering from cache.
8009 This avoids a copy of the data.
8010 - do not do useless byteswap on query id. Store reply flags in uint16
8011 for easier access (and no repeated byteswapping).
8013 - configure detects and config.h includes sys/uio.h for writev decl.
8015 28 March 2007: Wouter
8016 - new config option: num-queries-per-thread.
8017 - added tpkg test for answering three queries at the same time
8018 using one thread (from the query service list).
8020 27 March 2007: Wouter
8021 - added test for cache and not cached answers, in testbound replays.
8022 - testbound can give config file and commandline options from the
8023 replay file to unbound.
8024 - created test that checks if items drop out of the cache.
8025 - added word 'partitioned hash table' to documentation on slab hash.
8026 A slab hash is a partitioned hash table.
8027 - worker can handle multiple queries at a time.
8029 26 March 2007: Wouter
8030 - config settings for slab hash message cache.
8031 - test for cached answer.
8032 - Fixup deleting fake answer from testbound list.
8034 23 March 2007: Wouter
8035 - review of yesterday's commits.
8036 - covered up memory leak of the entry locks.
8037 - answers from the cache correctly. Copies flags correctly.
8038 - sanity check for incoming query replies.
8039 - slabbed hash table. Much nicer contention, need dual cpu to see.
8041 22 March 2007: Wouter
8042 - AIX configure check.
8043 - lock-verify can handle references to locks that are created
8044 in files it has not yet read in.
8045 - threaded hash table test.
8046 - unit test runs lock-verify afterwards and checks result.
8047 - need writelock to update data on hash_insert.
8048 - message cache code, msgreply code.
8050 21 March 2007: Wouter
8051 - unit test of hash table, fixup locking problem in table_grow().
8052 - fixup accounting of sizes for removing items from hashtable.
8053 - unit test for hash table, single threaded test of integrity.
8054 - lock-verify reports errors nicely. More quiet in operation.
8056 16 March 2007: Wouter
8057 - lock-verifier, checks consistent order of locking.
8059 14 March 2007: Wouter
8060 - hash table insert (and subroutines) and lookup implemented.
8061 - hash table remove.
8062 - unit tests for hash internal bin, lru functions.
8064 13 March 2007: Wouter
8065 - lock_unprotect in checklocks.
8066 - util/storage/lruhash.h for LRU hash table structure.
8068 12 March 2007: Wouter
8069 - configure.ac moved to 0.2.
8070 - query_info and replymsg util/data structure.
8072 9 March 2007: Wouter
8073 - added rwlock writelock checking.
8074 So it will keep track of the writelock, and readlocks are enforced
8075 to not change protected memory areas.
8076 - log_hex function to dump hex strings to the logfile.
8077 - checklocks zeroes its destroyed lock after checking memory areas.
8078 - unit test for alloc.
8079 - identifier for union in checklocks to please older compilers.
8082 8 March 2007: Wouter
8083 - Reviewed checklock code.
8085 7 March 2007: Wouter
8086 - created a wrapper around thread calls that performs some basic
8087 checking for data race and deadlock, and basic performance
8088 contention measurement.
8090 6 March 2007: Wouter
8091 - Testbed works with threading (different machines, different options).
8092 - alloc work, does the special type.
8094 2 March 2007: Wouter
8095 - do not compile fork funcs unless needed. Otherwise will give
8096 type errors as their typedefs have not been enabled.
8097 - log shows thread numbers much more nicely (and portably).
8098 - even on systems with nonthreadsafe libevent signal handling,
8099 unbound will exit if given a signal.
8100 Reloads will not work, and exit is not graceful.
8101 - start of alloc framework layout.
8103 1 March 2007: Wouter
8104 - Signals, libevent and threads work well, with libevent patch and
8105 changes to code (close after event_del).
8106 - set ipc pipes nonblocking.
8108 27 February 2007: Wouter
8109 - ub_thread_join portable definition.
8110 - forking is used if no threading is available.
8111 Tested, it works, since pipes work across processes as well.
8112 Thread_join is replaced with waitpid.
8113 - During reloads the daemon will temporarily handle signals,
8114 so that they do not result in problems.
8115 - Also randomize the outgoing port range for tests.
8116 - If query list is full, will stop selecting listening ports for read.
8117 This makes all threads service incoming requests, instead of one.
8118 No memory is leaking during reloads, service of queries, etc.
8119 - test that uses ldns-testns -f to test threading. Have to answer
8120 three queries at the same time.
8121 - with verbose=0 operates quietly.
8123 26 February 2007: Wouter
8124 - ub_random code used to select ID and port.
8125 - log code prints thread id.
8126 - unbound can thread itself, with reload(HUP) and quit working
8128 - don't open pipes for #0, doesn't need it.
8129 - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload).
8131 23 February 2007: Wouter
8132 - Can do reloads on sigHUP. Everything is stopped, and freed,
8133 except the listening ports. Then the config file is reread.
8134 And everything is started again (and listening ports if needed).
8135 - Ports for queries are shared.
8136 - config file added interface:, chroot: and username:.
8137 - config file: directory, logfile, pidfile. And they work too.
8138 - will daemonize by default now. Use -d to stay in the foreground.
8139 - got BSD random[256 state] code, made it threadsafe. util/random.
8141 22 February 2007: Wouter
8142 - Have a config file. Removed commandline options, moved to config.
8143 - tests use config file.
8145 21 February 2007: Wouter
8146 - put -c option in man page.
8147 - minievent fd array capped by FD_SETSIZE.
8149 20 February 2007: Wouter
8150 - Added locks code and pthread spinlock detection.
8151 - can use no locks, or solaris native thread library.
8152 - added yacc and lex configure, and config file parsing code.
8153 also makedist.sh, and manpage.
8154 - put include errno.h in config.h
8156 19 February 2007: Wouter
8157 - Created 0.0 svn tag.
8158 - added acx_pthread.m4 autoconf check for pthreads from
8159 the autoconf archive. It is GPL-with-autoconf-exception Licensed.
8160 You can specify --with-pthreads, or --without-pthreads to configure.
8162 16 February 2007: Wouter
8163 - Updated testbed script, works better by using make on remote end.
8164 - removed check decls, we can compile without them.
8165 - makefile supports LIBOBJ replacements.
8166 - docs checks ignore compat code.
8167 - added util/mini-event.c and .h, a select based alternative used with
8168 ./configure --with-libevent=no
8169 It is limited to 1024 file descriptors, and has less features.
8170 - will not create ip6 sockets if ip6 not on the machine.
8172 15 February 2007: Wouter
8173 - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64,
8174 Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc.
8175 - malloc rndstate, so that it is aligned for access.
8176 - fixed rbtree cleanup with postorder traverse.
8177 - fixed pending messages are deleted when handled.
8178 - You can control verbosity; default is not verbose, every -v
8179 adds more verbosity.
8181 14 February 2007: Wouter
8182 - Included configure.ac changes from ldns.
8183 - detect (some) headers before the standards check.
8184 - do not use isblank to test c99, since its not available on solaris9.
8185 - review of testcode.
8186 * entries in a RANGE are no longer reversed.
8187 * print name of file with replay entry parse errors.
8188 - port to OSX: cast to int for some prints of sizet.
8189 - Makefile copies ldnstestpkts.c before doing dependencies on it.
8191 13 February 2007: Wouter
8192 - work on fake events, first fwd replay works.
8193 - events can do timeouts and errors on queries to servers.
8194 - test package that runs replay scenarios.
8196 12 February 2007: Wouter
8197 - work on fake events.
8199 9 February 2007: Wouter
8200 - replay file reading.
8201 - fake event setup, it creates fake structures, and teardowns,
8202 added signal callbacks to reply to be able to fake those,
8203 and main structure of event replay routines.
8205 8 February 2007: Wouter
8208 - testcode/fake_event work.
8210 7 February 2007: Wouter
8211 - return answer with the same ID as query was sent with.
8212 - created udp forwarder test. I've done some effort to make it perform
8213 quickly. After servers are created, no big sleep statements but
8214 it checks the logfiles to see if servers have come up. Takes 0.14s.
8215 - set addrlen value when calling recvfrom.
8216 - comparison of addrs more portable.
8217 - LIBEVENT option for testbed to set libevent directory.
8218 - work on tcp input.
8220 6 February 2007: Wouter
8221 - reviewed code and improved in places.
8223 5 February 2007: Wouter
8224 - Picked up stdc99 and other define tests from ldns. Improved
8225 POSIX define test to include getaddrinfo.
8226 - defined constants for netevent callback error code.
8227 - unit test for strisip6.
8229 2 February 2007: Wouter
8230 - Created udp4 and udp6 port arrays to provide service for both
8232 - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets.
8233 - listens on both ip4 and ip6 ports to provide correct return address.
8234 - worker fwder address filled correctly.
8236 - forwards udp queries and sends answer.
8238 1 February 2007: Wouter
8239 - outside network more UDP work.
8240 - moved * closer to type.
8241 - comm_timer object and events.
8243 31 January 2007: Wouter
8244 - Added makedist.sh script to make release tarball.
8245 - Removed listen callback layer, did not add anything.
8246 - Added UDP recv to netevent, worker callback for udp.
8247 - netevent communication reply storage structure.
8248 - minimal query header sanity checking for worker.
8249 - copied over rbtree implementation from NSD (BSD licensed too).
8250 - outgoing network query service work.
8252 30 January 2007: Wouter
8253 - links in example/ldns-testpkts.c and .h for premade packet support.
8254 - added callback argument to listen_dnsport and daemon/worker.
8256 29 January 2007: Wouter
8257 - unbound.8 a short manpage.
8259 26 January 2007: Wouter
8261 - make lint works on BSD and Linux (openssl defines).
8263 - testbound program start.
8265 25 January 2007: Wouter
8266 - fixed lint so it may work on BSD.
8267 - put license into header of every file.
8268 - created verbosity flag.
8269 - fixed libevent configure flag.
8270 - detects event_base_free() in new libevent 1.2 version.
8271 - getopt in daemon. fatal_exit() and verbose() logging funcs.
8272 - created log_assert, that throws assertions to the logfile.
8273 - listen_dnsport service. Binds ports.
8275 24 January 2007: Wouter
8276 - cleaned up configure.ac.
8278 23 January 2007: Wouter
8279 - added libevent to configure to link with.
8280 - util/netevent setup work.
8281 - configure searches for libevent.
8282 - search for libs at end of configure (when other headers and types
8284 - doxygen works with ATTR_UNUSED().
8285 - util/netevent implementation.
8287 22 January 2007: Wouter
8288 - Designed header file for network communication.
8290 16 January 2007: Wouter
8291 - added readme.svn and readme.tests.
8293 4 January 2007: Wouter
8294 - Testbed script (run on multiple platforms the test set).
8295 Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5.
8296 - added unit test tpkg.
8298 3 January 2007: Wouter
8299 - committed first set of files into subversion repository.
8300 svn co svn+ssh://unbound.net/svn/unbound
8301 You need a ssh login. There is no https access yet.
8302 - Added LICENSE, the BSD license.
8303 - Added doc/README with compile help.
8304 - main program stub and quiet makefile.
8305 - minimal logging service (to stderr).
8306 - added postcommit hook that serves emails.
8307 - added first test 00-lint. postcommit also checks if build succeeds.
8308 - 01-doc: doxygen doc target added for html docs. And stringent test
8309 on documented files, functions and parameters.
8311 15 December 2006: Wouter
8312 - Created Makefile.in and configure.ac.
projects / FreeBSD / FreeBSD.git / blob