2 - Fix#524: max-udp-size not effective to non-EDNS0 queries, from
6 - MIN_TTL and MAX_TTL also in time_t.
7 - tag 1.4.21rc1 made again.
10 - More fixes for bug#519: for the threaded case test if the bg
11 thread has been killed, on ub_ctx_delete, to avoid hangs.
14 - more fixes that I overlooked.
15 - review fixes from Willem.
18 - Fix#520: Errors found by static analysis from Tomas Hozza(redhat).
21 - Fix for 2038, with time_t instead of uint32_t.
24 - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound).
27 - Fix uninit variable in fix#516.
30 - Fix#516 dnssec lameness detection for answers that are improper.
36 - Fix#512 memleak in testcode for testbound (if it fails).
37 - Fix#512 NSS returned arrays out of setup function to be statics.
40 - max include of 100.000 files (depth and globbed at one time).
41 This is to preserve system memory in bug cases, or endless cases.
42 - iana portlist updated.
45 - streamtcp man page, contributed by Tomas Hozza.
46 - iana portlist updated.
47 - libunbound documentation on how to avoid openssl race conditions.
50 - Squelch sendto-permission denied errors when the network is
51 not connected, to avoid spamming syslog.
52 - configure --disable-flto option (from Robert Edmonds).
55 - Fix for const string literals in C++ for libunbound, from Karel
57 - iana portlist updated.
60 - Fixup manpage syntax.
63 - get_option and set_option support for log-time-ascii, python-script
64 val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect
65 immediately. The others are mostly useful for libunbound users.
68 - get_option, set_option, unbound-checkconf -o and libunbound
69 getoption and setoption support cache-min-ttl and cache-max-ttl.
72 - Fix#501: forward-first does not recurse, when forward name is ".".
73 - iana portlist update.
74 - Max include depth is unlimited.
77 - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply
78 patch to it to not fail when -Werror is also specified, from the
80 - iana portlist update.
83 - Explain bogus and secure flags in libunbound more.
86 - Fix#499 use-after-free in out-of-memory handling code (thanks Jake
88 - Fix#500 use on non-initialised values on socket bind failures.
91 - Fix round-robin doesn't work with some Windows clients (from Ilya
95 - update acx_nlnetlabs.m4 to v23, sleep w32 fix.
98 - add unbound-control insecure_add and insecure_remove for the
99 administration of negative trust anchors.
101 25 April 2013: Wouter
102 - Implement max-udp-size config option, default 4096 (thanks
104 - Robust checks on dname validity from rdata for dname compare.
105 - updated iana portlist.
107 19 April 2013: Wouter
108 - Fixup snprintf return value usage, fixed libunbound_get_option.
110 18 April 2013: Wouter
111 - fix bug #491: pick program name (0th argument) as syslog identity.
112 - own implementation of compat/snprintf.c.
114 15 April 2013: Wouter
115 - Fix so that for a configuration line of include: "*.conf" it is not
116 an error if there are no files matching the glob pattern.
117 - unbound-anchor review: BIO_write can return 0 successfully if it
118 has successfully appended a zero length string.
120 11 April 2013: Wouter
121 - Fix queries leaking up for stubs and forwards, if the configured
122 nameservers all fail to answer.
124 10 April 2013: Wouter
125 - code improve for minimal responses, small speed increase.
128 - updated iana portlist.
129 - Fix crash in previous private address fixup of 22 March.
131 28 March 2013: Wouter
132 - Make reverse zones easier by documenting the nodefault statements
133 commented-out in the example config file.
135 26 March 2013: Wouter
136 - more fixes to lookup3.c endianness detection.
138 25 March 2013: Wouter
139 - #492: Fix endianness detection, revert to older lookup3.c detection
140 and put new detect lines after previous tests, to avoid regressions
141 but allow new detections to succeed.
142 And add detection for machine/endian.h to it.
144 22 March 2013: Wouter
145 - Fix resolve of names that use a mix of public and private addresses.
146 - iana portlist update.
147 - Fix makedist for new svn for -d option.
148 - unbound.h header file has UNBOUND_VERSION_MAJOR define.
149 - Fix windows RSRC version for long version numbers.
151 21 March 2013: Wouter
154 - committed libunbound version 4:1:2 for binary API updated in 1.4.20
155 - install copy of unbound-control.8 man page for unbound-control-setup
157 14 March 2013: Wouter
158 - iana portlist update.
161 12 March 2013: Wouter
162 - Fixup makedist.sh for windows compile.
164 11 March 2013: Wouter
165 - iana portlist update.
166 - testcode/ldns-testpkts.c check for makedist is informational.
168 15 February 2013: Wouter
169 - fix defines in lookup3 for bigendian bsd alpha
171 11 February 2013: Wouter
172 - Fixup openssl_thread init code to only run if compiled with SSL.
174 7 February 2013: Wouter
175 - detect endianness in lookup3 on BSD.
176 - add libunbound.ttl at end of result structure, version bump for
177 libunbound and binary backwards compatible, but 1.4.19 is not
178 forward compatible with 1.4.20.
179 - update iana port list.
181 30 January 2013: Wouter
182 - includes and have_ssl fixes for nss.
184 29 January 2013: Wouter
185 - printout name of zone with duplicate fwd and hint errors.
187 28 January 2013: Wouter
188 - updated fwd_zero for newer nc. Updated common.sh for newer netstat.
190 17 January 2013: Wouter
191 - unbound-anchors checks the emailAddress of the signer of the
192 root.xml file, default is dnssec@iana.org. It also checks that
193 the signer has the correct key usage for a digital signature.
194 - update iana port list.
196 3 January 2013: Wouter
197 - Test that unbound-control checks client credentials.
198 - Test that unbound can handle a CNAME at an intermediate node in
199 the chain of trust (where it seeks a DS record).
200 - Check the commonName of the signer of the root.xml file in
201 unbound-anchor, default is dnssec@iana.org.
203 2 January 2013: Wouter
204 - Fix openssl lock free on exit (reported by Robert Fleischman).
205 - iana portlist updated.
206 - Tested that unbound implements the RFC5155 Technical Errata id 3441.
207 Unbound already implements insecure classification of an empty
208 nonterminal in NSEC3 optout zone.
210 20 December 2012: Wouter
211 - Fix unbound-anchor xml parse of entity declarations for safety.
213 19 December 2012: Wouter
214 - iana portlist updated.
216 18 December 2012: Wouter
217 - iana portlist updated.
219 14 December 2012: Wouter
220 - Change of D.ROOT-SERVERS.NET A address in default root hints.
222 12 December 2012: Wouter
224 - trunk has 1.4.20 under development.
226 5 December 2012: Wouter
227 - note support for AAAA RR type RFC.
229 4 December 2012: Wouter
232 30 November 2012: Wouter
233 - bug 481: fix python example0.
234 - iana portlist updated.
236 27 November 2012: Wouter
237 - iana portlist updated.
239 9 November 2012: Wouter
240 - Fix unbound-control forward disables configured stubs below it.
242 7 November 2012: Wouter
243 - Fixup ldns-testpkts, identical to ldns/examples.
244 - iana portlist updated.
246 30 October 2012: Wouter
247 - Fix bug #477: unbound-anchor segfaults if EDNS is blocked.
249 29 October 2012: Matthijs
250 - Fix validation for responses with both CNAME and wildcard
251 expanded CNAME records in answer section.
253 8 October 2012: Wouter
254 - update ldns-testpkts.c to ldns 1.6.14 version.
255 - fix build of pythonmod in objdir, for unbound.py.
256 - make clean and makerealclean remove generated python and docs.
258 5 October 2012: Wouter
259 - fix build of pythonmod in objdir (thanks Jakob Schlyter).
261 3 October 2012: Wouter
262 - fix text in unbound-anchor man page.
264 1 October 2012: Wouter
265 - ignore trusted-keys globs that have no files (from Paul Wouters).
267 27 September 2012: Wouter
268 - include: directive in config file accepts wildcards. Patch from
269 Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*"
270 - unbound-control -q option is quiet, patch from Mariano Absatz.
271 - iana portlist updated.
272 - updated contrib/unbound.spec, patch from Valentin Bud.
274 21 September 2012: Wouter
275 - chdir to / after chroot call (suggested by Camiel Dobbelaar).
277 17 September 2012: Wouter
278 - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation
279 otherwise it is treated as insecure. The RSAMD5 algorithm is
280 deprecated (RFC6725). The MD5 hash is considered weak for some
281 purposes, if you want to sign your zone, then RSASHA256 is an
284 30 August 2012: Wouter
285 - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled.
286 - iana portlist updated.
288 29 August 2012: Wouter
289 - Nicer comments outgoing-port-avoid, thanks Stu (bug #465).
291 22 August 2012: Wouter
292 - Fallback to 1472 and 1232, one fragment size without headers.
294 21 August 2012: Wouter
295 - Fix timeouts so that when a server has been offline for a while
296 and is probed to see it works, it becomes fully available for
297 server selection again.
299 17 August 2012: Wouter
300 - Add documentation to libunbound for default nonuse of resolv.conf.
302 2 August 2012: Wouter
303 - trunk has 1.4.19 under development (fixes from 1 aug and 31 july
305 - iana portlist updated.
307 1 August 2012: Wouter
308 - Fix openssl race condition, initializes openssl locks, reported
309 by Einar Lonn and Patrik Wallstrom.
312 - Improved forward-first and stub-first documentation.
313 - Fix that enables modules to register twice for the same
314 serviced_query, without race conditions or administration issues.
315 This should not happen with the current codebase, but it is robust.
316 - Fix forward-first option where it sets the RD flag wrongly.
317 - added manpage links for libunbound calls (Thanks Paul Wouters).
320 - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012).
323 - unbound-host works with libNSS
324 - fix bogus nodata cname chain not reported as bogus by validator,
325 (Thanks Peter van Dijk).
328 - iana portlist updated.
332 - review fix for libnss, check hash prefix allocation size.
335 - fix missing break for GOST DS hash function.
336 - implemented forward_first for the root.
339 - Fix bug#452 and another assertion failure in mesh.c, makes
340 assertions in mesh.c resist duplicates. Fixes DS NS search to
341 not generate duplicate sub queries.
344 - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac,
345 if CFLAGS is specified at configure time then '-g -O2' is not
346 appended to CFLAGS, so that the user can override them.
349 - Fix libunbound report of errors when in background mode.
352 - updated iana ports list.
355 - Add flush_bogus option for unbound-control
358 - Fix validation of qtype DS queries that result in no data for
359 non-optout NSEC3 zones.
362 - compile libunbound with libnss on Suse, passes regression tests.
365 - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.
368 - updated iana ports list.
371 - patch for unbound_munin_ script to handle arbitrary thread count by
375 - detect if openssl has FIPS_mode.
376 - code review: return value of cache_store can be ignored for better
377 performance in out of memory conditions.
378 - fix edns-buffer-size and msg-buffer-size manpage documentation.
379 - updated iana ports list.
382 - disable RSAMD5 if in FIPS mode (for openssl and for libnss).
385 - implement DS records, NSEC3 and ECDSA for compile with libnss.
388 - fix error handling of alloc failure during rrsig verification.
389 - nss check for verification failure.
390 - nss crypto works for RSA and DSA.
393 - work on --with-nss build option (for now, --with-libunbound-only).
396 - --with-libunbound-only build option, only builds the library and
397 not the daemon and other tools.
403 - implement log-time-ascii on windows.
404 - The key-cache bad key ttl is now 60 seconds.
405 - updated iana ports list.
409 - bug #452: fix crash on assert in mesh_state_attachment.
412 - silence warning from swig-generated code (md set but not used in
413 swig initmodule, due to ifdefs in swig-generated code).
416 - Fix debian-bugs-658021: Please enable hardened build flags.
419 - updated iana ports list.
422 - tag for 1.4.17 release.
423 - trunk is 1.4.18 in development.
426 - Review comments, removed duplicate memset to zero in delegpt.
429 - Updated doc/FEATURES with RFCs that are implemented but not listed.
430 - Protect if statements in val_anchor for compile without locks.
434 - fix configure ECDSA support in ldns detection for windows compile.
435 - fix possible uninitialised variable in windows pipe implementation.
438 - Fix alignment problem in util/random on sparc64/freebsd.
441 - Fix for accept spinning reported by OpenBSD.
442 - iana portlist updated.
445 - Fix validation of nodata for DS query in NSEC zones, reported by
448 13 April 2012: Wouter
449 - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older
452 10 April 2012: Wouter
453 - Applied patch from Daisuke HIGASHI for rrset-roundrobin and
454 minimal-responses features.
455 - iana portlist updated.
458 - fix bug #443: --with-chroot-dir not honoured by configure.
459 - fix bug #444: setusercontext was called too late (thanks Bjorn
462 27 March 2012: Wouter
463 - fix bug #442: Fix that Makefile depends on pythonmod headers
464 even using --without-pythonmodule.
466 22 March 2012: Wouter
467 - contrib/validation-reporter follows rotated log file (patch from
470 21 March 2012: Wouter
471 - new approach to NS fetches for DS lookup that works with
472 cornercases, and is more robust and considers forwarders.
474 19 March 2012: Wouter
475 - iana portlist updated.
476 - fix to locate nameservers for DS lookup with NS fetches.
478 16 March 2012: Wouter
479 - Patch for access to full DNS packet data in unbound python module
483 - Applied line-buffer patch from Augie Schwer to validation.reporter.sh.
486 - flush_infra cleans timeouted servers from the cache too.
487 - removed warning from --enable-ecdsa.
490 - forward-first option. Tries without forward if a query fails.
491 Also stub-first option that is similar.
493 28 February 2012: Wouter
494 - Fix from code review, if EINPROGRESS not defined chain if statement
497 27 February 2012: Wouter
498 - Fix bug#434: on windows check registry for config file location
499 for unbound-control.exe, and unbound-checkconf.exe.
501 23 February 2012: Wouter
502 - Fix to squelch 'network unreachable' errors from tcp connect in
503 logs, high verbosity will show them.
505 16 February 2012: Wouter
506 - iter_hints is now thread-owned in module env, and thus threadsafe.
507 - Fix prefetch and sticky NS, now the prefetch works. It picks
508 nameservers that 'would be valid in the future', and if this makes
509 the NS timeout, it updates that NS by asking delegation from the
510 parent again. If child NS has longer TTL, that TTL does not get
511 refreshed from the lookup to the child nameserver.
513 15 February 2012: Wouter
514 - Fix forward-zone memory, uses malloc and frees original root dp.
515 - iter hints (stubs) uses malloc inside for more dynamicity.
516 - unbound-control forward_add, forward_remove, stub_add, stub_remove
517 can modify stubs and forwards for running unbound (on mobile computer)
518 they can also add and remove domain-insecure for the zone.
520 14 February 2012: Wouter
521 - Fix sticky NS (ghost domain problem) if prefetch is yes.
522 - iter forwards uses malloc inside for more dynamicity.
524 13 February 2012: Wouter
525 - RT#2955. Fix for cygwin compilation.
526 - iana portlist updated.
528 10 February 2012: Wouter
529 - Slightly smaller critical region in one case in infra cache.
530 - Fix timeouts to keep track of query type, A, AAAA and other, if
531 another has caused timeout blacklist, different type can still probe.
532 - unit test fix for nomem_cnametopos.rpl race condition.
534 9 February 2012: Wouter
535 - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h.
537 8 February 2012: Wouter
538 - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This
539 implementation is experimental at this time and not recommended
540 for use on the public internet (the protocol numbers have not
541 been assigned). Needs recent ldns with --enable-ecdsa.
542 - fix memory leak in errorcase for DSA signatures.
543 - iana portlist updated.
544 - workaround for openssl 0.9.8 ecdsa sha2 and evp problem.
546 3 February 2012: Wouter
547 - fix for windows, rename() is not posix compliant on windows.
549 2 February 2012: Wouter
550 - 1.4.16 release tag.
551 - svn trunk is 1.4.17 in development.
552 - iana portlist updated.
554 1 February 2012: Wouter
555 - Fix validation failures (like: validation failure xx: no NSEC3
556 closest encloser from yy for DS zz. while building chain of trust,
557 because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata
558 for an NSEC3. Now it does not change rdata, and fixes TTL.
560 30 January 2012: Wouter
561 - Fix version-number in libtool to be version-info so it produces
562 libunbound.so.2 like it should.
564 26 January 2012: Wouter
565 - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release.
566 - trunk 1.4.16; includes changes memset testcode, #424 openindiana,
567 and keyfile write fixup.
568 - applied patch to support outgoing-interface with ub_ctx_set_option.
570 23 January 2012: Wouter
571 - Fix memset in test code.
573 20 January 2012: Wouter
574 - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2.
576 19 January 2012: Wouter
577 - Fix to write key files completely to a temporary file, and if that
578 succeeds, replace the real key file. So failures leave a useful file.
580 18 January 2012: Wouter
581 - tag 1.4.15rc1 created
582 - updated libunbound/ubsyms.def and remade tag 1.4.15rc1.
584 17 January 2012: Wouter
585 - Fix bug where canonical_compare of RRSIG did not downcase the
586 signer-name. This is mostly harmless because RRSIGs do not have
587 to be sorted in canonical order, usually.
589 12 January 2012: Wouter
590 - bug#428: add ub_version() call to libunbound. API version increase,
591 with (binary) backwards compatibility for the previous version.
593 10 January 2012: Wouter
594 - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL
595 that would be permissible by the RFCs but it is not the TTL in the
597 - iana portlist updated.
598 - uninitialised variable in reprobe for rtt blocked domains fixed.
599 - lintfix and new flex output.
601 2 January 2012: Wouter
602 - Fix to randomize hash function, based on 28c3 congress, reported
605 24 December 2011: Wouter
606 - Fix for memory leak (about 20 bytes when a tcp or udp send operation
607 towards authority servers failed, takes about 50.000 such failures to
608 leak one Mb, such failures are also usually logged), reported by
610 - iana portlist updated.
612 19 December 2011: Wouter
613 - Fix for VU#209659 CVE-2011-4528: Unbound denial of service
614 vulnerabilities from nonstandard redirection and denial of existence
615 http://www.unbound.net/downloads/CVE-2011-4528.txt
616 - robust checks for next-closer NSEC3s.
617 - tag 1.4.14 created.
618 - trunk has 1.4.15 in development.
620 15 December 2011: Wouter
621 - remove uninit warning from cachedump code.
622 - Fix parse error on negative SOA RRSIGs if badly ordered in the packet.
624 13 December 2011: Wouter
625 - iana portlist updated.
627 - fix infra cache comparison.
628 - Fix to constrain signer_name to be a parent of the lookupname.
630 5 December 2011: Wouter
631 - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
632 - Fix warnings with gcc 4.6 in compat/inet_ntop.c.
633 - Fix warning unused in compat/strptime.c.
634 - Fix malloc detection and double defintion.
636 2 December 2011: Wouter
637 - configure generated with autoconf 2.68.
639 30 November 2011: Wouter
640 - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes
641 SERVFAILs. Also fixed for UDP (but less likely).
643 28 November 2011: Wouter
644 - Fix quartile time estimate, it was too low, (thanks Jan Komissar).
645 - iana ports updated.
647 11 November 2011: Wouter
648 - Makefile compat with SunOS make, BSD make and GNU make.
649 - iana ports updated.
651 10 November 2011: Wouter
652 - Makefile changed for BSD make compatibility.
654 9 November 2011: Wouter
655 - added unit test for SSL service and SSL-upstream.
657 8 November 2011: Wouter
658 - can configure ssl service to one port number, and not on others.
659 - fixup windows compile with ssl support.
660 - Fix double free in unbound-host, reported by Steve Grubb.
661 - iana portlist updated.
663 1 November 2011: Wouter
664 - dns over ssl support as a client, ssl-upstream yes turns it on.
665 It performs an SSL transaction for every DNS query (250 msec).
666 - documentation for new options: ssl-upstream, ssl-service-key and
668 - iana portlist updated.
669 - fix -flto detection on Lion for llvm-gcc.
671 31 October 2011: Wouter
672 - dns over ssl support, ssl-service-pem and ssl-service-key files
673 can be given and then TCP queries are serviced wrapped in SSL.
675 27 October 2011: Wouter
676 - lame-ttl and lame-size options no longer exist, it is integrated
677 with the host info. They are ignored (with verbose warning) if
678 encountered to keep the config file backwards compatible.
679 - fix iana-update for changing gzip compression of results.
680 - fix export-all-symbols on OSX.
682 26 October 2011: Wouter
683 - iana portlist updated.
684 - Infra cache stores information about ping and lameness per IP, zone.
686 - fix iana_update target for gzipped file on iana site.
688 24 October 2011: Wouter
689 - Fix resolve of partners.extranet.microsoft.com with a fix for the
690 server selection for choosing out of a (particular) list of bad
692 - Fix make_new_space function so that the incoming query is not
693 overwritten if a jostled out query causes a waiting query to be
694 resumed that then fails and sends an error message. (Thanks to
697 21 October 2011: Wouter
698 - fix --enable-allsymbols, fptr wlist is disabled on windows with this
699 option enabled because of memory layout exe vs dll.
701 19 October 2011: Wouter
702 - fix unbound-anchor for broken strptime on OSX lion, detected
704 - Detect if GOST really works, openssl1.0 on OSX fails.
705 - Implement ipv6%interface notation for scope_id usage.
707 17 October 2011: Wouter
708 - better documentation for inform_super (Thanks Yang Zhe).
710 14 October 2011: Wouter
711 - Fix for out-of-memory condition in libunbound (thanks
714 13 October 2011: Wouter
715 - Fix --enable-allsymbols, it depended on link specifics of the
716 target platform, or fptr_wlist assertion failures could occur.
718 12 October 2011: Wouter
719 - updated contrib/unbound_munin_ to family=auto so that it works with
720 munin-node-configure automatically (if installed as
721 /usr/local/share/munin/plugins/unbound_munin_ ).
723 27 September 2011: Wouter
724 - unbound.exe -w windows option for start and stop service.
726 23 September 2011: Wouter
727 - TCP-upstream calculates tcp-ping so server selection works if there
730 20 September 2011: Wouter
731 - Fix classification of NS set in answer section, where there is a
732 parent-child server, and the answer has the AA flag for dir.slb.com.
733 Thanks to Amanda Constant from Secure64.
735 16 September 2011: Wouter
736 - fix bug #408: accept patch from Steve Snyder that comments out
737 unused functions in lookup3.c.
738 - iana portlist updated.
739 - fix EDNS1480 change memleak and TCP fallback.
740 - fix various compiler warnings (reported by Paul Wouters).
741 - max sent count. EDNS1480 only for rtt < 5000. No promiscuous
742 fetch if sentcount > 3, stop query if sentcount > 16. Count is
743 reset when referral or CNAME happens. This makes unbound better
744 at managing large NS sets, they are explored when there is continued
745 interest (in the form of queries).
747 15 September 2011: Wouter
749 - trunk contains 1.4.14 in development.
750 - Unbound probes at EDNS1480 if there an EDNS0 timeout.
752 12 September 2011: Wouter
753 - Reverted dns EDNS backoff fix, it did not help and needs
754 fragmentation fixes instead.
757 7 September 2011: Wouter
758 - Fix operation in ipv6 only (do-ip4: no) mode.
760 6 September 2011: Wouter
761 - fedora specfile updated.
763 5 September 2011: Wouter
766 2 September 2011: Wouter
767 - iana portlist updated.
769 26 August 2011: Wouter
770 - Fix num-threads 0 does not segfault, reported by Simon Deziel.
771 - Fix validation failures due to EDNS backoff retries, the retry
772 for fetch of data has want_dnssec because the iter_indicate_dnssec
773 function returns true when validation failure retry happens, and
774 then the serviced query code does not fallback to noEDNS, even if
775 the cache says it has this. This helps for DLV deployment when
776 the DNSSEC status is not known for sure before the lookup concludes.
778 24 August 2011: Wouter
779 - Applied patch from Karel Slany that fixes a memory leak in the
780 unbound python module, in string conversions.
782 22 August 2011: Wouter
783 - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy
784 Zhang and Luo Ce). Unbound responds with the RR types that are
785 available at the name for qtype ANY and validates those RR types.
786 It does not test for completeness (i.e. with NSEC or NSEC3 query),
787 and it does not follow the CNAME or DNAME to another name (with
788 even more data for the already large response).
789 - Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
790 - Documented the options that work with control set_option command.
791 - tcp-upstream yes/no option (works with set_option) for tunnels.
793 18 August 2011: Wouter
794 - fix autoconf call in makedist crosscompile to RC or snapshot.
796 17 August 2011: Wouter
797 - Fix validation of . DS query.
798 - new xml format at IANA, new awk for iana_update.
799 - iana portlist updated.
801 10 August 2011: Wouter
802 - Fix python site-packages path to /usr/lib64.
803 - updated patch from Tom.
804 - fix memory and fd leak after out-of-memory condition.
806 9 August 2011: Wouter
807 - patch from Tom Hendrikx fixes load of python modules.
809 8 August 2011: Wouter
810 - make clean had ldns-src reference, removed.
812 1 August 2011: Wouter
813 - Fix autoconf 2.68 warnings
816 - Unbound implements RFC6303 (since version 1.4.7).
817 - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
818 meantime, those are for 1.4.13).
819 - iana portlist updated.
822 - Quick fix for contrib/unbound.spec example, no ldns-builtin any more.
825 - Fix wildcard expansion no-data reply under an optout NSEC3 zone is
826 validated as insecure, reported by Jia Li (lijia@cnnic.cn).
829 - 1.4.12rc1 tag created.
832 - version number in example config file.
833 - fix that --enable-static-exe does not complain about it unknown.
836 - tag relase 1.4.11, trunk is 1.4.12 development.
837 - iana portlist updated.
838 - fix bug#395: id bits of other query may leak out under conditions
839 - fix replyaddr count wrong after jostled queries, which leads to
840 eventual starvation where the daemon has no replyaddrs left to use.
841 - fix comment about rndc port, that referred to the old port number.
842 - fix that the listening socket is not closed when too many remote
843 control connections are made at the same time.
844 - removed ldns-src tarball inside the unbound tarball.
847 - Changed -flto check to support clang compiler.
848 - tag 1.4.11rc3 created.
851 - tag 1.4.11rc1 created.
852 - remove warning about signed/unsigned from flex (other flex version).
853 - updated aclocal.m4 and libtool to match.
854 - tag 1.4.11rc2 created.
857 - log-queries: yesno option, default is no, prints querylog.
861 - Use -flto compiler flag for link time optimization, if supported.
862 - iana portlist updated.
865 - IPv6 service address for d.root-servers.net (2001:500:2D::D).
868 - unbound-control has version number in the header,
869 UBCT[version]_space_ is the header sent by the client now.
870 - Unbound control port number is registered with IANA:
871 ub-dns-control 8953/tcp unbound dns nameserver control
872 This is the new default for the control-port config setting.
873 - statistics-interval prints the number of jostled queries to log.
876 - Fix Makefile for U in environment, since wrong U is more common than
877 deansification necessity.
878 - iana portlist updated.
879 - updated ldns tarball to 1.6.10rc2 snapshot of today.
882 - Fix assertion failure when unbound generates an empty error reply
883 in response to a query, CVE-2011-1922 VU#531342.
884 - This fix is in tag 1.4.10.
885 - defense in depth against the above bug, an error is printed to log
886 instead of an assertion failure.
889 - bug#386: --enable-allsymbols option links all binaries to libunbound
890 and reduces install size significantly.
891 - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
892 - iana portlist updated.
893 - Fix TTL of SOA so negative TTL is separately cached from normal TTL.
895 14 April 2011: Wouter
896 - configure created with newer autoconf 2.66.
898 12 April 2011: Wouter
899 - bug#378: Fix that configure checks for ldns_get_random presence.
902 - iana portlist updated.
903 - queries with CD flag set cause DNSSEC validation, but the answer is
904 not withheld if it is bogus. Thus, unbound will retry if it is bad
905 and curb the TTL if it is bad, thus protecting the cache for use by
906 downstream validators.
907 - val-override-date: -1 ignores dates entirely, for NTP usage.
909 29 March 2011: Wouter
910 - harden-below-nxdomain: changed so that it activates when the
911 cached nxdomain is dnssec secure. This avoids backwards
912 incompatibility because those old servers do not have dnssec.
914 24 March 2011: Wouter
915 - iana portlist updated.
919 17 March 2011: Wouter
920 - bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
921 Applied but did not do the --disable-gost.
923 10 March 2011: Wouter
924 - tag 1.4.9 release candidate 1 created.
927 - updated ldns to today.
930 - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
931 - give config parse error for multiple names on a stub or forward zone.
932 - updated ldns tarball to 1.6.9(todays snapshot).
934 24 February 2011: Wouter
935 - bug #361: Fix, time.elapsed variable not reset with stats_noreset.
937 23 February 2011: Wouter
938 - iana portlist updated.
939 - common.sh to version 3.
941 18 February 2011: Wouter
942 - common.sh in testdata updated to version 2.
944 15 February 2011: Wouter
945 - Added explicit note on unbound-anchor usage:
946 Please note usage of unbound-anchor root anchor is at your own risk
947 and under the terms of our LICENSE (see that file in the source).
949 11 February 2011: Wouter
950 - iana portlist updated.
951 - tpkg updated with common.sh for common functionality.
953 7 February 2011: Wouter
954 - Added regression test for addition of a .net DS to the root, and
955 cache effects with different TTL for glue and DNSKEY.
956 - iana portlist updated.
958 28 January 2011: Wouter
959 - Fix remove private address does not throw away entire response.
961 24 January 2011: Wouter
964 19 January 2011: Wouter
965 - fix bug#349: no -L/usr for ldns.
967 18 January 2011: Wouter
968 - ldns 1.6.8 tarball included.
971 17 January 2011: Wouter
972 - add get and set option for harden-below-nxdomain feature.
973 - iana portlist updated.
975 14 January 2011: Wouter
976 - Fix so a changed NS RRset does not get moved name stuck on old
977 server, for type NS the TTL is not increased.
979 13 January 2011: Wouter
980 - Fix prefetch so it does not get stuck on old server for moved names.
982 12 January 2011: Wouter
983 - iana portlist updated.
985 11 January 2011: Wouter
986 - Fix insecure CNAME sequence marked as secure, reported by Bert
989 10 January 2011: Wouter
990 - faster lruhash get_mem routine.
992 4 January 2011: Wouter
993 - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root.
994 - iana portlist updated.
996 23 December 2010: Wouter
997 - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
999 21 December 2010: Wouter
1000 - algorithm compromise protection using the algorithms signalled in
1001 the DS record. Also, trust anchors, DLV, and RFC5011 receive this,
1002 and thus, if you have multiple algorithms in your trust-anchor-file
1003 then it will now behave different than before. Also, 5011 rollover
1004 for algorithms needs to be double-signature until the old algorithm
1006 It is not an option, because I see no use to turn the security off.
1007 - iana portlist updated.
1009 17 December 2010: Wouter
1010 - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them).
1011 - fix validation in this case: CNAME to nodata for co-hosted opt-in
1012 NSEC3 insecure delegation, was bogus, fixed to be insecure.
1014 16 December 2010: Wouter
1015 - Fix our 'BDS' license (typo reported by Xavier Belanger).
1017 10 December 2010: Wouter
1018 - iana portlist updated.
1019 - review changes for unbound-anchor.
1021 2 December 2010: Wouter
1022 - feature typetransparent localzone, does not block other RR types.
1024 1 December 2010: Wouter
1025 - Fix bug#338: print address when socket creation fails.
1027 30 November 2010: Wouter
1028 - Fix storage of EDNS failures in the infra cache.
1029 - iana portlist updated.
1031 18 November 2010: Wouter
1032 - harden-below-nxdomain option, default off (because very old
1033 software may be incompatible). We could enable it by default in
1036 17 November 2010: Wouter
1037 - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
1038 - make test output nicer.
1040 15 November 2010: Wouter
1041 - silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
1042 - iana portlist updated.
1043 - so-sndbuf option for very busy servers, a bit like so-rcvbuf.
1045 9 November 2010: Wouter
1046 - unbound-anchor compiles with openssl 0.9.7.
1048 8 November 2010: Wouter
1049 - release tag 1.4.7.
1050 - trunk is version 1.4.8.
1051 - Be lenient and accept imgw.pl malformed packet (like BIND).
1053 5 November 2010: Wouter
1054 - do not synthesize a CNAME message from cache for qtype DS.
1056 4 November 2010: Wouter
1057 - Use central entropy to seed threads.
1059 3 November 2010: Wouter
1060 - Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
1062 2 November 2010: Wouter
1066 1 November 2010: Wouter
1067 - GOST code enabled by default (RFC 5933).
1069 27 October 2010: Wouter
1070 - Fix uninit value in dump_infra print.
1071 - Fix validation failure for parent and child on same server with an
1072 insecure childzone and a CNAME from parent to child.
1073 - Configure detects libev-4.00.
1075 26 October 2010: Wouter
1076 - dump_infra and flush_infra commands for unbound-control.
1077 - no timeout backoff if meanwhile a query succeeded.
1078 - Change of timeout code. No more lost and backoff in blockage.
1079 At 12sec timeout (and at least 2x lost before) one probe per IP
1080 is allowed only. At 120sec, the IP is blocked. After 15min, a
1081 120sec entry has a single retry packet.
1083 25 October 2010: Wouter
1084 - Configure errors if ldns is not found.
1086 22 October 2010: Wouter
1087 - Windows 7 fix for the installer.
1089 21 October 2010: Wouter
1090 - Fix bug where fallback_tcp causes wrong roundtrip and edns
1091 observation to be noted in cache. Fix bug where EDNSprobe halted
1092 exponential backoff if EDNS status unknown.
1093 - new unresponsive host method, exponentially increasing block backoff.
1094 - iana portlist updated.
1096 20 October 2010: Wouter
1097 - interface automatic works for some people with ip6 disabled.
1098 Therefore the error check is removed, so they can use the option.
1100 19 October 2010: Wouter
1101 - Fix for request list growth, if a server has long timeout but the
1102 lost counter is low, then its effective rtt is the one without
1103 exponential backoff applied. Because the backoff is not working.
1104 The lost counter can then increase and the server is blacklisted,
1105 or the lost counter does not increase and the server is working
1108 18 October 2010: Wouter
1109 - iana portlist updated.
1111 13 October 2010: Wouter
1112 - Fix TCP so it uses a random outgoing-interface.
1113 - unbound-anchor handles ADDPEND keystate.
1115 11 October 2010: Wouter
1116 - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where
1117 the zone has a secure delegation hosted on the same server did not
1118 verify as secure (it was insecure by mistake).
1119 - iana portlist updated.
1120 - ldns tarball updated (for reading cachedumps with bad RR data).
1122 1 October 2010: Wouter
1123 - test for unbound-anchor. fix for reading certs.
1124 - Fix alloc_reg_release for longer uptime in out of memory conditions.
1126 28 September 2010: Wouter
1127 - unbound-anchor working, it creates or updates a root.key file.
1128 Use it before you start the validator (e.g. at system boot time).
1130 27 September 2010: Wouter
1131 - iana portlist updated.
1133 24 September 2010: Wouter
1134 - bug#329: in example.conf show correct ipv4 link-local 169.254/16.
1136 23 September 2010: Wouter
1137 - unbound-anchor app, unbound requires libexpat (xml parser library).
1139 22 September 2010: Wouter
1140 - compliance with draft-ietf-dnsop-default-local-zones-14, removed
1141 reverse ipv6 orchid prefix from builtin list.
1142 - iana portlist updated.
1144 17 September 2010: Wouter
1145 - DLV has downgrade protection again, because the RFC says so.
1146 - iana portlist updated.
1148 16 September 2010: Wouter
1149 - Algorithm rollover operational reality intrudes, for trust-anchor,
1150 5011-store, and DLV-anchor if one key matches it's good enough.
1151 - iana portlist updated.
1152 - Fix reported validation error in out of memory condition.
1154 15 September 2010: Wouter
1155 - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
1157 14 September 2010: Wouter
1158 - increased mesh-max-activation from 1000 to 3000 for crazy domains
1159 like _tcp.slb.com with 262 servers.
1160 - iana portlist updated.
1162 13 September 2010: Wouter
1163 - bug#327: Fix for cannot access stub zones until the root is primed.
1165 9 September 2010: Wouter
1166 - unresponsive servers are not completely blacklisted (because of
1167 firewalls), but also not probed all the time (because of the request
1168 list size it generates). The probe rate is 1%.
1169 - iana portlist updated.
1171 20 August 2010: Wouter
1172 - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
1173 iterator get_mem includes priv_get_mem. delegpt nodup removed.
1174 listen_pushback, query_info_allocqname, write_socket, send_packet,
1175 comm_point_set_cb_arg and listen_resume removed.
1177 19 August 2010: Wouter
1178 - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20.
1179 Delegpt structures checked for duplicates always.
1180 No more nameserver lookups generated when depth is full anyway.
1181 - example.conf notes how to do DNSSEC validation and track the root.
1182 - iana portlist updated.
1184 18 August 2010: Wouter
1185 - Fix bug#322: configure does not respect CFLAGS on Solaris.
1186 Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line
1187 if use sun-cc, but some systems need different flags.
1189 16 August 2010: Wouter
1190 - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP
1191 changes, uses m4_bpatsubst now.
1192 - make test (or make check) should be more portable and run the unit
1193 test and testbound scripts. (make longtest has special requirements).
1195 13 August 2010: Wouter
1196 - More pleasant remote control command parsing.
1197 - documentation added for return values reported by doxygen 1.7.1.
1198 - iana portlist updated.
1200 9 August 2010: Wouter
1201 - Fix name of rrset printed that failed validation.
1203 5 August 2010: Wouter
1204 - Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
1206 4 August 2010: Wouter
1207 - Fix validation in case a trust anchor enters into a zone with
1208 unsupported algorithms.
1210 3 August 2010: Wouter
1211 - updated ldns tarball with bugfixes.
1212 - release tag 1.4.6.
1213 - trunk becomes 1.4.7 develop.
1214 - iana portlist updated.
1216 22 July 2010: Wouter
1217 - more error details on failed remote control connection.
1219 15 July 2010: Wouter
1220 - rlimit adjustments for select and ulimit can happen at the same time.
1222 14 July 2010: Wouter
1223 - Donation text added to README.
1224 - Fix integer underflow in prefetch ttl creation from cache. This
1225 fixes a potential negative prefetch ttl.
1227 12 July 2010: Wouter
1228 - Changed the defaults for num-queries-per-thread/outgoing-range.
1229 For builtin-select: 512/960, for libevent 1024/4096 and for
1230 windows 24/48 (because of win api). This makes the ratio this way
1231 to improve resilience under heavy load. For high performance, use
1232 libevent and possibly higher numbers.
1234 10 July 2010: Wouter
1235 - GOST enabled if SSL is recent and ldns has GOST enabled too.
1236 - ldns tarball updated.
1239 - iana portlist updated.
1240 - Fix validation of qtype DNSKEY when a key-cache entry exists but
1241 no rr-cache entry is used (it expired or prefetch), it then goes
1242 back up to the DS or trust-anchor to validate the DNSKEY.
1245 - Neat function prototypes, unshadowed local declarations.
1248 - failure to chown the pidfile is not fatal any more.
1249 - testbound uses UTC timezone.
1250 - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add
1251 /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake.
1254 - log if a server is skipped because it is on the donotquery list,
1255 at verbosity 4, to enable diagnosis why no queries to 127.0.0.1.
1256 - added feature to print configure date, target and options with -h.
1257 - added feature to print event backend system details with -h.
1258 - wdiff is not actually required by make test, updated requirements.
1261 - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex
1262 must be signed with all algorithms from the DS rrset at the parent.
1263 This is now checked and becomes bogus if not.
1265 28 June 2010: Wouter
1266 - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps
1267 in overload situations to be about 5 qps for the class of shortly
1269 The capacity of the resolver is then about (numqueriesperthread / 2)
1270 / (average time for such long queries) qps for long queries.
1271 And about (numqueriesperthread / 2)/(jostletimeout in whole seconds)
1272 qps for short queries, per thread.
1273 - Fix the max number of reply-address count to be applied for duplicate
1274 queries, and not for new query list entries. This raises the memory
1275 usage to a max of (16+1)*numqueriesperthread reply addresses.
1277 25 June 2010: Wouter
1278 - Fix handling of corner case reply from lame server, follows rfc2308.
1279 It could lead to a nodata reply getting into the cache if the search
1280 for a non-lame server turned up other misconfigured servers.
1281 - unbound.h has extern "C" statement for easier include in c++.
1283 23 June 2010: Wouter
1284 - iana portlist updated.
1285 - makedist upgraded cross compile openssl option, like this:
1286 ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost
1288 22 June 2010: Wouter
1289 - Unbound reports libev or libevent correctly in logs in verbose mode.
1290 - Fix to unload gost dynamic library module for leak testing.
1292 18 June 2010: Wouter
1293 - iana portlist updated.
1295 17 June 2010: Wouter
1296 - Add AAAA to root hints for I.ROOT-SERVERS.NET.
1298 16 June 2010: Wouter
1299 - Fix assertion failure reported by Kai Storbeck from XS4ALL, the
1300 assertion was wrong.
1301 - updated ldns tarball.
1303 15 June 2010: Wouter
1304 - tag 1.4.5 created.
1305 - trunk contains 1.4.6 in development.
1306 - Fix TCPreply on systems with no writev, if just 1 byte could be sent.
1307 - Fix to use one pointer less for iterator query state store_parent_NS.
1308 - makedist crosscompile to windows uses builtin ldns not host ldns.
1309 - Max referral count from 30 to 130, because 128 one character domains
1311 - added documentation for the histogram printout to syslog.
1313 11 June 2010: Wouter
1314 - When retry to parent the retrycount is not wiped, so failed
1315 nameservers are not tried again.
1316 - iana portlist updated.
1318 10 June 2010: Wouter
1319 - Fix bug where a long loop could be entered, now cycle detection
1320 has a loop-counter and maximum search amount.
1323 - iana portlist updated.
1324 - 1.4.5rc1 tag created.
1327 - ldns tarball updated, 1.6.5.
1328 - review comments, split dependency cycle tracking for parentside
1329 last resort lookups for A and AAAA so there are more lookup options.
1332 - Fix compile warning if compiled without threads.
1333 - updated ldns-tarball with current ldns svn (pre 1.6.5).
1334 - GOST disabled-by-default, the algorithm number is allocated but the
1335 RFC is still has to pass AUTH48 at the IETF.
1338 - Ignore Z flag in incoming messages too.
1339 - Fix storage of negative parent glue if that last resort fails.
1340 - libtoolize 2.2.6b, autoconf 2.65 applied to configure.
1341 - new splint flags for newer splint install.
1344 - Fix AD flag handling, it could in some cases mistakenly copy the AD
1345 flag from upstream servers.
1346 - alloc_special_obtain out of memory is not a fatal error any more,
1347 enabling unbound to continue longer in out of memory conditions.
1348 - parentside names are dispreferred but not said to be dnssec-lame.
1349 - parentside check for cached newname glue.
1350 - fix parentside and querytargets modulestate, for dump_requestlist.
1351 - unbound-control-setup makes keys -rw-r--- so not all users permitted.
1352 - fix parentside from cache to be marked dispreferred for bad names.
1355 - iana portlist updated.
1356 - parent-child disagreement approach altered. Older fixes are
1357 removed in place of a more exhaustive search for misconfigured data
1358 available via the parent of a delegation.
1359 This is designed to be throttled by cache entries, with TTL from the
1360 parent if possible. Additionally the loop-counter is used.
1361 It also tests for NS RRset differences between parent and child.
1362 The fetch of misconfigured data should be more reliable and thorough.
1363 It should work reliably even with no or only partial data in cache.
1364 Data received from the child (as always) is deemed more
1365 authoritative than information received from the delegation parent.
1366 The search for misconfigured data is not performed normally.
1369 - Contribution from Migiel de Vos (Surfnet): nagios patch for
1370 unbound-host, in contrib/ (in the source tarball). Makes
1371 unbound-host suitable for monitoring dnssec(-chain) status.
1374 - EDNS timeout code will not fire if EDNS status already known.
1375 - EDNS failure not stored if EDNS status known to work.
1378 - Fix resolution for domains like safesvc.com.cn. If the iterator
1379 can not recurse further and it finds the delegation in a state
1380 where it would otherwise have rejected it outhand if so received
1381 from a cache lookup, then it can try to ask higherup (with loop
1383 - Fix comments in iter_utils:dp_is_useless.
1386 - Fix various compiler warnings from the clang llvm compiler.
1387 - iana portlist updated.
1390 - Fix bug#308: spelling error in variable name in parser and lexer.
1393 - Fix dnssec-missing detection that was turned off by server selection.
1394 - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default
1395 reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa,
1396 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa.
1398 29 April 2010: Wouter
1399 - Fix for dnssec lameness detection to use the key cache.
1400 - infra cache entries that are expired are wiped clean. Previously
1401 it was possible to not expire host data (if accessed often).
1403 28 April 2010: Wouter
1404 - ldns tarball updated and GOST support is detected and then enabled.
1405 - iana portlist updated.
1406 - Fix detection of gost support in ldns (reported by Chris Smith).
1408 27 April 2010: Wouter
1409 - unbound-control get_option domain-insecure shows config file items.
1410 - fix retry sequence if prime hints are recursion-lame.
1411 - autotrust anchor file can be initialized with a ZSK key as well.
1412 - harden-referral-path does not result in failures due to max-depth.
1413 You can increase the max-depth by adding numbers (' 0') after the
1414 target-fetch-policy, this increases the depth to which is checked.
1416 26 April 2010: Wouter
1417 - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use
1418 CPPFLAGS during configure process.
1419 - if libev is installed on the base system (not libevent), detect
1420 it from the event.h header file and link with -lev.
1421 - configlexer.lex gets config.h, and configyyrename.h added by make,
1422 no more double include.
1423 - More strict scrubber (Thanks to George Barwood for the idea):
1424 NS set must be pertinent to the query (qname subdomain nsname).
1425 - Fix bug#307: In 0x20 backoff fix fallback so the number of
1426 outstanding queries does not become -1 and block the request.
1427 Fixed handling of recursion-lame in combination with 0x20 fallback.
1428 Fix so RRsets are compared canonicalized and sorted if the immediate
1429 comparison fails, this makes it work around round-robin sites.
1431 23 April 2010: Wouter
1432 - Squelch log message: sendto failed permission denied for
1433 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2).
1434 - Fix to fetch data as last resort more tenaciously. When cycle
1435 targets cause the server selection to believe there are more options
1436 when they really are not there, the server selection is reinitiated.
1437 - Fix fetch from blacklisted dnssec lame servers as last resort. The
1438 server's IP address is then given in validator errors as well.
1439 - Fix local-zone type redirect that did not use the query name for
1442 22 April 2010: Wouter
1444 - trunk contains 1.4.5 in development.
1445 - Fix validation failure for qtype ANY caused by a RRSIG parse failure.
1446 The validator error message was 'no signatures from ...'.
1448 16 April 2010: Wouter
1449 - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
1452 15 April 2010: Wouter
1453 - ECC-GOST algorithm number 12 that is assigned by IANA. New test
1454 example key and signatures for GOST. GOST requires openssl-1.0.0.
1455 GOST is still disabled by default.
1457 9 April 2010: Wouter
1458 - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
1459 get into an endless loop, if 0x20 was enabled, and buffers are small
1460 or particular broken packets are received.
1461 - Fix chain of trust with CNAME at an intermediate step, for the DS
1464 8 April 2010: Wouter
1465 - Fix validation of queries with wildcard names (*.example).
1467 6 April 2010: Wouter
1468 - Fix EDNS probe for .de DNSSEC testbed failure, where the infra
1469 cache timeout coincided with a server update, the current EDNS
1470 backoff is less sensitive, and does not cache the backoff unless
1471 the backoff actually works and the domain is not expecting DNSSEC.
1472 - GOST support with correct algorithm numbers.
1474 1 April 2010: Wouter
1475 - iana portlist updated.
1477 24 March 2010: Wouter
1478 - unbound control flushed items are not counted when flushed again.
1480 23 March 2010: Wouter
1481 - iana portlist updated.
1483 22 March 2010: Wouter
1484 - unbound-host disables use-syslog from config file so that the
1485 config file for the main server can be used more easily.
1486 - fix bug#301: unbound-checkconf could not parse interface
1487 '0.0.0.0@5353', even though unbound itself worked fine.
1489 19 March 2010: Wouter
1490 - fix fwd_ancil test to pass if the socket options are not supported.
1492 18 March 2010: Wouter
1493 - Fixed random numbers for port, interface and server selection.
1494 Removed very small bias.
1495 - Refer to the listing in unbound-control man page in the extended
1496 statistics entry in the unbound.conf man page.
1498 16 March 2010: Wouter
1499 - Fix interface-automatic for OpenBSD: msg.controllen was too small,
1500 also assertions on ancillary data buffer.
1501 - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
1502 - for NSEC3 check if signatures are cached.
1504 15 March 2010: Wouter
1505 - unit test for util/regional.c.
1507 12 March 2010: Wouter
1508 - Reordered configure checks so fork and -lnsl -lsocket checks are
1509 earlier, and thus later checks benefit from and do not hinder them.
1510 - iana portlist updated.
1511 - ldns tarball updated.
1512 - Fix python use when multithreaded.
1513 - Fix solaris python compile.
1514 - Include less in config.h and include per code file for ldns, ssl.
1516 11 March 2010: Wouter
1517 - another memory allocation option: --enable-alloc-nonregional.
1518 exposes the regional allocations to other memory purifiers.
1519 - fix for memory alignment in struct sock_list allocation.
1520 - Fix for MacPorts ldns without ssl default, unbound checks if ldns
1521 has dnssec functionality and uses the builtin if not.
1522 - Fix daemonize on Solaris 10, it did not detach from terminal.
1523 - tag 1.4.3 created.
1524 - trunk is 1.4.4 in development.
1525 - spelling fix in validation error involving cnames.
1527 10 March 2010: Wouter
1528 - --enable-alloc-lite works with test set.
1529 - portability in the testset: printf format conversions, prototypes.
1531 9 March 2010: Wouter
1532 - tag 1.4.2 created.
1533 - trunk is 1.4.3 in development.
1534 - --enable-alloc-lite debug option.
1536 8 March 2010: Wouter
1537 - iana portlist updated.
1539 4 March 2010: Wouter
1540 - Fix crash in control channel code.
1542 3 March 2010: Wouter
1543 - better casts in pipe code, brackets placed wrongly.
1544 - iana portlist updated.
1546 1 March 2010: Wouter
1547 - make install depends on make all.
1548 - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs.
1549 - --enable-checking: enables assertions but does not look nonproduction.
1550 - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with
1551 nxdomain and nodata distinguished.
1552 - ldns tarball updated.
1553 - --disable-rpath fixed for libtool not found errors.
1554 - new fedora specfile from Fedora13 in contrib from Paul Wouters.
1556 26 February 2010: Wouter
1557 - Fixup prototype for lexer cleanup in daemon code.
1558 - unbound-control list_stubs, list_forwards, list_local_zones and
1561 24 February 2010: Wouter
1562 - Fix scrubber bug that potentially let NS records through. Reported
1564 - Also delete potential poison references from additional.
1565 - Fix: no classification of a forwarder as lame, throw away instead.
1567 23 February 2010: Wouter
1568 - libunbound ub_ctx_get_option() added.
1569 - unbound-control set_option and get_option commands.
1570 - iana portlist updated.
1572 18 February 2010: Wouter
1573 - A little more strict DS scrubbing.
1574 - No more blacklisting of unresponsive servers, a 2 minute timeout
1576 - RD flag not enabled for dnssec-blacklisted tries, unless necessary.
1577 - pickup ldns compile fix, libdl for libcrypto.
1578 - log 'tcp connect: connection timed out' only in high verbosity.
1579 - unbound-control log_reopen command.
1580 - moved get_option code from unbound-checkconf to util/config_file.c
1582 17 February 2010: Wouter
1583 - Disregard DNSKEY from authority section for chain of trust.
1584 DS records that are irrelevant to a referral scrubbed. Anti-poison.
1585 - iana portlist updated.
1587 16 February 2010: Wouter
1588 - Check for 'no space left on device' (or other errors) when
1589 writing updated autotrust anchors and print errno to log.
1591 15 February 2010: Wouter
1592 - Fixed the requery protection, the TTL was 0, it is now 900 seconds,
1593 hardcoded. We made the choice to send out more conservatively,
1594 protecting against an aggregate effect more than protecting a
1595 single user (from their own folly, perhaps in case of misconfig).
1597 12 February 2010: Wouter
1598 - Re-query pattern changed on validation failure. To protect troubled
1599 authority servers, unbound caches a failure for the DNSKEY or DS
1600 records for the entire zone, and only retries that 900 seconds later.
1601 This implies that only a handful of packets are sent extra to the
1602 authority if the zone fails.
1604 11 February 2010: Wouter
1605 - ldns tarball update for long label length syntax error fix.
1606 - iana portlist updated.
1608 9 February 2010: Wouter
1609 - Fixup in compat snprintf routine, %f 1.02 and %g support.
1610 - include math.h for testbound test compile portability.
1612 2 February 2010: Wouter
1613 - Updated url of IANA itar, interim trust anchor repository, in script.
1615 1 February 2010: Wouter
1616 - iana portlist updated.
1617 - configure test for memcmp portability.
1619 27 January 2010: Wouter
1620 - removed warning on format string in validator error log statement.
1621 - iana portlist updated.
1623 22 January 2010: Wouter
1624 - libtool finish the install of unbound python dynamic library.
1626 21 January 2010: Wouter
1627 - acx_nlnetlabs.m4 synchronised with nsd's version.
1629 20 January 2010: Wouter
1630 - Fixup lookup trouble for parent-child domains on the first query.
1632 14 January 2010: Wouter
1633 - Fixup ldns detection to also check for header files.
1635 13 January 2010: Wouter
1636 - prefetch-key option that performs DNSKEY queries earlier in the
1637 validation process, and that could halve the latency on DNSSEC
1638 queries. It takes some extra processing (CPU, a cache is needed).
1640 12 January 2010: Wouter
1641 - Fix unbound-checkconf for auto-trust-anchor-file present checks.
1643 8 January 2010: Wouter
1644 - Fix for parent-child disagreement code which could have trouble
1645 when (a) ipv6 was disabled and (b) the TTL for parent and child
1646 were different. There were two bugs, the parent-side information
1647 is fixed to no longer block lookup of child side information and
1648 the iterator is fixed to no longer attempt to get ipv6 when it is
1649 not enabled and then give up in failure.
1650 - test and fixes to make prefetch actually store the answer in the
1651 cache. Considers some rrsets 'already expired' but does not allow
1652 overwriting of rrsets considered more secure.
1654 7 January 2010: Wouter
1655 - Fixup python documentation (thanks Leo Vandewoestijne).
1656 - Work on cache prefetch feature.
1657 - Stats for prefetch, in log print stats, unbound-control stats
1658 and in unbound_munin plugin.
1660 6 January 2010: Wouter
1661 - iana portlist updated.
1662 - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length.
1663 - verbose output includes parent-side-address notion for lameness.
1664 - documented val-log-level: 2 setting in example.conf and man page.
1665 - change unbound-control-setup from 1024(sha1) to 1536(sha256).
1667 1 January 2010: Wouter
1668 - iana portlist updated.
1670 22 December 2009: Wouter
1671 - configure with newer libtool 2.2.6b.
1673 17 December 2009: Wouter
1676 - trunk to version 1.4.2.
1678 15 December 2009: Wouter
1679 - Answer to qclass=ANY queries, with class IN contents.
1680 Test that validation also works.
1681 - updated ldns snapshot tarball with latest fixes (parsing records).
1683 11 December 2009: Wouter
1684 - on IPv4 UDP turn off DF flag.
1686 10 December 2009: Wouter
1687 - requirements.txt updated with design choice explanations.
1688 - Reading fixes: fix to set unlame when child confirms parent glue,
1689 and fix to avoid duplicate addresses in delegation point.
1690 - verify_rrsig routine checks expiration last.
1692 9 December 2009: Wouter
1693 - Fix Bug#287(reopened): update of ldns tarball with fix for parse
1694 errors generated for domain names like '.example.com'.
1695 - Fix SOA excluded from negative DS responses. Reported by Hauke
1696 Lampe. The negative cache did not include proper SOA records for
1697 negative qtype DS responses which makes BIND barf on it, such
1698 responses are now only used internally.
1699 - Fix negative cache lookup of closestencloser check of DS type bit.
1701 8 December 2009: Wouter
1702 - Fix for lookup of parent-child disagreement domains, where the
1703 parent-side glue works but it does not provide proper NS, A or AAAA
1704 for itself, fixing domains such as motorcaravanners.eu.
1705 - Feature: you can specify a port number in the interface: line, so
1706 you can bind the same interface multiple times at different ports.
1708 7 December 2009: Wouter
1709 - Bug#287: Fix segfault when unbound-control remove nonexistent local
1710 data. Added check to tests.
1712 1 December 2009: Wouter
1713 - Fix crash with module-config "iterator".
1714 - Added unit test that has "iterator" module-config.
1716 30 November 2009: Wouter
1717 - bug#284: fix parse of # without end-of-line at end-of-file.
1719 26 November 2009: Wouter
1720 - updated ldns with release candidate for version 1.6.3.
1721 - tag for 1.4.0 release.
1722 - 1.4.1 version in trunk.
1723 - Fixup major libtool version to 2 because of why_bogus change.
1724 It was 1:5:0 but should have been 2:0:0.
1726 23 November 2009: Wouter
1727 - Patch from David Hubbard for libunbound manual page.
1728 - Fixup endless spinning in unbound-control stats reported by
1729 Attila Nagy. Probably caused by clock reversal.
1731 20 November 2009: Wouter
1732 - contrib/split-itar.sh contributed by Tom Hendrikx.
1734 19 November 2009: Wouter
1735 - better argument help for unbound-control.
1736 - iana portlist updated.
1738 17 November 2009: Wouter
1739 - noted multiple entries for multiple domain names in example.conf.
1740 - iana portlist updated.
1742 16 November 2009: Wouter
1743 - Fixed signer detection of CNAME responses without signatures.
1744 - Fix#282 libunbound memleak on error condition by Eric Sesterhenn.
1745 - Tests for CNAMEs to deeper trust anchors, secure and bogus.
1746 - svn tag 1.4.0rc1 made.
1748 13 November 2009: Wouter
1749 - Fixed validation failure for CNAME to optout NSEC3 nodata answer.
1750 - unbound-host does not fail on type ANY.
1751 - Fixed wireparse failure to put RRSIGs together with data in some
1752 long ANY mix cases, which fixes validation failures.
1754 12 November 2009: Wouter
1755 - iana portlist updated.
1756 - fix manpage errors reported by debian lintian.
1758 - fixup very long vallog2 level error strings.
1760 11 November 2009: Wouter
1761 - ldns tarball updated (to 1.6.2).
1764 10 November 2009: Wouter
1765 - Thanks to Surfnet found bug in new dnssec-retry code that failed
1766 to combine well when combined with DLV and a particular failure.
1767 - Fixed unbound-control -h output about argument optionality.
1770 5 November 2009: Wouter
1771 - lint fixes and portability tests.
1772 - better error text for multiple domain keys in one autotrust file.
1774 2 November 2009: Wouter
1775 - Fix bug where autotrust does not work when started with a DS.
1776 - Updated GOST unit tests for unofficial algorithm number 249
1777 and DNSKEY-format changes in draft version -01.
1779 29 October 2009: Wouter
1780 - iana portlist updated.
1781 - edns-buffer-size option, default 4096.
1784 28 October 2009: Wouter
1785 - removed abort on prealloc failure, error still printed but softfail.
1786 - iana portlist updated.
1787 - RFC 5702: RSASHA256 and RSASHA512 support enabled by default.
1788 - ldns tarball updated (which also enables rsasha256 support).
1790 27 October 2009: Wouter
1791 - iana portlist updated.
1793 8 October 2009: Wouter
1795 - add val-log-level print to corner case (nameserver.epost.bg).
1796 - more detail to errors from insecure delegation checks.
1797 - Fix double time subtraction in negative cache reported by
1798 Amanda Constant and Hugh Mahon.
1799 - Made new validator error string available from libunbound for
1800 applications. It is in result->why_bogus, a zero-terminated string.
1801 unbound-host prints it by default if a result is bogus.
1802 Also the errinf is public in module_qstate (for other modules).
1804 7 October 2009: Wouter
1805 - retry for validation failure in DS and prime results. Less mem use.
1806 unit test. Provisioning in other tests for requeries.
1807 - retry for validation failure in DNSKEY in middle of chain of trust.
1809 - retry for empty non terminals in chain of trust and unit test.
1810 - Fixed security bug where the signatures for NSEC3 records were not
1811 checked when checking for absence of DS records. This could have
1812 enabled the substitution of an insecure delegation.
1813 - moved version number to 1.4.0 because of 1.3.4 release with only
1814 the NSEC3 patch from the entry above.
1815 - val-log-level: 2 shows extended error information for validation
1816 failures, but still one (longish) line per failure. For example:
1817 validation failure <example.com. DNSKEY IN>: signature expired from
1818 192.0.2.4 for trust anchor example.com. while building chain of trust
1819 validation failure <www.example.com. A IN>: no signatures from
1820 192.0.2.6 for key example.com. while building chain of trust
1822 6 October 2009: Wouter
1823 - Test set updated to provide additional ns lookup result.
1824 The retry would attempt to fetch the data from other nameservers
1825 for bogus data, and this needed to be provisioned in the tests.
1827 5 October 2009: Wouter
1828 - first validation failure retry code. Retries for data failures.
1831 2 October 2009: Wouter
1832 - improve 5011 modularization.
1833 - fix unbound-host so -d can be given before -C.
1834 - iana portlist updated.
1836 28 September 2009: Wouter
1837 - autotrust-anchor-file can read multiline input and $ORIGIN.
1838 - prevent integer overflow in holddown calculation. review fixes.
1839 - fixed race condition in trust point revocation. review fix.
1840 - review fixes to comments, removed unused code.
1842 25 September 2009: Wouter
1843 - so-rcvbuf: 4m option added. Set this on large busy servers to not
1844 drop the occasional packet in spikes due to full socket buffers.
1845 netstat -su keeps a counter of UDP dropped due to full buffers.
1846 - review of validator/autotrust.c, small fixes and comments.
1848 23 September 2009: Wouter
1849 - 5011 query failed counts verification failures, not lookup failures.
1850 - 5011 probe failure handling fixup.
1851 - test unbound reading of original autotrust data.
1852 The metadata per-key, such as key state (PENDING, MISSING, VALID) is
1853 picked up, otherwise performs initial probe like usual.
1855 22 September 2009: Wouter
1856 - autotrust test with algorithm rollover, new ordering of checks
1857 assists in orderly rollover.
1858 - autotrust test with algorithm rollover to unknown algorithm.
1859 checks if new keys are supported before adding them.
1860 - autotrust test with trust point revocation, becomes unsigned.
1861 - fix DNSSEC-missing-signature detection for minimal responses
1862 for qtype DNSKEY (assumes DNSKEY occurs at zone apex).
1864 18 September 2009: Wouter
1865 - autotrust tests, fix trustpoint timer deletion code.
1866 fix count of valid anchors during missing remove.
1867 - autotrust: pick up REVOKE even if not signed with known other keys.
1869 17 September 2009: Wouter
1870 - fix compile of unbound-host when --enable-alloc-checks.
1871 - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis.
1872 - Manual page fixes reported by Tony Finch.
1874 16 September 2009: Wouter
1875 - Fix memory leak reported by Tao Ma.
1876 - Fix memstats test tool for log-time-ascii log format.
1878 15 September 2009: Wouter
1879 - iana portlist updated.
1881 10 September 2009: Wouter
1882 - increased MAXSYSLOGLEN so .bg key can be printed in debug output.
1883 - use linebuffering for log-file: output, this can be significantly
1884 faster than the previous fflush method and enable some class of
1885 resolvers to use high verbosity (for short periods).
1886 Not on windows, because line buffering does not work there.
1888 9 September 2009: Wouter
1889 - Fix bug where DNSSEC-bogus messages were marked with too high TTL.
1890 The RRsets would still expire at the normal time, but this would
1891 keep messages bogus in the cache for too long.
1892 - regression test for that bug.
1893 - documented that load_cache is meant for debugging.
1895 8 September 2009: Wouter
1896 - fixup printing errors when load_cache, they were printed to the
1897 SSL connection which broke, now to the log.
1898 - new ldns - with fixed parse of large SOA values.
1900 7 September 2009: Wouter
1901 - autotrust testbound scenarios.
1902 - autotrust fix that failure count is written to file.
1903 - autotrust fix that keys may become valid after add holddown time
1904 alone, before the probe returns.
1906 4 September 2009: Wouter
1907 - Changes to make unbound work with libevent-2.0.3 alpha. (in
1908 configure detection due to new ssl dependency in libevent)
1909 - do not call sphinx for documentation when python is disabled.
1910 - remove EV_PERSIST from libevent timeout code to make the code
1911 compatible with the libevent-2.0. Works with older libevent too.
1912 - fix memory leak in python code.
1914 3 September 2009: Wouter
1915 - Got a patch from Luca Bruno for libunbound support on windows to
1916 pick up the system resolvconf nameservers and hosts there.
1917 - included ldns updated (enum warning fixed).
1918 - makefile fix for parallel makes.
1919 - Patch from Zdenek Vasicek and Attila Nagy for using the source IP
1920 from python scripts. See pythonmod/examples/resip.py.
1921 - doxygen comment fixes.
1923 2 September 2009: Wouter
1924 - TRAFFIC keyword for testbound. Simplifies test generation.
1925 ${range lower val upper} to check probe timeout values.
1926 - test with 5011-prepublish rollover and revocation.
1927 - fix revocation of RR for autotrust, stray exclamation mark.
1929 1 September 2009: Wouter
1930 - testbound variable arithmetic.
1931 - autotrust probe time is randomised.
1932 - autotrust: the probe is active and does not fetch from cache.
1934 31 August 2009: Wouter
1935 - testbound variable processing.
1937 28 August 2009: Wouter
1938 - fixup unbound-control lookup to print forward and stub servers.
1940 27 August 2009: Wouter
1941 - autotrust: mesh answer callback is empty.
1943 26 August 2009: Wouter
1944 - autotrust probing.
1945 - iana portlist updated.
1947 25 August 2009: Wouter
1948 - fixup memleak in trust anchor unsupported algorithm check.
1949 - iana portlist updated.
1950 - autotrust options: add-holddown, del-holddown, keep-missing.
1951 - autotrust store revoked status of trust points.
1952 - ctime_r compat definition.
1953 - detect yylex_destroy() in configure.
1954 - detect SSL_get_compression_methods declaration in configure.
1955 - fixup DS lookup at anchor point with unsigned parent.
1956 - fixup DLV lookup for DS queries to unsigned domains.
1958 24 August 2009: Wouter
1959 - cleaner memory allocation on exit. autotrust test routines.
1960 - free all memory on program exit, fix for ssl and flex.
1962 21 August 2009: Wouter
1963 - autotrust: debug routines. Read,write and conversions work.
1965 20 August 2009: Wouter
1966 - autotrust: save and read trustpoint variables.
1968 19 August 2009: Wouter
1969 - autotrust: state table updates.
1970 - iana portlist updated.
1972 17 August 2009: Wouter
1973 - autotrust: process events.
1975 17 August 2009: Wouter
1976 - Fix so that servers are only blacklisted if they fail to reply
1977 to 16 queries in a row and the timeout gets above 2 minutes.
1978 - autotrust work, split up DS verification of DNSKEYs.
1980 14 August 2009: Wouter
1981 - unbound-control lookup prints out infra cache information, like RTT.
1982 - Fix bug in DLV lookup reported by Amanda from Secure64.
1983 It could sometimes wrongly classify a domain as unsigned, which
1984 does not give the AD bit on replies.
1986 13 August 2009: Wouter
1987 - autotrust read anchor files. locked trust anchors.
1989 12 August 2009: Wouter
1990 - autotrust import work.
1992 11 August 2009: Wouter
1993 - Check for openssl compatible with gost if enabled.
1994 - updated unit test for GOST=211 code.
1995 Nicer naming of test files.
1996 - iana portlist updated.
1998 7 August 2009: Wouter
1999 - call OPENSSL_config() in unbound and unit test so that the
2000 operator can use openssl.cnf for configuration options.
2001 - removed small memory leak from config file reader.
2003 6 August 2009: Wouter
2004 - configure --enable-gost for GOST support, experimental
2005 implementation of draft-dolmatov-dnsext-dnssec-gost-01.
2006 - iana portlist updated.
2007 - ldns tarball updated (with GOST support).
2009 5 August 2009: Wouter
2010 - trunk moved to 1.3.4.
2012 4 August 2009: Wouter
2013 - Added test that the examples from draft rsasha256-14 verify.
2014 - iana portlist updated.
2017 3 August 2009: Wouter
2018 - nicer warning when algorithm not supported, tells you to upgrade.
2019 - iana portlist updated.
2021 27 July 2009: Wouter
2022 - Updated unbound-cacti contribution from Dmitriy Demidov, with
2023 the queue statistics displayed in its own graph.
2024 - iana portlist updated.
2026 22 July 2009: Wouter
2027 - Fix bug found by Michael Tokarev where unbound would try to
2028 prime the root servers even though forwarders are configured for
2032 21 July 2009: Wouter
2033 - Fix server selection, so that it waits for open target queries when
2034 faced with lameness.
2036 20 July 2009: Wouter
2037 - Ignore transient sendto errors, no route to host, and host, net down.
2038 - contrib/update-anchor.sh has -r option for root-hints.
2039 - feature val-log-level: 1 prints validation failures so you can
2040 keep track of them during dnssec deployment.
2042 16 July 2009: Wouter
2043 - fix replacement malloc code. Used in crosscompile.
2044 - makedist -w creates crosscompiled setup.exe on fedora11.
2046 15 July 2009: Wouter
2047 - dependencies for compat items, for crosscompile.
2048 - mingw32 crosscompile changes, dependencies and zipfile creation.
2049 and with System.dll from the windows NSIS you can make setup.exe.
2050 - package libgcc_s_sjlj exception handler for NSISdl.dll.
2052 14 July 2009: Wouter
2053 - updated ldns tarball for solaris x64 compile assistance.
2054 - no need to define RAND_MAX from config.h.
2055 - iana portlist updated.
2056 - configure changes and ldns update for mingw32 crosscompile.
2058 13 July 2009: Wouter
2059 - Fix for crash at start on windows.
2060 - tag for release 1.3.2.
2061 - trunk has version 1.3.3.
2062 - Fix for ID bits on windows to use all 16. RAND_MAX was not
2063 defined like you'd expect on mingw. Reported by Mees de Roo.
2066 - tag for release 1.3.1.
2067 - trunk has version 1.3.2.
2070 - iana portlist updated.
2073 - prettier error handling in SSL setup.
2074 - makedist.sh uname fix (same as ldns).
2075 - updated fedora spec file.
2078 - fixup linking when ldnsdir is "".
2080 30 June 2009: Wouter
2081 - more lenient truncation checks.
2083 29 June 2009: Wouter
2084 - ldns trunk r2959 imported as tarball, because of solaris cc compile
2085 support for c99. r2960 for better configure.
2086 - better wrongly_truncated check.
2087 - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to
2088 avoid dropped packets at routers.
2090 26 June 2009: Wouter
2091 - Fix EDNS fallback when EDNS works for short answers but long answers
2094 22 June 2009: Wouter
2095 - fixup iter priv strict aliasing while preserving size of sockaddr.
2096 - iana portlist updated. (one less port allocated, one more fraction
2097 of a bit for security!)
2098 - updated fedora specfile in contrib from Paul Wouters.
2100 19 June 2009: Wouter
2101 - Fixup strict aliasing warning in iter priv code.
2102 and config_file code.
2103 - iana portlist updated.
2104 - harden-referral-path: handle cases where NS is in answer section.
2106 18 June 2009: Wouter
2107 - Fix of message parse bug where (specifically) an NSEC and RRSIG
2108 in the wrong order would be parsed, but put wrongly into internal
2109 structures so that later validation would fail.
2110 - Extreme lenience for wrongly truncated replies where a positive
2111 reply has an NS in the authority but no signatures. They are
2112 turned into minimal responses with only the (secure) answer.
2113 - autoconf 2.63 for configure.
2114 - python warnings suppress. Keep python API away from header files.
2116 17 June 2009: Wouter
2117 - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was
2118 used for the python code in unbound. (http://www.nic.cz/vip/ in cz).
2120 16 June 2009: Wouter
2121 - Fixup opportunistic target query generation to it does not
2122 generate queries that are known to fail.
2123 - Touchup on munin total memory report.
2124 - messages picked out of the cache by the iterator are checked
2125 if their cname chain is still correct and if validation status
2126 has to be reexamined.
2128 15 June 2009: Wouter
2129 - iana portlist updated.
2131 14 June 2009: Wouter
2132 - Fixed bug where cached responses would lose their security
2133 status on second validation, which especially impacted dlv
2134 lookups. Reported by Hauke Lampe.
2136 13 June 2009: Wouter
2137 - bug #254. removed random whitespace from example.conf.
2139 12 June 2009: Wouter
2140 - Fixup potential wrong NSEC picked out of the cache.
2141 - If unfulfilled callbacks are deleted they are called with an error.
2142 - fptr wlist checks for mesh callbacks.
2143 - fwd above stub in configuration works.
2145 11 June 2009: Wouter
2146 - Fix queries for type DS when forward or stub zones are there.
2147 They are performed to higherup domains, and thus treated as if
2148 going to higher zones when looking up the right forward or stub
2149 server. This makes a stub pointing to a local server that has
2150 a local view of example.com signed with the same keys as are
2151 publicly used work. Reported by Johan Ihren.
2152 - Added build-unbound-localzone-from-hosts.pl to contrib, from
2153 Dennis DeDonatis. It converts /etc/hosts into config statements.
2154 - same thing fixed for forward-zone and DS, chain of trust from
2155 public internet into the forward-zone works now. Added unit test.
2158 - openssl key files are opened apache-style, when user is root and
2159 before chrooting. This makes permissions on remote-control key
2160 files easier to set up. Fixes bug #251.
2161 - flush_type and flush_name remove msg cache entries.
2162 - codereview - dp copy bogus setting fix.
2165 - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause
2166 inadvertant behaviour.
2167 - 1.3.0 tarball for release created.
2168 - 1.3.1 development in svn trunk.
2169 - iana portlist updated.
2170 - fix lint from complaining on ldns/sha.h.
2171 - help compiler figure out aliasing in priv_rrset_bad() routine.
2172 - fail to configure with python if swig is not found.
2173 - unbound_munin_ in contrib uses ps to show rss if sbrk does not work.
2176 - fixup bad free() when wrongly encoded DSA signature is seen.
2177 Reported by Paul Wouters.
2178 - review comments from Matthijs.
2181 - --enable-sha2 option. The draft rsasha256 changed its algorithm
2182 numbers too often. Therefore it is more prudent to disable the
2183 RSASHA256 and RSASHA512 support by default.
2184 - ldns trunk included as new tarball.
2185 - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point.
2188 - fixup doc bug in README reported by Matthew Dempsky.
2191 - update iana port list
2192 - update ldns lib tarball
2195 - detect lack of IPv6 support on XP (with a different error code).
2196 - Fixup a crash-on-exit which was triggered by a very long queue.
2197 Unbound would try to re-use ports that came free, but this is
2198 of course not really possible because everything is deleted.
2199 Most easily triggered on XP (not Vista), maybe because of the
2200 network stack encouraging large messages backlogs.
2201 - change in debug statements.
2202 - Fixed bug that could cause a crash if root prime failed when there
2203 were message backlogs.
2206 - Thanks again to Brett Carr, found an assertion that was not true.
2207 Assertion checked if recursion parent query still existed.
2209 29 April 2009: Wouter
2210 - Thanks to Brett Carr, caught windows resource leak, use
2211 closesocket() and not close() on sockets or else the network stack
2212 starts to leak handles.
2213 - Removed usage of windows Mutex because windows cannot handle enough
2214 mutexes open. Provide own mutex implementation using primitives.
2216 28 April 2009: Wouter
2217 - created svn tag for 1.3.0.
2219 27 April 2009: Wouter
2220 - optimised cname from cache.
2221 - ifdef windows functions in testbound.
2223 23 April 2009: Wouter
2224 - fix for threadsafety in solaris thr_key_create() in tests.
2225 - iana portlist updated.
2226 - fix pylib test for Darwin.
2227 - fix pymod test for Darwin and a python threading bug in pymod init.
2228 - check python >= 2.4 in configure.
2229 - -ldl check for libcrypto 1.0.0beta.
2231 21 April 2009: Wouter
2232 - fix for build outside sourcedir.
2233 - fix for configure script swig detection.
2235 17 April 2009: Wouter
2236 - Fix reentrant in minievent handler for unix. Could have resulted
2237 in spurious event callbacks.
2238 - timers do not take up a fd slot for winsock handler.
2239 - faster fix for winsock reentrant check.
2240 - fix rsasha512 unit test for new (interim) algorithm number.
2241 - fix test:ldns doesn't like DOS line endings in keyfiles on unix.
2242 - fix compile warning on ubuntu (configlexer fwrite return value).
2243 - move python include directives into CPPFLAGS instead of CFLAGS.
2245 16 April 2009: Wouter
2246 - winsock event handler exit very quickly on signal, even if
2248 - iana portlist updated.
2249 - fixup windows winsock handler reentrant problem.
2251 14 April 2009: Wouter
2252 - bug #245: fix munin plugin, perform cleanup of stale lockfiles.
2253 - makedist.sh; better help text.
2254 - cache-min-ttl option and tests.
2255 - mingw detect error condition on TCP sockets (NOTCONN).
2257 9 April 2009: Wouter
2258 - Fix for removal of RSASHA256_NSEC3 protonumber from ldns.
2259 - ldns tarball updated.
2260 - iana portlist update.
2261 - detect GOST support in openssl-1.0.0-beta1, and fix compile problem
2262 because that openssl defines the name STRING for itself.
2264 6 April 2009: Wouter
2265 - windows compile fix.
2266 - Detect FreeBSD jail without ipv6 addresses assigned.
2267 - python libunbound wrapper unit test.
2268 - installs the following files. Default is to not build them.
2269 from configure --with-pythonmodule:
2270 /usr/lib/python2.x/site-packages/unboundmodule.py
2271 from configure --with-pyunbound:
2272 /usr/lib/python2.x/site-packages/unbound.py
2273 /usr/lib/python2.x/site-packages/_unbound.so*
2274 The example python scripts (pythonmod/examples and
2275 libunbound/python/examples) are not installed.
2276 - python invalidate routine respects packed rrset ids and locks.
2277 - clock skew checks in unbound, config statements.
2278 - nxdomain ttl considerations in requirements.txt
2280 3 April 2009: Wouter
2281 - Fixed a bug that caused messages to be stored in the cache too
2282 long. Hard to trigger, but NXDOMAINs for nameservers or CNAME
2283 targets have been more vulnerable to the TTL miscalculation bug.
2284 - documentation test fixed for python addition.
2286 2 April 2009: Wouter
2287 - pyunbound (libunbound python plugin) compiles using libtool.
2288 - documentation for pythonmod and pyunbound is generated in doc/html.
2289 - iana portlist updated.
2290 - fixed bug in unbound-control flush_zone where it would not flush
2291 every message in the target domain. This especially impacted
2292 NXDOMAIN messages which could remain in the cache regardless.
2293 - python module test package.
2295 1 April 2009: Wouter
2296 - suppress errors when trying to contact authority servers that gave
2297 ipv6 AAAA records for their nameservers with ipv4 mapped contents.
2298 Still tries to do so, could work when deployed in intranet.
2299 Higher verbosity shows the error.
2300 - new libunbound calls documented.
2301 - pyunbound in libunbound/python. Removed compile warnings.
2302 Makefile to make it.
2304 30 March 2009: Wouter
2305 - Fixup LDFLAGS from libevent sourcedir compile configure restore.
2306 - Fixup so no non-absolute rpaths are added.
2307 - Fixup validation of RRSIG queries, they are let through.
2308 - read /dev/random before chroot
2309 - checkconf fix no python checks when no python module enabled.
2310 - fix configure, pthread first, so other libs do not change outcome.
2312 27 March 2009: Wouter
2313 - nicer -h output. report linked libraries and modules.
2314 - prints modules in intuitive order (config file friendly).
2315 - python compiles easily on BSD.
2317 26 March 2009: Wouter
2318 - ignore swig varargs warnings with gcc.
2319 - remove duplicate example.conf text from python example configs.
2320 - outofdir compile fix for python.
2322 - print modules compiled in on -h. manpage.
2324 25 March 2009: Wouter
2325 - initial import of the python contribution from Zdenek Vasicek and
2327 - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0.
2329 24 March 2009: Wouter
2330 - more neat configure.ac. Removed duplicate config.h includes.
2331 - neater config.h.in.
2332 - iana portlist updated.
2333 - fix util/configlexer.c and solaris -std=c99 flag.
2334 - fix postcommit aclocal errors.
2335 - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R.
2336 - swap order of host detect and libtool generation.
2338 23 March 2009: Wouter
2339 - added launchd plist example file for MacOSX to contrib.
2340 - deprecation test for daemon(3).
2341 - moved common configure actions to m4 include, prettier Makefile.
2343 20 March 2009: Wouter
2344 - bug #239: module-config entries order is important. Documented.
2345 - build fix for test asynclook.
2347 19 March 2009: Wouter
2348 - winrc/README.txt dos-format text file.
2349 - iana portlist updated.
2350 - use _beginthreadex() when available (performs stack alignment).
2351 - defaults for windows baked into configure.ac (used if on mingw).
2353 18 March 2009: Wouter
2354 - Added tests, unknown algorithms become insecure. fallback works.
2355 - Fix for and test for unknown algorithms in a trust anchor
2356 definition. Trust anchors with no supported algos are ignored.
2357 This means a (higher)DS or DLV entry for them could succeed, and
2358 otherwise they are treated as insecure.
2359 - domain-insecure: "example.com" statement added. Sets domain
2360 insecure regardless of chain of trust DSs or DLVs. The inverse
2363 17 March 2009: Wouter
2364 - unit test for unsupported algorithm in anchor warning.
2365 - fixed so queries do not fail on opportunistic target queries.
2367 16 March 2009: Wouter
2368 - fixup diff error printout in contrib/update-itar.sh.
2369 - added contrib/unbound_cacti for statistics support in cacti,
2370 contributed by Dmitriy Demidov.
2372 13 March 2009: Wouter
2373 - doxygen and lex/yacc on linux.
2374 - strip update-anchor on makedist -w.
2375 - fix testbound on windows.
2376 - default log to syslog for windows.
2377 - uninstaller can stop unbound - changed text on it to reflect that.
2378 - remove debugging from windows 'cron' actions.
2380 12 March 2009: Wouter
2381 - log to App.logs on windows prints executable identity.
2383 - munin plugin fix benign locking error printout.
2384 - anchor-update for windows, called every 24 hours; unbound reloads.
2386 11 March 2009: Wouter
2387 - winsock event handler resets WSAevents after signalled.
2388 - winsock event handler tests if signals are really signalled.
2389 - install and service with log to file works on XP and Vista on
2390 default install location.
2391 - on windows logging to the Application logbook works (as a service).
2392 - fix RUN_DIR on windows compile setting in makedist.
2393 - windows registry has Software\Unbound\ConfigFile element.
2394 If does not exist, the default is used. The -c switch overrides it.
2395 - fix makedist version cleanup function.
2397 10 March 2009: Wouter
2398 - makedist -w strips out old rc.. and snapshot info from version.
2399 - setup.exe starts and stops unbound after install, before uninstall.
2400 - unbound-checkconf recognizes absolute pathnames on windows (C:...).
2402 9 March 2009: Wouter
2403 - Nullsoft NSIS installer creation script.
2405 5 March 2009: Wouter
2406 - fixup memory leak introduced on 18feb in mesh reentrant fix.
2408 3 March 2009: Wouter
2409 - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8).
2410 - service works on xp/vista, no config necessary (using defaults).
2411 - windows registry settings.
2413 2 March 2009: Wouter
2414 - fixup --export-symbols to be -export-symbls for libtool.
2415 This should fix extraneous symbols exported from libunbound.
2416 Thanks to Ondrej Sury and Robert Edmonds for finding it.
2417 - iana portlist updated.
2418 - document FAQ entry on stub/forward zones and default blocking.
2419 - fix asynclook test app for libunbound not exporting symbols.
2420 - service install and remove utils that work with vista UAC.
2422 27 February 2009: Wouter
2423 - Fixup lexer, to not give warnings about fwrite. Appeared in
2425 - makedistro functionality for mingw. Has RC support.
2426 - support spaces and backslashes in configured defaults paths.
2427 - register, deregister in service control manager.
2429 25 February 2009: Wouter
2430 - windres usage for application resources.
2432 24 February 2009: Wouter
2433 - isc moved their dlv key download location.
2434 - fixup warning on vista/mingw.
2435 - makedist -w for window zip distribution first version.
2437 20 February 2009: Wouter
2438 - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped.
2439 Nicer script layout. Added url to site in -h output.
2441 19 February 2009: Wouter
2442 - unbound-checkconf and unbound print warnings when trust anchors
2443 have unsupported algorithms.
2444 - added contrib/update-itar.sh This script is similar to
2445 update-anchor.sh, and updates from the IANA ITAR repository.
2446 You can provide your own PGP key and trust repo, or can use the
2447 builtin. The program uses wget and gpg to work.
2448 - iana portlist updated.
2449 - update-itar.sh: using ftp:// urls because https godaddy certificate
2450 is not available everywhere and then gives fatal errors. The
2451 security is provided by pgp signature.
2453 18 February 2009: Wouter
2454 - more cycle detection. Also for target queries.
2455 - fixup bug where during deletion of the mesh queries the callbacks
2456 that were reentrant caused assertion failures. Keep the mesh in
2457 a reentrant safe state. Affects libunbound, reload of server,
2458 on quit and flush_requestlist.
2459 - iana portlist updated.
2461 13 February 2009: Wouter
2462 - forwarder information now per-thread duplicated.
2463 This keeps it read only for speed, with no locking necessary.
2464 - forward command for unbound control to change forwarders to use
2466 - document that unbound-host reads no config file by default.
2467 - updated iana portlist.
2469 12 February 2009: Wouter
2470 - call setusercontext if available (on BSD).
2471 - small refactor of stats clearing.
2472 - #227: flush_stats feature for unbound-control.
2473 - stats_noreset feature for unbound-control.
2474 - flush_requestlist feature for unbound-control.
2475 - libunbound version upped API (was changed 5 feb).
2476 - unbound-control status shows if root forwarding is in use.
2477 - slightly nicer memory management in iter-fwd code.
2479 10 February 2009: Wouter
2480 - keys with rfc5011 REVOKE flag are skipped and not considered when
2482 - iana portlist updated
2483 - #226: dump_requestlist feature for unbound-control.
2485 6 February 2009: Wouter
2486 - contrib contains specfile for fedora 1.2.1 (from Paul Wouters).
2487 - iana portlist updated.
2488 - fixup EOL in include directive (reported by Paul Wouters).
2489 You can no longer specify newlines in the names of included files.
2490 - config parser changed. Gives some syntax errors closer to where they
2491 occurred. Does not enforce a space after keyword anymore.
2492 Does not allow literal newlines inside quoted strings anymore.
2493 - verbosity level 5 logs customer IP for new requestlist entries.
2494 - test fix, lexer and cancel test.
2495 - new option log-time-ascii: yes if you enable it prints timestamps
2496 in the log file as Feb 06 13:45:26 (like syslog does).
2497 - detect event_base_new in libevent-1.4.1 and later and use it.
2498 - #231 unbound-checkconf -o option prints that value from config file.
2499 Useful for scripting in management scripts and the like.
2501 5 February 2009: Wouter
2502 - ldns 1.5.0 rc as tarball included.
2503 - 1.3.0 development continues:
2504 change in libunbound API: ub_cancel can return an error, that
2505 the async_id did not exist, or that it was already delivered.
2506 The result could have been delivered just before the cancel
2507 routine managed to acquire the lock, so a caller may get the
2508 result at the same time they call cancel. For this case,
2509 ub_cancel tries to return an error code.
2510 Fixes race condition in ub_cancel() libunbound function.
2511 - MacOSX Leopard cleaner text output from configure.
2512 - initgroups(3) is called to drop secondary group permissions, if
2514 - configure option --with-ldns-builtin forces the use of the
2515 inluded ldns package with the unbound source. The -I include
2516 is put before the others, so it avoids bad include files from
2517 an older ldns install.
2518 - daemon(3) posix call is used when available.
2519 - testbound test for older fix added.
2521 4 February 2009: Wouter
2522 - tag for release 1.2.1.
2523 - trunk setup for 1.3.0 development.
2525 3 February 2009: Wouter
2526 - noted feature requests in doc/TODO.
2527 - printout more detailed errors on ssl certificate loading failures.
2528 - updated IANA portlist.
2530 16 January 2009: Wouter
2531 - more quiet about ipv6 network failures, i.e. when ipv6 is not
2532 available (network unreachable). Debug still printed on high
2534 - unbound-host -4 and -6 options. Stops annoying ipv6 errors when
2535 debugging with unbound-host -4 -d ...
2536 - more cycle detection for NS-check, addr-check, root-prime and
2537 stub-prime queries in the iterator. Avoids possible deadlock
2540 15 January 2009: Wouter
2541 - bug #229: fixup configure checks for compilation with Solaris
2542 Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc
2543 - fixup suncc warnings.
2544 - fix bug where unbound could crash using libevent 1.3 and older.
2545 - update testset for recent retry change.
2547 14 January 2009: Wouter
2548 - 1.2.1 feature: negative caching for failed queries.
2549 Queries that failed are cached for 5 seconds (NORR_TTL).
2550 If the failure is local, like out of memory, it is not cached.
2551 - the TTL comparison for the cache used different comparisons,
2552 causing many cache responses that used the iterator and validator
2553 state machines unnecessarily.
2554 - retry from 4 to 5 so that EDNS drop retry is part of the first
2555 query resolve attempt, and cached error does not stop EDNS fallback.
2556 - remove debug prints that protect against bad referrals.
2557 - honor QUIET=no on make commandline (or QUIET=yes ).
2559 13 January 2009: Wouter
2560 - fixed bug in lameness marking, removed printouts.
2561 - find NS rrset more cleanly for qtype NS.
2562 - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for
2564 - 1.2.1 feature: stops resolving AAAAs promiscuously when they
2565 are in the negative cache.
2567 12 January 2009: Wouter
2568 - fixed bug in infrastructure lameness cache, did not lowercase
2569 name of zone to hash when setting lame.
2570 - lameness debugging printouts.
2572 9 January 2009: Wouter
2573 - created svn tag for 1.2.0 release.
2574 - svn trunk contains 1.2.1 version number.
2575 - iana portlist updated for todays list.
2576 - removed debug print.
2578 8 January 2009: Wouter
2579 - new version of ldns-trunk (today) included as tarball, fixed
2580 bug #224, building with -j race condition.
2581 - remove possible race condition in the test for race conditions.
2583 7 January 2009: Wouter
2584 - version 1.2.0 in preparation.
2585 - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file
2586 statements. (Adapted from patch by Paul Wouters).
2587 - typo fix and iana portlist updated.
2588 - porting testsuite; unused var warning, and type fixup.
2590 6 January 2009: Wouter
2591 - fixup packet-of-death when compiled with --enable-debug.
2592 A malformed packet could cause an internal assertion failure.
2593 - added test for HINFO canonicalisation behaviour.
2594 - fixup reported problem with transparent local-zone data where
2595 queries with different type could get nxdomain. Now queries
2596 with a different name get resolved normally, with different type
2597 get a correct NOERROR/NODATA answer.
2598 - HINFO no longer downcased for validation, making unbound compatible
2600 - fix reading included config files when chrooted.
2601 Give full path names for include files.
2602 Relative path names work if the start dir equals the working dir.
2603 - fix libunbound message transport when no packet buffer is available.
2605 5 January 2009: Wouter
2606 - fixup getaddrinfo failure handling for remote control port.
2607 - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints.
2608 - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/
2609 - comm_timer_set performs base_set operation after event_add.
2611 18 December 2008: Wouter
2612 - fixed bug reported by Duane Wessels: error in DLV lookup, would make
2613 some zones that had correct DLV keys as insecure.
2614 - follows -rc makedist from ldns changes (no _rc).
2615 - ldns tarball updated with 1.4.1rc for DLV unit test.
2616 - verbose prints about recursion lame detection and server selection.
2617 - fixup BSD port for infra host storage. It hashed wrongly.
2618 - fixup makedist snapshot name generation.
2619 - do not reopen syslog to avoid dev/log dependency.
2621 17 December 2008: Wouter
2622 - follows ldns makedist.sh. -rc option. autom4te dir removed.
2623 - unbound-control status command.
2624 - extended statistics has a number of ipv6 queries counter.
2625 contrib/unbound_munin_ was updated to draw ipv6 in the hits graph.
2627 16 December 2008: Wouter
2628 - follow makedist improvements from ldns, for maintainers prereleases.
2629 - snapshot version uses _ not - to help rpm distinguish the
2632 11 December 2008: Wouter
2633 - better fix for bug #219: use LOG_NDELAY with openlog() call.
2634 Thanks to Tamas Tevesz.
2636 9 December 2008: Wouter
2637 - bug #221 fixed: unbound checkconf checks if key files exist if
2638 remote control is enabled. Also fixed NULL printf when not chrooted.
2639 - iana portlist updated.
2641 3 December 2008: Wouter
2642 - Fix problem reported by Jaco Engelbrecht where unbound-control stats
2643 freezes up unbound if this was compiled without threading, and
2644 was using multiple processes.
2645 - iana portlist updated.
2646 - test for remote control with interprocess communication.
2647 - created command distribution mechanism so that remote control
2648 commands other than 'stats' work on all processes in a nonthreaded
2649 compiled version. dump/load cache work, on the first process.
2650 - fixup remote control local_data addition memory corruption bug.
2652 1 December 2008: Wouter
2653 - SElinux policy files in contrib/selinux for the unbound daemon,
2654 by Paul Wouters and Adam Tkac.
2656 25 November 2008: Wouter
2657 - configure complains when --without-ssl is given (bug #220).
2658 - skip unsupported feature tests on vista/mingw.
2659 - fixup testcode/streamtcp to work on vista/mingw.
2660 - root-hints test checks version of dig required.
2661 - blacklisted servers are polled at a low rate (1%) to see if they
2662 come back up. But not if there is some other working server.
2664 24 November 2008: Wouter
2665 - document that the user of the server daemon needs read privileges
2666 on the keys and certificates generated by unbound-control-setup.
2667 This is different per system or distribution, usually, running the
2668 script under the same username as the server uses suffices.
2669 i.e. sudo -u unbound unbound-control-setup
2670 - testset port to vista/mingw.
2671 - tcp_sigpipe to freebsd port.
2673 21 November 2008: Wouter
2674 - fixed tcp accept, errors were printed when they should not.
2675 - unbound-control-setup.sh removes read/write permissions other
2676 from the keys it creates (as suggested by Dmitriy Demidov).
2678 20 November 2008: Wouter
2679 - fixup fatal error due to faulty error checking after tcp accept.
2680 - add check in rlimit to avoid integer underflow.
2681 - rlimit check with new formula; better estimate for number interfaces
2682 - nicer comments in rlimit check.
2683 - tag 1.1.1 created in svn.
2684 - trunk label is 1.1.2
2686 19 November 2008: Wouter
2687 - bug #219: fixed so that syslog which delays opening until the first
2688 log line is written, gets a log line while not chroot'ed yet.
2690 18 November 2008: Wouter
2691 - iana portlist updated.
2692 - removed cast in unit test debug print that was not 64bit safe.
2693 - trunk back to 1.1.0; copied to tags 1.1.0 release.
2694 - trunk to has version number 1.1.1 again.
2695 - in 1.1.1; make clean nicer. grammar in manpage.
2697 17 November 2008: Wouter
2698 - theoretical fix for problems reported on mailing list.
2699 If a delegation point has no A but only AAAA and do-ip6 is no,
2700 resolution would fail. Fixed to ask for the A and AAAA records.
2701 It has to ask for both always, so that it can fail quietly, from
2702 TLD perspective, when a zone is only reachable on one transport.
2703 - test for above, only AAAA and doip6 is no. Fix causes A record
2704 for nameserver to be fetched.
2705 - fixup address duplication on cache fillup for delegation points.
2706 - testset updated for new query answer requirements.
2708 14 November 2008: Wouter
2709 - created 1.1.0 release tag in svn.
2710 - trunk moved to 1.1.1
2711 - fixup unittest-neg for locking.
2713 13 November 2008: Wouter
2714 - added fedora init and specfile to contrib (by Paul Wouters).
2715 - added configure check for ldns 1.4.0 (using its compat funcs).
2716 - neater comments in worker.h.
2717 - removed doc/plan and updated doc/TODO.
2718 - silenced EHOSTDOWN (verbosity 2 or higher to see it).
2719 - review comments from Jelte, Matthijs. Neater code.
2721 12 November 2008: Wouter
2722 - add unbound-control manpage to makedist replace list.
2724 11 November 2008: Wouter
2725 - unit test for negative cache, stress tests the refcounting.
2726 - fix for refcounting error that could cause fptr_wlist fatal exit
2727 in the negative cache rbtree (upcoming 1.1 feature). (Thanks to
2728 Attila Nagy for testing).
2729 - nicer comments in cachedump about failed RR to string conversion.
2730 - fix 32bit wrap around when printing large (4G and more) mem usage
2731 for extended statistics.
2733 10 November 2008: Wouter
2734 - fixup the getaddrinfo compat code rename.
2736 8 November 2008: Wouter
2737 - added configure check for eee build warning.
2739 7 November 2008: Wouter
2740 - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4.
2741 - detect nonblocking problems in network stack in configure script.
2743 6 November 2008: Wouter
2744 - dname_priv must decompress the name before comparison.
2745 - iana portlist updated.
2747 5 November 2008: Wouter
2748 - fixed possible memory leak in key_entry_key deletion.
2749 Would leak a couple bytes when trust anchors were replaced.
2750 - if query and reply qname overlap, the bytes are skipped not copied.
2751 - fixed file descriptor leak when messages were jostled out that
2752 had outstanding (TCP) replies.
2753 - DNAMEs used from cache have their synthesized CNAMEs initialized
2755 - fixed file descriptor leak for localzone type deny (for TCP).
2756 - fixed memleak at exit for nsec3 negative cached zones.
2757 - fixed memleak for the keyword 'nodefault' when reading config.
2758 - made verbosity of 'edns incapable peer' warning higher, so you
2759 do not get spammed by it.
2760 - caught elusive Bad file descriptor error bug, that would print the
2761 error while unnecessarily try to listen to a closed fd. Fixed.
2763 4 November 2008: Wouter
2764 - fixed -Wwrite-strings warnings that result in better code.
2766 3 November 2008: Wouter
2767 - fixup build process for Mac OSX linker, use ldns b32 compat funcs.
2768 - generated configure with autoconf-2.61.
2769 - iana portlist updated.
2770 - detect if libssl needs libdl. For static linking with libssl.
2771 - changed to use new algorithm identifiers for sha256/sha512
2772 from ldns 1.4.0 (need very latest version).
2773 - updated the included ldns tarball.
2774 - proper detection of SHA256 and SHA512 functions (not just sizes).
2776 23 October 2008: Wouter
2777 - a little more debug info for failure on signer names. prints names.
2779 22 October 2008: Wouter
2780 - CFLAGS are picked up by configure from the environment.
2781 - iana portlist updated.
2782 - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too.
2783 - new stub-prime: yesno option. Default is off, so it does not prime.
2784 can be turned on to get same behaviour as previous unbound release.
2785 - made automated test that checks if builtin root hints are uptodate.
2786 - finished draft-wijngaards-dnsext-resolver-side-mitigation
2787 implementation. The unwanted-reply-threshold can be set.
2788 - fixup so fptr_whitelist test in alloc.c works.
2790 21 October 2008: Wouter
2791 - fix update-anchors.sh, so it does not report different RR order
2792 as an update. Sorts the keys in the file. Updated copyright.
2793 - fixup testbound on windows, the command control pipe doesn't exist.
2794 - skip 08hostlib test on windows, no fork() available.
2795 - made unbound-remote work on windows.
2797 20 October 2008: Wouter
2798 - quench a log message that is debug only.
2799 - iana portlist updated.
2800 - do not query bogus nameservers. It is like nameservers that have
2801 the NS or A or AAAA record bogus are listed as donotquery.
2802 - if server selection is faced with only bad choices, it will
2803 attempt to get more options to be fetched.
2804 - changed bogus-ttl default value from 900 to 60 seconds.
2805 In anticipation that operator caused failures are more likely than
2806 actual attacks at this time. And thus repeated validation helps
2807 the operators get the problem fixed sooner. It makes validation
2808 failures go away sooner (60 seconds after the zone is fixed).
2809 Also it is likely to try different nameserver targets every minute,
2810 so that if a zone is bad on one server but not another, it is
2811 likely to pick up the 'correct' one after a couple minutes,
2812 and if the TTL is big enough that solves validation for the zone.
2813 - fixup unbound-control compilation on windows.
2815 17 October 2008: Wouter
2816 - port Leopard/G5: fixup type conversion size_t/uint32.
2817 please ranlib, stop file without symbols warning.
2818 - harden referral path now also validates the root after priming.
2819 It looks up the root NS authoritatively as well as the root servers
2820 and attemps to validate the entries.
2822 16 October 2008: Wouter
2823 - Fixup negative TTL values appearing (reported by Attila Nagy).
2825 15 October 2008: Wouter
2826 - better documentation for 0x20; remove fallback TODO, it is done.
2827 - harden-referral-path feature includes A, AAAA queries for glue,
2828 as well as very careful NS caching (only when doing NS query).
2829 A, AAAA use the delegation from the NS-query.
2831 14 October 2008: Wouter
2832 - fwd_three.tpkg test was flaky. If the three requests hit the
2833 wrong threads by chance (or bad OS) then the test would fail.
2834 Made less flaky by increasing number of retries.
2835 - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs.
2836 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014).
2837 Which includes the ldns_dname_absolute fix.
2838 - fwd_three test remains flaky now that unbound does not stop
2839 listening when full. Thus, removed timeout problem.
2840 It may be serviced by three threads, or maybe by one.
2841 Mostly only useful for lock-check testing now.
2843 13 October 2008: Wouter
2844 - fixed recursion servers deployed as authoritative detection, so
2845 that as a last resort, a +RD query is sent there to get the
2847 - iana port list update.
2848 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013).
2850 10 October 2008: Wouter
2851 - fixup tests - the negative cache contained the correct NSEC3s for
2852 two tests that are supposed to fail to validate.
2854 9 October 2008: Wouter
2855 - negative cache caps max iterations of NSEC3 done.
2856 - NSEC3 negative cache for qtype DS works.
2858 8 October 2008: Wouter
2859 - NSEC negative cache for DS.
2861 6 October 2008: Wouter
2862 - jostle-timeout option, so you can config for slow links.
2863 - 0x20 fallback code. Tries 3xnumber of nameserver addresses
2864 queries that must all be the same. Sent to random nameservers.
2865 - documented choices for DoS, EDNS, 0x20.
2867 2 October 2008: Wouter
2868 - fixup unlink of pidfile.
2869 - fixup SHA256 algorithm collation code.
2870 - contrib/update-anchor.sh does not overwrite anchors if not needed.
2871 exits 0 when a restart is needed, other values if not.
2872 so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart
2873 can restart unbound exactly when needed.
2875 30 September 2008: Wouter
2876 - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1.
2877 - tests for sha256 support and downgrade resistance.
2878 - RSASHA256 and RSASHA512 support (using the draft in dnsext),
2879 using the drafted protocol numbers.
2880 - when using stub on localhost (127.0.0.1@10053) unbound works.
2881 Like when running NSD to host a local zone, on the same machine.
2882 The noprime feature. manpages more explanation. Added a test for it.
2883 - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com"
2885 29 September 2008: Wouter
2886 - EDNS lameness detection, if EDNS packets are dropped this is
2887 detected, eventually.
2888 - multiple query timeout rtt backoff does not backoff too much.
2890 26 September 2008: Wouter
2891 - tests for remote-control.
2892 - small memory leak in exception during remote control fixed.
2893 - fixup for lock checking but not unchecking in remote control.
2894 - iana portlist updated.
2896 23 September 2008: Wouter
2897 - Msg cache is loaded. A cache load enables cache responses.
2898 - unbound-control flush [name], flush_type and flush_zone.
2900 22 September 2008: Wouter
2901 - dump_cache and load_cache statements in unbound-control.
2902 RRsets are dumped and loaded correctly.
2903 Msg cache is dumped.
2905 19 September 2008: Wouter
2906 - locking on the localdata structure.
2907 - add and remove local zone and data with unbound-control.
2908 - ldns trunk snapshot updated, make tests work again.
2910 18 September 2008: Wouter
2911 - fixup error in time calculation.
2912 - munin plugin improvements.
2913 - nicer abbreviations for high query types values (ixfr, axfr, any...)
2914 - documented the statistics output in unbound-control man page.
2915 - extended statistics prints out histogram, over unbound-control.
2917 17 September 2008: Wouter
2918 - locking for threadsafe bogus rrset counter.
2919 - ldns trunk no longer exports b32 functions, provide compat.
2920 - ldns tarball updated.
2921 - testcode/ldns-testpkts.c const fixups.
2922 - fixed rcode stat printout.
2923 - munin plugin in contrib.
2924 - stats always printout uptime, because stats plugins need it.
2926 16 September 2008: Wouter
2927 - extended-statistics: yesno config option.
2928 - unwanted replies spoof nearmiss detector.
2929 - iana portlist updated.
2931 15 September 2008: Wouter
2932 - working start, stop, reload commands for unbound-control.
2933 - test for unbound-control working; better exit value for control.
2934 - verbosity control via unbound-control.
2935 - unbound-control stats.
2937 12 September 2008: Wouter
2938 - removed browser control mentions. Proto speccy.
2940 11 September 2008: Wouter
2941 - set nonblocking on new TCP streams, because linux does not inherit
2942 the socket options to the accepted socket.
2944 - SSL protected connection between server and unbound-control.
2946 10 September 2008: Wouter
2947 - remove memleak in privacy addresses on reloads and quits.
2948 - remote control work.
2950 9 September 2008: Wouter
2951 - smallapp/unbound-control-setup.sh script to set up certificates.
2953 4 September 2008: Wouter
2954 - scrubber scrubs away private addresses.
2955 - test for private addresses. man page entry.
2956 - code refactored for name and address tree lookups.
2958 3 September 2008: Wouter
2959 - options for 'DNS Rebinding' protection: private-address and
2961 - dnstree for reuse of routines that help with domain, addr lookups.
2962 - private-address and private-domain config option read, stored.
2964 2 September 2008: Wouter
2965 - DoS protection features. Queries are jostled out to make room.
2966 - testbound can pass time, increasing the internal timer.
2967 - do not mark unsigned additionals bogus, leave unchecked, which
2970 1 September 2008: Wouter
2971 - disallow nonrecursive queries for cache snooping by default.
2972 You can allow is using access-control: <subnet> allow_snoop.
2973 The defaults do allow access no authoritative data without RD bit.
2974 - two tests for it and fixups of tests for nonrec refused.
2976 29 August 2008: Wouter
2977 - version 1.1 number in trunk.
2978 - harden-referral-path option for query for NS records.
2979 Default turns off expensive, experimental option.
2981 28 August 2008: Wouter
2982 - fixup logfile handling; it is created with correct permissions
2983 again. (from bugfix#199).
2984 Some errors are not written to logfile (pidfile writing, forking),
2985 and these are only visible by using the -d commandline flag.
2987 27 August 2008: Wouter
2988 - daemon(3) is causing problems for people. Reverting the patch.
2989 bug#200, and 199 and 203 contain sideline discussion on it.
2990 - bug#199 fixed: pidfile can be outside chroot. openlog is done before
2991 chroot and drop permissions.
2992 - config option to set size of aggressive negative cache,
2994 - bug#203 fixed: dlv has been implemented.
2996 26 August 2008: Wouter
2997 - test for insecure zone when DLV is in use, also does negative cache.
2998 - test for trustanchor when DLV is in use (the anchor works).
2999 - test for DLV used for a zone below a trustanchor.
3000 - added scrub filter for overreaching NSEC records and unit test.
3001 - iana portlist update
3002 - use of setresuid or setreuid when available.
3003 - use daemon(3) if available.
3005 25 August 2008: Wouter
3006 - realclean patch from Robert Edmonds.
3008 22 August 2008: Wouter
3009 - nicer debuglogging of DLV.
3010 - test with secure delegation inside the DLV repository.
3012 21 August 2008: Wouter
3013 - negative cache code linked into validator, for DLV use.
3014 negative cache works for DLV.
3015 - iana portlist update.
3016 - dlv-anchor option for unit tests.
3017 - fixup NSEC_AT_APEX classification for short typemaps.
3018 - ldns-testns has subdomain checks, for unit tests.
3020 20 August 2008: Wouter
3021 - negative cache code, reviewed.
3023 18 August 2008: Wouter
3024 - changes info: in logfile to notice: info: or debug: depending on
3025 the verbosity of the statements. Better logfile message
3027 - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd.
3029 15 August 2008: Wouter
3030 - DLV nsec code fixed for better detection of closest existing
3031 enclosers from NSEC responses.
3032 - DLV works, straight to the dlv repository, so not for production.
3035 14 August 2008: Wouter
3036 - synthesize DLV messages from the rrset cache, like done for DS.
3038 13 August 2008: Wouter
3039 - bug #203: nicer do-auto log message when user sets incompatible
3041 - bug #204: variable name ameliorated in log.c.
3042 - bug #206: in iana_update, no egrep, but awk use.
3043 - ldns snapshot r2699 taken (includes DLV type).
3044 - DLV work, config file element, trust anchor read in.
3046 12 August 2008: Wouter
3047 - finished adjusting testset to provide qtype NS answers.
3049 11 August 2008: Wouter
3050 - Fixup rrset security updates overwriting 2181 trust status.
3051 This makes validated to be insecure data just as worthless as
3052 nonvalidated data, and 2181 rules prevent cache overwrites to them.
3053 - Fix assertion fail on bogus key handling.
3054 - dnssec lameness detection works on first query at trust apex.
3055 - NS queries get proper cache and dnssec lameness treatment.
3056 - fixup compilation without pthreads on linux.
3058 8 August 2008: Wouter
3059 - NS queries are done after every referral.
3060 validator is used on those NS records (if anchors enabled).
3062 7 August 2008: Wouter
3063 - Scrubber more strict. CNAME chains, DNAMEs from cache, other
3064 irrelevant rrsets removed.
3065 - 1.0.2 released from 1.0 support branch.
3066 - fixup update-anchor.sh to work both in BSD shell and bash.
3068 5 August 2008: Wouter
3069 - fixup DS test so apex nodata works again.
3071 4 August 2008: Wouter
3074 - fix bug 201: null ptr deref on cleanup while udp pkts wait for port.
3075 - added explanatory text for outgoing-port-permit in manpage.
3077 30 July 2008: Wouter
3078 - fixup bug qtype DS for unsigned zone and signed parent validation.
3080 25 July 2008: Wouter
3081 - added original copyright statement of OpenBSD arc4random code.
3082 - created tube signaling solution on windows, as a pipe replacement.
3083 this makes background asynchronous resolution work on windows.
3084 - removed very insecure socketpair compat code. It also did not
3085 work with event_waiting. Solved by pipe replacement.
3086 - unbound -h prints openssl version number as well.
3088 22 July 2008: Wouter
3089 - moved pipe actions to util/tube.c. easier porting and shared code.
3090 - check _raw() commpoint callbacks with fptr_wlist.
3093 21 July 2008: Wouter
3094 - #198: nicer entropy warning message. manpage OS hints.
3096 19 July 2008: Wouter
3097 - #198: fixup man page to suggest chroot entropy fix.
3099 18 July 2008: Wouter
3100 - branch for 1.0 support.
3101 - trunk work on tube.c.
3103 17 July 2008: Wouter
3104 - fix bug #196, compile outside source tree.
3105 - fix bug #195, add --with-username=user configure option.
3106 - print error and exit if started with config that requires more
3107 fds than the builtin minievent can handle.
3109 16 July 2008: Wouter
3110 - made svn tag 1.0.1, trunk now 1.0.2
3111 - sha256 checksums enabled in makedist.sh
3113 15 July 2008: Wouter
3114 - Follow draft-ietf-dnsop-default-local-zones-06 added reverse
3115 IPv6 example prefix to AS112 default blocklist.
3116 - fixup lookup of DS records by client with trustanchor for same.
3117 - libunbound ub_resolve, fix handling of error condition during setup.
3118 - lowered log_hex blocksize to fit through BSD syslog linesize.
3119 - no useless initialisation if getpwnam not available.
3120 - iana, ldns snapshot updated.
3123 - Matthijs fixed memory leaks in root hints file reading.
3125 26 June 2008: Wouter
3126 - fixup streamtcp bounds setting for udp mode, in the test framework.
3127 - contrib item for updating trust anchors.
3129 25 June 2008: Wouter
3130 - fixup fwd_ancil test typos.
3131 - Fix for newegg lameness : ok for qtype=A, but lame for others.
3132 - fixup unit test for infra cache, test lame merging.
3133 - porting to mingw, bind, listen, getsockopt and setsockopt error
3136 24 June 2008: Wouter
3137 - removed testcode/checklocks from production code compilation path.
3138 - streamtcp can use UDP mode (connected UDP socket), for testing IPv6
3140 - fwd_ancil test fails if platform support is lacking.
3142 23 June 2008: Wouter
3143 - fixup minitpkg to cleanup on windows with its file locking troubles.
3144 - minitpkg shows skipped tests in report.
3145 - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not
3147 - winsock event handler keeps track of sticky TCP events, that have
3148 not been fully handled yet. when interest in the event(s) resumes,
3149 they are sent again. When WOULDBLOCK is returned events are cleared.
3150 - skip tests that need signals when testing on mingw.
3152 18 June 2008: Wouter
3153 - open testbound replay files in binary mode, because fseek/ftell
3154 do not work in ascii-mode on windows. The b does nothing on unix.
3155 unittest and testbound tests work on windows (xp too).
3156 - ioctlsocket prints nicer error message.
3157 - fixed up some TCP porting for winsock.
3158 - lack of IPv6 gives a warning, no fatal error.
3159 - use WSAGetLastError() on windows instead of errno for some errors.
3161 17 June 2008: Wouter
3162 - outgoing num fds 32 by default on windows ; it supports less
3163 fds for waiting on than unixes.
3164 - winsock_event minievent handler for windows. (you could also
3165 attempt to link with libevent/libev ports for windows).
3166 - neater crypto check and gdi32 detection.
3167 - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista.
3169 16 June 2008: Wouter
3170 - on windows, use windows threads, mutex and thread-local-storage(Tls).
3171 - detect if openssl needs gdi32.
3172 - if no threading, THREADS_DISABLED is defined for use in the code.
3173 - sets USE_WINSOCK if using ws2_32 on windows.
3174 - wsa_strerror() function for more readable errors.
3175 - WSA Startup and Cleanup called in unbound.exe.
3177 13 June 2008: Wouter
3178 - port mingw32, more signal ifdefs, detect sleep, usleep,
3179 random, srandom (used inside the tests).
3180 - signed or unsigned FD_SET is cast.
3182 10 June 2008: Wouter
3183 - fixup warnings compiling on eeepc xandros linux.
3186 - in iteration response type code
3187 * first check for SOA record (negative answer) before NS record
3189 * check if no AA bit for non-forwarder, and thus lame zone.
3190 In response to error report by Richard Doty for mail.opusnet.com.
3191 - fixup unput warning from lexer on freeBSD.
3192 - bug#183. pidfile, rundir, and chroot configure options. Also the
3193 example.conf and manual pages get the configured defaults.
3194 You can use: (or accept the defaults to /usr/local/etc/unbound/)
3195 --with-conf-file=filename
3196 --with-pidfile=filename
3198 --with-chroot-dir=path
3201 - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug.
3202 Reported by Robert Edmonds.
3203 - iana port updated.
3206 - updated libtool files with newer version.
3207 - iana portlist updated.
3210 - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the
3211 trailing dot is not used during comparison.
3214 - Jelte fixed bugs in my absence
3215 - bug 178: fixed unportable shell usage in configure (relied on
3217 - bug 180: fixed buffer overflow in unbound-checkconf use of strncat.
3218 - bug 181: fixed buffer overflow in ldns (called by unbound to parse
3221 - bug 177: fixed compilation failure on opensuse, the
3222 --disable-static configure flag caused problems. (Patch from
3224 - bug 179: same fix as 177.
3225 - bug 185: --disable-shared not passed along to ldns included with
3226 unbound. Fixed so that configure parameters are passed to the
3227 subdir configure script.
3228 fixed that ./libtool is used always, you can still override
3229 manually with ./configure libtool=mylibtool or set $libtool in
3231 - update of the ldns tarball to current ldns svn version (fix 181).
3232 - bug 184: -r option for unbound-host, read resolv.conf for
3233 forwarder. (Note that forwarder must support DNSSEC for validation
3238 - test for sys/wait.h
3239 - WSAEWOULDBLOCK test after nonblocking TCP connect.
3240 - write_iov_buffer removed: unused and no struct iov on windows.
3241 - signed/unsigned warning fixup mini_event.
3242 - use ioctlsocket to set nonblocking I/O if fnctl is unavailable.
3243 - skip signals that are not defined
3245 - detect getpwnam, getrlimit, setsid, sbrk, chroot.
3246 - default config has no chroot if chroot() unavailable.
3247 - if no kill() then no pidfile is read or written.
3248 - gmtime_r is replaced by nonthreadsafe alternative if unavail.
3249 used in rrsig time validation errors.
3252 - contrib unbound.spec from Patrick Vande Walle.
3253 - fixup bug#175: call tzset before chroot to have correct timestamps
3255 - do not generate lex input and lex unput functions.
3256 - mingw port. replacement functions labelled _unbound.
3257 - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed.
3260 - fedora 9, check in6_pktinfo define in configure.
3261 - CREDITS fixup of history.
3262 - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative.
3265 - fixup for MacOSX hosts file reading (reported by John Dickinson).
3266 - created 1.0.0 svn tag.
3267 - trunk version 1.0.1.
3270 - accepted patch from Ondrej Sury for library version libtool option.
3271 - configure --disable-rpath fixes up libtool for rpath trouble.
3272 Adapted from debian package patch file.
3275 - Added root ipv6 addresses to builtin root hints.
3276 - TODO modified for post 1.0 plans.
3277 - trunk version set to 1.0.0.
3278 - no unnecessary linking with librt (only when libevent/libev used).
3281 - fixup no-ip4 problem with error callback in outside network.
3283 25 April 2008: Wouter
3284 - DESTDIR is honored by the Makefile for rpms.
3285 - contrib files unbound.spec and unbound.init, builds working RPM
3286 on FC7 Linux, a chrooted caching resolver, and libunbound.
3287 - iana ports update.
3289 24 April 2008: Wouter
3290 - chroot checks improved. working directory relative to chroot.
3291 checks if config file path is inside chroot. Documentation on it.
3292 - nicer example.conf text.
3295 23 April 2008: Wouter
3296 - parseunbound.pl contrib update from Kai Storbeck for threads.
3299 22 April 2008: Wouter
3301 - unit test for SIGPIPE ignore.
3303 21 April 2008: Wouter
3304 - FEATURES document.
3305 - fixup reread of config file if it was given as a full path
3306 and chroot was used.
3308 16 April 2008: Wouter
3309 - requirements doc, updated clean query returns.
3310 - parseunbound.pl update from Kai Storbeck.
3311 - sunos4 porting changes.
3313 15 April 2008: Wouter
3314 - fixup default rc.d pidfile location to /usr/local/etc.
3315 - iana ports updated.
3316 - copyright updated in ldns-testpkts to keep same as in ldns.
3317 - fixup checkconf chroot tests a bit more, chdir must be inside
3319 - documented 'gcc: unrecognized -KPIC option' errors on Solaris.
3320 - example.conf values changed to /usr/local/etc/unbound
3322 - DSA signatures: unbound is compatible with both encodings found.
3323 It will detect and convert when necessary.
3325 14 April 2008: Wouter
3326 - got update for parseunbound.pl statistics script from Kai Storbeck.
3327 - tpkg tests for udp wait list.
3328 - documented 0x20 status.
3329 - fixup chroot and checkconf, it is much smarter now.
3330 - fixup DSA EVP signature decoding. Solution that Jelte found copied.
3331 - and check first sig byte for the encoding type.
3333 11 April 2008: Wouter
3334 - random port selection out of the configged ports.
3335 - fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
3336 - removed base_port.
3337 - created 256-port ephemeral space for the OS, 59802 available.
3338 - fixup consistency of port_if out array during heavy use.
3340 10 April 2008: Wouter
3341 - --with-libevent works with latest libevent 1.4.99-trunk.
3342 - added log file statistics perl script to contrib.
3343 - automatic iana ports update from makefile. 60058 available.
3345 9 April 2008: Wouter
3346 - configure can detect libev(from its build directory) when passed
3347 --with-libevent=/home/wouter/libev-3.2
3348 libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
3349 - unused commpoints not listed in epoll list.
3350 - statistics-cumulative option so that the values are not reset.
3351 - config creates array of available ports, 61841 available,
3352 it excludes <1024 and iana assigned numbers.
3353 config statements to modify the available port numbers.
3355 8 April 2008: Wouter
3356 - unbound tries to set the ulimit fds when started as server.
3357 if that does not work, it will scale back its requirements.
3359 27 March 2008: Wouter
3360 - documented /dev/random symlink from chrootdir as FAQ entry.
3362 26 March 2008: Wouter
3363 - implemented AD bit signaling. If a query sets AD bit (but not DO)
3364 then the AD bit is set in the reply if the answer validated.
3365 Without including DNSSEC signatures. Useful if you have a trusted
3366 path from the client to the resolver. Follows dnssec-updates draft.
3368 25 March 2008: Wouter
3369 - implemented check that for NXDOMAIN and NOERROR answers a query
3370 section must be present in the reply (by the scrubber). And it must
3371 be equal to the question sent, at least lowercase folded.
3372 Previously this feature happened because the cache code refused
3373 to store such messages. However blocking by the scrubber makes
3374 sure nothing gets into the RRset cache. Also, this looks like a
3375 timeout (instead of an allocation failure) and this retries are
3376 done (which is useful in a spoofing situation).
3377 - RTT banding. Band size 400 msec, this makes band around zero (fast)
3378 include unknown servers. This makes unbound explore unknown servers.
3380 7 March 2008: Wouter
3381 - -C config feature for harvest program.
3382 - harvest handles CNAMEs too.
3384 5 March 2008: Wouter
3385 - patch from Hugo Koji Kobayashi for iterator logs spelling.
3387 4 March 2008: Wouter
3388 - From report by Jinmei Tatuya, rfc2181 trust value for remainder
3389 of a cname trust chain is lower; not full answer_AA.
3390 - test for this fix.
3391 - default config file location is /usr/local/etc/unbound.
3392 Thus prefix is used to determine the location. This is also the
3393 chroot and pidfile default location.
3395 3 March 2008: Wouter
3396 - Create 0.10 svn tag.
3397 - 0.11 version in trunk.
3398 - indentation nicer.
3400 29 February 2008: Wouter
3401 - documentation update.
3402 - fixup port to Solaris of perf test tool.
3403 - updated ldns-tarball with decl-after-statement fixes.
3405 28 February 2008: Wouter
3406 - fixed memory leaks in libunbound (during cancellation and wait).
3407 - libunbound returns the answer packet in full.
3408 - snprintf compat update.
3409 - harvest performs lookup.
3410 - ldns-tarball update with fix for ldns_dname_label.
3411 - installs to sbin by default.
3412 - install all manual pages (unbound-host and libunbound too).
3414 27 February 2008: Wouter
3415 - option to use caps for id randomness.
3416 - config file option use-caps-for-id: yes
3417 - harvest debug tool
3419 26 February 2008: Wouter
3420 - delay utility delays TCP as well. If the server that is forwarded
3421 to has a TCP error, the delay utility closes the connection.
3422 - delay does REUSE_ADDR, and can handle a server that closes its end.
3423 - answers use casing from query.
3425 25 February 2008: Wouter
3426 - delay utility works. Gets decent thoughput too (>20000).
3428 22 February 2008: Wouter
3429 - +2% for recursions, if identical queries (except for destination
3430 and query ID) in the reply list, avoid re-encoding the answer.
3431 - removed TODO items for optimizations that do not show up in
3433 - default is now minievent - not libevent. As its faster and
3434 not needed for regular installs, only for very large port ranges.
3435 - loop check different speedup pkt-dname-reading, 1% faster for
3436 nocache-recursion check.
3437 - less hashing during msg parse, 4% for recursion.
3438 - small speed fix for dname_count_size_labels, +1 or +2% recursion.
3439 - some speed results noted:
3440 optimization resulted in +40% for recursion (cache miss) and
3441 +70 to +80 for cache hits, and +96% for version.bind.
3442 zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4
3443 www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
3444 www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
3445 So, unbound can be about equal qps to NSD in cache hits.
3446 And about 3.4x faster than BIND in cache performance.
3447 - delay utility for testing.
3449 21 February 2008: Wouter
3450 - speedup of root-delegation message encoding by 15%.
3451 - minor speedup of compress tree_lookup, maybe 1%.
3452 - speedup of dname_lab_cmp and memlowercmp - the top functions in
3453 profiler output, maybe a couple percent when it matters.
3455 20 February 2008: Wouter
3456 - setup speec_cache for need-ldns-testns in dotests.
3457 - check number of queued replies on incoming queries to avoid overload
3459 - fptr whitelist checks are not disabled in optimize mode.
3460 - do-daemonize config file option.
3461 - minievent time share initializes time at start.
3462 - updated testdata for nsec3 new algorithm numbers (6, 7).
3463 - small performance test of packet encoding (root delegation).
3465 19 February 2008: Wouter
3466 - applied patch to unbound-host man page from Jan-Piet Mens.
3467 - fix donotquery-localhost: yes default (it erroneously was switched
3469 - time is only gotten once and the value is shared across unbound.
3470 - unittest cleans up crypto, so that it has no memory leaks.
3471 - mini_event shares the time value with unbound this results in
3472 +3% speed for cache responses and +9% for recursions.
3473 - ldns tarball update with new NSEC3 sign code numbers.
3474 - perform several reads per UDP operation. This improves performance
3475 in DoS conditions, and costs very little in normal conditions.
3476 improves cache response +50%, and recursions +10%.
3477 - modified asynclook test. because the callback from async is not
3478 in any sort of lock (and thus can use all library functions freely),
3479 this causes a tiny race condition window when the last lock is
3480 released for a callback and a new cancel() for that callback.
3481 The only way to remove this is by putting callbacks into some
3482 lock window. I'd rather have the small possibility of a callback
3483 for a cancelled function then no use of library functions in
3484 callbacks. Could be possible to only outlaw process(), wait(),
3485 cancel() from callbacks, by adding another lock, but I'd rather not.
3487 18 February 2008: Wouter
3488 - patch to unbound-host from Jan-Piet Mens.
3489 - unbound host prints errors if fails to configure context.
3490 - fixup perf to resend faster, so that long waiting requests do
3491 not hold up the queue, they become lost packets or SERVFAILs,
3492 or can be sent a little while later (i.e. processing time may
3493 take long, but throughput has to be high).
3494 - fixup iterator operating in no cache conditions (RD flag unset
3496 - streamlined code for RD flag setting.
3497 - profiled code and changed dname compares to be faster.
3498 The speedup is about +3% to +8% (depending on the test).
3499 - minievent tests for eintr and eagain.
3501 15 February 2008: Wouter
3502 - added FreeBSD rc.d script to contrib.
3503 - --prefix option for configure also changes directory: pidfile:
3504 and chroot: defaults in config file.
3505 - added cache speed test, for cache size OK and cache too small.
3507 14 February 2008: Wouter
3508 - start without a config file (will complain, but start with
3510 - perf test program works.
3512 13 February 2008: Wouter
3514 - 1.0 development. Printout ldns version on unbound -h.
3515 - start of perf tool.
3516 - bugfix to read empty lines from /etc/hosts.
3518 12 February 2008: Wouter
3519 - fixup problem with configure calling itself if ldns-src tarball
3522 11 February 2008: Wouter
3523 - changed library to use ub_ instead of ub_val_ as prefix.
3524 - statistics output text nice.
3525 - etc/hosts handling.
3526 - library function to put logging to a stream.
3527 - set any option interface.
3529 8 February 2008: Wouter
3530 - test program for multiple queries over a TCP channel.
3531 - tpkg test for stream tcp queries.
3532 - unbound replies to multiple TCP queries on a TCP channel.
3533 - fixup misclassification of root referral with NS in answer
3534 when validating a nonrec query.
3536 - layout of manpages, spelling fix in header, manpages process by
3537 makedist, list asynclook and tcpstream tests as ldns-testns
3540 7 February 2008: Wouter
3541 - moved up all current level 2 to be level 3. And 3 to 4.
3542 to make room for new debug level 2 for detailed information
3544 - verbosity level 2. Describes recursion and validation.
3545 - cleaner configure script and fixes for libevent solaris.
3546 - signedness for log output memory sizes in high verbosity.
3548 6 February 2008: Wouter
3549 - clearer explanation of threading configure options.
3550 - fixup asynclook test for nothreading (it creates only one process
3551 to do the extended test).
3552 - changed name of ub_val_result_free to ub_val_resolve_free.
3553 - removes warning message during library linking, renamed
3554 libunbound/unbound.c -> libunbound.c and worker to libworker.
3555 - fallback without EDNS if result is NOTIMPL as well as on FORMERR.
3557 5 February 2008: Wouter
3558 - statistics-interval: seconds option added.
3559 - test for statistics option
3560 - ignore errors making directories, these can occur in parallel builds
3561 - fixup Makefile strip command and libunbound docs typo.
3563 31 January 2008: Wouter
3564 - bg thread/process reads and writes the pipe nonblocking all the time
3565 so that even if the pipe is buffered or so, the bg thread does not
3566 block, and services both pipes and queries.
3568 30 January 2008: Wouter
3569 - check trailing / on chrootdir in checkconf.
3570 - check if root hints and anchor files are in chrootdir.
3571 - no route to host tcp error is verbosity level 2.
3572 - removed unused send_reply_iov. and its configure check.
3573 - added prints of 'remote address is 1.2.3.4 port 53' to errors
3574 from netevent; the basic socket errors.
3576 28 January 2008: Wouter
3577 - fixup uninit use of buffer by libunbound (query id, flags) for
3579 - fixup uninit warning from random.c; also seems to fix sporadic
3580 sigFPE coming out of openssl.
3581 - made openssl entropy warning more silent for library use. Needs
3583 - fixup forgotten locks for rbtree_searches on ctx->query tree.
3584 - random generator cleanup - RND_STATE_SIZE removed, and instead
3585 a super-rnd can be passed at init to chain init random states.
3586 - test also does lock checks if available.
3587 - protect config access in libworker_setup().
3588 - libevent doesn't like comm_base_exit outside of runloop.
3589 - close fds after removing commpoints only (for epoll, kqueue).
3591 25 January 2008: Wouter
3592 - added tpkg for asynclook and library use.
3593 - allows localhost to be queried when as a library.
3594 - fixup race condition between cancel and answer (in case of
3595 really fast answers that beat the cancel).
3596 - please doxygen, put doxygen comment in one place.
3597 - asynclook -b blocking mode and test.
3598 - refactor asynclook, nicer code.
3599 - fixup race problems from opensll in rand init from library, with
3600 a mutex around the rand init.
3601 - fix pass async_id=NULL to _async resolve().
3602 - rewrote _wait() routine, so that it is threadsafe.
3603 - cancelation is threadsafe.
3604 - asynclook extended test in tpkg.
3605 - fixed two races where forked bg process waits for (somehow shared?)
3606 locks, so does not service the query pipe on the bg side.
3607 Now those locks are only held for fg_threads and for bg_as_a_thread.
3609 24 January 2008: Wouter
3610 - tested the cancel() function.
3611 - asynclook -c (cancel) feature.
3612 - fix fail to allocate context actions.
3613 - make pipe nonblocking at start.
3614 - update plane for retry mode with caution to limit bandwidth.
3615 - fix Makefile for concurrent make of unbound-host.
3616 - renamed ub_val_ctx_wait/poll/process/fd to ub_val*.
3617 - new calls to set forwarding added to header and docs.
3619 23 January 2008: Wouter
3620 - removed debug prints from if-auto, verb-algo enables some.
3621 - libunbound QUIT setup, remove memory leaks, when using threads
3622 will share memory for passing results instead of writing it over
3623 the pipe, only writes ID number over the pipe (towards the handler
3624 thread that does process() ).
3626 22 January 2008: Wouter
3627 - library code for async in libunbound/unbound.c.
3628 - fix link testbound.
3629 - fixup exit bug in mini_event.
3630 - background worker query enter and result functions.
3631 - bg query test application asynclook, it looks up multiple
3632 hostaddresses (A records) at the same time.
3634 21 January 2008: Wouter
3635 - libworker work, netevent raw commpoints, write_msg, serialize.
3637 18 January 2008: Wouter
3638 - touch up of manpage for libunbound.
3639 - support for IP_RECVDSTADDR (for *BSD ip4).
3640 - fix for BSD, do not use ip4to6 mapping, make two sockets, once
3641 ip6 and once ip4, uses socket options.
3642 - goodbye ip4to6 mapping.
3643 - update ldns-testpkts with latest version from ldns-trunk.
3644 - updated makedist for relative ldns pathnames.
3645 - library API with more information inside the result structure.
3646 - work on background resolves.
3648 17 January 2008: Wouter
3649 - fixup configure in case -lldns is installed.
3650 - fixup a couple of doxygen warnings, about enum variables.
3651 - interface-automatic now copies the interface address from the
3652 PKT_INFO structure as well.
3653 - manual page with library API, all on one page 'man libunbound'.
3654 - rewrite of PKTINFO structure, it also captures IP4 PKTINFO.
3656 16 January 2008: Wouter
3657 - incoming queries to the server with TC bit on are replied FORMERR.
3658 - interface-automatic replied the wrong source address on localhost
3659 queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying
3660 to use ifnum=-1 to mean 'no interface, use kernel route'.
3662 15 January 2008: Wouter
3663 - interface-automatic feature. experimental. Nice for anycast.
3664 - tpkg test for ip6 ancillary data.
3665 - removed debug prints.
3666 - porting experience, define for Solaris, test refined for BSD
3667 compatibility. The feature probably will not work on OpenBSD.
3668 - makedist fixup for ldns-src in build-dir.
3670 14 January 2008: Wouter
3671 - in no debug sets NDEBUG to remove asserts.
3672 - configure --enable-debug is needed for dependency generation
3673 for assertions and for compiler warnings.
3674 - ldns.tgz updated with ldns-trunk (where buffer.h is updated).
3675 - fix lint, unit test in optimize mode.
3676 - default access control allows ::ffff:127.0.0.1 v6mapped localhost.
3678 11 January 2008: Wouter
3679 - man page, warning removed.
3680 - added text describing the use of stub zones for private zones.
3681 - checkconf tests for bad hostnames (IP address), and for doubled
3683 - memory sizes can be given with 'k', 'Kb', or M or G appended.
3685 10 January 2008: Wouter
3686 - typo in example.conf.
3687 - made using ldns-src that is included the package more portable
3688 by linking with .lo instead of .o files in the ldns package.
3689 - nicer do-ip6: yes/no documentation.
3690 - nicer linking of libevent .o files.
3691 - man pages render correctly on solaris.
3693 9 January 2008: Wouter
3694 - fixup openssl RAND problem, when the system is not configured to
3695 give entropy, and the rng needs to be seeded.
3697 8 January 2008: Wouter
3698 - print median and quartiles with extensive logging.
3700 4 January 2008: Wouter
3701 - document misconfiguration in private network.
3703 2 January 2008: Wouter
3704 - fixup typo in requirements.
3705 - document that 'refused' is a better choice than 'drop' for
3706 the access control list, as refused will stop retries.
3708 7 December 2007: Wouter
3709 - unbound-host has a -d option to show what happens. This can help
3710 with debugging (why do I get this answer).
3711 - fixup CNAME handling, on nodata, sets and display canonname.
3712 - dot removed from CNAME display.
3713 - respect -v for NXDOMAINs.
3714 - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes).
3715 - size_t to int for portability of the header file.
3716 - fixup bogus handling.
3717 - dependencies and lint for unbound-host.
3719 6 December 2007: Wouter
3720 - library resolution works in foreground mode, unbound-host app
3722 - unbound-host prints rdata using ldns.
3723 - unbound-host accepts trust anchors, and prints validation
3724 information when you give -v.
3726 5 December 2007: Wouter
3727 - locking in context_new() inside the function.
3728 - setup of libworker.
3730 4 December 2007: Wouter
3731 - minor Makefile fixup.
3732 - moved module-stack code out of daemon/daemon into services/modstack,
3733 preparing for code-reuse.
3734 - move context into own header file.
3735 - context query structure.
3736 - removed unused variable pwd from checkconf.
3737 - removed unused assignment from outside netw.
3738 - check timeval length of string.
3739 - fixup error in val_utils getsigner.
3740 - fixup same (*var) error in netblocktostr.
3741 - fixup memleak on parse error in localzone.
3742 - fixup memleak on packet parse error.
3743 - put ; after union in parser.y.
3744 - small hardening in iter_operate against iq==NULL.
3745 - hardening, if error reply with rcode=0 (noerror) send servfail.
3746 - fixup same (*var) error in find_rrset in msgparse, was harmless.
3747 - check return value of evtimer_add().
3748 - fixup lockorder in lruhash_reclaim(), building up a list of locked
3749 entries one at a time. Instead they are removed and unlocked.
3750 - fptr_wlist for markdelfunc.
3751 - removed is_locked param from lruhash delkeyfunc.
3752 - moved bin_unlock during bin_split purely to please.
3754 3 December 2007: Wouter
3755 - changed checkconf/ to smallapp/ to make room for more support tools.
3756 (such as unbound-host).
3757 - install dirs created with -m 755 because they need to be accessible.
3758 - library extensive featurelist added to TODO.
3759 - please doxygen, lint.
3760 - library test application, with basic functionality.
3761 - fix for building in a subdirectory.
3762 - link lib fix for Leopard.
3764 30 November 2007: Wouter
3765 - makefile that creates libunbound.la, basic file or libunbound.a
3766 when creating static executables (no libtool).
3769 29 November 2007: Wouter
3770 - 0.9 public API start.
3772 28 November 2007: Wouter
3773 - Changeup plan for 0.8 - no complication needed, a simple solution
3774 has been chosen for authoritative features.
3775 - you can use single quotes in the config file, so it is possible
3776 to specify TXT records in local data.
3777 - fixup small memory problem in implicit transparent zone creation.
3778 - test for implicit zone creation and multiple RR RRsets local data.
3779 - local-zone nodefault test.
3780 - show testbound testlist on commit.
3781 - iterator normalizer changes CNAME chains ending in NXDOMAIN where
3782 the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial
3784 - nicer verbosity: 0 and 1 levels.
3785 - lower nonRDquery chance of eliciting wrongly typed validation
3786 requiring message from the cache.
3787 - fix for nonRDquery validation typing; nodata is detected when
3788 SOA record in auth section (all validation-requiring nodata messages
3789 have a SOA record in authority, so this is OK for the validator),
3790 and NS record is needed to be a referral.
3791 - duplicate checking when adding NSECs for a CNAME, and test.
3792 - created svn tag 0.8, after completing testbed tests.
3794 27 November 2007: Wouter
3795 - per suggestion in rfc2308, replaced default max-ttl value with 1 day.
3796 - set size of msgparse lookup table to 32, from 1024, so that its size
3797 is below the 2048 regional large size threshold, and does not cause
3798 a call to malloc when a message is parsed.
3799 - update of memstats tool to print number of allocation calls.
3800 This is what is taking time (not space) and indicates the avg size
3801 of the allocations as well. region_alloc stat is removed.
3803 22 November 2007: Wouter
3804 - noted EDNS in-the-middle dropping trouble as a TODO.
3805 At this point theoretical, no user trouble has been reported.
3806 - added all default AS112 zones.
3807 - answers from local zone content.
3808 * positive answer, the rrset in question
3809 * nodata answer (exist, but not that type).
3810 * nxdomain answer (domain does not exist).
3811 * empty-nonterminal answer.
3812 * But not: wildcard, nsec, referral, rrsig, cname/dname,
3813 or additional section processing, NS put in auth.
3814 - test for correct working of static and transparent and couple
3815 of important defaults (localhost, as112, reverses).
3816 Also checks deny and refuse settings.
3817 - fixup implicit zone generation and AA bit for NXDOMAIN on localdata.
3819 21 November 2007: Wouter
3820 - local zone internal data setup.
3822 20 November 2007: Wouter
3823 - 0.8 - str2list config support for double string config options.
3824 - local-zone and local-data options, config storage and documentation.
3826 19 November 2007: Wouter
3827 - do not downcase NSEC and RRSIG for verification. Follows
3828 draft-ietf-dnsext-dnssec-bis-updates-06.txt.
3829 - fixup leaking unbound daemons at end of tests.
3830 - README file updated.
3831 - nice libevent not found error.
3832 - README talks about gnu make.
3833 - 0.8: unit test for addr_mask and fixups for it.
3834 and unit test for addr_in_common().
3835 - 0.8: access-control config file element.
3836 and unit test rpl replay file.
3837 - 0.8: fixup address reporting from netevent.
3839 16 November 2007: Wouter
3840 - privilege separation is not needed in unbound at this time.
3841 TODO item marked as such.
3842 - created beta-0.7 branch for support.
3843 - tagged 0.7 for beta release.
3844 - moved trunk to 0.8 for 0.8(auth features) development.
3845 - 0.8: access control list setup.
3847 15 November 2007: Wouter
3848 - review fixups from Jelte.
3850 14 November 2007: Wouter
3851 - testbed script does not recreate configure, since its in svn now.
3852 - fixup checkconf test so that it does not test
3853 /etc/unbound/unbound.conf.
3856 13 November 2007: Wouter
3857 - remove debug print.
3858 - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists.
3860 12 November 2007: Wouter
3861 - fixup signal handling where SIGTERM could be ignored if a SIGHUP
3863 - bugreports to unbound-bugs@nlnetlabs.nl
3864 - fixup testbound so it exits cleanly.
3865 - cleanup the caches on a reload, so that rrsetID numbers won't clash.
3867 9 November 2007: Wouter
3868 - took ldns snapshot in repo.
3869 - default config file is /etc/unbound/unbound.conf.
3870 If it doesn't exist, it is installed with the doc/example.conf file.
3871 The file is not deleted on uninstall.
3872 - default listening is not all, but localhost interfaces.
3874 8 November 2007: Wouter
3875 - Fixup chroot and drop user privileges.
3876 - new L root ip address in default hints.
3878 1 November 2007: Wouter
3879 - Fixup of crash on reload, due to anchors in env not NULLed after
3880 dealloc during deinit.
3881 - Fixup of chroot call. Happens after privileges are dropped, so
3882 that checking the passwd entry still works.
3883 - minor touch up of clear() hashtable function.
3884 - VERB_DETAIL prints out what chdir, username, chroot is being done.
3885 - when id numbers run out, caches are cleared, as in design notes.
3886 Tested with a mock setup with very few bits in id, it worked.
3887 - harden-dnssec-stripped: yes is now default. It insists on dnssec
3888 data for trust anchors. Included tests for the feature.
3890 31 October 2007: Wouter
3891 - cache-max-ttl config option.
3892 - building outside sourcedir works again.
3893 - defaults more secure:
3895 chroot: "/etc/unbound"
3896 The operator can override them to be less secure ("") if necessary.
3897 - fix horrible oversight in sorting rrset references in a message,
3898 sort per reference key pointer, not on referencepointer itself.
3899 - pidfile: "/etc/unbound/unbound.pid" is now the default.
3900 - tests changed to reflect the updated default.
3901 - created hashtable clear() function that respects locks.
3903 30 October 2007: Wouter
3904 - fixup assertion failure that relied on compressed names to be
3905 smaller than uncompressed names. A packet from comrite.com was seen
3906 to be compressed to a larger size. Added it as unit test.
3907 - quieter logging at low verbosity level for common tcp messages.
3908 - no greedy TTL update.
3910 23 October 2007: Wouter
3911 - fixup (grand-)parent problem for dnssec-lameness detection.
3912 - fixup tests to do additional section processing for lame replies,
3913 since the detection needs that.
3914 - no longer trust in query section in reply during dnssec lame detect.
3915 - dnssec lameness does not make the server never ever queried, but
3916 non-preferred. If no other servers exist or answer, the dnssec lame
3917 server is used; the fastest dnssec lame server is chosen.
3918 - added test then when trust anchor cannot be primed (nodata), the
3919 insecure mode from unbound works.
3920 - Fixup max queries per thread, any more are dropped.
3922 22 October 2007: Wouter
3923 - added donotquerylocalhost config option. Can be turned off for
3925 - ISO C compat changes.
3926 - detect RA-no-AA lameness, as LAME.
3927 - DNSSEC-lameness detection, as LAME.
3928 See notes in requirements.txt for choices made.
3929 - tests for lameness detection.
3930 - added all to make test target; need unbound for fwd tests.
3931 - testbound does not pollute /etc/unbound.
3933 19 October 2007: Wouter
3934 - added configure (and its files) to svn, so that the trunk is easier
3935 to use. ./configure, config.guess, config.sub, ltmain.sh,
3937 - added yacc/lex generated files, util/configlexer.c,
3938 util/configparser.c util/configparser.h, to svn.
3939 - without lex no attempt to use it.
3940 - unsecure response validation collated into one block.
3941 - remove warning about const cast of cfgfile name.
3942 - outgoing-interfaces can be different from service interfaces.
3943 - ldns-src configure is done during unbound configure and
3944 ldns-src make is done during unbound make, and so inherits the
3945 make arguments from the unbound make invocation.
3946 - nicer error when libevent problem causes instant exit on signal.
3947 - read root hints from a root hint file (like BIND does).
3949 18 October 2007: Wouter
3950 - addresses are logged with errors.
3951 - fixup testcode fake event to remove pending before callback
3952 since the callback may create new pending items.
3953 - tests updated because retries are now in iterator module.
3954 - ldns-testpkts code is checked for differences between unbound
3955 and ldns by makedist.sh.
3956 - ldns trunk from today added in svn repo for fallback in case
3957 no ldns is installed on the system.
3958 make download_ldns refreshes the tarball with ldns svn trunk.
3959 - ldns-src.tar.gz is used if no ldns is found on the system, and
3960 statically linked into unbound.
3961 - start of regional allocator code.
3962 - regional uses less memory and variables, simplified code.
3963 - remove of region-allocator.
3964 - alloc cache keeps a cache of recently released regional blocks,
3966 - make unit test cleanly free memory.
3968 17 October 2007: Wouter
3969 - fixup another cycle detect and ns-addr timeout resolution bug.
3970 This time by refusing delegations from the cache without addresses
3971 when resolving a mandatory-glue nameserver-address for that zone.
3972 We're going to have to ask a TLD server anyway; might as well be
3973 the TLD server for this name. And this resolves a lot of cases where
3974 the other nameserver names lead to cycles or are not available.
3975 - changed random generator from random(3) clone to arc4random wrapped
3976 for thread safety. The random generator is initialised with
3977 entropy from the system.
3978 - fix crash where failure to prime DNSKEY tried to print null pointer
3980 - removed some debug prints, only verb_algo (4) enables them.
3981 - fixup test; new random generator took new paths; such as one
3982 where no scripted answer was available.
3983 - mark insecure RRs as insecure.
3984 - fixup removal of nonsecure items from the additional.
3985 - reduced timeout values to more realistic, 376 msec (262 msec has
3986 90% of roundtrip times, 512 msec has 99% of roundtrip times.)
3987 - server selection failover to next server after timeout (376 msec).
3989 16 October 2007: Wouter
3990 - no malloc in log_hex.
3991 - assertions around system calls.
3992 - protect against gethostname without ending zero.
3993 - ntop output is null terminated by unbound.
3994 - pidfile content null termination
3995 - various snprintf use sizeof(stringbuf) instead of fixed constant.
3996 - changed loopdetect % 8 with & 0x7 since % can become negative for
3997 weird negative input and particular interpretation of integer math.
3998 - dname_pkt_copy checks length of result, to protect result buffers.
3999 prints an error, this should not happen. Bad strings should have
4000 been rejected earlier in the program.
4001 - remove a size_t underflow from msgreply size func.
4003 15 October 2007: Wouter
4005 - fix IP6 TCP, wrong definition check. With test package.
4006 - fixup the fact that the query section was not compressed to,
4007 the code was there but was called by value instead of by reference.
4008 And test for the case, uses xxd and nc.
4009 - more portable ip6 check for sockaddr types.
4011 8 October 2007: Wouter
4012 - --disable-rpath option in configure for 64bit systems with
4013 several dynamic lib dirs.
4015 7 October 2007: Wouter
4016 - fixup tests for no AD bit in non-DO queries.
4017 - test that makes sure AD bit is not set on non-DO query.
4019 6 October 2007: Wouter
4020 - removed logfile open early. It did not have the proper permissions;
4021 it was opened as root instead of the user. And we cannot change user
4022 id yet, since chroot and bind ports need to be done.
4023 - callback checks for event callbacks done from mini_event. Because
4024 of deletions cannot do this from netevent. This means when using
4025 libevent the protection does not work on event-callbacks.
4026 - fixup too small reply (did not zero counts).
4027 - fixup reply no longer AD bit when query without DO bit.
4029 5 October 2007: Wouter
4030 - function pointer whitelist.
4032 4 October 2007: Wouter
4033 - overwrite sensitive random seed value after use.
4034 - switch to logfile very soon if not -d (console attached).
4035 - error messages do not reveal the trustanchor contents.
4036 - start work on function pointer whitelists.
4038 3 October 2007: Wouter
4039 - fix for multiple empty nonterminals, after multiple DSes in the
4041 - mesh checks if modules are looping, and stops them.
4042 - refetch with CNAMEd nameserver address regression test added.
4043 - fixup line count bug in testcode, so testbound prints correct line
4044 number with parse errors.
4045 - unit test for multiple ENT case.
4046 - fix for cname out of validated unsec zone.
4047 - fixup nasty id=0 reuse. Also added assertions to detect its
4048 return (the assertion catches in the existing test cases).
4050 1 October 2007: Wouter
4051 - skip F77, CXX, objC tests in configure step.
4052 - fixup crash in refetch glue after a CNAME.
4053 and protection against similar failures (with error print).
4055 28 September 2007: Wouter
4056 - test case for unbound-checkconf, fixed so it also checks the
4057 interface: statements.
4059 26 September 2007: Wouter
4060 - SIGHUP will reopen the log file.
4061 - Option to log to syslog.
4062 - please lint, fixup tests (that went to syslog on open, oops).
4063 - config check program.
4065 25 September 2007: Wouter
4066 - tests for NSEC3. Fixup bitmap checks for NSEC3.
4067 - positive ANY response needs to check if wildcard expansion, and
4068 check that original data did not exist.
4069 - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure
4070 delegation, for abuse of child zone apex nsec3.
4071 - create 0.5 release tag.
4073 24 September 2007: Wouter
4074 - do not make test programs by default.
4075 - But 'make test' will perform all of the tests.
4076 - Advertise builtin select libevent alternative when no libevent
4078 - signit can generate NSEC3 hashes, for generating tests.
4079 - multiple nsec3 paramaters in message test.
4080 - too high nsec3 iterations becomes insecure test.
4082 21 September 2007: Wouter
4083 - fixup empty_DS_name allocated in wrong region (port DEC Alpha).
4084 - fixup testcode lock safety (port FreeBSD).
4085 - removes subscript has type char warnings (port Solaris 9).
4086 - fixup of field with format type to int (port MacOS/X intel).
4087 - added test for infinite loop case in nonRD answer validation.
4088 It was a more general problem, but hard to reproduce. When an
4089 unsigned rrset is being validated and the key fetched, the DS
4090 sequence is followed, but if the final name has no DS, then no
4091 proof is possible - the signature has been stripped off.
4093 20 September 2007: Wouter
4094 - fixup and test for NSEC wildcard with empty nonterminals.
4095 - makedist.sh fixup for svn info.
4096 - acl features request in plan.
4097 - improved DS empty nonterminal handling.
4098 - compat with ANS nxdomain for empty nonterminals. Attempts the nodata
4099 proof anyway, which succeeds in ANS failure case.
4100 - striplab protection in case it becomes -1.
4101 - plans for static and blacklist config.
4103 19 September 2007: Wouter
4104 - comments about non-packed usage.
4105 - plan for overload support in 0.6.
4106 - added testbound tests for a failed resolution from the logs
4107 and for failed prime when missing glue.
4108 - fixup so useless delegation points are not returned from the
4109 cache. Also the safety belt is used if priming fails to complete.
4110 - fixup NSEC rdata not to be lowercased, bind compat.
4112 18 September 2007: Wouter
4113 - wildcard nsec3 testcases, and fixup to get correct wildcard name.
4114 - validator prints subtype classification for debug.
4116 17 September 2007: Wouter
4117 - NSEC3 hash cache unit test.
4118 - validator nsec3 nameerror test.
4120 14 September 2007: Wouter
4121 - nsec3 nodata proof, nods proof, wildcard proof.
4122 - nsec3 support for cname chain ending in noerror or nodata.
4123 - validator calls nsec3 proof routines if no NSECs prove anything.
4124 - fixup iterator bug where it stored the answer to a cname under
4125 the wrong qname into the cache. When prepending the cnames, the
4126 qname has to be reset to the original qname.
4128 13 September 2007: Wouter
4129 - nsec3 find matching and covering, ce proof, prove namerror msg.
4131 12 September 2007: Wouter
4132 - fixup of manual page warnings, like for NSD bugreport.
4133 - nsec3 work, config, max iterations, filter, and hash cache.
4135 6 September 2007: Wouter
4136 - fixup to find libevent on mac port install.
4137 - fixup size_t vs unsigned portability in validator/sigcrypt.
4138 - please compiler on different platforms, for unreachable code.
4140 - pthread_rwlock type is optional, in case of old pthread libs.
4142 5 September 2007: Wouter
4143 - cname, name error validator tests.
4144 - logging of qtype ANY works.
4145 - ANY type answers get RRSIG in answer section of replies (but not
4146 in other sections, unless DO bit is on).
4147 - testbound can replay a TCP query (set MATCH TCP in the QUERY).
4148 - DS and noDS referral validation test.
4149 - if you configure many trust anchors, parent trust anchors can
4150 securely deny existance of child trust anchors, if validated.
4151 - not all *.name NSECs are present because a wildcard was matched,
4152 and *.name NSECs can prove nodata for empty nonterminals.
4153 Also, for wildcard name NSECs, check they are not from the parent
4154 zone (for wildcarded zone cuts), and check absence of CNAME bit,
4156 - configure option for memory allocation debugging.
4157 - port configure option for memory allocation to solaris10.
4159 4 September 2007: Wouter
4160 - fixup of Leakage warning when serviced queries processed multiple
4161 callbacks for the same query from the same server.
4162 - testbound removes config file from /tmp on failed exit.
4163 - fixup for referral cleanup of the additional section.
4164 - tests for cname, referral validation.
4165 - neater testbound tpkg output.
4166 - DNAMEs no longer match their apex when synthesized from the cache.
4167 - find correct signer name for DNAME responses.
4168 - wildcarded DNAME test and fixup code to detect.
4169 - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs.
4170 So that wildcarded CNAMEs get their NSEC with them to the answer.
4171 - test for a CNAME to a DNAME to a CNAME to an answer, all from
4172 different domains, for key fetching and signature checking of
4175 3 September 2007: Wouter
4176 - Fixed error in iterator that would cause assertion failure in
4177 validator. CNAME to a NXDOMAIN response was collated into a response
4178 with both a CNAME and the NXDOMAIN rcode. Added a test that the
4179 rcode is changed to NOERROR (because of the CNAME).
4180 - timeout on tcp does not lead to spurious leakage detect.
4181 - account memory for name of lame zones, so that memory leakages does
4182 not show lame cache growth as a leakage growth.
4183 - config setting for lameness cache expressed in bytes, instead of
4185 - tool too summarize allocations per code line.
4187 31 August 2007: Wouter
4188 - can read bind trusted-keys { ... }; files, in a compatibility mode.
4189 - iterator should not detach target queries that it still could need.
4190 the protection against multiple outstanding queries is moved to a
4191 current_query num check.
4192 - validator nodata, positive, referral tests.
4193 - dname print can print '*' wildcard.
4195 30 August 2007: Wouter
4196 - fixup override date config option.
4197 - config options to control memory usage.
4198 - caught bad free of un-alloced data in worker_send error case.
4199 - memory accounting for key cache (trust anchors and temporary cache).
4200 - memory accounting fixup for outside network tcp pending waits.
4201 - memory accounting fixup for outside network tcp callbacks.
4202 - memory accounting for iterator fixed storage.
4203 - key cache size and slabs config options.
4204 - lib crypto cleanups at exit.
4206 29 August 2007: Wouter
4207 - test tool to sign rrsets for testing validator with.
4208 - added RSA and DSA test keys, public and private pairs, 512 bits.
4209 - default configuration is with validation enabled.
4210 Only a trust-anchor needs to be configured for DNSSEC to work.
4211 - do not convert to DER for DSA signature verification.
4212 - validator replay test file, for a DS to DNSKEY DSA key prime and
4215 28 August 2007: Wouter
4216 - removed double use for udp buffers, that could fail,
4217 instead performs a malloc to do the backup.
4218 - validator validates referral messages, by validating all the rrsets
4219 and stores the rrsets in the cache. Further referral (nonRD queries)
4220 replies are made from the rrset cache directly. Unless unchecked
4221 rrsets are encountered, there are then validated.
4222 - enforce that signing is done by a parent domain (or same domain).
4223 - adjust TTL downwards if rrset TTL bigger than signature allows.
4224 - permissive mode feature, sets AD bit for secure, but bogus does
4225 not give servfail (bogus is changed into indeterminate).
4226 - optimization of rrset verification. rr canonical sorting is reused,
4227 for the same rrset. canonical rrset image in buffer is reused for
4229 - if the rrset is too big (64k exactly + large owner name) the
4230 canonicalization routine will fail if it does not fit in buffer.
4231 - faster verification for large sigsets.
4232 - verb_detail mode reports validation failures, but not the entire
4233 algorithm for validation. Key prime failures are reported as
4236 27 August 2007: Wouter
4237 - do not garble the edns if a cache answer fails.
4238 - answer norecursive from cache if possible.
4239 - honor clean_additional setting when returning secure non-recursive
4241 - do not store referral in msg cache for nonRD queries.
4242 - store verification status in the rrset cache to speed up future
4244 - mark rrsets indeterminate and insecure if they are found to be so.
4245 and store this in the cache.
4247 24 August 2007: Wouter
4248 - message is bogus if unsecure authority rrsets are present.
4249 - val-clean-additional option, so you can turn it off.
4250 - move rrset verification out of the specific proof types into one
4251 routine. This makes the proof routines prettier.
4252 - fixup cname handling in validator, cname-to-positive and cname-to-
4254 - Do not synthesize DNSKEY and DS responses from the rrset cache if
4255 the rrset is from the additional section. Signatures may have
4256 fallen off the packet, and cause validation failure.
4257 - more verbose signature date errors (with the date attached).
4258 - increased default infrastructure cache size. It is important for
4259 performance, and 1000 entries are only 212k (or a 400 k total cache
4260 size). To 10000 entries (for 2M entries, 4M cache size).
4262 23 August 2007: Wouter
4263 - CNAME handling - move needs_validation to before val_new().
4264 val_new() setups the chase-reply to be an edited copy of the msg.
4265 new classification, and find signer can find for it.
4266 removal of unsigned crap from additional, and query restart for
4268 - refuse to follow wildcarded DNAMEs when validating.
4269 But you can query for qtype ANY, or qtype DNAME and validate that.
4271 22 August 2007: Wouter
4273 - review - use val_error().
4275 21 August 2007: Wouter
4276 - ANY response validation.
4277 - store security status in cache.
4278 - check cache security status and either send the query to be
4279 validated, return the query to client, or send servfail to client.
4280 Sets AD bit on validated replies.
4281 - do not examine security status on an error reply in mesh_done.
4282 - construct DS, DNSKEY messages from rrset cache.
4283 - manual page entry for override-date.
4285 20 August 2007: Wouter
4286 - validate and positive validation, positive wildcard NSEC validation.
4287 - nodata validation, nxdomain validation.
4289 18 August 2007: Wouter
4290 - process DNSKEY response in FINDKEY state.
4292 17 August 2007: Wouter
4293 - work on DS2KE routine.
4294 - val_nsec.c for validator NSEC proofs.
4295 - unit test for NSEC bitmap reading.
4296 - dname iswild and canonical_compare with unit tests.
4298 16 August 2007: Wouter
4300 - latest release libevent 1.3c and 1.3d have threading fixed.
4301 - key entry fixup data pointer and ttl absolute.
4302 - This makes a key-prime succeed in validator, with DS or DNSKEY as
4304 - fixup canonical compare byfield routine, fix bug and also neater.
4305 - fixed iterator response type classification for queries of type
4307 dig ANY gives sometimes NS rrset in AN and NS section, and parser
4308 removes the NS section duplicate. dig NS gives sometimes the NS
4309 in the answer section, as referral.
4310 - validator FINDKEY state.
4312 15 August 2007: Wouter
4313 - crypto calls to verify signatures.
4314 - unit test for rrsig verification.
4316 14 August 2007: Wouter
4317 - default outgoing ports changed to avoid port 2049 by default.
4318 This port is widely blocked by firewalls.
4319 - count infra lameness cache in memory size.
4320 - accounting of memory improved
4321 - outbound entries are allocated in the query region they are for.
4322 - extensive debugging for memory allocations.
4323 - --enable-lock-checks can be used to enable lock checking.
4324 - protect undefs in config.h from autoheaders ministrations.
4325 - print all received udp packets. log hex will print on multiple
4327 - fixed error in parser with backwards rrsig references.
4328 - mark cycle targets for iterator did not have CD flag so failed
4331 13 August 2007: Wouter
4332 - fixup makefile, if lexer is missing give nice error and do not
4333 mess up the dependencies.
4334 - canonical compare routine updated.
4335 - canonical hinfo compare.
4336 - printout list of the queries that the mesh is working on.
4338 10 August 2007: Wouter
4339 - malloc and free overrides that track total allocation and frees.
4340 for memory debugging.
4341 - work on canonical sort.
4343 9 August 2007: Wouter
4344 - canonicalization, signature checks
4345 - dname signature label count and unit test.
4346 - added debug heap size print to memory printout.
4347 - typo fixup in worker.c
4348 - -R needed on solaris.
4349 - validator override option for date check testing.
4351 8 August 2007: Wouter
4352 - ldns _raw routines created (in ldns trunk).
4353 - sigcrypt DS digest routines
4354 - val_utils uses sigcrypt to perform signature cryptography.
4355 - sigcrypt keyset processing
4357 7 August 2007: Wouter
4358 - security status type.
4359 - security status is copied when rdata is equal for rrsets.
4360 - rrset id is updated to invalidate all the message cache entries
4361 that refer to NSEC, NSEC3, DNAME rrsets that have changed.
4363 - val_sigcrypt file for validator signature checks.
4365 6 August 2007: Wouter
4366 - key cache for validator.
4367 - moved isroot and dellabel to own dname routines, with unit test.
4369 3 August 2007: Wouter
4371 - scrubber check section of lame NS set.
4372 - trust anchors can be in config file or read from zone file,
4373 DS and DNSKEY entries.
4374 - unit test trust anchor storage.
4375 - trust anchors converted to packed rrsets.
4376 - key entry definition.
4378 2 August 2007: Wouter
4379 - configure change for latest libevent trunk version (needs -lrt).
4380 - query_done and walk_supers are moved out of module interface.
4381 - fixup delegation point duplicates.
4382 - fixup iterator scrubber; lame NS set is let through the scrubber
4383 so that the classification is lame.
4384 - validator module exists, and does nothing but pass through,
4385 with calling of next module and return.
4388 1 August 2007: Wouter
4389 - set version to 0.5
4390 - module work for module to module interconnections.
4391 - config of modules.
4392 - detect cycle takes flags.
4394 31 July 2007: Wouter
4398 30 July 2007: Wouter
4399 - changed random state init, so that sequential process IDs are not
4400 cancelled out by sequential thread-ids in the random number seed.
4401 - the fwd_three test, which sends three queries to unbound, and
4402 unbound is kept waiting by ldns-testns for 3 seconds, failed
4403 because the retry timeout for default by unbound is 3 seconds too,
4404 it would hit that timeout and fail the test. Changed so that unbound
4405 is kept waiting for 2 seconds instead.
4407 27 July 2007: Wouter
4408 - removed useless -C debug option. It did not work.
4409 - text edit of documentation.
4410 - added doc/CREDITS file, referred to by the manpages.
4413 26 July 2007: Wouter
4414 - cycle detection, for query state dependencies. Will attempt to
4415 circumvent the cycle, but if no other targets available fails.
4416 - unit test for AXFR, IXFR response.
4417 - test for cycle detection.
4419 25 July 2007: Wouter
4420 - testbound read ADDRESS and check it.
4421 - test for version.bind and friends.
4422 - test for iterator chaining through several referrals.
4423 - test and fixup for refetch for glue. Refetch fails if glue
4424 is still not provided.
4426 24 July 2007: Wouter
4427 - Example section in config manual.
4428 - Addr stored for range and moment in replay.
4430 20 July 2007: Wouter
4431 - Check CNAME chain before returning cache entry with CNAMEs.
4432 - Option harden-glue, default is on. It will discard out of zone
4433 data. If disabled, performance is faster, but spoofing attempts
4434 become a possibility. Note that still normalize scrubbing is done,
4435 and that the potentially spoofed data is used for infrastructure
4436 and not returned to the client.
4437 - if glue times out, refetch by asking parent of delegation again.
4438 Much like asking for DS at the parent side.
4439 - TODO items from forgery-resilience draft.
4440 and on memory handling improvements.
4441 - renamed module_event_timeout to module_event_noreply.
4442 - memory reporting code; reports on memory usage after handling
4443 a network packet (not on cache replies).
4445 19 July 2007: Wouter
4446 - shuffle NS selection when getting nameserver target addresses.
4447 - fixup of deadlock warnings, yield cpu in checklock code so that
4448 freebsd scheduler selects correct process to run.
4449 - added identity and version config options and replies.
4450 - store cname messages complete answers.
4452 18 July 2007: Wouter
4453 - do not query addresses, 127.0.0.1, and ::1 by default.
4455 17 July 2007: Wouter
4456 - forward zone options in config file.
4457 - forward per zone in iterator. takes precendence over stubs.
4458 - fixup commithooks.
4459 - removed forward-to and forward-to-port features, subsumed by
4461 - fix parser to handle absent server: clause.
4462 - change untrusted rrset test to account for scrubber that is now
4463 applied during the test (which removes the poison, by the way).
4464 - feature, addresses can be specified with @portnumber, like nsd.conf.
4465 - test config files changed over to new forwarder syntax.
4467 27 June 2007: Wouter
4468 - delete of mesh does a postorder traverse of the tree.
4469 - found and fixed a memory leak. For TTL=0 messages, that would
4470 not be cached, instead the msg-replyinfo structure was leaked.
4471 - changed server selection so it will filter out hosts that are
4472 unresponsive. This is defined as a host with the maximum rto value.
4473 This means that unbound tried the host for retries up to 120 secs.
4474 The rto value will time out after host-ttl seconds from the cache.
4475 This keeps such unresolvable queries from taking up resources.
4476 - utility for keeping histogram.
4478 26 June 2007: Wouter
4479 - mesh is called by worker, and iterator uses it.
4480 This removes the hierarchical code.
4481 QueryTargets state and Finished state are merged for iterator.
4482 - forwarder mode no longer sets AA bit on first reply.
4483 - rcode in walk_supers is not needed.
4485 25 June 2007: Wouter
4487 - error encode routine for ease.
4489 22 June 2007: Wouter
4490 - removed unused _node iterator value from rbtree_t. Takes up space.
4491 - iterator can handle querytargets state without a delegation point
4492 set, so that a priming(stub) subquery error can be handled.
4493 - iterator stores if it is priming or not.
4494 - log_query_info() neater logging.
4495 - changed iterator so that it does not alter module_qstate.qinfo
4496 but keeps a chase query info. Also query_flags are not altered,
4497 the iterator uses chase_flags.
4498 - fixup crash in case no ports for the family exist.
4500 21 June 2007: Wouter
4501 - Fixup secondary buffer in case of error callback.
4502 - cleanup slumber list of runnable states.
4503 - module_subreq_depth fails to work in slumber list.
4504 - fixup query release for cached results to sub targets.
4505 - neater error for tcp connection failure, shows addr in verbose.
4506 - rbtree_init so that it can be used with preallocated memory.
4508 20 June 2007: Wouter
4509 - new -C option to enable coredumps after forking away.
4511 - fixup CNAME generation by scrubber, and memory allocation of it.
4512 - fixup deletion of serviced queries when all callbacks delete too.
4513 - set num target queries to 0 when you move them to slumber list.
4514 - typo in check caused subquery errors to be ignored, fixed.
4515 - make lint happy about rlim_t.
4516 - freeup of modules after freeup of module-states.
4517 - duplicate replies work, this uses secondary udp buffer in outnet.
4519 19 June 2007: Wouter
4520 - nicer layout in stats.c, review 0.3 change.
4521 - spelling improvement, review 0.3 change.
4522 - uncapped timeout for server selection, so that very fast or slow
4523 servers will stand out from the rest.
4524 - target-fetch-policy: "3 2 1 0 0" config setting.
4525 - fixup queries answered without RD bit (for root prime results).
4526 - refuse AXFR and IXFR requests.
4527 - fixup RD flag in error reply from iterator. fixup RA flag from
4529 - fixup encoding of very short edns buffer sizes, now sets TC bit.
4530 - config options harden-short-bufsize and harden-large-queries.
4532 18 June 2007: Wouter
4533 - same, move subqueries to slumber list when first has resolved.
4534 - fixup last fix for duplicate callbacks.
4535 - another offbyone in targetcounter. Also in Java prototype by the way.
4537 15 June 2007: Wouter
4538 - if a query asks to be notified of the same serviced query result
4539 multiple times, this will succeed. Only one callback will happen;
4540 multiple outbound-list entries result (but the double cleanup of it
4542 - when iterator moves on due to CNAME or referral, it will remove
4543 the subqueries (for other targets). These are put on the slumber
4545 - state module wait subq is OK with no new subqs, an old one may have
4546 stopped, with an error, and it is still waiting for other ones.
4547 - if a query loops, halt entire query (easy way to clean up properly).
4549 14 June 2007: Wouter
4550 - num query targets was > 0 , not >= 0 compared, so that fetch
4551 policy of 0 did nothing.
4553 13 June 2007: Wouter
4554 - debug option: configure --enable-static-exe for compile where
4555 ldns and libevent are linked statically. Default is off.
4556 - make install and make uninstall. Works with static-exe and without.
4557 installation of unbound binary and manual pages.
4558 - alignement problem fix on solaris 64.
4559 - fixup address in case of TCP error.
4561 12 June 2007: Wouter
4562 - num target queries was set to 0 at a bad time. Default it to 0 and
4563 increase as target queries are done.
4564 - synthesize CNAME and DNAME responses from the cache.
4565 - Updated doxygen config for doxygen 1.5.
4566 - aclocal newer version.
4567 - doxygen 1.5 fixes for comments (for the strict check on docs).
4569 11 June 2007: Wouter
4570 - replies on TCP queries have the address field set in replyinfo,
4571 for serviced queries, because the initiator does not know that
4572 a TCP fallback has occured.
4573 - omit DNSSEC types from nonDO replies, except if qtype is ANY or
4574 if qtype directly queries for the type (and then only show that
4575 'unknown type' in the answer section).
4576 - fixed message parsing where rrsigs on their own would be put
4577 in the signature list over the rrsig type.
4580 - fixup error in double linked list insertion for subqueries and
4581 for outbound list of serviced queries for iterator module.
4582 - nicer printout of outgoing port selection.
4583 - fixup cname target readout.
4584 - nicer debug output.
4585 - fixup rrset counts when prepending CNAMEs to the answer.
4586 - fixup rrset TTL for prepended CNAMEs.
4587 - process better check for looping modules, and which submodule to
4589 - subreq insertion code fixup for slumber list.
4590 - VERB_DETAIL, verbosity: 2 level gives short but readable output.
4591 VERB_ALGO, verbosity: 3 gives extensive output.
4592 - fixup RA bit in cached replies.
4593 - fixup CNAME responses from the cache no longer partial response.
4594 - error in network send handled without leakage.
4595 - enable ip6 from config, and try ip6 addresses if available,
4596 if ip6 is not connected, skips to next server.
4599 - iterator state finished.
4600 - subrequests without parent store in cache and stop.
4601 - worker slumber list for ongoing promiscuous queries.
4602 - subrequest error handling.
4603 - priming failure returns SERVFAIL.
4604 - priming gives LAME result, returns SERVFAIL.
4605 - debug routine to print dns_msg as handled by iterator.
4606 - memleak in config file stubs fixup.
4607 - more small bugs, in scrubber, query compare no ID for lookup,
4608 in dname validation for NS targets.
4609 - sets entry.key for new special allocs.
4610 - lognametypeclass can display unknown types and classes.
4613 - random selection of equally preferred nameserver targets.
4614 - reply info copy routine. Reuses existing code.
4615 - cache lameness in response handling.
4616 - do not touch qstate after worker_process_query because it may have
4617 been deleted by that routine.
4618 - Prime response state.
4619 - Process target response state.
4620 - some memcmp changed to dname_compare for case preservation.
4623 - normalize incoming messages. Like unbound-java, with CNAME chain
4624 checked, DNAME checked, CNAME's synthesized, glue checked.
4625 - sanitize incoming messages.
4626 - split msgreply encode functions into own file msgencode.c.
4627 - msg_parse to queryinfo/replyinfo conversion more versatile.
4628 - process_response, classify response, delegpt_from_message.
4631 - querytargets state.
4632 - dname_subdomain_c() routine.
4633 - server selection, based on RTT. ip6 is filtered out if not available,
4634 and lameness is checked too.
4635 - delegation point copy routine.
4638 - removed FLAG_CD from message and rrset caches. This was useful for
4639 an agnostic forwarder, but not for a sophisticated (trust value per
4640 rrset enabled) cache.
4641 - iterator reponse typing.
4642 - iterator cname handle.
4643 - iterator prime start.
4645 - processInitRequest and processInitRequest2.
4646 - cache synthesizes referral messages, with DS and NSEC.
4647 - processInitRequest3.
4648 - if a request creates multiple subrequests these are all activated.
4651 - routines to lock and unlock array of rrsets moved to cache/rrset.
4652 - lookup message from msg cache (and copy to region).
4653 - fixed cast error in dns msg lookup.
4654 - message with duplicate rrset does not increase its TTLs twice.
4655 - 'qnamesize' changed to 'qname_len' for similar naming scheme.
4658 - Acknowledge use of unbound-java code in iterator. Nicer readme.
4659 - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and
4660 rrset cache from module environment.
4661 - packed rrset key has type and class as easily accessable struct
4662 members. They are still kept in network format for fast msg encode.
4663 - dns cache find_delegation routine.
4664 - iterator main functions setup.
4665 - dns cache lookup setup.
4668 - small changes to prepare for subqueries.
4669 - iterator forwarder feature separated out.
4670 - iterator hints stub code, config file stub code, so that first
4671 testing can proceed locally.
4672 - replay tests now have config option to enable forwarding mode.
4675 - outside network does precise timers for roundtrip estimates for rtt
4676 and for setting timeout for UDP. Pending_udp takes milliseconds.
4677 - cleaner iterator sockaddr conversion of forwarder address.
4678 - iterator/iter_utils and iter_delegpt setup.
4682 - outbound query list for modules and support to callback with the
4683 outbound entry to the module.
4684 - testbound support for new serviced queries.
4685 - test for retry to TCP cannot use testbound any longer.
4686 - testns test for EDNS fallback, test for TCP fallback already exists.
4687 - fixes for no-locking compile.
4688 - mini_event timer precision and fix for change in timeouts during
4689 timeout callback. Fix for fwd_three tests, performed nonexit query.
4692 - small comment on hash table locking.
4693 - outside network serviced queries, contain edns and tcp fallback,
4694 and udp retries and rtt timing.
4697 - lruhash_touch() would cause locking order problems. Fixup in
4698 lock-verify in case locking cycle is found.
4699 - services/cache/rrset.c for rrset cache code.
4700 - special rrset_cache LRU updating function that uses the rrset id.
4701 - no dependencies calculation when make clean is called.
4702 - config settings for infra cache.
4703 - daemon code slightly cleaner, only creates caches once.
4707 - unit test for host cache.
4710 - Port to OS/X and Dec Alpha. Printf format and alignment fixes.
4711 - extensive lock debug report on join timeout.
4712 - proper RTT calculation, in utility code.
4713 - setup of services/cache/infra, host cache.
4716 - iterator/iterator.c module.
4717 - fixup to pass reply_info in testcode and in netevent.
4720 - created release-0.3 svn tag.
4722 - fixed compression - no longer compresses root name.
4725 - outside network cleans up waiting tcp queries on exit.
4727 - testbound replay with retry in TCP mode.
4728 - tpkg test for retry in TCP mode, against ldns-testns server.
4729 - daemon checks max number of open files and complains if not enough.
4730 - test where data expires in the cache.
4731 - compiletests: fixed empty body ifstatements in alloc.c, in case
4735 - outgoing network keeps list of available tcp buffers for outgoing
4737 - outgoing-num-tcp config option.
4738 - outgoing network keeps waiting list of queries waiting for buffer.
4739 - netevent supports outgoing tcp commpoints, nonblocking connects.
4742 - EDNS read from query, used to make reply smaller.
4743 - advertised edns value constants.
4744 - EDNS BADVERS response, if asked for too high edns version.
4745 - EDNS extended error reponses once the EDNS record from the query
4746 has successfully been parsed.
4749 - msgreply sizefunc is more accurate.
4750 - config settings for rrset cache size and slabs.
4751 - hashtable insert takes argument so that a thread can use its own
4752 alloc cache to store released keys.
4753 - alloc cache special_release() locks if necessary.
4754 - rrset trustworthiness type added.
4755 - thread keeps a scratchpad region for handling messages.
4756 - writev used in netevent to write tcp length and data after another.
4757 This saves a roundtrip on tcp replies.
4758 - test for one rrset updated in the cache.
4759 - test for one rrset which is not updated, as it is not deemed
4761 - test for TTL refreshed in rrset.
4764 - fill refs. Use new parse and encode to answer queries.
4765 - stores rrsets in cache.
4766 - uses new msgreply format in cache.
4769 - dname unit tests in own file and spread out neatly in functions.
4770 - more dname unit tests.
4771 - message encoding creates truncated TC flagged messages if they do
4772 not fit, and will leave out (whole)rrsets from additional if needed.
4775 - decompress query section, extremely lenient acceptance.
4776 But only for answers from other servers, not for plain queries.
4777 - compression and decompression test cases.
4779 - example.conf interface: line is changed from 127.0.0.1 which leads
4780 to problems if used (restricting communication to the localhost),
4781 to a documentation and test address.
4783 27 April 2007: Wouter
4784 - removed iov usage, it is not good for dns message encoding.
4785 - owner name compression more optimal.
4786 - rrsig owner name compression.
4787 - rdata domain name compression.
4789 26 April 2007: Wouter
4790 - floating point exception fix in lock-verify.
4791 - lint uses make dependency
4792 - fixup lint in dname owner domain name compression code.
4793 - define for offset range that can be compressed to.
4795 25 April 2007: Wouter
4796 - prettier code; parse_rrset->type kept in host byte order.
4797 - datatype used for hashvalue of converted rrsig structure.
4798 - unit test compares edns section data too.
4800 24 April 2007: Wouter
4801 - ttl per RR, for RRSIG rrsets and others.
4802 - dname_print debug function.
4803 - if type is not known, size calc will skip DNAME decompression.
4804 - RRSIG parsing and storing and putting in messages.
4805 - dnssec enabled unit tests (from nlnetlabs.nl and se queries).
4806 - EDNS extraction routine.
4808 20 April 2007: Wouter
4809 - code comes through all of the unit tests now.
4810 - disabled warning about spurious extra data.
4811 - documented the RRSIG parse plan in msgparse.h.
4812 - rrsig reading and outputting.
4814 19 April 2007: Wouter
4815 - fix unit test to actually to tests.
4816 - fix write iov helper, and fakevent code.
4817 - extra builtin testcase (small packet).
4818 - ttl converted to network format in packets.
4819 - flags converted correctly
4820 - rdatalen off by 2 error fixup.
4821 - uses less iov space for header.
4823 18 April 2007: Wouter
4824 - review of msgparse code.
4825 - smaller test cases.
4827 17 April 2007: Wouter
4828 - copy and decompress dnames.
4829 - store calculated hash value too.
4830 - routine to create message out of stored information.
4831 - util/data/msgparse.c for message parsing code.
4832 - unit test, and first fixes because of test.
4833 * forgot rrset_count addition.
4834 * did & of ptr on stack for memory position calculation.
4835 * dname_pkt_copy forgot to read next label length.
4836 - test from file and fixes
4837 * double frees fixed in error conditions.
4838 * types with less than full rdata allowed by parser.
4839 Some dynamic update packets seem to use it.
4841 16 April 2007: Wouter
4842 - following a small change in LDNS, parsing code calculates the
4843 memory size to allocate for rrs.
4844 - code to handle ID creation.
4846 13 April 2007: Wouter
4847 - parse routines. Code that parses rrsets, rrs.
4849 12 April 2007: Wouter
4850 - dname compare routine that preserves case, with unit tests.
4852 11 April 2007: Wouter
4853 - parse work - dname packet parse, msgparse, querysection parse,
4854 start of sectionparse.
4856 10 April 2007: Wouter
4857 - Improved alignment of reply_info packet, nice for 32 and 64 bit.
4858 - Put RRset counts in reply_info, because the number of RRs can change
4859 due to RRset updates.
4860 - import of region-allocator code from nsd.
4861 - set alloc special type to ub_packed_rrset_key.
4862 Uses lruhash entry overflow chain next pointer in alloc cache.
4863 - doxygen documentation for region-allocator.
4864 - setup for parse scratch data.
4866 5 April 2007: Wouter
4867 - discussed packed rrset with Jelte.
4869 4 April 2007: Wouter
4870 - moved to version 0.3.
4871 - added util/data/dname.c
4872 - layout of memory for rrsets.
4874 3 April 2007: Wouter
4875 - detect sign of msghdr.msg_iovlen so that the cast to that type
4876 in netevent (which is there to please lint) can be correct.
4877 The type on several OSes ranges from int, int32, uint32, size_t.
4878 Detects unsigned or signed using math trick.
4879 - constants for DNS flags.
4880 - compilation without locks fixup.
4881 - removed include of unportable header from lookup3.c.
4882 - more portable use of struct msghdr.
4883 - casts for printf warning portability.
4884 - tweaks to tests to port them to the testbed.
4887 2 April 2007: Wouter
4888 - check sizes of udp received messages, not too short.
4889 - review changes. Some memmoves can be memcpys: 4byte aligned.
4890 set id correctly on cached answers.
4891 - review changes msgreply.c, memleak on error condition. AA flag
4892 clear on cached reply. Lowercase queries on hashing.
4893 unit test on lowercasing. Test AA bit not set on cached reply.
4894 Note that no TTLs are managed.
4896 29 March 2007: Wouter
4897 - writev or sendmsg used when answering from cache.
4898 This avoids a copy of the data.
4899 - do not do useless byteswap on query id. Store reply flags in uint16
4900 for easier access (and no repeated byteswapping).
4902 - configure detects and config.h includes sys/uio.h for writev decl.
4904 28 March 2007: Wouter
4905 - new config option: num-queries-per-thread.
4906 - added tpkg test for answering three queries at the same time
4907 using one thread (from the query service list).
4909 27 March 2007: Wouter
4910 - added test for cache and not cached answers, in testbound replays.
4911 - testbound can give config file and commandline options from the
4912 replay file to unbound.
4913 - created test that checks if items drop out of the cache.
4914 - added word 'partitioned hash table' to documentation on slab hash.
4915 A slab hash is a partitioned hash table.
4916 - worker can handle multiple queries at a time.
4918 26 March 2007: Wouter
4919 - config settings for slab hash message cache.
4920 - test for cached answer.
4921 - Fixup deleting fake answer from testbound list.
4923 23 March 2007: Wouter
4924 - review of yesterday's commits.
4925 - covered up memory leak of the entry locks.
4926 - answers from the cache correctly. Copies flags correctly.
4927 - sanity check for incoming query replies.
4928 - slabbed hash table. Much nicer contention, need dual cpu to see.
4930 22 March 2007: Wouter
4931 - AIX configure check.
4932 - lock-verify can handle references to locks that are created
4933 in files it has not yet read in.
4934 - threaded hash table test.
4935 - unit test runs lock-verify afterwards and checks result.
4936 - need writelock to update data on hash_insert.
4937 - message cache code, msgreply code.
4939 21 March 2007: Wouter
4940 - unit test of hash table, fixup locking problem in table_grow().
4941 - fixup accounting of sizes for removing items from hashtable.
4942 - unit test for hash table, single threaded test of integrity.
4943 - lock-verify reports errors nicely. More quiet in operation.
4945 16 March 2007: Wouter
4946 - lock-verifier, checks consistent order of locking.
4948 14 March 2007: Wouter
4949 - hash table insert (and subroutines) and lookup implemented.
4950 - hash table remove.
4951 - unit tests for hash internal bin, lru functions.
4953 13 March 2007: Wouter
4954 - lock_unprotect in checklocks.
4955 - util/storage/lruhash.h for LRU hash table structure.
4957 12 March 2007: Wouter
4958 - configure.ac moved to 0.2.
4959 - query_info and replymsg util/data structure.
4961 9 March 2007: Wouter
4962 - added rwlock writelock checking.
4963 So it will keep track of the writelock, and readlocks are enforced
4964 to not change protected memory areas.
4965 - log_hex function to dump hex strings to the logfile.
4966 - checklocks zeroes its destroyed lock after checking memory areas.
4967 - unit test for alloc.
4968 - identifier for union in checklocks to please older compilers.
4971 8 March 2007: Wouter
4972 - Reviewed checklock code.
4974 7 March 2007: Wouter
4975 - created a wrapper around thread calls that performs some basic
4976 checking for data race and deadlock, and basic performance
4977 contention measurement.
4979 6 March 2007: Wouter
4980 - Testbed works with threading (different machines, different options).
4981 - alloc work, does the special type.
4983 2 March 2007: Wouter
4984 - do not compile fork funcs unless needed. Otherwise will give
4985 type errors as their typedefs have not been enabled.
4986 - log shows thread numbers much more nicely (and portably).
4987 - even on systems with nonthreadsafe libevent signal handling,
4988 unbound will exit if given a signal.
4989 Reloads will not work, and exit is not graceful.
4990 - start of alloc framework layout.
4992 1 March 2007: Wouter
4993 - Signals, libevent and threads work well, with libevent patch and
4994 changes to code (close after event_del).
4995 - set ipc pipes nonblocking.
4997 27 February 2007: Wouter
4998 - ub_thread_join portable definition.
4999 - forking is used if no threading is available.
5000 Tested, it works, since pipes work across processes as well.
5001 Thread_join is replaced with waitpid.
5002 - During reloads the daemon will temporarily handle signals,
5003 so that they do not result in problems.
5004 - Also randomize the outgoing port range for tests.
5005 - If query list is full, will stop selecting listening ports for read.
5006 This makes all threads service incoming requests, instead of one.
5007 No memory is leaking during reloads, service of queries, etc.
5008 - test that uses ldns-testns -f to test threading. Have to answer
5009 three queries at the same time.
5010 - with verbose=0 operates quietly.
5012 26 February 2007: Wouter
5013 - ub_random code used to select ID and port.
5014 - log code prints thread id.
5015 - unbound can thread itself, with reload(HUP) and quit working
5017 - don't open pipes for #0, doesn't need it.
5018 - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload).
5020 23 February 2007: Wouter
5021 - Can do reloads on sigHUP. Everything is stopped, and freed,
5022 except the listening ports. Then the config file is reread.
5023 And everything is started again (and listening ports if needed).
5024 - Ports for queries are shared.
5025 - config file added interface:, chroot: and username:.
5026 - config file: directory, logfile, pidfile. And they work too.
5027 - will daemonize by default now. Use -d to stay in the foreground.
5028 - got BSD random[256 state] code, made it threadsafe. util/random.
5030 22 February 2007: Wouter
5031 - Have a config file. Removed commandline options, moved to config.
5032 - tests use config file.
5034 21 February 2007: Wouter
5035 - put -c option in man page.
5036 - minievent fd array capped by FD_SETSIZE.
5038 20 February 2007: Wouter
5039 - Added locks code and pthread spinlock detection.
5040 - can use no locks, or solaris native thread library.
5041 - added yacc and lex configure, and config file parsing code.
5042 also makedist.sh, and manpage.
5043 - put include errno.h in config.h
5045 19 February 2007: Wouter
5046 - Created 0.0 svn tag.
5047 - added acx_pthread.m4 autoconf check for pthreads from
5048 the autoconf archive. It is GPL-with-autoconf-exception Licensed.
5049 You can specify --with-pthreads, or --without-pthreads to configure.
5051 16 February 2007: Wouter
5052 - Updated testbed script, works better by using make on remote end.
5053 - removed check decls, we can compile without them.
5054 - makefile supports LIBOBJ replacements.
5055 - docs checks ignore compat code.
5056 - added util/mini-event.c and .h, a select based alternative used with
5057 ./configure --with-libevent=no
5058 It is limited to 1024 file descriptors, and has less features.
5059 - will not create ip6 sockets if ip6 not on the machine.
5061 15 February 2007: Wouter
5062 - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64,
5063 Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc.
5064 - malloc rndstate, so that it is aligned for access.
5065 - fixed rbtree cleanup with postorder traverse.
5066 - fixed pending messages are deleted when handled.
5067 - You can control verbosity; default is not verbose, every -v
5068 adds more verbosity.
5070 14 February 2007: Wouter
5071 - Included configure.ac changes from ldns.
5072 - detect (some) headers before the standards check.
5073 - do not use isblank to test c99, since its not available on solaris9.
5074 - review of testcode.
5075 * entries in a RANGE are no longer reversed.
5076 * print name of file with replay entry parse errors.
5077 - port to OSX: cast to int for some prints of sizet.
5078 - Makefile copies ldnstestpkts.c before doing dependencies on it.
5080 13 February 2007: Wouter
5081 - work on fake events, first fwd replay works.
5082 - events can do timeouts and errors on queries to servers.
5083 - test package that runs replay scenarios.
5085 12 February 2007: Wouter
5086 - work on fake events.
5088 9 February 2007: Wouter
5089 - replay file reading.
5090 - fake event setup, it creates fake structures, and teardowns,
5091 added signal callbacks to reply to be able to fake those,
5092 and main structure of event replay routines.
5094 8 February 2007: Wouter
5097 - testcode/fake_event work.
5099 7 February 2007: Wouter
5100 - return answer with the same ID as query was sent with.
5101 - created udp forwarder test. I've done some effort to make it perform
5102 quickly. After servers are created, no big sleep statements but
5103 it checks the logfiles to see if servers have come up. Takes 0.14s.
5104 - set addrlen value when calling recvfrom.
5105 - comparison of addrs more portable.
5106 - LIBEVENT option for testbed to set libevent directory.
5107 - work on tcp input.
5109 6 February 2007: Wouter
5110 - reviewed code and improved in places.
5112 5 February 2007: Wouter
5113 - Picked up stdc99 and other define tests from ldns. Improved
5114 POSIX define test to include getaddrinfo.
5115 - defined constants for netevent callback error code.
5116 - unit test for strisip6.
5118 2 February 2007: Wouter
5119 - Created udp4 and udp6 port arrays to provide service for both
5121 - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets.
5122 - listens on both ip4 and ip6 ports to provide correct return address.
5123 - worker fwder address filled correctly.
5125 - forwards udp queries and sends answer.
5127 1 February 2007: Wouter
5128 - outside network more UDP work.
5129 - moved * closer to type.
5130 - comm_timer object and events.
5132 31 January 2007: Wouter
5133 - Added makedist.sh script to make release tarball.
5134 - Removed listen callback layer, did not add anything.
5135 - Added UDP recv to netevent, worker callback for udp.
5136 - netevent communication reply storage structure.
5137 - minimal query header sanity checking for worker.
5138 - copied over rbtree implementation from NSD (BSD licensed too).
5139 - outgoing network query service work.
5141 30 January 2007: Wouter
5142 - links in example/ldns-testpkts.c and .h for premade packet support.
5143 - added callback argument to listen_dnsport and daemon/worker.
5145 29 January 2007: Wouter
5146 - unbound.8 a short manpage.
5148 26 January 2007: Wouter
5150 - make lint works on BSD and Linux (openssl defines).
5152 - testbound program start.
5154 25 January 2007: Wouter
5155 - fixed lint so it may work on BSD.
5156 - put license into header of every file.
5157 - created verbosity flag.
5158 - fixed libevent configure flag.
5159 - detects event_base_free() in new libevent 1.2 version.
5160 - getopt in daemon. fatal_exit() and verbose() logging funcs.
5161 - created log_assert, that throws assertions to the logfile.
5162 - listen_dnsport service. Binds ports.
5164 24 January 2007: Wouter
5165 - cleaned up configure.ac.
5167 23 January 2007: Wouter
5168 - added libevent to configure to link with.
5169 - util/netevent setup work.
5170 - configure searches for libevent.
5171 - search for libs at end of configure (when other headers and types
5173 - doxygen works with ATTR_UNUSED().
5174 - util/netevent implementation.
5176 22 January 2007: Wouter
5177 - Designed header file for network communication.
5179 16 January 2007: Wouter
5180 - added readme.svn and readme.tests.
5182 4 January 2007: Wouter
5183 - Testbed script (run on multiple platforms the test set).
5184 Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5.
5185 - added unit test tpkg.
5187 3 January 2007: Wouter
5188 - committed first set of files into subversion repository.
5189 svn co svn+ssh://unbound.net/svn/unbound
5190 You need a ssh login. There is no https access yet.
5191 - Added LICENSE, the BSD license.
5192 - Added doc/README with compile help.
5193 - main program stub and quiet makefile.
5194 - minimal logging service (to stderr).
5195 - added postcommit hook that serves emails.
5196 - added first test 00-lint. postcommit also checks if build succeeds.
5197 - 01-doc: doxygen doc target added for html docs. And stringent test
5198 on documented files, functions and parameters.
5200 15 December 2006: Wouter
5201 - Created Makefile.in and configure.ac.
projects / FreeBSD / FreeBSD.git / blob