14 September 2018: Wouter 2 - Tag for 1.8.0rc1 release. 3 431 August 2018: Wouter 5 - Disable minimal-responses in subnet unit tests. 6 730 August 2018: Wouter 8 - Fix that a local-zone with a local-zone-type that is transparent 9 in a view with view-first, makes queries check for answers from the 10 local-zones defined outside of views. 11 1228 August 2018: Ralph 13 - Disable minimal-responses in ipsecmod unit tests. 14 - Added serve-expired-ttl and serve-expired-ttl-reset options. 15 1627 August 2018: Wouter 17 - Set defaults to yes for a number of options to increase speed and 18 resilience of the server. The so-reuseport, harden-below-nxdomain, 19 and minimal-responses options are enabled by default. They used 20 to be disabled by default, waiting to make sure they worked. They 21 are enabled by default now, and can be disabled explicitly by 22 setting them to "no" in the unbound.conf config file. The reuseport 23 and minimal options increases speed of the server, and should be 24 otherwise harmless. The harden-below-nxdomain option works well 25 together with the recently default enabled qname minimisation, this 26 causes more fetches to use information from the cache. 27 - next release is called 1.8.0. 28 - Fix lintflags for lint on FreeBSD. 29 3022 August 2018: George 31 - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This 32 gives access to reply information for the client's communication 33 point when the callback is called before the mesh state (modules). 34 Changes to C and Python's inplace_callback signatures were also 35 necessary. 36 3721 August 2018: Wouter 38 - log-local-actions: yes option for unbound.conf that logs all the 39 local zone actions, a patch from Saksham Manchanda (Secure64). 40 - #4146: num.query.subnet and num.query.subnet_cache counters. 41 - Fix only misc failure from log-servfail when val-log-level is not 42 enabled. 43 4417 August 2018: Ralph 45 - Fix classification for QTYPE=CNAME queries when QNAME minimisation is 46 enabled. 47 4817 August 2018: Wouter 49 - Set libunbound to increase current, because the libunbound change 50 to the event callback function signature. That needs programs, 51 that use it, to recompile against the new header definition. 52 - print servfail info to log as error. 53 - added more servfail printout statements, to the iterator. 54 - log-servfail: yes prints log lines that say why queries are 55 returning SERVFAIL to clients. 56 5716 August 2018: Wouter 58 - Fix warning on compile without threads. 59 - Fix contrib/fastrpz.patch. 60 6115 August 2018: Wouter 62 - Fix segfault in auth-zone read and reorder of RRSIGs. 63 6414 August 2018: Wouter 65 - Fix that printout of error for cycle targets is a verbosity 4 66 printout and does not wrongly print it is a memory error. 67 - Upgraded crosscompile script to include libunbound DLL in the 68 zipfile. 69 7010 August 2018: Wouter 71 - Fix #4144: dns64 module caches wrong (negative) information. 72 739 August 2018: Wouter 74 - unbound-checkconf checks if modules exist and prints if they are 75 not compiled in the name of the wrong module. 76 - document --enable-subnet in doc/README. 77 - Patch for stub-no-cache and forward-no-cache options that disable 78 caching for the contents of that stub or forward, for when you 79 want immediate changes visible, from Bjoern A. Zeeb. 80 817 August 2018: Ralph 82 - Make capsforid fallback QNAME minimisation aware. 83 847 August 2018: Wouter 85 - Fix #4142: unbound.service.in: improvements and fixes. 86 Add unit dependency ordering (based on systemd-resolved). 87 Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings 88 about missing privileges during startup). Add 'AF_INET6' to 89 'RestrictAddressFamilies' (without it IPV6 can't work). From 90 Guido Shanahan. 91 - Patch to implement tcp-connection-limit from Jim Hague (Sinodun). 92 This limits the number of simultaneous TCP client connections 93 from a nominated netblock. 94 - make depend, yacc, lex, doc, headers. And log the limit exceeded 95 message only on high verbosity, so as to not spam the logs when 96 it is busy. 97 986 August 2018: Wouter 99 - Fix for #4136: Fix to unconditionally call destroy in daemon.c. 100 1013 August 2018: George 102 - Expose if a query (or a subquery) was ratelimited (not src IP 103 ratelimiting) to libunbound under 'ub_result.was_ratelimited'. 104 This also introduces a change to 'ub_event_callback_type' in 105 libunbound/unbound-event.h. 106 - Tidy pylib tests. 107 1083 August 2018: Wouter 109 - Revert previous change for #4136: because it introduces build 110 problems. 111 - New fix for #4136: This one ignores lex without without 112 yylex_destroy. 113 1141 August 2018: Wouter 115 - Fix to remove systemd sockaddr function check, that is not 116 always present. Make socket activation more lenient. But not 117 different when socket activation is not used. 118 - iana port list update. 119 12031 July 2018: Wouter 121 - Patches from Jim Hague (Sinodun) for EDNS KeepAlive. 122 - Sort out test runs when the build directory isn't the project 123 root directory. 124 - Add config tcp-idle-timeout (default 30s). This applies to 125 client connections only; the timeout on TCP connections upstream 126 is unaffected. 127 - Error if EDNS Keepalive received over UDP. 128 - Add edns-tcp-keepalive and edns-tcp-keepalive timeout options 129 and implement option in client responses. 130 - Correct and expand manual page entries for keepalive and idle timeout. 131 - Implement progressive backoff of TCP idle/keepalive timeout. 132 - Fix 'make depend' to work when build dir is not project root. 133 - Add delay parameter to streamtcp, -d secs. 134 To be used when testing idle timeout. 135 - From Wouter: make depend, the dependencies in the patches did not 136 apply cleanly. Also remade yacc and lex. 137 - Fix mesh.c incompatible pointer pass. 138 - Please doxygen so it passes. 139 - Fix #4139: Fix unbound-host leaks memory on ANY. 140 14130 July 2018: Wouter 142 - Fix #4136: insufficiency from mismatch of FLEX capability between 143 released tarball and build host. 144 14527 July 2018: Wouter 146 - Fix man page, say that chroot is enabled by default. 147 14826 July 2018: Wouter 149 - Fix #4135: 64-bit Windows Installer Creates Entries Under The 150 Wrong Registry Key, reported by Brian White. 151 15223 July 2018: Wouter 153 - Fix use-systemd readiness signalling, only when use-systemd is yes 154 and not in signal handler. 155 15620 July 2018: Wouter 157 - Fix #4130: print text describing -dd and unbound-checkconf on 158 config file read error at startup, the errors may have been moved 159 away by the startup process. 160 - Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared. 161 16219 July 2018: Wouter 163 - Fix #4129 unbound-control error message with wrong cert permissions 164 is too cryptic. 165 16617 July 2018: Wouter 167 - Fix #4127 unbound -h does not list -p help. 168 - Print error if SSL name verification configured but not available 169 in the ssl library. 170 - Fix that ratelimit and ip-ratelimit are applied after reload of 171 changed config file. 172 - Resize ratelimit and ip-ratelimit caches if changed on reload. 173 17416 July 2018: Wouter 175 - Fix qname minimisation NXDOMAIN validation lookup failures causing 176 error_supers assertion fails. 177 - Squelch can't bind socket errors with Permission denied unless 178 verbosity is 4 or higher, for UDP outgoing sockets. 179 18012 July 2018: Wouter 181 - Fix to improve systemd socket activation code file descriptor 182 assignment. 183 - Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more 184 easily changed to adjust default rtt assumptions. 185 18610 July 2018: Wouter 187 - Note in documentation that the cert name match code needs 188 OpenSSL 1.1.0 or later to be enabled. 189 1906 July 2018: Wouter 191 - Fix documentation ambiguity for tls-win-cert in tls-upstream and 192 forward-tls-upstream docs. 193 - iana port update. 194 - Note RFC8162 support. SMIMEA record type can be read in by the 195 zone record parser. 196 - Fix round robin for failed addresses with prefer-ip6: yes 197 1984 July 2018: Wouter 199 - Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass 200 if DNSSEC is not enabled. New option -R allows fallback from 201 resolv.conf to direct queries. 202 2033 July 2018: Wouter 204 - Better documentation for unblock-lan-zones and insecure-lan-zones 205 config statements. 206 - Fix permission denied printed for auth zone probe random port nrs. 207 2082 July 2018: Wouter 209 - Fix checking for libhiredis printout in configure output. 210 - Fix typo on man page in ip-address description. 211 - Update libunbound/python/examples/dnssec_test.py example code to 212 also set the 20326 trust anchor for the root in the example code. 213 21429 June 2018: Wouter 215 - dns64-ignore-aaaa: config option to list domain names for which the 216 existing AAAA is ignored and dns64 processing is used on the A 217 record. 218 21928 June 2018: Wouter 220 - num.queries.tls counter for queries over TLS. 221 - log port number with err_addr logs. 222 22327 June 2018: Wouter 224 - #4109: Fix that package config depends on python unconditionally. 225 - Patch, do not export python from pkg-config, from Petr Menšík. 226 22726 June 2018: Wouter 228 - Partial fix for permission denied on IPv6 address on FreeBSD. 229 - Fix that auth-zone master reply with current SOA serial does not 230 stop scan of masters for an updated zone. 231 - Fix that auth-zone does not start the wait timer without checking 232 if the wait timer has already been started. 233 23421 June 2018: Wouter 235 - #4108: systemd reload hang fix. 236 - Fix usage printout for unbound-host, hostname has to be last 237 argument on BSDs and Windows. 238 23919 June 2018: Wouter 240 - Fix for unbound-control on Windows and set TCP socket parameters 241 more closely. 242 This fix is part of 1.7.3. 243 - Windows example service.conf edited with more windows specific 244 configuration. 245 - Fix windows unbound-control no cert bad file descriptor error. 246 This fix is part of 1.7.3. 247 24818 June 2018: Wouter 249 - Fix that control-use-cert: no works for 127.0.0.1 to disable certs. 250 This fix is part of 1.7.3rc2. 251 - Fix unbound-checkconf for control-use-cert. 252 This fix is part of 1.7.3. 253 25415 June 2018: Wouter 255 - tag for 1.7.3rc1. 256 - trunk has 1.7.4. 257 - unbound-control auth_zone_reload _zone_ option rereads the zonefile. 258 - unbound-control auth_zone_transfer _zone_ option starts the probe 259 sequence for a master to transfer the zone from and transfers when 260 a new zone version is available. 261 26214 June 2018: Wouter 263 - #4103: Fix that auth-zone does not insist on SOA record first in 264 file for url downloads. 265 - Fix that first control-interface determines if TLS is used. Warn 266 when IP address interfaces are used without TLS. 267 - Fix nettle compile. 268 26912 June 2018: Ralph 270 - Don't count CNAME response types received during qname minimisation as 271 query restart. 272 27312 June 2018: Wouter 274 - #4102 for NSD, but for Unbound. Named unix pipes do not use 275 certificate and key files, access can be restricted with file and 276 directory permissions. The option control-use-cert is no longer 277 used, and ignored if found in unbound.conf. 278 - Rename tls-additional-ports to tls-additional-port, because every 279 line adds one port. 280 - Fix buffer size warning in unit test. 281 - remade dependencies in the Makefile. 282 2836 June 2018: Wouter 284 - Patch to fix openwrt for mac os build darwin detection in configure. 285 2865 June 2018: Wouter 287 - Fix crash if ratelimit taken into use with unbound-control 288 instead of with unbound.conf. 289 2904 June 2018: Wouter 291 - Fix deadlock caused by incoming notify for auth-zone. 292 - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018, 293 trunk is 1.7.3 in development from this point. 294 - #4100: Fix stub reprime when it becomes useless. 295 2961 June 2018: Wouter 297 - Rename additional-tls-port to tls-additional-ports. 298 The older name is accepted for backwards compatibility. 299 30030 May 2018: Wouter 301 - Patch from Syzdek: Add ability to ignore RD bit and treat all 302 requests as if the RD bit is set. 303 30429 May 2018: Wouter 305 - in compat/arc4random call getentropy_urandom when getentropy fails 306 with ENOSYS. 307 - Fix that fallback for windows port. 308 30928 May 2018: Wouter 310 - Fix windows tcp and tls spin on events. 311 - Add routine from getdns to add windows cert store to the SSL_CTX. 312 - tls-win-cert option that adds the system certificate store for 313 authenticating DNS-over-TLS connections. It can be used instead 314 of the tls-cert-bundle option, or with it to add certificates. 315 31625 May 2018: Wouter 317 - For TCP and TLS connections that don't establish, perform address 318 update in infra cache, so future selections can exclude them. 319 - Fix that tcp sticky events are removed for closed fd on windows. 320 - Fix close events for tcp only. 321 32224 May 2018: Wouter 323 - Fix that libunbound can do DNS-over-TLS, when configured. 324 - Fix that windows unbound service can use DNS-over-TLS. 325 - unbound-host initializes ssl (for potential DNS-over-TLS usage 326 inside libunbound), when ssl upstream or a cert-bundle is configured. 327 32823 May 2018: Wouter 329 - Use accept4 to speed up incoming TCP (and TLS) connections, 330 available on Linux, FreeBSD and OpenBSD. 331 33217 May 2018: Ralph 333 - Qname minimisation default changed to yes. 334 33515 May 2018: Wouter 336 - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand. 337 33811 May 2018: Wouter 339 - Fix contrib/libunbound.pc for libssl libcrypto references, 340 from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914 341 3427 May 2018: Wouter 343 - Fix windows to not have sticky TLS events for TCP. 344 - Fix read of DNS over TLS length and data in one read call. 345 - Fix mesh state assertion failure due to callback removal. 346 3473 May 2018: Wouter 348 - Fix that configure --with-libhiredis also turns on cachedb. 349 - Fix gcc 8 buffer warning in testcode. 350 - Fix function type cast warning in libunbound context callback type. 351 3522 May 2018: Wouter 353 - Fix fail to reject dead peers in forward-zone, with ssl-upstream. 354 3551 May 2018: Wouter 356 - Fix that unbound-control reload frees the rrset keys and returns 357 the memory pages to the system. 358 35930 April 2018: Wouter 360 - Fix spelling error in man page and note defaults as no instead of 361 off. 362 36326 April 2018: Wouter 364 - Fix for crash in daemon_cleanup with dnstap during reload, 365 from Saksham Manchanda. 366 - Also that for dnscrypt. 367 - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk 368 is from here 1.7.2 in development. 369 37025 April 2018: Ralph 371 - Fix memory leak when caching wildcard records for aggressive NSEC use 372 37324 April 2018: Wouter 374 - Fix contrib/fastrpz.patch for this release. 375 - Fix auth https for libev. 376 37724 April 2018: Ralph 378 - Added root-key-sentinel support 379 38023 April 2018: Wouter 381 - makedist uses bz2 for expat code, instead of tar.gz. 382 - Fix #4092: libunbound: use-caps-for-id lacks colon in 383 config_set_option. 384 - auth zone http download stores exact copy of downloaded file, 385 including comments in the file. 386 - Fix sldns parse failure for CDS alternate delete syntax empty hex. 387 - Attempt for auth zone fix; add of callback in mesh gets from 388 callback does not skip callback of result. 389 - Fix cname classification with qname minimisation enabled. 390 - list_auth_zones unbound-control command. 391 39220 April 2018: Wouter 393 - man page documentation for dns-over-tls forward-addr '#' notation. 394 - removed free from failed parse case. 395 - Fix #4091: Fix that reload of auth-zone does not merge the zonefile 396 with the previous contents. 397 - Delete auth zone when removed from config. 398 39919 April 2018: Wouter 400 - Can set tls authentication with forward-addr: IP#tls.auth.name 401 And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem". 402 such as forward-addr: 9.9.9.9@853#dns.quad9.net or 403 1.1.1.1@853#cloudflare-dns.com 404 - Fix #658: unbound using TLS in a forwarding configuration does not 405 verify the server's certificate (RFC 8310 support). 406 - For addr with #authname and no @port notation, the default is 853. 407 40818 April 2018: Wouter 409 - Fix auth-zone retry timer to be on schedule with retry timeout, 410 with backoff. Also time a refresh at the zone expiry. 411 41217 April 2018: Wouter 413 - auth zone notify work. 414 - allow-notify: config statement for auth-zones. 415 - unit test for allow-notify 416 41716 April 2018: Wouter 418 - Fix auth zone target lookup iterator. 419 - auth zone notify with prefix 420 - auth zone notify work. 421 42213 April 2018: Wouter 423 - Fix for max include depth for authzones. 424 - Fix memory free on fail for $INCLUDE in authzone. 425 - Fix that an internal error to look up the wrong rr type for 426 auth zone gets stopped, before trying to send there. 427 - auth zone notify work. 428 42910 April 2018: Ralph 430 - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN 431 statistics counters. 432 43310 April 2018: Wouter 434 - documentation for low-rtt and low-rtt-pct. 435 - auth zone notify work. 436 4379 April 2018: Wouter 438 - Fix that flush_zone sets prefetch ttl expired, so that with 439 serve-expired enabled it'll start prefetching those entries. 440 - num.query.authzone.up and num.query.authzone.down statistics counters. 441 - Fix downstream auth zone, only fallback when auth zone fails to 442 answer and fallback is enabled. 443 - Accept both option names with and without colon for get_option 444 and set_option. 445 - low-rtt and low-rtt-pct in unbound.conf enable the server selection 446 of fast servers for some percentage of the time. 447 4485 April 2018: Wouter 449 - Combine write of tcp length and tcp query for dns over tls. 450 - nitpick fixes in example.conf. 451 - Fix above stub queries for type NS and useless delegation point. 452 - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3 453 tls_choose_sigalg routine does not allow the ciphers for the pipe, 454 so use TLSv1.2. 455 - ED448 support. 456 4573 April 2018: Wouter 458 - Fix #4043: make test fails due to v6 presentation issue in macOS. 459 - Fix unable to resolve after new WLAN connection, due to auth-zone 460 failing with a forwarder set. Now, auth-zone is only used for 461 answers (not referrals) when a forwarder is set. 462 46329 March 2018: Ralph 464 - Check "result" in dup_all(), by Florian Obser. 465 46623 March 2018: Ralph 467 - Fix unbound-control get_option aggressive-nsec 468 46921 March 2018: Ralph 470 - Do not use cached NSEC records to generate negative answers for 471 domains under DNSSEC Negative Trust Anchors. 472 47319 March 2018: Wouter 474 - iana port update. 475 47616 March 2018: Wouter 477 - corrected a minor typo in the changelog. 478 - move htobe64/be64toh portability code to cachedb.c. 479 48015 March 2018: Wouter 481 - Add --with-libhiredis, unbound support for a new cachedb backend 482 that uses a Redis server as the storage. This implementation 483 depends on the hiredis client library (https://redislabs.com/lp/hiredis/). 484 And unbound should be built with both --enable-cachedb and 485 --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h 486 should exist). Patch from Jinmei Tatuya (Infoblox). 487 - Fix #3817: core dump happens in libunbound delete, when queued 488 servfail hits deleted message queue. 489 - Create additional tls service interfaces by opening them on other 490 portnumbers and listing the portnumbers as additional-tls-port: nr. 491 49213 March 2018: Wouter 493 - Fix typo in documentation. 494 - Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually 495 flushed with serve-expired on. 496 49712 March 2018: Wouter 498 - Added documentation for aggressive-nsec: yes. 499 - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk 500 now has 1.7.1 in development. 501 - Fix #3727: Protocol name is TLS, options have been renamed but 502 documentation is not consistent. 503 - Check IXFR start serial. 504 5059 March 2018: Wouter 506 - Fix #3598: Fix swig build issue on rhel6 based system. 507 configure --disable-swig-version-check stops the swig version check. 508 5098 March 2018: Wouter 510 - tag 1.7.0rc2. 511 5127 March 2018: Wouter 513 - Fixed contrib/fastrpz.patch, even though this already applied 514 cleanly for me, now also for others. 515 - patch to log creates keytag queries, from A. Schulze. 516 - patch suggested by Debian lintian: allow to -> allow one to, from 517 A. Schulze. 518 - Attempt to remove warning about trailing whitespace. 519 5206 March 2018: Wouter 521 - Reverted fix for #3512, this may not be the best way forward; 522 although it could be changed at a later time, to stay similar to 523 other implementations. 524 - svn trunk contains 1.7.0, this is the number for the next release. 525 - Fix for windows compile. 526 - tag 1.7.0rc1. 527 5285 March 2018: Wouter 529 - Fix to check define of DSA for when openssl is without deprecated. 530 - iana port update. 531 - Fix #3582: Squelch address already in use log when reuseaddr option 532 causes same port to be used twice for tcp connections. 533 53427 February 2018: Wouter 535 - Fixup contrib/fastrpz.patch so that it applies. 536 - Fix compile without threads, and remove unused variable. 537 - Fix compile with staticexe and python module. 538 - Fix nettle compile. 539 54022 February 2018: Ralph 541 - Save wildcard RRset from answer with original owner for use in 542 aggressive NSEC. 543 54421 February 2018: Wouter 545 - Fix #3512: unbound incorrectly reports SERVFAIL for CAA query 546 when there is a CNAME loop. 547 - Fix validation for CNAME loops. When it detects a cname loop, 548 by finding the cname, cname in the existing list, it returns 549 the partial result with the validation result up to then. 550 - more robust cachedump rrset routine. 551 55219 February 2018: Wouter 553 - Fix #3505: Documentation for default local zones references 554 wrong RFC. 555 - Fix #3494: local-zone noview can be used to break out of the view 556 to the global local zone contents, for queries for that zone. 557 - Fix for more maintainable code in localzone. 558 55916 February 2018: Wouter 560 - Fixes for clang static analyzer, the missing ; in 561 edns-subnet/addrtree.c after the assert made clang analyzer 562 produce a failure to analyze it. 563 56413 February 2018: Ralph 565 - Aggressive NSEC tests 566 56713 February 2018: Wouter 568 - tls-cert-bundle option in unbound.conf enables TLS authentication. 569 - iana port update. 570 57112 February 2018: Wouter 572 - Unit test for auth zone https url download. 573 57412 February 2018: Ralph 575 - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) 576 - Processed aggressive NSEC code review remarks Wouter 577 5788 February 2018: Ralph 579 - Aggressive use of NSEC implementation. Use cached NSEC records to 580 generate NXDOMAIN, NODATA and positive wildcard answers. 581 5828 February 2018: Wouter 583 - iana port update. 584 - auth zone url config. 585 5865 February 2018: Wouter 587 - Fix #3451: dnstap not building when you have a separate build dir. 588 And removed protoc warning, set dnstap.proto syntax to proto2. 589 - auth-zone provides a way to configure RFC7706 from unbound.conf, 590 eg. with auth-zone: name: "." for-downstream: no for-upstream: yes 591 fallback-enabled: yes and masters or a zonefile with data. 592 5932 February 2018: Wouter 594 - Fix unfreed locks in log and arc4random at exit of unbound. 595 - unit test with valgrind 596 - Fix lock race condition in dns cache dname synthesis. 597 - lock subnet new item before insertion to please checklocks, 598 no modification of critical regions outside of lock region. 599 6001 February 2018: Wouter 601 - fix unaligned structure making a false positive in checklock 602 unitialised memory. 603 60429 January 2018: Ralph 605 - Use NSEC with longest ce to prove wildcard absence. 606 - Only use *.ce to prove wildcard absence, no longer names. 607 60825 January 2018: Wouter 609 - ltrace.conf file for libunbound in contrib. 610 61123 January 2018: Wouter 612 - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file 613 for startup scripts to get the full pathname(s) of anchor file(s). 614 - Print fatal errors about remote control setup before log init, 615 so that it is printed to console. 616 61722 January 2018: Wouter 618 - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is 619 also recognized and means the same. Also for tls-port, 620 tls-service-key, tls-service-pem, stub-tls-upstream and 621 forward-tls-upstream. 622 - Fix #3397: Fix that cachedb could return a partial CNAME chain. 623 - Fix #3397: Fix that when the cache contains an unsigned DNAME in 624 the middle of a cname chain, a result without the DNAME could 625 be returned. 626 62719 January 2018: Wouter 628 - tag 1.6.8 for release with CVE fix. 629 - trunk has 1.6.9 with fix and previous commits. 630 - patch for CVE-2017-15105: vulnerability in the processing of 631 wildcard synthesized NSEC records. 632 - iana port update. 633 - make depend: code dependencies updated in Makefile. 634 6354 January 2018: Ralph 636 - Copy query and correctly set flags on REFUSED answers when cache 637 snooping is not allowed. 638 6393 January 2018: Ralph 640 - Fix queries being leaked above stub when refetching glue. 641 6422 January 2017: Wouter 643 - Fix that DS queries with referral replies are answered straight 644 away, without a repeat query picking the DS from cache. 645 The correct reply should have been an answer, the reply is fixed 646 by the scrubber to have the answer in the answer section. 647 - Remove clang optimizer disable, 648 Fix that expiration date checks don't fail with clang -O2. 649 65015 December 2017: Wouter 651 - Fix timestamp failure because of clang optimizer failure, by 652 disabling -O2 when the compiler --version is clang. 653 - iana port update. 654 - Also disable -flto for clang, to make incep-expi signature check 655 work. 656 65712 December 2017: Ralph 658 - Fix qname-minimisation documentation (A QTYPE, not NS) 659 66012 December 2017: Wouter 661 - authzone work, transfer connect. 662 6637 December 2017: Ralph 664 - Check whether --with-libunbound-only is set when using --with-nettle 665 or --with-nss. 666 6674 December 2017: Wouter 668 - Fix link failure on OmniOS. 669 6701 December 2017: Wouter 671 - auth zone work. 672 67330 November 2017: Wouter 674 - Fix #3299 - forward CNAME daisy chain is not working 675 67614 November 2017: Wouter 677 - Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is 678 set for stub zone. It no longer searches for DNSSEC information. 679 - auth xfer work on probe timer and lookup. 680 68113 November 2017: Wouter 682 - Fix #2801: Install libunbound.pc. 683 - Fix qname minimisation to send AAAA queries at zonecut like type A. 684 - reverted AAAA change. 685 6867 November 2017: Wouter 687 - Fix #2492: Documentation libunbound. 688 6893 November 2017: Wouter 690 - Fix #2362: TLS1.3/openssl-1.1.1 not working. 691 - Fix #2034 - Autoconf and -flto. 692 - Fix #2141 - for libsodium detect lack of entropy in chroot, print 693 a message and exit. 694 6952 November 2017: Wouter 696 - Fix #1913: ub_ctx_config is under circumstances thread-safe. 697 - make ip-transparent option work on OpenBSD. 698 69931 October 2017: Wouter 700 - Document that errno is left informative on libunbound config read 701 fail. 702 - lexer output. 703 - iana port update. 704 70525 October 2017: Ralph 706 - Fixed libunbound manual typo. 707 - Fix #1949: [dnscrypt] make provider name mismatch more obvious. 708 - Fix #2031: Double included headers 709 71024 October 2017: Ralph 711 - Update B root ipv4 address. 712 71319 October 2017: Wouter 714 - authzone work, probe timer setup. 715 71618 October 2017: Wouter 717 - lint for recent authzone commit. 718 71917 October 2017: Wouter 720 - Fix #1749: With harden-referral-path: performance drops, due to 721 circular dependency in NS and DS lookups. 722 - [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert 723 duplicates 724 - [dnscrypt] introduce dnscrypt-provider-cert-rotated option, 725 from Manu Bretelle. 726 This option allows handling multiple cert/key pairs while only 727 distributing some of them. 728 In order to reliably match a client magic with a given key without 729 strong assumption as to how those were generated, we need both key and 730 cert. Likewise, in order to know which ES version should be used. 731 On the other hand, when rotating a cert, it can be desirable to only 732 serve the new cert but still be able to handle clients that are still 733 using the old certs's public key. 734 The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not 735 publish the cert as part of the DNS's provider_name's TXT answer. 736 - Better documentation for cache-max-negative-ttl. 737 - Work on local root zone code. 738 73910 October 2017: Wouter 740 - tag 1.6.7 741 - trunk has version 1.6.8. 742 7436 October 2017: Wouter 744 - Fix spelling in unbound-control man page. 745 7465 October 2017: Wouter 747 - Fix trust-anchor-signaling works in libunbound. 748 - Fix some more crpls in testdata for different signaling default. 749 - tag 1.6.7rc1 750 7515 October 2017: Ralph 752 - Set trust-anchor-signaling default to yes 753 - Use RCODE from A query on DNS64 synthesized answer. 754 7552 October 2017: Wouter 756 - Fix param unused warning for windows exportsymbol compile. 757 75825 September 2017: Ralph 759 - Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch 760 (by Danilo G. Baio). 761 76221 September 2017: Ralph 763 - Log name of looping module 764 76519 September 2017: Wouter 766 - use a cachedb answer even if it's "expired" when serve-expired is yes 767 (patch from Jinmei Tatuya). 768 - trigger refetching of the answer in that case (this will bypass 769 cachedb lookup) 770 - allow storing a 0-TTL answer from cachedb in the in-memory message 771 cache when serve-expired is yes 772 - Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff. 773 77418 September 2017: Ralph 775 - Fix #1400: allowing use of global cache on ECS-forwarding unless 776 always-forward. 777 77818 September 2017: Wouter 779 - tag 1.6.6 (is 1.6.6rc2) 780 - Fix that looping modules always stop the query, and don't pass 781 control. 782 - Fix #1435: Please allow UDP to be disabled separately upstream and 783 downstream. 784 - Fix #1440: [dnscrypt] client nonce cache. 785 78615 September 2017: Wouter 787 - Fix unbound-host to report error for DNSSEC state of failed lookups. 788 - Spelling fixes, from Josh Soref. 789 79013 September 2017: Wouter 791 - tag 1.6.6rc2, became 1.6.6 on 18 sep. trunk 1.6.7 in development. 792 79312 September 2017: Wouter 794 - Add dns64 for client-subnet in unbound-checkconf. 795 7964 September 2017: Ralph 797 - Fix #1412: QNAME minimisation strict mode not honored 798 - Fix #1434: Fix windows openssl 1.1.0 linking. 799 8004 September 2017: Wouter 801 - tag 1.6.6rc1 802 - makedist fix for windows binaries, with openssl 1.1.0 windres fix, 803 and expat 2.2.4 install target fix. 804 8051 September 2017: Wouter 806 - Recommend 1472 buffer size in unbound.conf 807 80831 August 2017: Wouter 809 - Fix #1424: cachedb:testframe is not thread safe. 810 - For #1417: escape ; in dnscrypt tests. 811 - but reverted that, tests fails with that escape. 812 - Fix #1417: [dnscrypt] shared secret cache counters, and works when 813 dnscrypt is not enabled. And cache size configuration option. 814 - make depend 815 - Fix #1418: [ip ratelimit] initialize slabhash using 816 ip-ratelimit-slabs. 817 81830 August 2017: Wouter 819 - updated contrib/fastrpz.patch to apply with configparser changes. 820 - Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs. 821 82229 August 2017: Wouter 823 - Fix #1414: fix segfault on parse failure and log_replies. 824 - zero qinfo in handle_request, this zeroes local_alias and also the 825 qname member. 826 - new keys and certs for dnscrypt tests. 827 - fixup WKS test on buildhost without servicebyname. 828 82928 August 2017: Wouter 830 - Fix #1415: patch to free dnscrypt environment on reload. 831 - iana portlist update 832 - Fix #1415: [dnscrypt] shared secret cache, patch from 833 Manu Bretelle. 834 - Small fixes for the shared secret cache patch. 835 - Fix WKS records on kvm autobuild host, with default protobyname 836 entries for udp and tcp. 837 83823 August 2017: Wouter 839 - Fix #1407: Add ECS options check to unbound-checkconf. 840 - make depend 841 - Fix to reclaim tcp handler when it is closed due to dnscrypt buffer 842 allocation failure. 843 84422 August 2017: Wouter 845 - Fix install of trust anchor when two anchors are present, makes both 846 valid. Checks hash of DS but not signature of new key. This fixes 847 the root.key file if created when unbound is installed between 848 sep11 and oct11 2017. 849 - tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix). 850 - trunk version 1.6.6 in development. 851 - Fix issue on macOX 10.10 where TCP fast open is detected but not 852 implemented causing TCP to fail. The fix allows fallback to regular 853 TCP in this case and is also more robust for cases where connectx() 854 fails for some reason. 855 - Fix #1402: squelch invalid argument error for fd_set_block on windows. 856 85710 August 2017: Wouter 858 - Patch to show DNSCrypt status in help output, from Carsten 859 Strotmann. 860 8618 August 2017: Wouter 862 - Fix #1398: make cachedb secret configurable. 863 - Remove spaces from Makefile. 864 8657 August 2017: Wouter 866 - Fix #1397: Recursive DS lookups for AS112 zones names should recurse. 867 8683 August 2017: Ralph 869 - Remove unused iter_env member (ip6arpa_dname) 870 - Do not reset rrset.bogus stats when called using stats_noreset. 871 - Added stats for queries that have been ratelimited by domain 872 recursion. 873 - Do not add rrset_bogus and query ratelimiting stats per thread, these 874 module stats are global. 875 8763 August 2017: Wouter 877 - Fix #1394: mix of serve-expired and response-ip could cause a crash. 878 87924 July 2017: Wouter 880 - upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02), 881 config.sub(2016-09-05). 882 - annotate case statement fallthrough for gcc 7.1.1. 883 - flex output from flex 2.6.1. 884 - snprintf of thread number does not warn about truncated string. 885 - squelch TCP fast open error on FreeBSD when kernel has it disabled, 886 unless verbosity is high. 887 - remove warning from windows compile. 888 - Fix compile with libnettle 889 - Fix DSA configure switch (--disable dsa) for libnettle and libnss. 890 - Fix #1365: Add Ed25519 support using libnettle. 891 - iana portlist update 892 89317 July 2017: Wouter 894 - Fix #1350: make cachedb backend configurable (from JINMEI Tatuya). 895 - Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor). 896 With the -p option unbound does not create a pidfile. 897 89811 July 2017: Wouter 899 - Fix #1344: RFC6761-reserved domains: test. and invalid. 900 - Redirect all localhost names to localhost address for RFC6761. 901 9026 July 2017: Wouter 903 - Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg. 904 - Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists).. 905 9064 July 2017: Wouter 907 - Fix 1332: Bump verbosity of failed chown'ing of the control socket. 908 9093 July 2017: Wouter 910 - Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned 911 on. 912 - Fix #1331: libunbound segfault in threaded mode when context is 913 deleted. 914 - Fix pythonmod link line option flag. 915 - Fix openssl 1.1.0 load of ssl error strings from ssl init. 916 91729 June 2017: Wouter 918 - Fix python example0 return module wait instead of error for pass. 919 - iana portlist update 920 - enhancement for hardened-tls for DNS over TLS. Removed duplicated 921 security settings. 922 92327 June 2017: Wouter 924 - Tag 1.6.4 is created with the 1.6.4rc2 contents. 925 - Trunk contains 1.6.5, with changes from 26, 27 june. 926 - Remove signed unsigned warning from authzone. 927 - Fix that infra cache host hash does not change after reconfig. 928 92926 June 2017: Wouter 930 - (for 1.6.5) 931 Better fixup of dnscrypt_cert_chacha test for different escapes. 932 - First fix for zero b64 and hex text zone format in sldns. 933 - unbound-control dump_infra prints port number for address if not 53. 934 93523 June 2017: Wouter 936 - (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle). 937 93822 June 2017: Wouter 939 - Tag 1.6.4rc2 940 94122 June 2017: Ralph 942 - Added fastrpz patch to contrib 943 94421 June 2017: Wouter 945 - Fix #1316: heap read buffer overflow in parse_edns_options. 946 94720 June 2017: Wouter 948 - Fix warning in pythonmod under clang compiler. 949 - Tag 1.6.4rc1 950 - Fix lintian typo. 951 95216 June 2017: Ralph 953 - Fix #1277: disable domain ratelimit by setting value to 0. 954 95516 June 2017: Wouter 956 - Fix #1301: memory leak in respip and tests. 957 - Free callback in edns-subnetmod on exit and restart. 958 - Fix memory leak in sldns_buffer_new_frm_data. 959 - Fix memory leak in dnscrypt config read. 960 - Fix dnscrypt chacha cert support ifdefs. 961 - Fix dnscrypt chacha cert unit test escapes in grep. 962 - Remove asynclook tests that cause test and purifier problems. 963 - Fix to unlock view in view test. 964 96515 June 2017: Wouter 966 - Fix stub zone queries leaking to the internet for 967 harden-referral-path ns checks. 968 - Fix query for refetch_glue of stub leaking to internet. 969 97013 June 2017: Wouter 971 - Fix #1279: Memory leak on reload when python module is enabled. 972 - Fix #1280: Unbound fails assert when response from authoritative 973 contains malformed qname. When 0x20 caps-for-id is enabled, when 974 assertions are not enabled the malformed qname is handled correctly. 975 - 1.6.3 tag created, with only #1280 fix, trunk is 1.6.4 development. 976 - More fixes in depth for buffer checks in 0x20 qname checks. 977 97812 June 2017: Wouter 979 - Fix #1278: Incomplete wildcard proof. 980 9818 June 2017: Ralph 982 - Added domain name based ECS whitelist. 983 9848 June 2017: Wouter 985 - Detect chacha for dnscrypt at configure time. 986 - dnscrypt unit tests with chacha. 987 9887 June 2017: Wouter 989 - Fix that unbound-control can set val_clean_additional and val_permissive_mode. 990 - Add dnscrypt XChaCha20 tests. 991 9926 June 2017: Wouter 993 - Add an explicit type cast for TCP FASTOPEN fix. 994 - renumbering B-Root's IPv6 address to 2001:500:200::b. 995 - Fix #1275: cached data in cachedb is never used. 996 - Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher. 997 9981 June 2017: Ralph 999 - Fix #1274: automatically trim chroot path from dnscrypt key/cert paths 1000 (from Manu Bretelle). 1001 10021 June 2017: Wouter 1003 - Fix fastopen EPIPE fallthrough to perform connect. 1004 100531 May 2017: Ralph 1006 - Also use global local-zones when there is a matching view that does 1007 not have any local-zone specified. 1008 100931 May 2017: Wouter 1010 - Fix #1273: cachedb.c doesn't compile with -Wextra. 1011 - If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write. 1012 101330 May 2017: Ralph 1014 - Fix #1269: inconsistent use of built-in local zones with views. 1015 - Add defaults for new local-zone trees added to views using 1016 unbound-control. 1017 101830 May 2017: Wouter 1019 - Support for openssl EVP_DigestVerify. 1020 - Support for the ED25519 algorithm with openssl (from openssl 1.1.1). 1021 102229 May 2017: Wouter 1023 - Fix assertion for low buffer size and big edns payload when worker 1024 overrides udpsize. 1025 102626 May 2017: Ralph 1027 - Added redirect-bogus.patch to contrib directory. 1028 102926 May 2017: Wouter 1030 - Fix #1270: unitauth.c doesn't compile with higher warning level 1031 and optimization 1032 - exec_prefix is by default equal to prefix. 1033 - printout localzone for duplicate local-zone warnings. 1034 103524 May 2017: Wouter 1036 - authzone cname chain, no rrset duplicates, wildcard doesn't change 1037 rrsets added for cname chain. 1038 103923 May 2017: Wouter 1040 - first services/authzone check in, it compiles and reads and writes 1041 zonefiles. 1042 - iana portlist update 1043 104422 May 2017: Wouter 1045 - Fix #1268: SIGSEGV after log_reopen. 1046 104718 May 2017: Wouter 1048 - Fix #1265 to use /bin/kill. 1049 - Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs, 1050 and compatibility with BoringSSL. 1051 105217 May 2017: Wouter 1053 - Fix #1265: contrib/unbound.service contains hardcoded path. 1054 105517 May 2017: George 1056 - Use qstate's region for IPSECKEY rrset (ipsecmod). 1057 105816 May 2017: George 1059 - Implemented opportunistic IPsec support module (ipsecmod). 1060 - Some whitespace fixup. 1061 106216 May 2017: Wouter 1063 - updated dependencies in the makefile. 1064 - document trust-anchor-signaling in example config file. 1065 - updated configure, dependencies and flex output. 1066 - better module memory lookup, fix of unbound-control shm names for 1067 module memory printout of statistics. 1068 - Fix type AVC sldns rrdef. 1069 107012 May 2017: Wouter 1071 - Adjust servfail by iterator to not store in cache when serve-expired 1072 is enabled, to avoid overwriting useful information there. 1073 - Fix queries for nameservers under a stub leaking to the internet. 1074 10759 May 2017: Ralph 1076 - Add 'c' to getopt() in testbound. 1077 - iana portlist update 1078 10798 May 2017: Wouter 1080 - Fix tcp-mss failure printout text. 1081 - Set SO_REUSEADDR on outgoing tcp connections to fix the bind before 1082 connect limited tcp connections. With the option tcp connections 1083 can share the same source port (for different destinations). 1084 10852 May 2017: Ralph 1086 - Added mesh_add_sub to add detached mesh entries. 1087 - Use mesh_add_sub for key tag signaling query. 1088 10892 May 2017: Wouter 1090 - Added test for leak of stub information. 1091 - Fix sldns wire2str printout of RR type CAA tags. 1092 - Fix sldns int16_data parse. 1093 - Fix sldns parse and printout of TSIG RRs. 1094 - sldns SMIMEA and AVC definitions, same as getdns definitions. 1095 10961 May 2017: Wouter 1097 - Fix #1259: "--disable-ecdsa" argument overwritten 1098 by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c". 1099 - iana portlist update 1100 - Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start. 1101 and fix that 64bit getting installed in C:\Program Files (x86). 1102 110326 April 2017: Ralph 1104 - Implemented trust anchor signaling using key tag query. 1105 110626 April 2017: Wouter 1107 - Based on #1257: check parse limit before t increment in sldns RR 1108 string parse routine. 1109 111024 April 2017: Wouter 1111 - unbound-checkconf -o allows query of dnstap config variables. 1112 Also unbound-control get_option. Also for dnscrypt. 1113 - trunk contains 1.6.3 version number (changes from 1.6.2 back from 1114 when the 1.6.2rc1 tag has been created). 1115 111621 April 2017: Ralph 1117 - Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle). 1118 - iana portlist update 1119 112018 April 2017: Ralph 1121 - Fix #1252: more indentation inconsistencies. 1122 - Fix #1253: unused variable in edns-subnet/addrtree.c:getbit(). 1123 112413 April 2017: Ralph 1125 - Added ECS unit test (from Manu Bretelle). 1126 - ECS documentation fix (from Manu Bretelle). 1127 112813 April 2017: Wouter 1129 - Fix #1250: inconsistent indentation in services/listen_dnsport.c. 1130 - tag for 1.6.2rc1 1131 - (for 1.6.3:) unbound.h exports the shm stats structures. They use 1132 type long long and no ifdefs, and ub_ before the typenames. 1133 113412 April 2017: Wouter 1135 - subnet mem value is available in shm, also when not enabled, 1136 to make the struct easier to memmap by other applications, 1137 independent of the configuration of unbound. 1138 113912 April 2017: Ralph 1140 - Fix #1247: unbound does not shorten source prefix length when 1141 forwarding ECS. 1142 - Properly check for allocation failure in local_data_find_tag_datas. 1143 - Fix #1249: unbound doesn't return FORMERR to bogus ECS. 1144 - Set SHM ECS memory usage to 0 when module not loaded. 1145 114611 April 2017: Ralph 1147 - Display ECS module memory usage. 1148 114910 April 2017: Wouter 1150 - harden-algo-downgrade: no also makes unbound more lenient about 1151 digest algorithms in DS records. 1152 115310 April 2017: Ralph 1154 - Remove ECS option after REFUSED answer. 1155 - Fix small memory leak in edns_opt_copy_alloc. 1156 - Respip dereference after NULL check. 1157 - Zero initialize addrtree allocation. 1158 - Use correct identifier for SHM destroy. 1159 11607 April 2017: George 1161 - Fix pythonmod for cb changes. 1162 - Some whitespace fixup. 1163 11647 April 2017: Ralph 1165 - Unlock view in respip unit test 1166 11676 April 2017: Ralph 1168 - Generalise inplace callback (de)registration 1169 - (de)register inplace callbacks for module id 1170 - No unbound-control set_option for ECS options 1171 - Deprecated client-subnet-opcode config option 1172 - Introduced client-subnet-always-forward config option 1173 - Changed max-client-subnet-ipv6 default to 56 (as in RFC) 1174 - Removed extern ECS config options 1175 - module_restart_next now calls clear on all following modules 1176 - Also create ECS module qstate on module_event_pass event 1177 - remove malloc from inplace_cb_register 1178 11796 April 2017: Wouter 1180 - Small fixup for documentation. 1181 - iana portlist update 1182 - Fix respip for braces when locks arent used. 1183 - Fix pythonmod for cb changes. 1184 11854 April 2017: Wouter 1186 - Fix #1244: document that use of chroot requires trust anchor file to 1187 be under chroot. 1188 - iana portlist update 1189 11903 April 2017: Ralph 1191 - Do not add current time twice to TTL before ECS cache store. 1192 - Do not touch rrset cache after ECS cache message generation. 1193 - Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode. 1194 11953 April 2017: Wouter 1196 - Fix #1217: Add metrics to unbound-control interface showing 1197 crypted, cert request, plaintext and malformed queries (from 1198 Manu Bretelle). 1199 - iana portlist update 1200 120127 March 2017: Wouter 1202 - Remove (now unused) event2 include from dnscrypt code. 1203 120424 March 2017: George 1205 - Fix to prevent non-referal query from being cached as referal when the 1206 no_cache_store flag was set. 1207 120823 March 2017: Wouter 1209 - Fix #1239: configure fails to find python distutils if python 1210 prints warning. 1211 121222 March 2017: Wouter 1213 - Fix #1238: segmentation fault when adding through the remote 1214 interface a per-view local zone to a view with no previous 1215 (configured) local zones. 1216 - Fix #1229: Systemd service sandboxing, options in wrong sections. 1217 121821 March 2017: Ralph 1219 - Merge EDNS Client subnet implementation from feature branch into main 1220 branch, using new EDNS processing framework. 1221 122221 March 2017: Wouter 1223 - Fix doxygen for dnscrypt files. 1224 122520 March 2017: Wouter 1226 - #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then 1227 enabled in the config file from Manu Bretelle. 1228 - make depend, autoconf, remove warnings about statement before var. 1229 - lru_demote and lruhash_insert_or_retrieve functions for getdns. 1230 - fixup for lruhash (whitespace and header file comment). 1231 - dnscrypt tests. 1232 123317 March 2017: Wouter 1234 - Patch for view functionality for local-data-ptr from Björn Ketelaars. 1235 - Fix #1237 - Wrong resolving in chain, for norec queries that get 1236 SERVFAIL returned. 1237 123816 March 2017: Wouter 1239 - Fix that SHM is not inited if not enabled. 1240 - Add trustanchor.unbound CH TXT that gets a response with a number 1241 of TXT RRs with a string like "example.com. 2345 1234" with 1242 the trust anchors and their keytags. 1243 - Fix that looped DNAMEs do not cause unbound to spend effort. 1244 - trustanchor tags are sorted. reusable routine to fetch taglist. 1245 124613 March 2017: Wouter 1247 - testbound understands Deckard MATCH rcode question answer commands. 1248 - Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead 1249 of YXDOMAIN + query loop, reported by Petr Spacek. 1250 125110 March 2017: Wouter 1252 - Fix #1234: shortening DNAME loop produces duplicate DNAME records 1253 in ANSWER section. 1254 12559 March 2017: Wouter 1256 - --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and 1257 DS records. NSEC3 is not disabled. 1258 - fake-sha1 test option; print warning if used. To make unit tests. 1259 - unbound-control list local zone and data commands listed in the 1260 help output. 1261 12628 March 2017: Wouter 1263 - make depend for build dependencies. 1264 - swig version 2.0.1 required. 1265 - fix enum conversion warnings 1266 12677 March 2017: Wouter 1268 - Fix #1230: swig version 2.0.0 is required for pythonmod, with 1269 1.3.40 it crashes when running repeatly unbound-control reload. 1270 - Response actions based on IP address from Jinmei Tatuya (Infoblox). 1271 12726 March 2017: Wouter 1273 - Fix #1229: Systemd service sandboxing in contrib/unbound.service. 1274 - iana portlist update 1275 127628 February 2017: Ralph 1277 - Fix testpkts.c, check if DO bit is set, not only if there is an OPT 1278 record. 1279 128028 February 2017: Wouter 1281 - For #1227: if we have sha256, set the cipher list to have no 1282 known vulns. 1283 128427 February 2017: Wouter 1285 - Fix #1227: Fix that Unbound control allows weak ciphersuits. 1286 - Fix #1226: provide official 32bit binary for windows. 1287 128824 February 2017: Wouter 1289 - include sys/time.h for new shm code on NetBSD. 1290 129123 February 2017: Wouter 1292 - Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to 1293 redirect. 1294 - Patch from Luiz Fernando Softov for Stats Shared Memory. 1295 - unbound-control stats_shm command prints stats using shared memory, 1296 which uses less cpu. 1297 - make depend, autoconf, doxygen and lint fixed up. 1298 129922 February 2017: Wouter 1300 - Fix #1224: Fix that defaults should not fall back to "Program Files 1301 (x86) if Unbound is 64bit by default on windows. 1302 130321 February 2017: Wouter 1304 - iana portlist update 1305 130616 February 2017: Wouter 1307 - sldns updated for vfixed and buffer resize indication from getdns. 1308 130915 February 2017: Wouter 1310 - sldns has ED25519 and ED448 algorithm number and name for display. 1311 131214 February 2017: Wouter 1313 - tag 1.6.1rc3. -- which became 1.6.1 on 21feb, trunk has 1.6.2 1314 131513 February 2017: Wouter 1316 - Fix autoconf of systemd check for lack of pkg-config. 1317 131810 February 2017: Wouter 1319 - Fix pythonmod for typedef changes. 1320 - Fix dnstap for warning of set but not used. 1321 - tag 1.6.1rc2. 1322 13239 February 2017: Wouter 1324 - tag 1.6.1rc1. 1325 13268 February 2017: Wouter 1327 - Fix for type name change and fix warning on windows compile. 1328 13297 February 2017: Wouter 1330 - Include root trust anchor id 20326 in unbound-anchor. 1331 13326 February 2017: Wouter 1333 - Fix compile on solaris of the fix to use $host detect. 1334 13354 February 2017: Wouter 1336 - fix root_anchor test for updated icannbundle.pem lower certificates. 1337 133826 January 2017: Wouter 1339 - Fix 1211: Fix can't enable interface-automatic if no IPv6 with 1340 more helpful error message. 1341 134220 January 2017: Wouter 1343 - Increase MAX_MODULE to 16. 1344 134519 January 2017: Wouter 1346 - Fix to Rename ub_callback_t to ub_callback_type, because POSIX 1347 reserves _t typedefs. 1348 - Fix to rename internally used types from _t to _type, because _t 1349 type names are reserved by POSIX. 1350 - iana portlist update 1351 135212 January 2017: Wouter 1353 - Fix to also block meta types 128 through to 248 with formerr. 1354 - Fix #1206: Some view-related commands are missing from 'unbound-control -h' 1355 13569 January 2017: Wouter 1357 - Fix #1202: Fix code comment that packed_rrset_data is not always 1358 'packed'. 1359 13606 January 2017: Wouter 1361 - Fix #1201: Fix missing unlock in answer_from_cache error condition. 1362 13635 January 2017: Wouter 1364 - Fix to return formerr for queries for meta-types, to avoid 1365 packet amplification if this meta-type is sent on to upstream. 1366 - Fix #1184: Log DNS replies. This includes the same logging 1367 information that DNS queries and response code and response size, 1368 patch from Larissa Feng. 1369 - Fix #1187: Source IP rate limiting, patch from Larissa Feng. 1370 13713 January 2017: Wouter 1372 - configure --enable-systemd and lets unbound use systemd sockets if 1373 you enable use-systemd: yes in unbound.conf. 1374 Also there are contrib/unbound.socket and contrib/unbound.service: 1375 systemd files for unbound, install them in /usr/lib/systemd/system. 1376 Contributed by Sami Kerola and Pavel Odintsov. 1377 - Fix reload chdir failure when also chrooted to that directory. 1378 13792 January 2017: Wouter 1380 - Fix #1194: Cross build fails when $host isn't `uname` for getentropy. 1381 138223 December 2016: Ralph 1383 - Fix #1190: Do not echo back EDNS options in local-zone error response. 1384 - iana portlist update 1385 138621 December 2016: Ralph 1387 - Fix #1188: Unresolved symbol 'fake_dsa' in libunbound.so when built 1388 with Nettle 1389 139019 December 2016: Ralph 1391 - Fix #1191: remove comment about view deletion. 1392 139315 December 2016: Wouter 1394 - iana portlist update 1395 - 64bit is default for windows builds. 1396 - Fix inet_ntop and inet_pton warnings in windows compile. 1397 139814 December 2016: Wouter 1399 - Fix #1178: attempt to fix setup error at end, pop result values 1400 at end of install. 1401 140213 December 2016: Wouter 1403 - Fix #1182: Fix Resource leak (socket), at startup. 1404 - Fix unbound-control and ipv6 only. 1405 14069 December 2016: Wouter 1407 - Fix #1176: stack size too small for Alpine Linux. 1408 14098 December 2016: Wouter 1410 - Fix downcast warnings from visual studio in sldns code. 1411 - tag 1.6.0rc1 which became 1.6.0 on 15 dec, and trunk is 1.6.1. 1412 14137 December 2016: Ralph 1414 - Add DSA support for OpenSSL 1.1.0 1415 - Fix remote control without cert for LibreSSL 1416 14176 December 2016: George 1418 - Added generic EDNS code for registering known EDNS option codes, 1419 bypassing the cache response stage and uniquifying mesh states. Four EDNS 1420 option lists were added to module_qstate (module_qstate.edns_opts_*) to 1421 store EDNS options from/to front/back side. 1422 - Added two flags to module_qstate (no_cache_lookup, no_cache_store) that 1423 control the modules' cache interactions. 1424 - Added code for registering inplace callback functions. The registered 1425 functions can be called just before replying with local data or Chaos, 1426 replying from cache, replying with SERVFAIL, replying with a resolved 1427 query, sending a query to a nameserver. The functions can inspect the 1428 available data and maybe change response/query related data (i.e. append 1429 EDNS options). 1430 - Updated Python module for the above. 1431 - Updated Python documentation. 1432 14335 December 2016: Ralph 1434 - Fix #1173: differ local-zone type deny from unset 1435 tag_actions element. 1436 14375 December 2016: Wouter 1438 - Fix #1170: document that 'inform' local-zone uses local-data. 1439 14401 December 2016: Ralph 1441 - hyphen as minus fix, by Andreas Schulze 1442 144330 November 2016: Ralph 1444 - Added local-zones and local-data bulk addition and removal 1445 functionality in unbound-control (local_zones, local_zones_remove, 1446 local_datas and local_datas_remove). 1447 - iana portlist update 1448 144929 November 2016: Wouter 1450 - version 1.6.0 is in the development branch. 1451 - braces in view.c around lock statements. 1452 145328 November 2016: Wouter 1454 - new install-sh. 1455 145625 November 2016: Wouter 1457 - Fix that with openssl 1.1 control-use-cert: no uses less cpu, by 1458 using no encryption over the unix socket. 1459 146022 Novenber 2016: Ralph 1461 - Make access-control-tag-data RDATA absolute. This makes the RDATA 1462 origin consistent between local-data and access-control-tag-data. 1463 - Fix NSEC ENT wildcard check. Matching wildcard does not have to be a 1464 subdomain of the NSEC owner. 1465 - QNAME minimisation uses QTYPE=A, therefore always check cache for 1466 this type in harden-below-nxdomain functionality. 1467 - Added unit test for QNAME minimisation + harden below nxdomain 1468 synergy. 1469 147022 November 2016: Wouter 1471 - iana portlist update. 1472 - Fix unit tests for DS hash processing for fake-dsa test option. 1473 - patch from Dag-Erling Smorgrav that removes code that relies 1474 on sbrk(). 1475 147621 November 2016: Wouter 1477 - Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing 1478 Underneath" for the harden-below-nxdomain option. 1479 148010 November 2016: Ralph 1481 - Fix #1155: test status code of unbound-control in 04-checkconf, 1482 not the status code from the tee command. 1483 14844 November 2016: Ralph 1485 - Added stub-ssl-upstream and forward-ssl-upstream options. 1486 14874 November 2016: Wouter 1488 - configure detects ssl security level API function in the autoconf 1489 manner. Every function on its own, so that other libraries (eg. 1490 LibreSSL) can develop their API without hindrance. 1491 - Fix #1154: segfault when reading config with duplicate zones. 1492 - Note that for harden-below-nxdomain the nxdomain must be secure, 1493 this means nsec3 with optout is insufficient. 1494 14953 November 2016: Ralph 1496 - Set OpenSSL security level to 0 when using aNULL ciphers. 1497 14983 November 2016: Wouter 1499 - .gitattributes line for githubs code language display. 1500 - log-identity: config option to set sys log identity, patch from 1501 "Robin H. Johnson" <robbat2@gentoo.org> 1502 15032 November 2016: Wouter 1504 - iana portlist update. 1505 150631 October 2016: Wouter 1507 - Fix failure to build on arm64 with no sbrk. 1508 - iana portlist update. 1509 151028 October 2016: Wouter 1511 - Patch for server.num.zero_ttl stats for count of expired replies, 1512 from Pavel Odintsov. 1513 151426 October 2016: Wouter 1515 - Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled 1516 with the undocumented switch 'fake-dsa'. It logs a warning. 1517 151825 October 2016: Wouter 1519 - Fix #1134: unbound-control set_option -- val-override-date: -1 works 1520 immediately to ignore datetime, or back to 0 to enable it again. 1521 The -- is to ignore the '-1' as an option flag. 1522 152324 October 2016: Wouter 1524 - serve-expired config option: serve expired responses with TTL 0. 1525 - g.root-servers.net has AAAA address. 1526 152721 October 2016: Wouter 1528 - Ported tests for local_cname unit test to testbound framework. 1529 153020 October 2016: Wouter 1531 - suppress compile warning in lex files. 1532 - init lzt variable, for older gcc compiler warnings. 1533 - fix --enable-dsa to work, instead of copying ecdsa enable. 1534 - Fix DNSSEC validation of query type ANY with DNAME answers. 1535 - Fixup query_info local_alias init. 1536 153719 October 2016: Wouter 1538 - Fix #1130: whitespace in example.conf.in more consistent. 1539 154018 October 2016: Wouter 1541 - Patch that resolves CNAMEs entered in local-data conf statements that 1542 point to data on the internet, from Jinmei Tatuya (Infoblox). 1543 - Removed patch comments from acllist.c and msgencode.c 1544 - Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, 1545 from Jinmei Tatuya (Infoblox). 1546 - Fix #1125: unbound could reuse an answer packet incorrectly for 1547 clients with different EDNS parameters, from Jinmei Tatuya. 1548 - Fix #1118: libunbound.pc sets strange Libs, Libs.private values. 1549 - Added Requires line to libunbound.pc 1550 - Please doxygen by modifying mesh.h 1551 155217 October 2016: Wouter 1553 - Re-fix #839 from view commit overwrite. 1554 - Fixup const void cast warning. 1555 155612 October 2016: Ralph 1557 - Free view config elements. 1558 155911 October 2016: Ralph 1560 - Added qname-minimisation-strict config option. 1561 - iana portlist update. 1562 - fix memoryleak logfile when in debug mode. 1563 15645 October 2016: Ralph 1565 - Added views functionality. 1566 - Fix #1117: spelling errors, from Robert Edmonds. 1567 156830 September 2016: Wouter 1569 - Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav. 1570 157129 September 2016: Wouter 1572 - Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX. 1573 - Fix #839: Memory grows unexpectedly with large RPZ files. 1574 - Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile. 1575 - Fix #841: big local-zone's make it consume large amounts of memory. 1576 157727 September 2016: Wouter 1578 - tag for 1.5.10 release 1579 - trunk contains 1.5.11 in development. 1580 - Fix dnstap relaying "random" messages instead of resolver/forwarder 1581 responses, from Nikolay Edigaryev. 1582 - Fix #836: unbound could echo back EDNS options in an error response. 1583 158420 September 2016: Wouter 1585 - iana portlist update. 1586 - Fix #835: fix --disable-dsa with nettle verify. 1587 - tag for 1.5.10rc1 release. 1588 158915 September 2016: Wouter 1590 - Fix 883: error for duplicate local zone entry. 1591 - Test for openssl init_crypto and init_ssl functions. 1592 159315 September 2016: Ralph 1594 - fix potential memory leak in daemon/remote.c and nullpointer 1595 dereference in validator/autotrust. 1596 - iana portlist update. 1597 159813 September 2016: Wouter 1599 - Silenced flex-generated sign-unsigned warning print with gcc 1600 diagnostic pragma. 1601 - Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len. 1602 16039 September 2016: Wouter 1604 - Fix #831: workaround for spurious fread_chk warning against petal.c 1605 16065 September 2016: Ralph 1607 - Take configured minimum TTL into consideration when reducing TTL 1608 to original TTL from RRSIG. 1609 16105 September 2016: Wouter 1611 - Fix #829: doc of sldns_wire2str_rdata_buf() return value has an 1612 off-by-one typo, from Jinmei Tatuya (Infoblox). 1613 - Fix incomplete prototypes reported by Dag-Erling Smørgrav. 1614 - Fix #828: missing type in access-control-tag-action redirect results 1615 in NXDOMAIN. 1616 16172 September 2016: Wouter 1618 - Fix compile with openssl 1.1.0 with api=1.1.0. 1619 16201 September 2016: Wouter 1621 - RFC 7958 is now out, updated docs for unbound-anchor. 1622 - Fix for compile without warnings with openssl 1.1.0. 1623 - Fix #826: Fix refuse_non_local could result in a broken response. 1624 - iana portlist update. 1625 162629 August 2016: Wouter 1627 - Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A. 1628 Siewior. 1629 - Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e. 1630 163125 August 2016: Ralph 1632 - Clarify local-zone-override entry in unbound.conf.5 1633 163425 August 2016: Wouter 1635 - 64bit build option for makedist windows compile, -w64. 1636 163724 August 2016: Ralph 1638 - Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter 1639 in each iteration in find_tag_datas(). 1640 - unbound.conf.5 entries for define-tag, access-control-tag, 1641 access-control-tag-action, access-control-tag-data, local-zone-tag, 1642 and local-zone-override. 1643 164423 August 2016: Wouter 1645 - Fix #804: unbound stops responding after outage. Fixes queries 1646 that attempt to wait for an empty list of subqueries. 1647 - Fix #804: lower num_target_queries for iterator also for failed 1648 lookups. 1649 16508 August 2016: Wouter 1651 - Note that OPENPGPKEY type is RFC 7929. 1652 16534 August 2016: Wouter 1654 - Fix #807: workaround for possible some "unused" function parameters 1655 in test code, from Jinmei Tatuya. 1656 16573 August 2016: Wouter 1658 - use sendmsg instead of sendto for TFO. 1659 166028 July 2016: Wouter 1661 - Fix #806: wrong comment removed. 1662 166326 July 2016: Wouter 1664 - nicer ratelimit-below-domain explanation. 1665 166622 July 2016: Wouter 1667 - Fix #801: missing error condition handling in 1668 daemon_create_workers(). 1669 - Fix #802: workaround for function parameters that are "unused" 1670 without log_assert. 1671 - Fix #803: confusing (and incorrect) code comment in daemon_cleanup(). 1672 167320 July 2016: Wouter 1674 - Fix typo in unbound.conf. 1675 167618 July 2016: Wouter 1677 - Fix #798: Client-side TCP fast open fails (Linux). 1678 167914 July 2016: Wouter 1680 - TCP Fast open patch from Sara Dickinson. 1681 - Fixed unbound.doxygen for 1.8.11. 1682 16837 July 2016: Wouter 1684 - access-control-tag-data implemented. verbose(4) prints tag debug. 1685 16865 July 2016: Wouter 1687 - Fix dynamic link of anchor-update.exe on windows. 1688 - Fix detect of mingw for MXE package build. 1689 - Fixes for 64bit windows compile. 1690 - Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and 1691 --with-libunbound-only --with-nettle. 1692 16934 July 2016: Wouter 1694 - For #787: prefer-ip6 option for unbound.conf prefers to send 1695 upstream queries to ipv6 servers. 1696 - Fix #787: outgoing-interface netblock/64 ipv6 option to use linux 1697 freebind to use 64bits of entropy for every query with random local 1698 part. 1699 170030 June 2016: Wouter 1701 - Document always_transparent, always_refuse, always_nxdomain types. 1702 170329 June 2016: Wouter 1704 - Fix static compile on windows missing gdi32. 1705 170628 June 2016: Wouter 1707 - Create a pkg-config file for libunbound in contrib. 1708 170927 June 2016: Wouter 1710 - Fix #784: Build configure assumess that having getpwnam means there 1711 is endpwent function available. 1712 - Updated repository with newer flex and bison output. 1713 171424 June 2016: Ralph 1715 - Possibility to specify local-zone type for an acl/tag pair 1716 - Possibility to specify (override) local-zone type for a source address 1717 block 171816 June 2016: Ralph 1719 - Decrease dp attempts at each QNAME minimisation iteration 1720 172116 June 2016: Wouter 1722 - Fix tcp timeouts in tv.usec. 1723 172415 June 2016: Wouter 1725 - TCP_TIMEOUT is specified in milliseconds. 1726 - If more than half of tcp connections are in use, a shorter timeout 1727 is used (200 msec, vs 2 minutes) to pressure tcp for new connects. 1728 172914 June 2016: Ralph 1730 - QNAME minimisation unit test for dropped QTYPE=A queries. 1731 173214 June 2016: Wouter 1733 - Fix 775: unbound-host and unbound-anchor crash on windows, ignore 1734 null delete for wsaevent. 1735 - Fix spelling in freebind option man page text. 1736 - Fix windows link of ssl with crypt32. 1737 - Fix 779: Union casting is non-portable. 1738 - Fix 780: MAP_ANON not defined in HP-UX 11.31. 1739 - Fix 781: prealloc() is an HP-UX system library call. 1740 174113 June 2016: Ralph 1742 - Use QTYPE=A for QNAME minimisation. 1743 - Keep track of number of time-outs when performing QNAME minimisation. 1744 Stop minimising when number of time-outs for a QNAME/QTYPE pair is 1745 more than three. 1746 174713 June 2016: Wouter 1748 - Fix #778: unbound 1.5.9: -h segfault (null deref). 1749 - Fix directory: fix for unbound-checkconf, it restores cwd. 1750 175110 June 2016: Wouter 1752 - And delete service.conf.shipped on uninstall. 1753 - In unbound.conf directory: dir immediately changes to that directory, 1754 so that include: file below that is relative to that directory. 1755 With chroot, make the directory an absolute path inside chroot. 1756 - keep debug symbols in windows build. 1757 - do not delete service.conf on windows uninstall. 1758 - document directory immediate fix and allow EXECUTABLE syntax in it 1759 on windows. 1760 17619 June 2016: Wouter 1762 - Trunk is called 1.5.10 (with previous fixes already in there to 2 1763 june). 1764 - Revert fix for NetworkService account on windows due to breakage 1765 it causes. 1766 - Fix that windows install will not overwrite existing service.conf 1767 file (and ignore gui config choices if it exists). 1768 17697 June 2016: Ralph 1770 - Lookup localzones by taglist from acl. 1771 - Possibility to lookup local_zone, regardless the taglist. 1772 - Added local_zone/taglist/acl unit test. 1773 17747 June 2016: Wouter 1775 - Fix #773: Non-standard Python location build failure with pyunbound. 1776 - Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures. 1777 17786 June 2016: Wouter 1779 - Better help text from -h (from Ray Griffith). 1780 - access-control-tag config directive. 1781 - local-zone-override config directive. 1782 - access-control-tag-action and access-control-tag-data config 1783 directives. 1784 - free acl-tags, acltag-action and acltag-data config lists during 1785 initialisation to free up memory for more entries. 1786 17873 June 2016: Wouter 1788 - Fix to not ignore return value of chown() in daemon startup. 1789 17902 June 2016: Wouter 1791 - Fix libubound for edns optlist feature. 1792 - Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc. 1793 - Fix #752: retry resource temporarily unavailable on control pipe. 1794 - un-document localzone tags. 1795 - tag for release 1.5.9rc1. 1796 And this also became release 1.5.9. 1797 - Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to 1798 Program Files with (x86) appended. 1799 - re-documented localzone tags in example.conf. 1800 180131 May 2016: Wouter 1802 - Fix windows service to be created run with limited rights, as a 1803 network service account, from Mario Turschmann. 1804 - compat strsep implementation. 1805 - generic edns option parse and store code. 1806 - and also generic edns options for upstream messages (and replies). 1807 after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID), 1808 to insert use edns_opt_append(edns, region, code, len, bindata) on 1809 the opt_list passed to send_query, or in edns_opt_inplace_reply. 1810 181130 May 2016: Wouter 1812 - Fix time in case answer comes from cache in ub_resolve_event(). 1813 - Attempted fix for #765: _unboundmodule missing for python3. 1814 181527 May 2016: Wouter 1816 - Fix #770: Small subgroup attack on DH used in unix pipe on localhost 1817 if unbound control uses a unix local named pipe. 1818 - Document write permission to directory of trust anchor needed. 1819 - Fix #768: Unbound Service Sometimes Can Not Shutdown 1820 Completely, WER Report Shown Up. Close handle before closing WSA. 1821 182226 May 2016: Wouter 1823 - Updated patch from Charles Walker. 1824 182524 May 2016: Wouter 1826 - disable-dnssec-lame-check config option from Charles Walker. 1827 - remove memory leak from lame-check patch. 1828 - iana portlist update. 1829 183023 May 2016: Wouter 1831 - Fix #767: Reference to an expired Internet-Draft in 1832 harden-below-nxdomain documentation. 1833 183420 May 2016: Ralph 1835 - No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC 1836 signed zones. 1837 - iana portlist update. 1838 183919 May 2016: Wouter 1840 - Fix #766: dns64 should synthesize results on timeout/errors. 1841 184218 May 2016: Wouter 1843 - Fix #761: DNSSEC LAME false positive resolving nic.club. 1844 184517 May 2016: Wouter 1846 - trunk updated with output of flex 2.6.0. 1847 18486 May 2016: Wouter 1849 - Fix memory leak in out-of-memory conditions of local zone add. 1850 185129 April 2016: Wouter 1852 - Fix sldns with static checking fixes copied from getdns. 1853 185428 April 2016: Wouter 1855 - Fix #759: 0x20 capsforid no longer checks type PTR, for 1856 compatibility with cisco dns guard. This lowers false positives. 1857 185818 April 2016: Wouter 1859 - Fix some malformed reponses to edns queries get fallback to nonedns. 1860 186115 April 2016: Wouter 1862 - cachedb module event handling design. 1863 186414 April 2016: Wouter 1865 - cachedb module framework (empty). 1866 - iana portlist update. 1867 186812 April 2016: Wouter 1869 - Fix #753: document dump_requestlist is for first thread. 1870 187124 March 2016: Wouter 1872 - Document permit-small-holddown for 5011 debug. 1873 - Fix #749: unbound-checkconf gets SIGSEGV when use against a 1874 malformatted conf file. 1875 187623 March 2016: Wouter 1877 - OpenSSL 1.1.0 portability, --disable-dsa configure option. 1878 187921 March 2016: Wouter 1880 - Fix compile of getentropy_linux for SLES11 servicepack 4. 1881 - Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev. 1882 - Fix test for openssl to use HMAC_Update for 1.1.0. 1883 - acx_nlnetlabs.m4 to v33, with HMAC_Update. 1884 - acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto. 1885 - ERR_remove_state deprecated since openssl 1.0.0. 1886 - OPENSSL_config is deprecated, removing. 1887 188818 March 2016: Ralph 1889 - Validate QNAME minimised NXDOMAIN responses. 1890 - If QNAME minimisation is enabled, do cache lookup for QTYPE NS in 1891 harden-below-nxdomain. 1892 189317 March 2016: Ralph 1894 - Limit number of QNAME minimisation iterations. 1895 189617 March 2016: Wouter 1897 - Fix #746: Fix unbound sets CD bit on all forwards. 1898 If no trust anchors, it'll not set CD bit when forwarding to another 1899 server. If a trust anchor, no CD bit on the first attempt to a 1900 forwarder, but CD bit thereafter on repeated attempts to get DNSSEC. 1901 - iana portlist update. 1902 190316 March 2016: Wouter 1904 - Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma. 1905 - Fix ip-transparent for tcp on freebsd. 1906 190715 March 2016: Wouter 1908 - ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for 1909 binding to an IP address while the interface or address is down. 1910 191114 March 2016: Wouter 1912 - Fix warnings in ifdef corner case, older or unknown libevent. 1913 - Fix compile for ub_event code with older libev. 1914 191511 March 2016: Wouter 1916 - Remove warning about unused parameter in event_pluggable.c. 1917 - Fix libev usage of dispatch return value. 1918 - No side effects in tolower() call, in case it is a macro. 1919 - For test put free in pluggable api in parenthesis. 1920 192110 March 2016: Wouter 1922 - Fixup backend2str for libev. 1923 192409 March 2016: Willem 1925 - User defined pluggable event API for libunbound 1926 - Fixup of compile fix for pluggable event API from P.Y. Adi 1927 Prasaja. 1928 192909 March 2016: Wouter 1930 - Updated configure and ltmain.sh. 1931 - Updated L root IPv6 address. 1932 193307 March 2016: Wouter 1934 - Fix #747: assert in outnet_serviced_query_stop. 1935 - iana ports fetched via https. 1936 - iana portlist update. 1937 193803 March 2016: Wouter 1939 - configure tests for the weak attribute support by the compiler. 1940 194102 March 2016: Wouter 1942 - 1.5.8 release tag 1943 - trunk contains 1.5.9 in development. 1944 - iana portlist update. 1945 - Fix #745: unbound.py - idn2dname throws UnicodeError when idnname 1946 contains trailing dot. 1947 194824 February 2016: Wouter 1949 - Fix OpenBSD asynclook lock free that gets used later (fix test code). 1950 - Fix that NSEC3 negative cache is used when there is no salt. 1951 195223 February 2016: Wouter 1953 - ub_ctx_set_stub() function for libunbound to config stub zones. 1954 - sorted ubsyms.def file with exported libunbound functions. 1955 195619 February 2016: Wouter 1957 - Print understandable debug log when unusable DS record is seen. 1958 - load gost algorithm if digest is seen before key algorithm. 1959 - iana portlist update. 1960 196117 February 2016: Wouter 1962 - Fix that "make install" fails due to "text file busy" error. 1963 196416 February 2016: Wouter 1965 - Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error. 1966 196715 February 2016: Wouter 1968 - ip-transparent option for FreeBSD with IP_BINDANY socket option. 1969 - wait for sendto to drain socket buffers when they are full. 1970 19719 February 2016: Wouter 1972 - Test for type OPENPGPKEY. 1973 - insecure-lan-zones: yesno config option, patch from Dag-Erling 1974 Smørgrav. 1975 19768 February 2016: Wouter 1977 - Fix patch typo in prevuous commit for 734 from Adi Prasaja. 1978 - RR Type CSYNC support RFC 7477, in debug printout and config input. 1979 - RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07). 1980 198129 January 2016: Wouter 1982 - Neater cmdline_verbose increment patch from Edgar Pettijohn. 1983 198427 January 2016: Wouter 1985 - Made netbsd sendmsg test nonfatal, in case of false positives. 1986 - Fix #741: log message for dnstap socket connection is more clear. 1987 198826 January 2016: Wouter 1989 - Fix #734: chown the pidfile if it resides inside the chroot. 1990 - Use arc4random instead of random in tests (because it is 1991 available, possibly as compat, anyway). 1992 - Fix cmsg alignment for argument to sendmsg on NetBSD. 1993 - Fix that unbound complains about unimplemented IP_PKTINFO for 1994 sendmsg on NetBSD (for interface-automatic). 1995 199625 January 2016: Wouter 1997 - Fix #738: Swig should not be invoked with CPPFLAGS. 1998 199919 January 2016: Wouter 2000 - Squelch 'cannot assign requested address' log messages unless 2001 verbosity is high, it was spammed after network down. 2002 200314 January 2016: Wouter 2004 - Fix to simplify empty string checking from Michael McConville. 2005 - iana portlist update. 2006 200712 January 2016: Wouter 2008 - Fix #734: Do not log an error when the PID file cannot be chown'ed. 2009 Patch from Simon Deziel. 2010 201111 January 2016: Wouter 2012 - Fix test if -pthreads unused to use better grep for portability. 2013 201406 January 2016: Wouter 2015 - Fix mingw crosscompile for recent mingw. 2016 - Update aclocal, autoconf output with new versions (1.15, 2.4.6). 2017 201805 January 2016: Wouter 2019 - #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch 2020 from Daisuke Higashi. 2021 - Support RFC7686: handle ".onion" Special-Use Domain. It is blocked 2022 by default, and can be unblocked with "nodefault" localzone config. 2023 202404 January 2016: Wouter 2025 - Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined, 2026 for Linux glibc 2.20. 2027 - Fixup contrib/aaaa-filter-iterator.patch for moved contents in the 2028 source code, so it applies cleanly again. Removed unused variable 2029 warnings. 2030 203115 December 2015: Ralph 2032 - Fix #729: omit use of escape sequences in echo since they are not 2033 portable (unbound-control-setup). 2034 203511 December 2015: Wouter 2036 - remove NULL-checks before free, patch from Michael McConville. 2037 - updated ax_pthread.m4 to version 21 with clang support, this 2038 removes a warning from compilation. 2039 - OSX portability, detect if sbrk is deprecated. 2040 - OSX clang, stop -pthread unused during link stage warnings. 2041 - OSX clang new flto check. 2042 204310 December 2015: Wouter 2044 - 1.5.7 release 2045 - trunk has 1.5.8 in development. 2046 20478 December 2015: Wouter 2048 - Fixup 724 for unbound-control. 2049 20507 December 2015: Ralph 2051 - Do not minimise forwarded requests. 2052 20534 December 2015: Wouter 2054 - Removed unneeded whitespace from example.conf. 2055 20563 December 2015: Ralph 2057 - (after rc1 tag) 2058 - Committed fix to qname minimisation and unit test case for it. 2059 20603 December 2015: Wouter 2061 - iana portlist update. 2062 - 1.5.7rc1 prerelease tag. 2063 20642 December 2015: Wouter 2065 - Fixup 724: Fix PCA prompt for unbound-service-install.exe. 2066 re-enable stdout printout. 2067 - For 724: Add Changelog to windows binary dist. 2068 20691 December 2015: Ralph 2070 - Qname minimisation review fixes 2071 20721 December 2015: Wouter 2073 - Fixup 724 fix for fname_after_chroot() calls. 2074 - Remove stdout printout for unbound-service-install.exe 2075 - .gitignore for git users. 2076 207730 November 2015: Ralph 2078 - Implemented qname minimisation 2079 208030 November 2015: Wouter 2081 - Fix for #724: conf syntax to read files from run dir (on Windows). 2082 208325 November 2015: Wouter 2084 - Fix for #720, fix unbound-control-setup windows batch file. 2085 208624 November 2015: Wouter 2087 - Fix #720: add windows scripts to zip bundle. 2088 - iana portlist update. 2089 209020 November 2015: Wouter 2091 - Added assert on rrset cache correctness. 2092 - Fix that malformed EDNS query gets a response without malformed EDNS. 2093 209418 November 2015: Wouter 2095 - newer acx_nlnetlabs.m4. 2096 - spelling fixes from Igor Sobrado Delgado. 2097 209817 November 2015: Wouter 2099 - Fix #594. libunbound: optionally use libnettle for crypto. 2100 Contributed by Luca Bruno. Added --with-nettle for use with 2101 --with-libunbound-only. 2102 - refactor nsec3 hash implementation to be more library-portable. 2103 - iana portlist update. 2104 - Fixup DER encoded DSA signatures for libnettle. 2105 210616 November 2015: Wouter 2107 - Fix for lenient accept of reverse order DNAME and CNAME. 2108 21096 November 2015: Wouter 2110 - Change example.conf: ftp.internic.net to https://www.internic.net 2111 21125 November 2015: Wouter 2113 - ACX_SSL_CHECKS no longer adds -ldl needlessly. 2114 21153 November 2015: Wouter 2116 - Fix #718: Fix unbound-control-setup with support for env 2117 without HEREDOC bash support. 2118 211929 October 2015: Wouter 2120 - patch from Doug Hogan for SSL_OP_NO_SSLvx options. 2121 - Fix #716: nodata proof with empty non-terminals and wildcards. 2122 212328 October 2015: Wouter 2124 - Fix checklock testcode for linux threads on exit. 2125 212627 October 2015: Wouter 2127 - isblank() compat implementation. 2128 - detect libexpat without xml_StopParser function. 2129 - portability fixes. 2130 - portability, replace snprintf if return value broken. 2131 213223 October 2015: Wouter 2133 - Fix #714: Document config to block private-address for IPv4 2134 mapped IPv6 addresses. 2135 213622 October 2015: Wouter 2137 - Fix #712: unbound-anchor appears to not fsync root.key. 2138 213920 October 2015: Wouter 2140 - 1.5.6 release. 2141 - trunk tracks development of 1.5.7. 2142 214315 October 2015: Wouter 2144 - Fix segfault in the dns64 module in the formaterror error path. 2145 - Fix sldns_wire2str_rdata_scan for malformed RRs. 2146 - tag for 1.5.6rc1 release. 2147 214814 October 2015: Wouter 2149 - ANY responses include DNAME records if present, as per Evan Hunt's 2150 remark in dnsop. 2151 - Fix manpage to suggest using SIGTERM to terminate the server. 2152 21539 October 2015: Wouter 2154 - Default for ssl-port is port 853, the temporary port assignment 2155 for secure domain name system traffic. 2156 If you used to rely on the older default of port 443, you have 2157 to put a clause in unbound.conf for that. The new value is likely 2158 going to be the standardised port number for this traffic. 2159 - iana portlist update. 2160 21616 October 2015: Wouter 2162 - 1.5.5 release. 2163 - trunk tracks the development of 1.5.6. 2164 216528 September 2015: Wouter 2166 - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution 2167 failures. 2168 - tag for 1.5.5rc1 release. 2169 - makedist.sh: pgp sig echo commands. 2170 217125 September 2015: Wouter 2172 - Fix unbound-control flush that does not succeed in removing data. 2173 217422 September 2015: Wouter 2175 - Fix config globbed include chroot treatment, this fixes reload of 2176 globs (patch from Dag-Erling Smørgrav). 2177 - iana portlist update. 2178 - Fix #702: New IPs for for h.root-servers.net. 2179 - Remove confusion comment from canonical_compare() function. 2180 - Fix #705: ub_ctx_set_fwd() return value mishandled on windows. 2181 - testbound selftest also works in non-debug mode. 2182 - Fix minor error in unbound.conf.5.in 2183 - Fix unbound.conf(5) access-control description for precedence 2184 and default. 2185 218631 August 2015: Wouter 2187 - changed windows setup compression to be more transparent. 2188 218928 August 2015: Wouter 2190 - Fix #697: Get PY_MAJOR_VERSION failure at configure for python 2191 2.4 to 2.6. 2192 - Feature #699: --enable-pie option to that builds PIE binary. 2193 - Feature #700: --enable-relro-now option that enables full read-only 2194 relocation. 2195 219624 August 2015: Wouter 2197 - Fix deadlock for local data add and zone add when unbound-control 2198 list_local_data printout is interrupted. 2199 - iana portlist update. 2200 - Change default of harden-algo-downgrade to off. This is lenient 2201 for algorithm rollover. 2202 220313 August 2015: Wouter 2204 - 5011 implementation does not insist on all algorithms, when 2205 harden-algo-downgrade is turned off. 2206 - Reap the child process that libunbound spawns. 2207 220811 August 2015: Wouter 2209 - Fix #694: configure script does not detect LibreSSL 2.2.2 2210 22114 August 2015: Wouter 2212 - Document that local-zone nodefault matches exactly and transparent 2213 can be used to release a subzone. 2214 22153 August 2015: Wouter 2216 - Document in the manual more text about configuring locally served 2217 zones. 2218 - Fix 5011 anchor update timer after reload. 2219 - Fix mktime in unbound-anchor not using UTC. 2220 222130 July 2015: Wouter 2222 - please afl-gcc (llvm) for uninitialised variable warning. 2223 - Added permit-small-holddown config to debug fast 5011 rollover. 2224 222524 July 2015: Wouter 2226 - Fix #690: Reload fails when so-reuseport is yes after changing 2227 num-threads. 2228 - iana portlist update. 2229 223021 July 2015: Wouter 2231 - Fix configure to detect SSL_CTX_set_ecdh_auto. 2232 - iana portlist update. 2233 223420 July 2015: Wouter 2235 - Enable ECDHE for servers. Where available, use 2236 SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to 2237 enable ECDHE. Otherwise, manually offer curve p256. 2238 Client connections should automatically use ECDHE when available. 2239 (thanks Daniel Kahn Gillmor) 2240 224118 July 2015: Willem 2242 - Allow certificate chain files to allow for intermediate certificates. 2243 (thanks Daniel Kahn Gillmor) 2244 224513 July 2015: Wouter 2246 - makedist produces sha1 and sha256 files for created binaries too. 2247 22489 July 2015: Wouter 2249 - 1.5.4 release tag 2250 - trunk has 1.5.5 in development. 2251 - Fix #681: Setting forwarders with unbound-control forward 2252 implicitly turns on forward-first. 2253 225429 June 2015: Wouter 2255 - iana portlist update. 2256 - Fix alloc with log for allocation size checks. 2257 225826 June 2015: Wouter 2259 - Fix #677 Fix DNAME responses from cache that failed internal chain 2260 test. 2261 - iana portlist update. 2262 226322 June 2015: Wouter 2264 - Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly 2265 and was therefore always synthesized (thanks to Valentin Dietrich). 2266 22674 June 2015: Wouter 2268 - RFC 7553 RR type URI support, is now enabled by default. 2269 22702 June 2015: Wouter 2271 - Fix #674: Do not free pointers given by getenv. 2272 227329 May 2015: Wouter 2274 - Fix that unparseable error responses are ratelimited. 2275 - SOA negative TTL is capped at minimumttl in its rdata section. 2276 - cache-max-negative-ttl config option, default 3600. 2277 227826 May 2015: Wouter 2279 - Document that ratelimit works with unbound-control set_option. 2280 228121 May 2015: Wouter 2282 - iana portlist update. 2283 - documentation proposes ratelimit of 1000 (closer to what upstream 2284 servers expect from us). 2285 228620 May 2015: Wouter 2287 - DLV is going to be decommissioned. Advice to stop using it, and 2288 put text in the example configuration and man page to that effect. 2289 229010 May 2015: Wouter 2291 - Change syntax of particular validator error to be easier for 2292 machine parse, swap rrset and ip adres info so it looks like: 2293 validation failure <www.example.nl. TXT IN>: signature crypto 2294 failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN> 2295 22961 May 2015: Wouter 2297 - caps-whitelist in unbound.conf allows whitelist of loadbalancers 2298 that cannot work with caps-for-id or its fallback. 2299 230030 April 2015: Wouter 2301 - Unit test for type ANY synthesis. 2302 230322 April 2015: Wouter 2304 - Removed contrib/unbound_unixsock.diff, because it has been 2305 integrated, use control-interface: /path in unbound.conf. 2306 - iana portlist update. 2307 230817 April 2015: Wouter 2309 - Synthesize ANY responses from cache. Does not search exhaustively, 2310 but MX,A,AAAA,SOA,NS also CNAME. 2311 - Fix leaked dns64prefix configuration string. 2312 231316 April 2015: Wouter 2314 - Add local-zone type inform_deny, that logs query and drops answer. 2315 - Ratelimit does not apply to prefetched queries, and ratelimit-factor 2316 is default 10. Repeated normal queries get resolved and with 2317 prefetch stay in the cache. 2318 - Fix bug#664: libunbound python3 related fixes (from Tomas Hozza) 2319 Use print_function also for Python2. 2320 libunbound examples: produce sorted output. 2321 libunbound-Python: libldns is not used anymore. 2322 Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns. 2323 232410 April 2015: Wouter 2325 - unbound-control ratelimit_list lists high rate domains. 2326 - ratelimit feature, ratelimit: 100, or some sensible qps, can be 2327 used to turn it on. It ratelimits recursion effort per zone. 2328 For particular names you can configure exceptions in unbound.conf. 2329 - Fix that get_option for cache-sizes does not print double newline. 2330 - Fix#663: ssl handshake fails when using unix socket because dh size 2331 is too small. 2332 23338 April 2015: Wouter 2334 - Fix crash in dnstap: Do not try to log TCP responses after timeout. 2335 23367 April 2015: Wouter 2337 - Libunbound skips dos-line-endings from etc/hosts. 2338 - Unbound exits with a fatal error when the auto-trust-anchor-file 2339 fails to be writable. This is seconds after startup. You can 2340 load a readonly auto-trust-anchor-file with trust-anchor-file. 2341 The file has to be writable to notice the trust anchor change, 2342 without it, a trust anchor change will be unnoticed and the system 2343 will then become inoperable. 2344 - unbound-control list_insecure command shows the negative trust 2345 anchors currently configured, patch from Jelte Jansen. 2346 23472 April 2015: Wouter 2348 - Fix #660: Fix interface-automatic broken in the presence of 2349 asymmetric routing. 2350 235126 March 2015: Wouter 2352 - remote.c probedelay line is easier to read. 2353 - rename ldns subdirectory to sldns to avoid name collision. 2354 235525 March 2015: Wouter 2356 - Fix #657: libunbound(3) recommends deprecated 2357 CRYPTO_set_id_callback. 2358 - If unknown trust anchor algorithm, and libressl is used, error 2359 message encourages upgrade of the libressl package. 2360 236123 March 2015: Wouter 2362 - Fix segfault on user not found at startup (from Maciej Soltysiak). 2363 236420 March 2015: Wouter 2365 - Fixed to add integer overflow checks on allocation (defense in depth). 2366 236719 March 2015: Wouter 2368 - Add ip-transparent config option for bind to non-local addresses. 2369 237017 March 2015: Wouter 2371 - Use reallocarray for integer overflow protection, patch submitted 2372 by Loganaden Velvindron. 2373 237416 March 2015: Wouter 2375 - Fixup compile on cygwin, more portable openssl thread id. 2376 237712 March 2015: Wouter 2378 - Updated default keylength in unbound-control-setup to 3k. 2379 238010 March 2015: Wouter 2381 - Fix lintian warning in unbound-checkconf man page (from Andreas 2382 Schulze). 2383 - print svnroot when building windows dist. 2384 - iana portlist update. 2385 - Fix warning on sign compare in getentropy_linux. 2386 23879 March 2015: Wouter 2388 - Fix #644: harden-algo-downgrade option, if turned off, fixes the 2389 reported excessive validation failure when multiple algorithms 2390 are present. It allows the weakest algorithm to validate the zone. 2391 - iana portlist update. 2392 23935 March 2015: Wouter 2394 - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal 2395 scripts. Contributed by Yuri Voinov. 2396 - Document that incoming-num-tcp increase is good for large servers. 2397 - stats reports tcp usage, of incoming-num-tcp buffers. 2398 23994 March 2015: Wouter 2400 - Patch from Brad Smith that syncs compat/getentropy_linux with 2401 OpenBSD's version (2015-03-04). 2402 - 0x20 fallback improved: servfail responses do not count as missing 2403 comparisons (except if all responses are errors), 2404 inability to find nameservers does not fail equality comparisons, 2405 many nameservers does not try to compare more than max-sent-count, 2406 parse failures start 0x20 fallback procedure. 2407 - store caps_response with best response in case downgrade response 2408 happens to be the last one. 2409 - Document windows 8 tests. 2410 24113 March 2015: Wouter 2412 - tag 1.5.3rc1 2413 [ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ] 2414 24152 March 2015: Wouter 2416 - iana portlist update. 2417 241820 February 2015: Wouter 2419 - Use the getrandom syscall introduced in Linux 3.17 (from Heiner 2420 Kallweit). 2421 - Fix #645 Portability to Solaris 10, use AF_LOCAL. 2422 - Fix #646 Portability to Solaris, -lrt for getentropy_solaris. 2423 - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after 2424 reload. 2425 242619 February 2015: Wouter 2427 - 1.5.2 release tag. 2428 - svn trunk contains 1.5.3 under development. 2429 243013 February 2015: Wouter 2431 - Fix #643: doc/example.conf.in: unnecessary whitespace. 2432 243312 February 2015: Wouter 2434 - tag 1.5.2rc1 2435 243611 February 2015: Wouter 2437 - iana portlist update. 2438 243910 February 2015: Wouter 2440 - Fix scrubber with harden-glue turned off to reject NS (and other 2441 not-address) records. 2442 24439 February 2015: Wouter 2444 - Fix validation failure in case upstream forwarder (ISC BIND) does 2445 not have the same trust anchors and decides to insert unsigned NS 2446 record in authority section. 2447 24482 February 2015: Wouter 2449 - infra-cache-min-rtt patch from Florian Riehm, for expected long 2450 uplink roundtrip times. 2451 245230 January 2015: Wouter 2453 - Fix 0x20 capsforid fallback to omit gratuitous NS and additional 2454 section changes. 2455 - Portability fix for Solaris ('sun' is not usable for a variable). 2456 245729 January 2015: Wouter 2458 - Fix pyunbound byte string representation for python3. 2459 246026 January 2015: Wouter 2461 - Fix unintended use of gcc extension for incomplete enum types, 2462 compile with pedantic c99 compliance (from Daniel Dickman). 2463 246423 January 2015: Wouter 2465 - windows port fixes, no AF_LOCAL, no chown, no chmod(grp). 2466 246716 January 2015: Wouter 2468 - unit test for local unix connection. Documentation and log_addr 2469 does not inspect port for AF_LOCAL. 2470 - unbound-checkconf -f prints chroot with pidfile path. 2471 247213 January 2015: Wouter 2473 - iana portlist update. 2474 247512 January 2015: Wouter 2476 - Cast sun_len sizeof to socklen_t. 2477 - Fix pyunbound ord call, portable for python 2 and 3. 2478 24797 January 2015: Wouter 2480 - Fix warnings in pythonmod changes. 2481 24826 January 2015: Wouter 2483 - iana portlist update. 2484 - patch for remote control over local sockets, from Dag-Erling 2485 Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and 2486 control-use-cert: no. 2487 - Fixup that patch and uid lookup (only for daemon). 2488 - coded the default of control-use-cert, to yes. 2489 24905 January 2015: Wouter 2491 - getauxval test for ppc64 linux compatibility. 2492 - make strip works for unbound-host and unbound-anchor. 2493 - patch from Stephane Lapie that adds to the python API, that 2494 exposes struct delegpt, and adds the find_delegation function. 2495 - print query name when max target count is exceeded. 2496 - patch from Stuart Henderson that fixes DESTDIR in 2497 unbound-control-setup for installs where config is not in 2498 the prefix location. 2499 - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing 2500 IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne). 2501 - Updated contrib warmup.cmd/sh to support two modes - load 2502 from pre-defined list of domains or (with filename as argument) 2503 load from user-specified list of domains, and updated contrib 2504 unbound_cache.sh/cmd to support loading/save/reload cache to/from 2505 default path or (with secondary argument) arbitrary path/filename, 2506 from Yuri Voinov. 2507 - Patch from Philip Paeps to contrib/unbound_munin_ that uses 2508 type ABSOLUTE. Allows munin.conf: [idleserver.example.net] 2509 unbound_munin_hits.graph_period minute 2510 25119 December 2014: Wouter 2512 - svn trunk has 1.5.2 in development. 2513 - config.guess and config.sub update from libtoolize. 2514 - local-zone: example.com inform makes unbound log a message with 2515 client IP for queries in that zone. Eg. for finding infected hosts. 2516 25178 December 2014: Wouter 2518 - Fix CVE-2014-8602: denial of service by making resolver chase 2519 endless series of delegations. 2520 25211 December 2014: Wouter 2522 - Fix bug#632: unbound fails to build on AArch64, protects 2523 getentropy compat code from calling sysctl if it is has been removed. 2524 252529 November 2014: Wouter 2526 - Add include to getentropy_linux.c, hopefully fixing debian build. 2527 252828 November 2014: Wouter 2529 - Fix makefile for build from noexec source tree. 2530 253126 November 2014: Wouter 2532 - Fix libunbound undefined symbol errors for main. 2533 Referencing main does not seem to be possible for libunbound. 2534 253524 November 2014: Wouter 2536 - Fix log at high verbosity and memory allocation failure. 2537 - iana portlist update. 2538 253921 November 2014: Wouter 2540 - Fix crash on multiple thread random usage on systems without 2541 arc4random. 2542 254320 November 2014: Wouter 2544 - fix compat/getentropy_win.c check if CryptGenRandom works and no 2545 immediate exit on windows. 2546 254719 November 2014: Wouter 2548 - Fix cdflag dns64 processing. 2549 255018 November 2014: Wouter 2551 - Fix that CD flag disables DNS64 processing, returning the DNSSEC 2552 signed AAAA denial. 2553 - iana portlist update. 2554 255517 November 2014: Wouter 2556 - Fix #627: SSL_CTX_load_verify_locations return code not properly 2557 checked. 2558 255914 November 2014: Wouter 2560 - parser with bison 2.7 2561 256213 November 2014: Wouter 2563 - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, 2564 added to contrib/aaaa-filter-iterator.patch. 2565 256612 November 2014: Wouter 2567 - trunk has 1.5.1 in development. 2568 - Patch from Robert Edmonds to build pyunbound python module 2569 differently. No versioninfo, with -shared and without $(LIBS). 2570 - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page. 2571 - Removed 'increased limit open files' log message that is written 2572 to console. It is only written on verbosity 4 and higher. 2573 This keeps system bootup console cleaner. 2574 - Patch from James Raftery, always print stats for rcodes 0..5. 2575 257611 November 2014: Wouter 2577 - iana portlist update. 2578 - Fix bug where forward or stub addresses with same address but 2579 different port number were not tried. 2580 - version number in svn trunk is 1.5.0 2581 - tag 1.5.0rc1 2582 - review fix from Ralph. 2583 25847 November 2014: Wouter 2585 - dnstap fixes by Robert Edmonds: 2586 dnstap/dnstap.m4: cosmetic fixes 2587 dnstap/: Remove compiled protoc-c output files 2588 dnstap/dnstap.m4: Error out if required libraries are not found 2589 dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of 2590 protobuf-c 1.0.0 2591 dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0) 2592 25934 November 2014: Wouter 2594 - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically 2595 tracked trust anchor to libunbound. 2596 - Redefine internal minievent symbols to unique symbols that helps 2597 linking on platforms where the linker leaks names across modules. 2598 259927 October 2014: Wouter 2600 - Disabled use of SSLv3 in remote-control and ssl-upstream. 2601 - iana portlist update. 2602 260316 October 2014: Wouter 2604 - Documented dns64 configuration in unbound.conf man page. 2605 260613 October 2014: Wouter 2607 - Fix #617: in ldns in unbound, lowercase WKS services. 2608 - Fix ctype invocation casts. 2609 261010 October 2014: Wouter 2611 - Fix unbound-checkconf check for module config with dns64 module. 2612 - Fix unbound capsforid fallback, it ignores TTLs in comparison. 2613 26146 October 2014: Wouter 2615 - Fix #614: man page variable substitution bug. 26166 October 2014: Willem 2617 - Whitespaces after $ORIGIN are not part of the origin dname (ldns). 2618 - $TTL's value starts at position 5 (ldns). 2619 26201 October 2014: Wouter 2621 - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire). 2622 262329 September 2014: Wouter 2624 - Fix #612: create service with service.conf in present directory and 2625 auto load it. 2626 - Fix for mingw compile openssl ranlib. 2627 262825 September 2014: Wouter 2629 - updated configure and aclocal with newer autoconf 1.13. 2630 263122 September 2014: Wouter 2632 - Fix swig and python examples for Python 3.x. 2633 - Fix for mingw compile with openssl-1.0.1i. 2634 263519 September 2014: Wouter 2636 - improve python configuration detection to build on Fedora 22. 2637 263818 September 2014: Wouter 2639 - patches to also build with Python 3.x (from Pavel Simerda). 2640 264116 September 2014: Wouter 2642 - Fix tcp timer waiting list removal code. 2643 - iana portlist update. 2644 - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue 2645 is longer and more tcp connections can be handled. 2646 264715 September 2014: Wouter 2648 - Fix unit test for CDS typecode. 2649 26505 September 2014: Wouter 2651 - type CDS and CDNSKEY types in sldns. 2652 265325 August 2014: Wouter 2654 - Fixup checklock code for log lock and its mutual initialization 2655 dependency. 2656 - iana portlist update. 2657 - Removed necessity for pkg-config from the dnstap.m4, new are 2658 the --with-libfstrm and --with-protobuf-c configure options. 2659 266019 August 2014: Wouter 2661 - Update unbound manpage with more explanation (from Florian Obser). 2662 266318 August 2014: Wouter 2664 - Fix #603: unbound-checkconf -o <option> should skip verification 2665 checks. 2666 - iana portlist update. 2667 - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings. 2668 26695 August 2014: Wouter 2670 - dnstap support, with a patch from Farsight Security, written by 2671 Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c. 2672 It is BSD licensed (see dnstap/dnstap.c). 2673 Building with --enable-dnstap needs pkg-config with this patch. 2674 - Noted dnstap in doc/README and doc/CREDITS. 2675 - Changes to the dnstap patch. 2676 - lint fixes. 2677 - dnstap/dnstap_config.h should not have been added to the repo, 2678 because is it generated. 2679 26801 August 2014: Wouter 2681 - Patch add msg, rrset, infra and key cache sizes to stats command 2682 from Maciej Soltysiak. 2683 - iana portlist update. 2684 268531 July 2014: Wouter 2686 - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault. 2687 Initial commit of the patch from the FreeBSD base (with its fixes). 2688 This adds a module (for module-config in unbound.conf) dns64 that 2689 performs DNS64 processing, see README.DNS64. 2690 - Changes from DNS64: 2691 strcpy changed to memmove. 2692 arraybound check fixed from prefix_net/8/4 to prefix_net/8+4. 2693 allocation of result consistently in the correct region. 2694 time_t is now used for ttl in unbound (since the patch's version). 2695 - testdata/dns64_lookup.rpl for unit test for dns64 functionality. 2696 269729 July 2014: Wouter 2698 - Patch from Dag-Erling Smorgrav that implements feature, unbound -dd 2699 does not fork in the background and also logs to stderr. 2700 270121 July 2014: Wouter 2702 - Fix endian.h include for OpenBSD. 2703 270416 July 2014: Wouter 2705 - And Fix#596: Bail out of unbound-control dump_infra when ssl 2706 write fails. 2707 270815 July 2014: Wouter 2709 - Fix #596: Bail out of unbound-control list_local_zones when ssl 2710 write fails. 2711 - iana portlist update. 2712 271313 July 2014: Wouter 2714 - Configure tests if main can be linked to from getentropy compat. 2715 271612 July 2014: Wouter 2717 - Fix getentropy compat code, function refs were not portable. 2718 - Fix to check openssl version number only for OpenSSL. 2719 - LibreSSL provides compat items, check for that in configure. 2720 - Fix bug in fix for log locks that caused deadlock in signal handler. 2721 - update compat/getentropy and arc4random to the most recent ones from OpenBSD. 2722 272311 July 2014: Matthijs 2724 - fake-rfc2553 patch (thanks Benjamin Baier). 2725 272611 July 2014: Wouter 2727 - arc4random in compat/ and getentropy, explicit_bzero, chacha for 2728 dependencies, from OpenBSD. arc4_lock and sha512 in compat. 2729 This makes arc4random available on all platforms, except when 2730 compiled with LIBNSS (it uses libNSS crypto random). 2731 - fix strptime implicit declaration error on OpenBSD. 2732 - arc4random, getentropy and explicit_bzero compat for Windows. 2733 27344 July 2014: Wouter 2735 - Fix #593: segfault or crash upon rotating logfile. 2736 27373 July 2014: Wouter 2738 - DLV tests added. 2739 - signit tool fixup for compile with libldns library. 2740 - iana portlist updated. 2741 274227 June 2014: Wouter 2743 - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X. 2744 274526 June 2014: Wouter 2746 - unbound-control status reports if so-reuseport was successful. 2747 - iana portlist updated. 2748 274924 June 2014: Wouter 2750 - Fix caps-for-id fallback, and added fallback attempt when servers 2751 drop 0x20 perturbed queries. 2752 - Fixup testsetup for VM tests (run testcode/run_vm.sh). 2753 275417 June 2014: Wouter 2755 - iana portlist updated. 2756 27573 June 2014: Wouter 2758 - Add AAAA for B root server to default root hints. 2759 27602 June 2014: Wouter 2761 - Remove unused define from iterator.h 2762 276330 May 2014: Wouter 2764 - Fixup sldns_enum_edns_option typedef definition. 2765 276628 May 2014: Wouter 2767 - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue 2768 fixes from FreeBSD's copy of Unbound, he notes: 2769 Generate unbound-control-setup.sh at build time so it respects 2770 prefix and sysconfdir from the configure script. Also fix the 2771 umask to match the comment, and the comment to match the umask. 2772 Add const and static where needed. Use unions instead of 2773 playing pointer poker. Move declarations that are needed in 2774 multiple source files into a shared header. Move sldns_bgetc() 2775 from parse.c to buffer.c where it belongs. Introduce a new 2776 header file, worker.h, which declares the callbacks that 2777 all workers must define. Remove those declarations from 2778 libworker.h. Include the correct headers in the correct places. 2779 Fix a few dummy callbacks that don't match their prototype. 2780 Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. 2781 Remove a useless printf which breaks reproducible builds. 2782 Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're 2783 no longer used. Add unbound-control-setup.sh to the list of 2784 generated files. The prototype for libworker_event_done_cb() 2785 needs to be moved from libunbound/libworker.h to 2786 libunbound/worker.h. 2787 - Fixup out-of-directory compile with unbound-control-setup.sh.in. 2788 - make depend. 2789 279023 May 2014: Wouter 2791 - unbound-host -D enabled dnssec and reads root trust anchor from 2792 the default root key file that was compiled in. 2793 279420 May 2014: Wouter 2795 - Feature, unblock-lan-zones: yesno that you can use to make unbound 2796 perform 10.0.0.0/8 and other reverse lookups normally, for use if 2797 unbound is running service for localhost on localhost. 2798 279916 May 2014: Wouter 2800 - Updated create_unbound_ad_servers and unbound_cache scripts from 2801 Yuri Voinov in the source/contrib directory. Added 2802 warmup.cmd (and .sh): warm up the DNS cache with your MRU domains. 2803 28049 May 2014: Wouter 2805 - Implement draft-ietf-dnsop-rfc6598-rfc6303-01. 2806 - iana portlist updated. 2807 28088 May 2014: Wouter 2809 - Contrib windows scripts from Yuri Voinov added to src/contrib: 2810 create_unbound_ad_servers.cmd: enters anti-ad server lists. 2811 unbound_cache.cmd: saves and loads the cache. 2812 - Added unbound-control-setup.cmd from Yuri Voinov to the windows 2813 unbound distribution set. It requires openssl installed in %PATH%. 2814 28156 May 2014: Wouter 2816 - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier. 2817 28185 May 2014: Wouter 2819 - More #567: remove : from output of stub and forward lists, this is 2820 easier to parse. 2821 282229 April 2014: Wouter 2823 - iana portlist updated. 2824 - Add unbound-control flush_negative that flushed nxdomains, nodata, 2825 and errors from the cache. For dnssec-trigger and NetworkManager, 2826 fixes cases where network changes have localdata that was already 2827 negatively cached from the previous network. 2828 282923 April 2014: Wouter 2830 - Patch from Jeremie Courreges-Anglas to use arc4random_uniform 2831 if available on the OS, it gets entropy from the OS. 2832 283315 April 2014: Wouter 2834 - Fix compile with libevent2 on FreeBSD. 2835 283611 April 2014: Wouter 2837 - Fix #502: explain that do-ip6 disable does not stop AAAA lookups, 2838 but it stops the use of the ipv6 transport layer for DNS traffic. 2839 - iana portlist updated. 2840 284110 April 2014: Wouter 2842 - iana portlist updated. 2843 - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation 2844 option for DNS fragmentation defense. 2845 - Document that dump_requestlist only prints queries from thread 0. 2846 - unbound-control stats prints num.query.tcpout with number of TCP 2847 outgoing queries made in the previous statistics interval. 2848 - Fix #567: unbound lists if forward zone is secure or insecure with 2849 +i annotation in output of list_forwards, also for list_stubs 2850 (for NetworkManager integration.) 2851 - Fix #554: use unsigned long to print 64bit statistics counters on 2852 64bit systems. 2853 - Fix #558: failed prefetch lookup does not remove cached response 2854 but delays next prefetch (in lieu of caching a SERVFAIL). 2855 - Fix #545: improved logging, the ip address of the error is printed 2856 on the same log-line as the error. 2857 28588 April 2014: Wouter 2859 - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control 2860 in testbound scripts. 2861 - iana portlist updated. 2862 28637 April 2014: Wouter 2864 - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root 2865 hints (patch from Anand Buddhdev). 2866 - Fix #572: Fix unit test failure for systems with different 2867 /etc/services. 2868 286928 March 2014: Wouter 2870 - Fix #569: do_tcp is do-tcp in unbound.conf man page. 2871 287225 March 2014: Wouter 2873 - Patch from Stuart Henderson to build unbound-host man from .1.in. 2874 287524 March 2014: Wouter 2876 - Fix print filename of encompassing config file on read failure. 2877 287812 March 2014: Wouter 2879 - tag 1.4.22 2880 - trunk has 1.4.23 in development. 2881 288210 March 2014: Wouter 2883 - Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes 2884 because of spelling. Patch from Chris Coates. 2885 288627 February 2014: Wouter 2887 - tag 1.4.22rc1 2888 288921 February 2014: Wouter 2890 - iana portlist updated. 2891 289220 February 2014: Matthijs 2893 - Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is 2894 received. This is okay according 4035, but not after revising 2895 existence in 4592. NSEC empty non-terminals exist and thus the 2896 RCODE should have been NOERROR. If this occurs, and the RRsets 2897 are secure, we set the RCODE to NOERROR and the security status 2898 of the response is also considered secure. 2899 290014 February 2014: Wouter 2901 - Works on Minix (3.2.1). 2902 290311 February 2014: Wouter 2904 - Fix parse of #553(NSD) string in sldns, quotes without spaces. 2905 29067 February 2014: Wouter 2907 - iana portlist updated. 2908 - add body to ifstatement if locks disabled. 2909 - add TXT string"string" test case to unit test. 2910 - Fix #551: License change "Regents" to "Copyright holder", matching 2911 the BSD license on opensource.org. 2912 29136 February 2014: Wouter 2914 - sldns has type HIP. 2915 - code documentation on the module interface. 2916 29175 February 2014: Wouter 2918 - Fix sldns parse tests on osx. 2919 29203 February 2014: Wouter 2921 - Detect libevent2 install automatically by configure. 2922 - Fixup link with lib/event2 subdir. 2923 - Fix parse in sldns of quoted parenthesized text strings. 2924 292531 January 2014: Wouter 2926 - unit test for ldns wire to str and back with zones, root, nlnetlabs 2927 and types.sidnlabs. 2928 - Fix for hex to string in unknown, atma and nsap. 2929 - fixup nss compile (no ldns in it). 2930 - fixup warning in unitldns 2931 - fixup WKS and rdata type service to print unsigned because strings 2932 are not portable; they cannot be read (for sure) on other computers. 2933 - fixup type EUI48 and EUI64, type APL and type IPSECKEY in string 2934 parse sldns. 2935 293630 January 2014: Wouter 2937 - delay-close does not act if there are udp-wait queries, so that 2938 it does not make a socketdrain DoS easier. 2939 294028 January 2014: Wouter 2941 - iana portlist updated. 2942 - iana portlist test updated so it does not touch the source 2943 if there are no changes. 2944 - delay-close: msec option that delays closing ports for which 2945 the UDP reply has timed out. Keeps the port open, only accepts 2946 the correct reply. This correct reply is not used, but the port 2947 is open so that no port-denied ICMPs are generated. 2948 294927 January 2014: Wouter 2950 - reuseport is attempted, then fallback to without on failure. 2951 295224 January 2014: Wouter 2953 - Change unbound-event.h to use void* buffer, length idiom. 2954 - iana portlist updated. 2955 - unbound-event.h is installed if you configure --enable-event-api. 2956 - speed up unbound (reports say it could be up to 10%), by reducing 2957 lock contention on localzones.lock. It is changed to an rwlock. 2958 - so-reuseport: yesno option to distribute queries evenly over 2959 threads on Linux (Thanks Robert Edmonds). 2960 - made lint clean. 2961 296221 January 2014: Wouter 2963 - Fix #547: no trustanchor written if filesystem full, fclose checked. 2964 296517 January 2014: Wouter 2966 - Fix isprint() portability in sldns, uses unsigned int. 2967 - iana portlist updated. 2968 296916 January 2014: Wouter 2970 - fix #544: Fixed +i causes segfault when running with module conf 2971 "iterator". 2972 - Windows port, adjust %lld to %I64d, and warning in win_event.c. 2973 297414 January 2014: Wouter 2975 - iana portlist updated. 2976 29775 Dec 2013: Wouter 2978 - Fix bug in cachedump that uses sldns. 2979 - update pythonmod for ldns_ to sldns_ name change. 2980 29813 Dec 2013: Wouter 2982 - Fix sldns to use sldns_ prefix for all ldns_ variables. 2983 - Fix windows compile to compile with sldns. 2984 298530 Nov 2013: Wouter 2986 - Fix sldns to make globals use sldns_ prefix. This fixes 2987 linking with libldns that uses global variables ldns_ . 2988 298913 Nov 2013: Wouter 2990 - Fix bug#537: compile python plugin without ldns library. 2991 299212 Nov 2013: Wouter 2993 - Fix bug#536: acl_deny_non_local and refuse_non_local added. 2994 29955 Nov 2013: Wouter 2996 - Patch from Neel Goyal to fix async id assignment if callback 2997 is called by libunbound in the mesh attach. 2998 - Accept ip-address: as an alternative for interface: for 2999 consistency with nsd.conf syntax. 3000 30014 Nov 2013: Wouter 3002 - Patch from Neel Goyal to fix callback in libunbound. 3003 30043 Nov 2013: Wouter 3005 - if configured --with-libunbound-only fix make install. 3006 300731 Oct 2013: Wouter 3008 - Fix #531: Set SO_REUSEADDR so that the wildcard interface and a 3009 more specific interface port 53 can be used at the same time, and 3010 one of the daemons is unbound. 3011 - iana portlist update. 3012 - separate ldns into core ldns inside ldns/ subdirectory. No more 3013 --with-ldns is needed and unbound does not rely on libldns. 3014 - portability fixes for new USE_SLDNS ldns subdir codebase. 3015 301622 Oct 2013: Wouter 3017 - Patch from Neel Goyal: Add an API call to set an event base on an 3018 existing ub_ctx. This basically just destroys the current worker and 3019 sets the event base to the current. And fix a deadlock in 3020 ub_resolve_event – the cfglock is held when libworker_create is 3021 called. This ends up trying to acquire the lock again in 3022 context_obtain_alloc in the call chain. 3023 - Fix #528: if very high logging (4 or more) segfault on allow_snoop. 3024 302526 Sep 2013: Wouter 3026 - unbound-event.h is installed if configured --with-libevent. It 3027 contains low-level library calls, that use libevent's event_base 3028 and an ldns_buffer for the wire return packet to perform async 3029 resolution in the client's eventloop. 3030 303119 Sep 2013: Wouter 3032 - 1.4.21 tag created. 3033 - trunk has 1.4.22 number inside it. 3034 - iana portlist updated. 3035 - acx_nlnetlabs.m4 to 26; improve FLTO help text. 3036 303716 Sep 2013: Wouter 3038 - Fix#524: max-udp-size not effective to non-EDNS0 queries, from 3039 Daisuke HIGASHI. 3040 304110 Sep 2013: Wouter 3042 - MIN_TTL and MAX_TTL also in time_t. 3043 - tag 1.4.21rc1 made again. 3044 304526 Aug 2013: Wouter 3046 - More fixes for bug#519: for the threaded case test if the bg 3047 thread has been killed, on ub_ctx_delete, to avoid hangs. 3048 304922 Aug 2013: Wouter 3050 - more fixes that I overlooked. 3051 - review fixes from Willem. 3052 305321 Aug 2013: Wouter 3054 - Fix#520: Errors found by static analysis from Tomas Hozza(redhat). 3055 305620 Aug 2013: Wouter 3057 - Fix for 2038, with time_t instead of uint32_t. 3058 305919 Aug 2013: Wouter 3060 - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound). 3061 306214 Aug 2013: Wouter 3063 - Fix uninit variable in fix#516. 3064 30658 Aug 2013: Wouter 3066 - Fix#516 dnssec lameness detection for answers that are improper. 3067 306830 Jun 2013: Wouter 3069 - tag 1.4.21rc1 3070 307129 Jun 2013: Wouter 3072 - Fix#512 memleak in testcode for testbound (if it fails). 3073 - Fix#512 NSS returned arrays out of setup function to be statics. 3074 307526 Jun 2013: Wouter 3076 - max include of 100.000 files (depth and globbed at one time). 3077 This is to preserve system memory in bug cases, or endless cases. 3078 - iana portlist updated. 3079 308019 Jun 2013: Wouter 3081 - streamtcp man page, contributed by Tomas Hozza. 3082 - iana portlist updated. 3083 - libunbound documentation on how to avoid openssl race conditions. 3084 308525 Jun 2013: Wouter 3086 - Squelch sendto-permission denied errors when the network is 3087 not connected, to avoid spamming syslog. 3088 - configure --disable-flto option (from Robert Edmonds). 3089 309018 Jun 2013: Wouter 3091 - Fix for const string literals in C++ for libunbound, from Karel 3092 Slany. 3093 - iana portlist updated. 3094 309517 Jun 2013: Wouter 3096 - Fixup manpage syntax. 3097 309814 Jun 2013: Wouter 3099 - get_option and set_option support for log-time-ascii, python-script 3100 val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect 3101 immediately. The others are mostly useful for libunbound users. 3102 310313 Jun 2013: Wouter 3104 - get_option, set_option, unbound-checkconf -o and libunbound 3105 getoption and setoption support cache-min-ttl and cache-max-ttl. 3106 310710 Jun 2013: Wouter 3108 - Fix#501: forward-first does not recurse, when forward name is ".". 3109 - iana portlist update. 3110 - Max include depth is unlimited. 3111 311227 May 2013: Wouter 3113 - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply 3114 patch to it to not fail when -Werror is also specified, from the 3115 autoconf-archives. 3116 - iana portlist update. 3117 311821 May 2013: Wouter 3119 - Explain bogus and secure flags in libunbound more. 3120 312116 May 2013: Wouter 3122 - Fix#499 use-after-free in out-of-memory handling code (thanks Jake 3123 Montgomery). 3124 - Fix#500 use on non-initialised values on socket bind failures. 3125 312615 May 2013: Wouter 3127 - Fix round-robin doesn't work with some Windows clients (from Ilya 3128 Bakulin). 3129 31303 May 2013: Wouter 3131 - update acx_nlnetlabs.m4 to v23, sleep w32 fix. 3132 313326 April 2013: Wouter 3134 - add unbound-control insecure_add and insecure_remove for the 3135 administration of negative trust anchors. 3136 313725 April 2013: Wouter 3138 - Implement max-udp-size config option, default 4096 (thanks 3139 Daisuke Higashi). 3140 - Robust checks on dname validity from rdata for dname compare. 3141 - updated iana portlist. 3142 314319 April 2013: Wouter 3144 - Fixup snprintf return value usage, fixed libunbound_get_option. 3145 314618 April 2013: Wouter 3147 - fix bug #491: pick program name (0th argument) as syslog identity. 3148 - own implementation of compat/snprintf.c. 3149 315015 April 2013: Wouter 3151 - Fix so that for a configuration line of include: "*.conf" it is not 3152 an error if there are no files matching the glob pattern. 3153 - unbound-anchor review: BIO_write can return 0 successfully if it 3154 has successfully appended a zero length string. 3155 315611 April 2013: Wouter 3157 - Fix queries leaking up for stubs and forwards, if the configured 3158 nameservers all fail to answer. 3159 316010 April 2013: Wouter 3161 - code improve for minimal responses, small speed increase. 3162 31639 April 2013: Wouter 3164 - updated iana portlist. 3165 - Fix crash in previous private address fixup of 22 March. 3166 316728 March 2013: Wouter 3168 - Make reverse zones easier by documenting the nodefault statements 3169 commented-out in the example config file. 3170 317126 March 2013: Wouter 3172 - more fixes to lookup3.c endianness detection. 3173 317425 March 2013: Wouter 3175 - #492: Fix endianness detection, revert to older lookup3.c detection 3176 and put new detect lines after previous tests, to avoid regressions 3177 but allow new detections to succeed. 3178 And add detection for machine/endian.h to it. 3179 318022 March 2013: Wouter 3181 - Fix resolve of names that use a mix of public and private addresses. 3182 - iana portlist update. 3183 - Fix makedist for new svn for -d option. 3184 - unbound.h header file has UNBOUND_VERSION_MAJOR define. 3185 - Fix windows RSRC version for long version numbers. 3186 318721 March 2013: Wouter 3188 - release 1.4.20 3189 - trunk has 1.4.21 3190 - committed libunbound version 4:1:2 for binary API updated in 1.4.20 3191 - install copy of unbound-control.8 man page for unbound-control-setup 3192 319314 March 2013: Wouter 3194 - iana portlist update. 3195 - tag 1.4.20rc1 3196 319712 March 2013: Wouter 3198 - Fixup makedist.sh for windows compile. 3199 320011 March 2013: Wouter 3201 - iana portlist update. 3202 - testcode/ldns-testpkts.c check for makedist is informational. 3203 320415 February 2013: Wouter 3205 - fix defines in lookup3 for bigendian bsd alpha 3206 320711 February 2013: Wouter 3208 - Fixup openssl_thread init code to only run if compiled with SSL. 3209 32107 February 2013: Wouter 3211 - detect endianness in lookup3 on BSD. 3212 - add libunbound.ttl at end of result structure, version bump for 3213 libunbound and binary backwards compatible, but 1.4.19 is not 3214 forward compatible with 1.4.20. 3215 - update iana port list. 3216 321730 January 2013: Wouter 3218 - includes and have_ssl fixes for nss. 3219 322029 January 2013: Wouter 3221 - printout name of zone with duplicate fwd and hint errors. 3222 322328 January 2013: Wouter 3224 - updated fwd_zero for newer nc. Updated common.sh for newer netstat. 3225 322617 January 2013: Wouter 3227 - unbound-anchors checks the emailAddress of the signer of the 3228 root.xml file, default is dnssec@iana.org. It also checks that 3229 the signer has the correct key usage for a digital signature. 3230 - update iana port list. 3231 32323 January 2013: Wouter 3233 - Test that unbound-control checks client credentials. 3234 - Test that unbound can handle a CNAME at an intermediate node in 3235 the chain of trust (where it seeks a DS record). 3236 - Check the commonName of the signer of the root.xml file in 3237 unbound-anchor, default is dnssec@iana.org. 3238 32392 January 2013: Wouter 3240 - Fix openssl lock free on exit (reported by Robert Fleischman). 3241 - iana portlist updated. 3242 - Tested that unbound implements the RFC5155 Technical Errata id 3441. 3243 Unbound already implements insecure classification of an empty 3244 nonterminal in NSEC3 optout zone. 3245 324620 December 2012: Wouter 3247 - Fix unbound-anchor xml parse of entity declarations for safety. 3248 324919 December 2012: Wouter 3250 - iana portlist updated. 3251 325218 December 2012: Wouter 3253 - iana portlist updated. 3254 325514 December 2012: Wouter 3256 - Change of D.ROOT-SERVERS.NET A address in default root hints. 3257 325812 December 2012: Wouter 3259 - 1.4.19 release. 3260 - trunk has 1.4.20 under development. 3261 32625 December 2012: Wouter 3263 - note support for AAAA RR type RFC. 3264 32654 December 2012: Wouter 3266 - 1.4.19rc1 tag. 3267 326830 November 2012: Wouter 3269 - bug 481: fix python example0. 3270 - iana portlist updated. 3271 327227 November 2012: Wouter 3273 - iana portlist updated. 3274 32759 November 2012: Wouter 3276 - Fix unbound-control forward disables configured stubs below it. 3277 32787 November 2012: Wouter 3279 - Fixup ldns-testpkts, identical to ldns/examples. 3280 - iana portlist updated. 3281 328230 October 2012: Wouter 3283 - Fix bug #477: unbound-anchor segfaults if EDNS is blocked. 3284 328529 October 2012: Matthijs 3286 - Fix validation for responses with both CNAME and wildcard 3287 expanded CNAME records in answer section. 3288 32898 October 2012: Wouter 3290 - update ldns-testpkts.c to ldns 1.6.14 version. 3291 - fix build of pythonmod in objdir, for unbound.py. 3292 - make clean and makerealclean remove generated python and docs. 3293 32945 October 2012: Wouter 3295 - fix build of pythonmod in objdir (thanks Jakob Schlyter). 3296 32973 October 2012: Wouter 3298 - fix text in unbound-anchor man page. 3299 33001 October 2012: Wouter 3301 - ignore trusted-keys globs that have no files (from Paul Wouters). 3302 330327 September 2012: Wouter 3304 - include: directive in config file accepts wildcards. Patch from 3305 Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*" 3306 - unbound-control -q option is quiet, patch from Mariano Absatz. 3307 - iana portlist updated. 3308 - updated contrib/unbound.spec, patch from Valentin Bud. 3309 331021 September 2012: Wouter 3311 - chdir to / after chroot call (suggested by Camiel Dobbelaar). 3312 331317 September 2012: Wouter 3314 - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation 3315 otherwise it is treated as insecure. The RSAMD5 algorithm is 3316 deprecated (RFC6725). The MD5 hash is considered weak for some 3317 purposes, if you want to sign your zone, then RSASHA256 is an 3318 uncontested hash. 3319 332030 August 2012: Wouter 3321 - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled. 3322 - iana portlist updated. 3323 332429 August 2012: Wouter 3325 - Nicer comments outgoing-port-avoid, thanks Stu (bug #465). 3326 332722 August 2012: Wouter 3328 - Fallback to 1472 and 1232, one fragment size without headers. 3329 333021 August 2012: Wouter 3331 - Fix timeouts so that when a server has been offline for a while 3332 and is probed to see it works, it becomes fully available for 3333 server selection again. 3334 333517 August 2012: Wouter 3336 - Add documentation to libunbound for default nonuse of resolv.conf. 3337 33382 August 2012: Wouter 3339 - trunk has 1.4.19 under development (fixes from 1 aug and 31 july 3340 are for 1.4.19). 3341 - iana portlist updated. 3342 33431 August 2012: Wouter 3344 - Fix openssl race condition, initializes openssl locks, reported 3345 by Einar Lonn and Patrik Wallstrom. 3346 334731 July 2012: Wouter 3348 - Improved forward-first and stub-first documentation. 3349 - Fix that enables modules to register twice for the same 3350 serviced_query, without race conditions or administration issues. 3351 This should not happen with the current codebase, but it is robust. 3352 - Fix forward-first option where it sets the RD flag wrongly. 3353 - added manpage links for libunbound calls (Thanks Paul Wouters). 3354 335530 July 2012: Wouter 3356 - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012). 3357 335827 July 2012: Wouter 3359 - unbound-host works with libNSS 3360 - fix bogus nodata cname chain not reported as bogus by validator, 3361 (Thanks Peter van Dijk). 3362 336326 July 2012: Wouter 3364 - iana portlist updated. 3365 - tag 1.4.18rc1. 3366 336725 July 2012: Wouter 3368 - review fix for libnss, check hash prefix allocation size. 3369 337023 July 2012: Wouter 3371 - fix missing break for GOST DS hash function. 3372 - implemented forward_first for the root. 3373 337420 July 2012: Wouter 3375 - Fix bug#452 and another assertion failure in mesh.c, makes 3376 assertions in mesh.c resist duplicates. Fixes DS NS search to 3377 not generate duplicate sub queries. 3378 337919 July 2012: Willem 3380 - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac, 3381 if CFLAGS is specified at configure time then '-g -O2' is not 3382 appended to CFLAGS, so that the user can override them. 3383 338418 July 2012: Willem 3385 - Fix libunbound report of errors when in background mode. 3386 338711 July 2012: Willem 3388 - updated iana ports list. 3389 33909 July 2012: Willem 3391 - Add flush_bogus option for unbound-control 3392 33936 July 2012: Wouter 3394 - Fix validation of qtype DS queries that result in no data for 3395 non-optout NSEC3 zones. 3396 33974 July 2012: Wouter 3398 - compile libunbound with libnss on Suse, passes regression tests. 3399 34003 July 2012: Wouter 3401 - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes. 3402 34032 July 2012: Wouter 3404 - updated iana ports list. 3405 340629 June 2012: Wouter 3407 - patch for unbound_munin_ script to handle arbitrary thread count by 3408 Sven Ulland. 3409 341028 June 2012: Wouter 3411 - detect if openssl has FIPS_mode. 3412 - code review: return value of cache_store can be ignored for better 3413 performance in out of memory conditions. 3414 - fix edns-buffer-size and msg-buffer-size manpage documentation. 3415 - updated iana ports list. 3416 341725 June 2012: Wouter 3418 - disable RSAMD5 if in FIPS mode (for openssl and for libnss). 3419 342022 June 2012: Wouter 3421 - implement DS records, NSEC3 and ECDSA for compile with libnss. 3422 342321 June 2012: Wouter 3424 - fix error handling of alloc failure during rrsig verification. 3425 - nss check for verification failure. 3426 - nss crypto works for RSA and DSA. 3427 342820 June 2012: Wouter 3429 - work on --with-nss build option (for now, --with-libunbound-only). 3430 343119 June 2012: Wouter 3432 - --with-libunbound-only build option, only builds the library and 3433 not the daemon and other tools. 3434 343518 June 2012: Wouter 3436 - code review. 3437 343815 June 2012: Wouter 3439 - implement log-time-ascii on windows. 3440 - The key-cache bad key ttl is now 60 seconds. 3441 - updated iana ports list. 3442 - code review. 3443 344411 June 2012: Wouter 3445 - bug #452: fix crash on assert in mesh_state_attachment. 3446 344730 May 2012: Wouter 3448 - silence warning from swig-generated code (md set but not used in 3449 swig initmodule, due to ifdefs in swig-generated code). 3450 345127 May 2012: Wouter 3452 - Fix debian-bugs-658021: Please enable hardened build flags. 3453 345425 May 2012: Wouter 3455 - updated iana ports list. 3456 345724 May 2012: Wouter 3458 - tag for 1.4.17 release. 3459 - trunk is 1.4.18 in development. 3460 346118 May 2012: Wouter 3462 - Review comments, removed duplicate memset to zero in delegpt. 3463 346416 May 2012: Wouter 3465 - Updated doc/FEATURES with RFCs that are implemented but not listed. 3466 - Protect if statements in val_anchor for compile without locks. 3467 - tag for 1.4.17rc1. 3468 346915 May 2012: Wouter 3470 - fix configure ECDSA support in ldns detection for windows compile. 3471 - fix possible uninitialised variable in windows pipe implementation. 3472 34739 May 2012: Wouter 3474 - Fix alignment problem in util/random on sparc64/freebsd. 3475 34768 May 2012: Wouter 3477 - Fix for accept spinning reported by OpenBSD. 3478 - iana portlist updated. 3479 34802 May 2012: Wouter 3481 - Fix validation of nodata for DS query in NSEC zones, reported by 3482 Ondrej Mikle. 3483 348413 April 2012: Wouter 3485 - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older 3486 openssl. 3487 348810 April 2012: Wouter 3489 - Applied patch from Daisuke HIGASHI for rrset-roundrobin and 3490 minimal-responses features. 3491 - iana portlist updated. 3492 34935 April 2012: Wouter 3494 - fix bug #443: --with-chroot-dir not honoured by configure. 3495 - fix bug #444: setusercontext was called too late (thanks Bjorn 3496 Ketelaars). 3497 349827 March 2012: Wouter 3499 - fix bug #442: Fix that Makefile depends on pythonmod headers 3500 even using --without-pythonmodule. 3501 350222 March 2012: Wouter 3503 - contrib/validation-reporter follows rotated log file (patch from 3504 Augie Schwer). 3505 350621 March 2012: Wouter 3507 - new approach to NS fetches for DS lookup that works with 3508 cornercases, and is more robust and considers forwarders. 3509 351019 March 2012: Wouter 3511 - iana portlist updated. 3512 - fix to locate nameservers for DS lookup with NS fetches. 3513 351416 March 2012: Wouter 3515 - Patch for access to full DNS packet data in unbound python module 3516 from Ondrej Mikle. 3517 35189 March 2012: Wouter 3519 - Applied line-buffer patch from Augie Schwer to validation.reporter.sh. 3520 35212 March 2012: Wouter 3522 - flush_infra cleans timeouted servers from the cache too. 3523 - removed warning from --enable-ecdsa. 3524 35251 March 2012: Wouter 3526 - forward-first option. Tries without forward if a query fails. 3527 Also stub-first option that is similar. 3528 352928 February 2012: Wouter 3530 - Fix from code review, if EINPROGRESS not defined chain if statement 3531 differently. 3532 353327 February 2012: Wouter 3534 - Fix bug#434: on windows check registry for config file location 3535 for unbound-control.exe, and unbound-checkconf.exe. 3536 353723 February 2012: Wouter 3538 - Fix to squelch 'network unreachable' errors from tcp connect in 3539 logs, high verbosity will show them. 3540 354116 February 2012: Wouter 3542 - iter_hints is now thread-owned in module env, and thus threadsafe. 3543 - Fix prefetch and sticky NS, now the prefetch works. It picks 3544 nameservers that 'would be valid in the future', and if this makes 3545 the NS timeout, it updates that NS by asking delegation from the 3546 parent again. If child NS has longer TTL, that TTL does not get 3547 refreshed from the lookup to the child nameserver. 3548 354915 February 2012: Wouter 3550 - Fix forward-zone memory, uses malloc and frees original root dp. 3551 - iter hints (stubs) uses malloc inside for more dynamicity. 3552 - unbound-control forward_add, forward_remove, stub_add, stub_remove 3553 can modify stubs and forwards for running unbound (on mobile computer) 3554 they can also add and remove domain-insecure for the zone. 3555 355614 February 2012: Wouter 3557 - Fix sticky NS (ghost domain problem) if prefetch is yes. 3558 - iter forwards uses malloc inside for more dynamicity. 3559 356013 February 2012: Wouter 3561 - RT#2955. Fix for cygwin compilation. 3562 - iana portlist updated. 3563 356410 February 2012: Wouter 3565 - Slightly smaller critical region in one case in infra cache. 3566 - Fix timeouts to keep track of query type, A, AAAA and other, if 3567 another has caused timeout blacklist, different type can still probe. 3568 - unit test fix for nomem_cnametopos.rpl race condition. 3569 35709 February 2012: Wouter 3571 - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h. 3572 35738 February 2012: Wouter 3574 - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This 3575 implementation is experimental at this time and not recommended 3576 for use on the public internet (the protocol numbers have not 3577 been assigned). Needs recent ldns with --enable-ecdsa. 3578 - fix memory leak in errorcase for DSA signatures. 3579 - iana portlist updated. 3580 - workaround for openssl 0.9.8 ecdsa sha2 and evp problem. 3581 35823 February 2012: Wouter 3583 - fix for windows, rename() is not posix compliant on windows. 3584 35852 February 2012: Wouter 3586 - 1.4.16 release tag. 3587 - svn trunk is 1.4.17 in development. 3588 - iana portlist updated. 3589 35901 February 2012: Wouter 3591 - Fix validation failures (like: validation failure xx: no NSEC3 3592 closest encloser from yy for DS zz. while building chain of trust, 3593 because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata 3594 for an NSEC3. Now it does not change rdata, and fixes TTL. 3595 359630 January 2012: Wouter 3597 - Fix version-number in libtool to be version-info so it produces 3598 libunbound.so.2 like it should. 3599 360026 January 2012: Wouter 3601 - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release. 3602 - trunk 1.4.16; includes changes memset testcode, #424 openindiana, 3603 and keyfile write fixup. 3604 - applied patch to support outgoing-interface with ub_ctx_set_option. 3605 360623 January 2012: Wouter 3607 - Fix memset in test code. 3608 360920 January 2012: Wouter 3610 - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2. 3611 361219 January 2012: Wouter 3613 - Fix to write key files completely to a temporary file, and if that 3614 succeeds, replace the real key file. So failures leave a useful file. 3615 361618 January 2012: Wouter 3617 - tag 1.4.15rc1 created 3618 - updated libunbound/ubsyms.def and remade tag 1.4.15rc1. 3619 362017 January 2012: Wouter 3621 - Fix bug where canonical_compare of RRSIG did not downcase the 3622 signer-name. This is mostly harmless because RRSIGs do not have 3623 to be sorted in canonical order, usually. 3624 362512 January 2012: Wouter 3626 - bug#428: add ub_version() call to libunbound. API version increase, 3627 with (binary) backwards compatibility for the previous version. 3628 362910 January 2012: Wouter 3630 - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL 3631 that would be permissible by the RFCs but it is not the TTL in the 3632 cache. 3633 - iana portlist updated. 3634 - uninitialised variable in reprobe for rtt blocked domains fixed. 3635 - lintfix and new flex output. 3636 36372 January 2012: Wouter 3638 - Fix to randomize hash function, based on 28c3 congress, reported 3639 by Peter van Dijk. 3640 364124 December 2011: Wouter 3642 - Fix for memory leak (about 20 bytes when a tcp or udp send operation 3643 towards authority servers failed, takes about 50.000 such failures to 3644 leak one Mb, such failures are also usually logged), reported by 3645 Robert Fleischmann. 3646 - iana portlist updated. 3647 364819 December 2011: Wouter 3649 - Fix for VU#209659 CVE-2011-4528: Unbound denial of service 3650 vulnerabilities from nonstandard redirection and denial of existence 3651 http://www.unbound.net/downloads/CVE-2011-4528.txt 3652 - robust checks for next-closer NSEC3s. 3653 - tag 1.4.14 created. 3654 - trunk has 1.4.15 in development. 3655 365615 December 2011: Wouter 3657 - remove uninit warning from cachedump code. 3658 - Fix parse error on negative SOA RRSIGs if badly ordered in the packet. 3659 366013 December 2011: Wouter 3661 - iana portlist updated. 3662 - svn tag 1.4.14rc1 3663 - fix infra cache comparison. 3664 - Fix to constrain signer_name to be a parent of the lookupname. 3665 36665 December 2011: Wouter 3667 - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc. 3668 - Fix warnings with gcc 4.6 in compat/inet_ntop.c. 3669 - Fix warning unused in compat/strptime.c. 3670 - Fix malloc detection and double definition. 3671 36722 December 2011: Wouter 3673 - configure generated with autoconf 2.68. 3674 367530 November 2011: Wouter 3676 - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes 3677 SERVFAILs. Also fixed for UDP (but less likely). 3678 367928 November 2011: Wouter 3680 - Fix quartile time estimate, it was too low, (thanks Jan Komissar). 3681 - iana ports updated. 3682 368311 November 2011: Wouter 3684 - Makefile compat with SunOS make, BSD make and GNU make. 3685 - iana ports updated. 3686 368710 November 2011: Wouter 3688 - Makefile changed for BSD make compatibility. 3689 36909 November 2011: Wouter 3691 - added unit test for SSL service and SSL-upstream. 3692 36938 November 2011: Wouter 3694 - can configure ssl service to one port number, and not on others. 3695 - fixup windows compile with ssl support. 3696 - Fix double free in unbound-host, reported by Steve Grubb. 3697 - iana portlist updated. 3698 36991 November 2011: Wouter 3700 - dns over ssl support as a client, ssl-upstream yes turns it on. 3701 It performs an SSL transaction for every DNS query (250 msec). 3702 - documentation for new options: ssl-upstream, ssl-service-key and 3703 ssl-service.pem. 3704 - iana portlist updated. 3705 - fix -flto detection on Lion for llvm-gcc. 3706 370731 October 2011: Wouter 3708 - dns over ssl support, ssl-service-pem and ssl-service-key files 3709 can be given and then TCP queries are serviced wrapped in SSL. 3710 371127 October 2011: Wouter 3712 - lame-ttl and lame-size options no longer exist, it is integrated 3713 with the host info. They are ignored (with verbose warning) if 3714 encountered to keep the config file backwards compatible. 3715 - fix iana-update for changing gzip compression of results. 3716 - fix export-all-symbols on OSX. 3717 371826 October 2011: Wouter 3719 - iana portlist updated. 3720 - Infra cache stores information about ping and lameness per IP, zone. 3721 This fixes bug #416. 3722 - fix iana_update target for gzipped file on iana site. 3723 372424 October 2011: Wouter 3725 - Fix resolve of partners.extranet.microsoft.com with a fix for the 3726 server selection for choosing out of a (particular) list of bad 3727 choices. (bug#415) 3728 - Fix make_new_space function so that the incoming query is not 3729 overwritten if a jostled out query causes a waiting query to be 3730 resumed that then fails and sends an error message. (Thanks to 3731 Matthew Lee). 3732 373321 October 2011: Wouter 3734 - fix --enable-allsymbols, fptr wlist is disabled on windows with this 3735 option enabled because of memory layout exe vs dll. 3736 373719 October 2011: Wouter 3738 - fix unbound-anchor for broken strptime on OSX lion, detected 3739 in configure. 3740 - Detect if GOST really works, openssl1.0 on OSX fails. 3741 - Implement ipv6%interface notation for scope_id usage. 3742 374317 October 2011: Wouter 3744 - better documentation for inform_super (Thanks Yang Zhe). 3745 374614 October 2011: Wouter 3747 - Fix for out-of-memory condition in libunbound (thanks 3748 Robert Fleischman). 3749 375013 October 2011: Wouter 3751 - Fix --enable-allsymbols, it depended on link specifics of the 3752 target platform, or fptr_wlist assertion failures could occur. 3753 375412 October 2011: Wouter 3755 - updated contrib/unbound_munin_ to family=auto so that it works with 3756 munin-node-configure automatically (if installed as 3757 /usr/local/share/munin/plugins/unbound_munin_ ). 3758 375927 September 2011: Wouter 3760 - unbound.exe -w windows option for start and stop service. 3761 376223 September 2011: Wouter 3763 - TCP-upstream calculates tcp-ping so server selection works if there 3764 are alternatives. 3765 376620 September 2011: Wouter 3767 - Fix classification of NS set in answer section, where there is a 3768 parent-child server, and the answer has the AA flag for dir.slb.com. 3769 Thanks to Amanda Constant from Secure64. 3770 377116 September 2011: Wouter 3772 - fix bug #408: accept patch from Steve Snyder that comments out 3773 unused functions in lookup3.c. 3774 - iana portlist updated. 3775 - fix EDNS1480 change memleak and TCP fallback. 3776 - fix various compiler warnings (reported by Paul Wouters). 3777 - max sent count. EDNS1480 only for rtt < 5000. No promiscuous 3778 fetch if sentcount > 3, stop query if sentcount > 16. Count is 3779 reset when referral or CNAME happens. This makes unbound better 3780 at managing large NS sets, they are explored when there is continued 3781 interest (in the form of queries). 3782 378315 September 2011: Wouter 3784 - release 1.4.13. 3785 - trunk contains 1.4.14 in development. 3786 - Unbound probes at EDNS1480 if there an EDNS0 timeout. 3787 378812 September 2011: Wouter 3789 - Reverted dns EDNS backoff fix, it did not help and needs 3790 fragmentation fixes instead. 3791 - tag 1.4.13rc2 3792 37937 September 2011: Wouter 3794 - Fix operation in ipv6 only (do-ip4: no) mode. 3795 37966 September 2011: Wouter 3797 - fedora specfile updated. 3798 37995 September 2011: Wouter 3800 - tag 1.4.13rc1 3801 38022 September 2011: Wouter 3803 - iana portlist updated. 3804 380526 August 2011: Wouter 3806 - Fix num-threads 0 does not segfault, reported by Simon Deziel. 3807 - Fix validation failures due to EDNS backoff retries, the retry 3808 for fetch of data has want_dnssec because the iter_indicate_dnssec 3809 function returns true when validation failure retry happens, and 3810 then the serviced query code does not fallback to noEDNS, even if 3811 the cache says it has this. This helps for DLV deployment when 3812 the DNSSEC status is not known for sure before the lookup concludes. 3813 381424 August 2011: Wouter 3815 - Applied patch from Karel Slany that fixes a memory leak in the 3816 unbound python module, in string conversions. 3817 381822 August 2011: Wouter 3819 - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy 3820 Zhang and Luo Ce). Unbound responds with the RR types that are 3821 available at the name for qtype ANY and validates those RR types. 3822 It does not test for completeness (i.e. with NSEC or NSEC3 query), 3823 and it does not follow the CNAME or DNAME to another name (with 3824 even more data for the already large response). 3825 - Fix that internally, CNAMEs with NXDOMAIN have that as rcode. 3826 - Documented the options that work with control set_option command. 3827 - tcp-upstream yes/no option (works with set_option) for tunnels. 3828 382918 August 2011: Wouter 3830 - fix autoconf call in makedist crosscompile to RC or snapshot. 3831 383217 August 2011: Wouter 3833 - Fix validation of . DS query. 3834 - new xml format at IANA, new awk for iana_update. 3835 - iana portlist updated. 3836 383710 August 2011: Wouter 3838 - Fix python site-packages path to /usr/lib64. 3839 - updated patch from Tom. 3840 - fix memory and fd leak after out-of-memory condition. 3841 38429 August 2011: Wouter 3843 - patch from Tom Hendrikx fixes load of python modules. 3844 38458 August 2011: Wouter 3846 - make clean had ldns-src reference, removed. 3847 38481 August 2011: Wouter 3849 - Fix autoconf 2.68 warnings 3850 385114 July 2011: Wouter 3852 - Unbound implements RFC6303 (since version 1.4.7). 3853 - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the 3854 meantime, those are for 1.4.13). 3855 - iana portlist updated. 3856 385713 July 2011: Wouter 3858 - Quick fix for contrib/unbound.spec example, no ldns-builtin any more. 3859 386011 July 2011: Wouter 3861 - Fix wildcard expansion no-data reply under an optout NSEC3 zone is 3862 validated as insecure, reported by Jia Li (lijia@cnnic.cn). 3863 38644 July 2011: Wouter 3865 - 1.4.12rc1 tag created. 3866 38671 July 2011: Wouter 3868 - version number in example config file. 3869 - fix that --enable-static-exe does not complain about it unknown. 3870 387130 June 2011: Wouter 3872 - tag relase 1.4.11, trunk is 1.4.12 development. 3873 - iana portlist updated. 3874 - fix bug#395: id bits of other query may leak out under conditions 3875 - fix replyaddr count wrong after jostled queries, which leads to 3876 eventual starvation where the daemon has no replyaddrs left to use. 3877 - fix comment about rndc port, that referred to the old port number. 3878 - fix that the listening socket is not closed when too many remote 3879 control connections are made at the same time. 3880 - removed ldns-src tarball inside the unbound tarball. 3881 388223 June 2011: Wouter 3883 - Changed -flto check to support clang compiler. 3884 - tag 1.4.11rc3 created. 3885 388617 June 2011: Wouter 3887 - tag 1.4.11rc1 created. 3888 - remove warning about signed/unsigned from flex (other flex version). 3889 - updated aclocal.m4 and libtool to match. 3890 - tag 1.4.11rc2 created. 3891 389216 June 2011: Wouter 3893 - log-queries: yesno option, default is no, prints querylog. 3894 - version is 1.4.11. 3895 389614 June 2011: Wouter 3897 - Use -flto compiler flag for link time optimization, if supported. 3898 - iana portlist updated. 3899 390012 June 2011: Wouter 3901 - IPv6 service address for d.root-servers.net (2001:500:2D::D). 3902 390310 June 2011: Wouter 3904 - unbound-control has version number in the header, 3905 UBCT[version]_space_ is the header sent by the client now. 3906 - Unbound control port number is registered with IANA: 3907 ub-dns-control 8953/tcp unbound dns nameserver control 3908 This is the new default for the control-port config setting. 3909 - statistics-interval prints the number of jostled queries to log. 3910 391130 May 2011: Wouter 3912 - Fix Makefile for U in environment, since wrong U is more common than 3913 deansification necessity. 3914 - iana portlist updated. 3915 - updated ldns tarball to 1.6.10rc2 snapshot of today. 3916 391725 May 2011: Wouter 3918 - Fix assertion failure when unbound generates an empty error reply 3919 in response to a query, CVE-2011-1922 VU#531342. 3920 - This fix is in tag 1.4.10. 3921 - defense in depth against the above bug, an error is printed to log 3922 instead of an assertion failure. 3923 392410 May 2011: Wouter 3925 - bug#386: --enable-allsymbols option links all binaries to libunbound 3926 and reduces install size significantly. 3927 - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers. 3928 - iana portlist updated. 3929 - Fix TTL of SOA so negative TTL is separately cached from normal TTL. 3930 393114 April 2011: Wouter 3932 - configure created with newer autoconf 2.66. 3933 393412 April 2011: Wouter 3935 - bug#378: Fix that configure checks for ldns_get_random presence. 3936 39378 April 2011: Wouter 3938 - iana portlist updated. 3939 - queries with CD flag set cause DNSSEC validation, but the answer is 3940 not withheld if it is bogus. Thus, unbound will retry if it is bad 3941 and curb the TTL if it is bad, thus protecting the cache for use by 3942 downstream validators. 3943 - val-override-date: -1 ignores dates entirely, for NTP usage. 3944 394529 March 2011: Wouter 3946 - harden-below-nxdomain: changed so that it activates when the 3947 cached nxdomain is dnssec secure. This avoids backwards 3948 incompatibility because those old servers do not have dnssec. 3949 395024 March 2011: Wouter 3951 - iana portlist updated. 3952 - release 1.4.9. 3953 - trunk is 1.5.0 3954 395517 March 2011: Wouter 3956 - bug#370: new unbound.spec for CentOS 5.x from Harold Jones. 3957 Applied but did not do the --disable-gost. 3958 395910 March 2011: Wouter 3960 - tag 1.4.9 release candidate 1 created. 3961 39623 March 2011: Wouter 3963 - updated ldns to today. 3964 39651 March 2011: Wouter 3966 - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout. 3967 - give config parse error for multiple names on a stub or forward zone. 3968 - updated ldns tarball to 1.6.9(todays snapshot). 3969 397024 February 2011: Wouter 3971 - bug #361: Fix, time.elapsed variable not reset with stats_noreset. 3972 397323 February 2011: Wouter 3974 - iana portlist updated. 3975 - common.sh to version 3. 3976 397718 February 2011: Wouter 3978 - common.sh in testdata updated to version 2. 3979 398015 February 2011: Wouter 3981 - Added explicit note on unbound-anchor usage: 3982 Please note usage of unbound-anchor root anchor is at your own risk 3983 and under the terms of our LICENSE (see that file in the source). 3984 398511 February 2011: Wouter 3986 - iana portlist updated. 3987 - tpkg updated with common.sh for common functionality. 3988 39897 February 2011: Wouter 3990 - Added regression test for addition of a .net DS to the root, and 3991 cache effects with different TTL for glue and DNSKEY. 3992 - iana portlist updated. 3993 399428 January 2011: Wouter 3995 - Fix remove private address does not throw away entire response. 3996 399724 January 2011: Wouter 3998 - release 1.4.8 3999 400019 January 2011: Wouter 4001 - fix bug#349: no -L/usr for ldns. 4002 400318 January 2011: Wouter 4004 - ldns 1.6.8 tarball included. 4005 - release 1.4.8rc1. 4006 400717 January 2011: Wouter 4008 - add get and set option for harden-below-nxdomain feature. 4009 - iana portlist updated. 4010 401114 January 2011: Wouter 4012 - Fix so a changed NS RRset does not get moved name stuck on old 4013 server, for type NS the TTL is not increased. 4014 401513 January 2011: Wouter 4016 - Fix prefetch so it does not get stuck on old server for moved names. 4017 401812 January 2011: Wouter 4019 - iana portlist updated. 4020 402111 January 2011: Wouter 4022 - Fix insecure CNAME sequence marked as secure, reported by Bert 4023 Hubert. 4024 402510 January 2011: Wouter 4026 - faster lruhash get_mem routine. 4027 40284 January 2011: Wouter 4029 - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root. 4030 - iana portlist updated. 4031 403223 December 2010: Wouter 4033 - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept. 4034 403521 December 2010: Wouter 4036 - algorithm compromise protection using the algorithms signalled in 4037 the DS record. Also, trust anchors, DLV, and RFC5011 receive this, 4038 and thus, if you have multiple algorithms in your trust-anchor-file 4039 then it will now behave different than before. Also, 5011 rollover 4040 for algorithms needs to be double-signature until the old algorithm 4041 is revoked. 4042 It is not an option, because I see no use to turn the security off. 4043 - iana portlist updated. 4044 404517 December 2010: Wouter 4046 - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them). 4047 - fix validation in this case: CNAME to nodata for co-hosted opt-in 4048 NSEC3 insecure delegation, was bogus, fixed to be insecure. 4049 405016 December 2010: Wouter 4051 - Fix our 'BDS' license (typo reported by Xavier Belanger). 4052 405310 December 2010: Wouter 4054 - iana portlist updated. 4055 - review changes for unbound-anchor. 4056 40572 December 2010: Wouter 4058 - feature typetransparent localzone, does not block other RR types. 4059 40601 December 2010: Wouter 4061 - Fix bug#338: print address when socket creation fails. 4062 406330 November 2010: Wouter 4064 - Fix storage of EDNS failures in the infra cache. 4065 - iana portlist updated. 4066 406718 November 2010: Wouter 4068 - harden-below-nxdomain option, default off (because very old 4069 software may be incompatible). We could enable it by default in 4070 the future. 4071 407217 November 2010: Wouter 4073 - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN. 4074 - make test output nicer. 4075 407615 November 2010: Wouter 4077 - silence 'tcp connect: broken pipe' and 'net down' at low verbosity. 4078 - iana portlist updated. 4079 - so-sndbuf option for very busy servers, a bit like so-rcvbuf. 4080 40819 November 2010: Wouter 4082 - unbound-anchor compiles with openssl 0.9.7. 4083 40848 November 2010: Wouter 4085 - release tag 1.4.7. 4086 - trunk is version 1.4.8. 4087 - Be lenient and accept imgw.pl malformed packet (like BIND). 4088 40895 November 2010: Wouter 4090 - do not synthesize a CNAME message from cache for qtype DS. 4091 40924 November 2010: Wouter 4093 - Use central entropy to seed threads. 4094 40953 November 2010: Wouter 4096 - Change the rtt used to probe EDNS-timeout hosts to 1000 msec. 4097 40982 November 2010: Wouter 4099 - tag 1.4.7rc1. 4100 - code review. 4101 41021 November 2010: Wouter 4103 - GOST code enabled by default (RFC 5933). 4104 410527 October 2010: Wouter 4106 - Fix uninit value in dump_infra print. 4107 - Fix validation failure for parent and child on same server with an 4108 insecure childzone and a CNAME from parent to child. 4109 - Configure detects libev-4.00. 4110 411126 October 2010: Wouter 4112 - dump_infra and flush_infra commands for unbound-control. 4113 - no timeout backoff if meanwhile a query succeeded. 4114 - Change of timeout code. No more lost and backoff in blockage. 4115 At 12sec timeout (and at least 2x lost before) one probe per IP 4116 is allowed only. At 120sec, the IP is blocked. After 15min, a 4117 120sec entry has a single retry packet. 4118 411925 October 2010: Wouter 4120 - Configure errors if ldns is not found. 4121 412222 October 2010: Wouter 4123 - Windows 7 fix for the installer. 4124 412521 October 2010: Wouter 4126 - Fix bug where fallback_tcp causes wrong roundtrip and edns 4127 observation to be noted in cache. Fix bug where EDNSprobe halted 4128 exponential backoff if EDNS status unknown. 4129 - new unresponsive host method, exponentially increasing block backoff. 4130 - iana portlist updated. 4131 413220 October 2010: Wouter 4133 - interface automatic works for some people with ip6 disabled. 4134 Therefore the error check is removed, so they can use the option. 4135 413619 October 2010: Wouter 4137 - Fix for request list growth, if a server has long timeout but the 4138 lost counter is low, then its effective rtt is the one without 4139 exponential backoff applied. Because the backoff is not working. 4140 The lost counter can then increase and the server is blacklisted, 4141 or the lost counter does not increase and the server is working 4142 for some queries. 4143 414418 October 2010: Wouter 4145 - iana portlist updated. 4146 414713 October 2010: Wouter 4148 - Fix TCP so it uses a random outgoing-interface. 4149 - unbound-anchor handles ADDPEND keystate. 4150 415111 October 2010: Wouter 4152 - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where 4153 the zone has a secure delegation hosted on the same server did not 4154 verify as secure (it was insecure by mistake). 4155 - iana portlist updated. 4156 - ldns tarball updated (for reading cachedumps with bad RR data). 4157 41581 October 2010: Wouter 4159 - test for unbound-anchor. fix for reading certs. 4160 - Fix alloc_reg_release for longer uptime in out of memory conditions. 4161 416228 September 2010: Wouter 4163 - unbound-anchor working, it creates or updates a root.key file. 4164 Use it before you start the validator (e.g. at system boot time). 4165 416627 September 2010: Wouter 4167 - iana portlist updated. 4168 416924 September 2010: Wouter 4170 - bug#329: in example.conf show correct ipv4 link-local 169.254/16. 4171 417223 September 2010: Wouter 4173 - unbound-anchor app, unbound requires libexpat (xml parser library). 4174 417522 September 2010: Wouter 4176 - compliance with draft-ietf-dnsop-default-local-zones-14, removed 4177 reverse ipv6 orchid prefix from builtin list. 4178 - iana portlist updated. 4179 418017 September 2010: Wouter 4181 - DLV has downgrade protection again, because the RFC says so. 4182 - iana portlist updated. 4183 418416 September 2010: Wouter 4185 - Algorithm rollover operational reality intrudes, for trust-anchor, 4186 5011-store, and DLV-anchor if one key matches it's good enough. 4187 - iana portlist updated. 4188 - Fix reported validation error in out of memory condition. 4189 419015 September 2010: Wouter 4191 - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout. 4192 419314 September 2010: Wouter 4194 - increased mesh-max-activation from 1000 to 3000 for crazy domains 4195 like _tcp.slb.com with 262 servers. 4196 - iana portlist updated. 4197 419813 September 2010: Wouter 4199 - bug#327: Fix for cannot access stub zones until the root is primed. 4200 42019 September 2010: Wouter 4202 - unresponsive servers are not completely blacklisted (because of 4203 firewalls), but also not probed all the time (because of the request 4204 list size it generates). The probe rate is 1%. 4205 - iana portlist updated. 4206 420720 August 2010: Wouter 4208 - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled. 4209 iterator get_mem includes priv_get_mem. delegpt nodup removed. 4210 listen_pushback, query_info_allocqname, write_socket, send_packet, 4211 comm_point_set_cb_arg and listen_resume removed. 4212 421319 August 2010: Wouter 4214 - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20. 4215 Delegpt structures checked for duplicates always. 4216 No more nameserver lookups generated when depth is full anyway. 4217 - example.conf notes how to do DNSSEC validation and track the root. 4218 - iana portlist updated. 4219 422018 August 2010: Wouter 4221 - Fix bug#322: configure does not respect CFLAGS on Solaris. 4222 Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line 4223 if use sun-cc, but some systems need different flags. 4224 422516 August 2010: Wouter 4226 - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP 4227 changes, uses m4_bpatsubst now. 4228 - make test (or make check) should be more portable and run the unit 4229 test and testbound scripts. (make longtest has special requirements). 4230 423113 August 2010: Wouter 4232 - More pleasant remote control command parsing. 4233 - documentation added for return values reported by doxygen 1.7.1. 4234 - iana portlist updated. 4235 42369 August 2010: Wouter 4237 - Fix name of rrset printed that failed validation. 4238 42395 August 2010: Wouter 4240 - Return NXDOMAIN after chain of CNAMEs ends at name-not-found. 4241 42424 August 2010: Wouter 4243 - Fix validation in case a trust anchor enters into a zone with 4244 unsupported algorithms. 4245 42463 August 2010: Wouter 4247 - updated ldns tarball with bugfixes. 4248 - release tag 1.4.6. 4249 - trunk becomes 1.4.7 develop. 4250 - iana portlist updated. 4251 425222 July 2010: Wouter 4253 - more error details on failed remote control connection. 4254 425515 July 2010: Wouter 4256 - rlimit adjustments for select and ulimit can happen at the same time. 4257 425814 July 2010: Wouter 4259 - Donation text added to README. 4260 - Fix integer underflow in prefetch ttl creation from cache. This 4261 fixes a potential negative prefetch ttl. 4262 426312 July 2010: Wouter 4264 - Changed the defaults for num-queries-per-thread/outgoing-range. 4265 For builtin-select: 512/960, for libevent 1024/4096 and for 4266 windows 24/48 (because of win api). This makes the ratio this way 4267 to improve resilience under heavy load. For high performance, use 4268 libevent and possibly higher numbers. 4269 427010 July 2010: Wouter 4271 - GOST enabled if SSL is recent and ldns has GOST enabled too. 4272 - ldns tarball updated. 4273 42749 July 2010: Wouter 4275 - iana portlist updated. 4276 - Fix validation of qtype DNSKEY when a key-cache entry exists but 4277 no rr-cache entry is used (it expired or prefetch), it then goes 4278 back up to the DS or trust-anchor to validate the DNSKEY. 4279 42807 July 2010: Wouter 4281 - Neat function prototypes, unshadowed local declarations. 4282 42836 July 2010: Wouter 4284 - failure to chown the pidfile is not fatal any more. 4285 - testbound uses UTC timezone. 4286 - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add 4287 /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake. 4288 42895 July 2010: Wouter 4290 - log if a server is skipped because it is on the donotquery list, 4291 at verbosity 4, to enable diagnosis why no queries to 127.0.0.1. 4292 - added feature to print configure date, target and options with -h. 4293 - added feature to print event backend system details with -h. 4294 - wdiff is not actually required by make test, updated requirements. 4295 42961 July 2010: Wouter 4297 - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex 4298 must be signed with all algorithms from the DS rrset at the parent. 4299 This is now checked and becomes bogus if not. 4300 430128 June 2010: Wouter 4302 - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps 4303 in overload situations to be about 5 qps for the class of shortly 4304 serviced queries. 4305 The capacity of the resolver is then about (numqueriesperthread / 2) 4306 / (average time for such long queries) qps for long queries. 4307 And about (numqueriesperthread / 2)/(jostletimeout in whole seconds) 4308 qps for short queries, per thread. 4309 - Fix the max number of reply-address count to be applied for duplicate 4310 queries, and not for new query list entries. This raises the memory 4311 usage to a max of (16+1)*numqueriesperthread reply addresses. 4312 431325 June 2010: Wouter 4314 - Fix handling of corner case reply from lame server, follows rfc2308. 4315 It could lead to a nodata reply getting into the cache if the search 4316 for a non-lame server turned up other misconfigured servers. 4317 - unbound.h has extern "C" statement for easier include in c++. 4318 431923 June 2010: Wouter 4320 - iana portlist updated. 4321 - makedist upgraded cross compile openssl option, like this: 4322 ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost 4323 432422 June 2010: Wouter 4325 - Unbound reports libev or libevent correctly in logs in verbose mode. 4326 - Fix to unload gost dynamic library module for leak testing. 4327 432818 June 2010: Wouter 4329 - iana portlist updated. 4330 433117 June 2010: Wouter 4332 - Add AAAA to root hints for I.ROOT-SERVERS.NET. 4333 433416 June 2010: Wouter 4335 - Fix assertion failure reported by Kai Storbeck from XS4ALL, the 4336 assertion was wrong. 4337 - updated ldns tarball. 4338 433915 June 2010: Wouter 4340 - tag 1.4.5 created. 4341 - trunk contains 1.4.6 in development. 4342 - Fix TCPreply on systems with no writev, if just 1 byte could be sent. 4343 - Fix to use one pointer less for iterator query state store_parent_NS. 4344 - makedist crosscompile to windows uses builtin ldns not host ldns. 4345 - Max referral count from 30 to 130, because 128 one character domains 4346 is valid DNS. 4347 - added documentation for the histogram printout to syslog. 4348 434911 June 2010: Wouter 4350 - When retry to parent the retrycount is not wiped, so failed 4351 nameservers are not tried again. 4352 - iana portlist updated. 4353 435410 June 2010: Wouter 4355 - Fix bug where a long loop could be entered, now cycle detection 4356 has a loop-counter and maximum search amount. 4357 43584 June 2010: Wouter 4359 - iana portlist updated. 4360 - 1.4.5rc1 tag created. 4361 43623 June 2010: Wouter 4363 - ldns tarball updated, 1.6.5. 4364 - review comments, split dependency cycle tracking for parentside 4365 last resort lookups for A and AAAA so there are more lookup options. 4366 43672 June 2010: Wouter 4368 - Fix compile warning if compiled without threads. 4369 - updated ldns-tarball with current ldns svn (pre 1.6.5). 4370 - GOST disabled-by-default, the algorithm number is allocated but the 4371 RFC is still has to pass AUTH48 at the IETF. 4372 43731 June 2010: Wouter 4374 - Ignore Z flag in incoming messages too. 4375 - Fix storage of negative parent glue if that last resort fails. 4376 - libtoolize 2.2.6b, autoconf 2.65 applied to configure. 4377 - new splint flags for newer splint install. 4378 437931 May 2010: Wouter 4380 - Fix AD flag handling, it could in some cases mistakenly copy the AD 4381 flag from upstream servers. 4382 - alloc_special_obtain out of memory is not a fatal error any more, 4383 enabling unbound to continue longer in out of memory conditions. 4384 - parentside names are dispreferred but not said to be dnssec-lame. 4385 - parentside check for cached newname glue. 4386 - fix parentside and querytargets modulestate, for dump_requestlist. 4387 - unbound-control-setup makes keys -rw-r--- so not all users permitted. 4388 - fix parentside from cache to be marked dispreferred for bad names. 4389 439028 May 2010: Wouter 4391 - iana portlist updated. 4392 - parent-child disagreement approach altered. Older fixes are 4393 removed in place of a more exhaustive search for misconfigured data 4394 available via the parent of a delegation. 4395 This is designed to be throttled by cache entries, with TTL from the 4396 parent if possible. Additionally the loop-counter is used. 4397 It also tests for NS RRset differences between parent and child. 4398 The fetch of misconfigured data should be more reliable and thorough. 4399 It should work reliably even with no or only partial data in cache. 4400 Data received from the child (as always) is deemed more 4401 authoritative than information received from the delegation parent. 4402 The search for misconfigured data is not performed normally. 4403 440426 May 2010: Wouter 4405 - Contribution from Migiel de Vos (Surfnet): nagios patch for 4406 unbound-host, in contrib/ (in the source tarball). Makes 4407 unbound-host suitable for monitoring dnssec(-chain) status. 4408 440921 May 2010: Wouter 4410 - EDNS timeout code will not fire if EDNS status already known. 4411 - EDNS failure not stored if EDNS status known to work. 4412 441319 May 2010: Wouter 4414 - Fix resolution for domains like safesvc.com.cn. If the iterator 4415 can not recurse further and it finds the delegation in a state 4416 where it would otherwise have rejected it outhand if so received 4417 from a cache lookup, then it can try to ask higherup (with loop 4418 protection). 4419 - Fix comments in iter_utils:dp_is_useless. 4420 442118 May 2010: Wouter 4422 - Fix various compiler warnings from the clang llvm compiler. 4423 - iana portlist updated. 4424 44256 May 2010: Wouter 4426 - Fix bug#308: spelling error in variable name in parser and lexer. 4427 44284 May 2010: Wouter 4429 - Fix dnssec-missing detection that was turned off by server selection. 4430 - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default 4431 reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa, 4432 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa. 4433 443429 April 2010: Wouter 4435 - Fix for dnssec lameness detection to use the key cache. 4436 - infra cache entries that are expired are wiped clean. Previously 4437 it was possible to not expire host data (if accessed often). 4438 443928 April 2010: Wouter 4440 - ldns tarball updated and GOST support is detected and then enabled. 4441 - iana portlist updated. 4442 - Fix detection of gost support in ldns (reported by Chris Smith). 4443 444427 April 2010: Wouter 4445 - unbound-control get_option domain-insecure shows config file items. 4446 - fix retry sequence if prime hints are recursion-lame. 4447 - autotrust anchor file can be initialized with a ZSK key as well. 4448 - harden-referral-path does not result in failures due to max-depth. 4449 You can increase the max-depth by adding numbers (' 0') after the 4450 target-fetch-policy, this increases the depth to which is checked. 4451 445226 April 2010: Wouter 4453 - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use 4454 CPPFLAGS during configure process. 4455 - if libev is installed on the base system (not libevent), detect 4456 it from the event.h header file and link with -lev. 4457 - configlexer.lex gets config.h, and configyyrename.h added by make, 4458 no more double include. 4459 - More strict scrubber (Thanks to George Barwood for the idea): 4460 NS set must be pertinent to the query (qname subdomain nsname). 4461 - Fix bug#307: In 0x20 backoff fix fallback so the number of 4462 outstanding queries does not become -1 and block the request. 4463 Fixed handling of recursion-lame in combination with 0x20 fallback. 4464 Fix so RRsets are compared canonicalized and sorted if the immediate 4465 comparison fails, this makes it work around round-robin sites. 4466 446723 April 2010: Wouter 4468 - Squelch log message: sendto failed permission denied for 4469 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2). 4470 - Fix to fetch data as last resort more tenaciously. When cycle 4471 targets cause the server selection to believe there are more options 4472 when they really are not there, the server selection is reinitiated. 4473 - Fix fetch from blacklisted dnssec lame servers as last resort. The 4474 server's IP address is then given in validator errors as well. 4475 - Fix local-zone type redirect that did not use the query name for 4476 the answer rrset. 4477 447822 April 2010: Wouter 4479 - tag 1.4.4. 4480 - trunk contains 1.4.5 in development. 4481 - Fix validation failure for qtype ANY caused by a RRSIG parse failure. 4482 The validator error message was 'no signatures from ...'. 4483 448416 April 2010: Wouter 4485 - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN. 4486 - tag 1.4.4rc1. 4487 448815 April 2010: Wouter 4489 - ECC-GOST algorithm number 12 that is assigned by IANA. New test 4490 example key and signatures for GOST. GOST requires openssl-1.0.0. 4491 GOST is still disabled by default. 4492 44939 April 2010: Wouter 4494 - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or 4495 get into an endless loop, if 0x20 was enabled, and buffers are small 4496 or particular broken packets are received. 4497 - Fix chain of trust with CNAME at an intermediate step, for the DS 4498 processing proof. 4499 45008 April 2010: Wouter 4501 - Fix validation of queries with wildcard names (*.example). 4502 45036 April 2010: Wouter 4504 - Fix EDNS probe for .de DNSSEC testbed failure, where the infra 4505 cache timeout coincided with a server update, the current EDNS 4506 backoff is less sensitive, and does not cache the backoff unless 4507 the backoff actually works and the domain is not expecting DNSSEC. 4508 - GOST support with correct algorithm numbers. 4509 45101 April 2010: Wouter 4511 - iana portlist updated. 4512 451324 March 2010: Wouter 4514 - unbound control flushed items are not counted when flushed again. 4515 451623 March 2010: Wouter 4517 - iana portlist updated. 4518 451922 March 2010: Wouter 4520 - unbound-host disables use-syslog from config file so that the 4521 config file for the main server can be used more easily. 4522 - fix bug#301: unbound-checkconf could not parse interface 4523 '0.0.0.0@5353', even though unbound itself worked fine. 4524 452519 March 2010: Wouter 4526 - fix fwd_ancil test to pass if the socket options are not supported. 4527 452818 March 2010: Wouter 4529 - Fixed random numbers for port, interface and server selection. 4530 Removed very small bias. 4531 - Refer to the listing in unbound-control man page in the extended 4532 statistics entry in the unbound.conf man page. 4533 453416 March 2010: Wouter 4535 - Fix interface-automatic for OpenBSD: msg.controllen was too small, 4536 also assertions on ancillary data buffer. 4537 - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO. 4538 - for NSEC3 check if signatures are cached. 4539 454015 March 2010: Wouter 4541 - unit test for util/regional.c. 4542 454312 March 2010: Wouter 4544 - Reordered configure checks so fork and -lnsl -lsocket checks are 4545 earlier, and thus later checks benefit from and do not hinder them. 4546 - iana portlist updated. 4547 - ldns tarball updated. 4548 - Fix python use when multithreaded. 4549 - Fix solaris python compile. 4550 - Include less in config.h and include per code file for ldns, ssl. 4551 455211 March 2010: Wouter 4553 - another memory allocation option: --enable-alloc-nonregional. 4554 exposes the regional allocations to other memory purifiers. 4555 - fix for memory alignment in struct sock_list allocation. 4556 - Fix for MacPorts ldns without ssl default, unbound checks if ldns 4557 has dnssec functionality and uses the builtin if not. 4558 - Fix daemonize on Solaris 10, it did not detach from terminal. 4559 - tag 1.4.3 created. 4560 - trunk is 1.4.4 in development. 4561 - spelling fix in validation error involving cnames. 4562 456310 March 2010: Wouter 4564 - --enable-alloc-lite works with test set. 4565 - portability in the testset: printf format conversions, prototypes. 4566 45679 March 2010: Wouter 4568 - tag 1.4.2 created. 4569 - trunk is 1.4.3 in development. 4570 - --enable-alloc-lite debug option. 4571 45728 March 2010: Wouter 4573 - iana portlist updated. 4574 45754 March 2010: Wouter 4576 - Fix crash in control channel code. 4577 45783 March 2010: Wouter 4579 - better casts in pipe code, brackets placed wrongly. 4580 - iana portlist updated. 4581 45821 March 2010: Wouter 4583 - make install depends on make all. 4584 - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs. 4585 - --enable-checking: enables assertions but does not look nonproduction. 4586 - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with 4587 nxdomain and nodata distinguished. 4588 - ldns tarball updated. 4589 - --disable-rpath fixed for libtool not found errors. 4590 - new fedora specfile from Fedora13 in contrib from Paul Wouters. 4591 459226 February 2010: Wouter 4593 - Fixup prototype for lexer cleanup in daemon code. 4594 - unbound-control list_stubs, list_forwards, list_local_zones and 4595 list_local_data. 4596 459724 February 2010: Wouter 4598 - Fix scrubber bug that potentially let NS records through. Reported 4599 by Amanda Constant. 4600 - Also delete potential poison references from additional. 4601 - Fix: no classification of a forwarder as lame, throw away instead. 4602 460323 February 2010: Wouter 4604 - libunbound ub_ctx_get_option() added. 4605 - unbound-control set_option and get_option commands. 4606 - iana portlist updated. 4607 460818 February 2010: Wouter 4609 - A little more strict DS scrubbing. 4610 - No more blacklisting of unresponsive servers, a 2 minute timeout 4611 is backed off to. 4612 - RD flag not enabled for dnssec-blacklisted tries, unless necessary. 4613 - pickup ldns compile fix, libdl for libcrypto. 4614 - log 'tcp connect: connection timed out' only in high verbosity. 4615 - unbound-control log_reopen command. 4616 - moved get_option code from unbound-checkconf to util/config_file.c 4617 461817 February 2010: Wouter 4619 - Disregard DNSKEY from authority section for chain of trust. 4620 DS records that are irrelevant to a referral scrubbed. Anti-poison. 4621 - iana portlist updated. 4622 462316 February 2010: Wouter 4624 - Check for 'no space left on device' (or other errors) when 4625 writing updated autotrust anchors and print errno to log. 4626 462715 February 2010: Wouter 4628 - Fixed the requery protection, the TTL was 0, it is now 900 seconds, 4629 hardcoded. We made the choice to send out more conservatively, 4630 protecting against an aggregate effect more than protecting a 4631 single user (from their own folly, perhaps in case of misconfig). 4632 463312 February 2010: Wouter 4634 - Re-query pattern changed on validation failure. To protect troubled 4635 authority servers, unbound caches a failure for the DNSKEY or DS 4636 records for the entire zone, and only retries that 900 seconds later. 4637 This implies that only a handful of packets are sent extra to the 4638 authority if the zone fails. 4639 464011 February 2010: Wouter 4641 - ldns tarball update for long label length syntax error fix. 4642 - iana portlist updated. 4643 46449 February 2010: Wouter 4645 - Fixup in compat snprintf routine, %f 1.02 and %g support. 4646 - include math.h for testbound test compile portability. 4647 46482 February 2010: Wouter 4649 - Updated url of IANA itar, interim trust anchor repository, in script. 4650 46511 February 2010: Wouter 4652 - iana portlist updated. 4653 - configure test for memcmp portability. 4654 465527 January 2010: Wouter 4656 - removed warning on format string in validator error log statement. 4657 - iana portlist updated. 4658 465922 January 2010: Wouter 4660 - libtool finish the install of unbound python dynamic library. 4661 466221 January 2010: Wouter 4663 - acx_nlnetlabs.m4 synchronised with nsd's version. 4664 466520 January 2010: Wouter 4666 - Fixup lookup trouble for parent-child domains on the first query. 4667 466814 January 2010: Wouter 4669 - Fixup ldns detection to also check for header files. 4670 467113 January 2010: Wouter 4672 - prefetch-key option that performs DNSKEY queries earlier in the 4673 validation process, and that could halve the latency on DNSSEC 4674 queries. It takes some extra processing (CPU, a cache is needed). 4675 467612 January 2010: Wouter 4677 - Fix unbound-checkconf for auto-trust-anchor-file present checks. 4678 46798 January 2010: Wouter 4680 - Fix for parent-child disagreement code which could have trouble 4681 when (a) ipv6 was disabled and (b) the TTL for parent and child 4682 were different. There were two bugs, the parent-side information 4683 is fixed to no longer block lookup of child side information and 4684 the iterator is fixed to no longer attempt to get ipv6 when it is 4685 not enabled and then give up in failure. 4686 - test and fixes to make prefetch actually store the answer in the 4687 cache. Considers some rrsets 'already expired' but does not allow 4688 overwriting of rrsets considered more secure. 4689 46907 January 2010: Wouter 4691 - Fixup python documentation (thanks Leo Vandewoestijne). 4692 - Work on cache prefetch feature. 4693 - Stats for prefetch, in log print stats, unbound-control stats 4694 and in unbound_munin plugin. 4695 46966 January 2010: Wouter 4697 - iana portlist updated. 4698 - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length. 4699 - verbose output includes parent-side-address notion for lameness. 4700 - documented val-log-level: 2 setting in example.conf and man page. 4701 - change unbound-control-setup from 1024(sha1) to 1536(sha256). 4702 47031 January 2010: Wouter 4704 - iana portlist updated. 4705 470622 December 2009: Wouter 4707 - configure with newer libtool 2.2.6b. 4708 470917 December 2009: Wouter 4710 - review comments. 4711 - tag 1.4.1. 4712 - trunk to version 1.4.2. 4713 471415 December 2009: Wouter 4715 - Answer to qclass=ANY queries, with class IN contents. 4716 Test that validation also works. 4717 - updated ldns snapshot tarball with latest fixes (parsing records). 4718 471911 December 2009: Wouter 4720 - on IPv4 UDP turn off DF flag. 4721 472210 December 2009: Wouter 4723 - requirements.txt updated with design choice explanations. 4724 - Reading fixes: fix to set unlame when child confirms parent glue, 4725 and fix to avoid duplicate addresses in delegation point. 4726 - verify_rrsig routine checks expiration last. 4727 47289 December 2009: Wouter 4729 - Fix Bug#287(reopened): update of ldns tarball with fix for parse 4730 errors generated for domain names like '.example.com'. 4731 - Fix SOA excluded from negative DS responses. Reported by Hauke 4732 Lampe. The negative cache did not include proper SOA records for 4733 negative qtype DS responses which makes BIND barf on it, such 4734 responses are now only used internally. 4735 - Fix negative cache lookup of closestencloser check of DS type bit. 4736 47378 December 2009: Wouter 4738 - Fix for lookup of parent-child disagreement domains, where the 4739 parent-side glue works but it does not provide proper NS, A or AAAA 4740 for itself, fixing domains such as motorcaravanners.eu. 4741 - Feature: you can specify a port number in the interface: line, so 4742 you can bind the same interface multiple times at different ports. 4743 47447 December 2009: Wouter 4745 - Bug#287: Fix segfault when unbound-control remove nonexistent local 4746 data. Added check to tests. 4747 47481 December 2009: Wouter 4749 - Fix crash with module-config "iterator". 4750 - Added unit test that has "iterator" module-config. 4751 475230 November 2009: Wouter 4753 - bug#284: fix parse of # without end-of-line at end-of-file. 4754 475526 November 2009: Wouter 4756 - updated ldns with release candidate for version 1.6.3. 4757 - tag for 1.4.0 release. 4758 - 1.4.1 version in trunk. 4759 - Fixup major libtool version to 2 because of why_bogus change. 4760 It was 1:5:0 but should have been 2:0:0. 4761 476223 November 2009: Wouter 4763 - Patch from David Hubbard for libunbound manual page. 4764 - Fixup endless spinning in unbound-control stats reported by 4765 Attila Nagy. Probably caused by clock reversal. 4766 476720 November 2009: Wouter 4768 - contrib/split-itar.sh contributed by Tom Hendrikx. 4769 477019 November 2009: Wouter 4771 - better argument help for unbound-control. 4772 - iana portlist updated. 4773 477417 November 2009: Wouter 4775 - noted multiple entries for multiple domain names in example.conf. 4776 - iana portlist updated. 4777 477816 November 2009: Wouter 4779 - Fixed signer detection of CNAME responses without signatures. 4780 - Fix#282 libunbound memleak on error condition by Eric Sesterhenn. 4781 - Tests for CNAMEs to deeper trust anchors, secure and bogus. 4782 - svn tag 1.4.0rc1 made. 4783 478413 November 2009: Wouter 4785 - Fixed validation failure for CNAME to optout NSEC3 nodata answer. 4786 - unbound-host does not fail on type ANY. 4787 - Fixed wireparse failure to put RRSIGs together with data in some 4788 long ANY mix cases, which fixes validation failures. 4789 479012 November 2009: Wouter 4791 - iana portlist updated. 4792 - fix manpage errors reported by debian lintian. 4793 - review comments. 4794 - fixup very long vallog2 level error strings. 4795 479611 November 2009: Wouter 4797 - ldns tarball updated (to 1.6.2). 4798 - review comments. 4799 480010 November 2009: Wouter 4801 - Thanks to Surfnet found bug in new dnssec-retry code that failed 4802 to combine well when combined with DLV and a particular failure. 4803 - Fixed unbound-control -h output about argument optionality. 4804 - review comments. 4805 48065 November 2009: Wouter 4807 - lint fixes and portability tests. 4808 - better error text for multiple domain keys in one autotrust file. 4809 48102 November 2009: Wouter 4811 - Fix bug where autotrust does not work when started with a DS. 4812 - Updated GOST unit tests for unofficial algorithm number 249 4813 and DNSKEY-format changes in draft version -01. 4814 481529 October 2009: Wouter 4816 - iana portlist updated. 4817 - edns-buffer-size option, default 4096. 4818 - fixed do-udp: no. 4819 482028 October 2009: Wouter 4821 - removed abort on prealloc failure, error still printed but softfail. 4822 - iana portlist updated. 4823 - RFC 5702: RSASHA256 and RSASHA512 support enabled by default. 4824 - ldns tarball updated (which also enables rsasha256 support). 4825 482627 October 2009: Wouter 4827 - iana portlist updated. 4828 48298 October 2009: Wouter 4830 - please doxygen 4831 - add val-log-level print to corner case (nameserver.epost.bg). 4832 - more detail to errors from insecure delegation checks. 4833 - Fix double time subtraction in negative cache reported by 4834 Amanda Constant and Hugh Mahon. 4835 - Made new validator error string available from libunbound for 4836 applications. It is in result->why_bogus, a zero-terminated string. 4837 unbound-host prints it by default if a result is bogus. 4838 Also the errinf is public in module_qstate (for other modules). 4839 48407 October 2009: Wouter 4841 - retry for validation failure in DS and prime results. Less mem use. 4842 unit test. Provisioning in other tests for requeries. 4843 - retry for validation failure in DNSKEY in middle of chain of trust. 4844 unit test. 4845 - retry for empty non terminals in chain of trust and unit test. 4846 - Fixed security bug where the signatures for NSEC3 records were not 4847 checked when checking for absence of DS records. This could have 4848 enabled the substitution of an insecure delegation. 4849 - moved version number to 1.4.0 because of 1.3.4 release with only 4850 the NSEC3 patch from the entry above. 4851 - val-log-level: 2 shows extended error information for validation 4852 failures, but still one (longish) line per failure. For example: 4853 validation failure <example.com. DNSKEY IN>: signature expired from 4854 192.0.2.4 for trust anchor example.com. while building chain of trust 4855 validation failure <www.example.com. A IN>: no signatures from 4856 192.0.2.6 for key example.com. while building chain of trust 4857 48586 October 2009: Wouter 4859 - Test set updated to provide additional ns lookup result. 4860 The retry would attempt to fetch the data from other nameservers 4861 for bogus data, and this needed to be provisioned in the tests. 4862 48635 October 2009: Wouter 4864 - first validation failure retry code. Retries for data failures. 4865 And unit test. 4866 48672 October 2009: Wouter 4868 - improve 5011 modularization. 4869 - fix unbound-host so -d can be given before -C. 4870 - iana portlist updated. 4871 487228 September 2009: Wouter 4873 - autotrust-anchor-file can read multiline input and $ORIGIN. 4874 - prevent integer overflow in holddown calculation. review fixes. 4875 - fixed race condition in trust point revocation. review fix. 4876 - review fixes to comments, removed unused code. 4877 487825 September 2009: Wouter 4879 - so-rcvbuf: 4m option added. Set this on large busy servers to not 4880 drop the occasional packet in spikes due to full socket buffers. 4881 netstat -su keeps a counter of UDP dropped due to full buffers. 4882 - review of validator/autotrust.c, small fixes and comments. 4883 488423 September 2009: Wouter 4885 - 5011 query failed counts verification failures, not lookup failures. 4886 - 5011 probe failure handling fixup. 4887 - test unbound reading of original autotrust data. 4888 The metadata per-key, such as key state (PENDING, MISSING, VALID) is 4889 picked up, otherwise performs initial probe like usual. 4890 489122 September 2009: Wouter 4892 - autotrust test with algorithm rollover, new ordering of checks 4893 assists in orderly rollover. 4894 - autotrust test with algorithm rollover to unknown algorithm. 4895 checks if new keys are supported before adding them. 4896 - autotrust test with trust point revocation, becomes unsigned. 4897 - fix DNSSEC-missing-signature detection for minimal responses 4898 for qtype DNSKEY (assumes DNSKEY occurs at zone apex). 4899 490018 September 2009: Wouter 4901 - autotrust tests, fix trustpoint timer deletion code. 4902 fix count of valid anchors during missing remove. 4903 - autotrust: pick up REVOKE even if not signed with known other keys. 4904 490517 September 2009: Wouter 4906 - fix compile of unbound-host when --enable-alloc-checks. 4907 - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis. 4908 - Manual page fixes reported by Tony Finch. 4909 491016 September 2009: Wouter 4911 - Fix memory leak reported by Tao Ma. 4912 - Fix memstats test tool for log-time-ascii log format. 4913 491415 September 2009: Wouter 4915 - iana portlist updated. 4916 491710 September 2009: Wouter 4918 - increased MAXSYSLOGLEN so .bg key can be printed in debug output. 4919 - use linebuffering for log-file: output, this can be significantly 4920 faster than the previous fflush method and enable some class of 4921 resolvers to use high verbosity (for short periods). 4922 Not on windows, because line buffering does not work there. 4923 49249 September 2009: Wouter 4925 - Fix bug where DNSSEC-bogus messages were marked with too high TTL. 4926 The RRsets would still expire at the normal time, but this would 4927 keep messages bogus in the cache for too long. 4928 - regression test for that bug. 4929 - documented that load_cache is meant for debugging. 4930 49318 September 2009: Wouter 4932 - fixup printing errors when load_cache, they were printed to the 4933 SSL connection which broke, now to the log. 4934 - new ldns - with fixed parse of large SOA values. 4935 49367 September 2009: Wouter 4937 - autotrust testbound scenarios. 4938 - autotrust fix that failure count is written to file. 4939 - autotrust fix that keys may become valid after add holddown time 4940 alone, before the probe returns. 4941 49424 September 2009: Wouter 4943 - Changes to make unbound work with libevent-2.0.3 alpha. (in 4944 configure detection due to new ssl dependency in libevent) 4945 - do not call sphinx for documentation when python is disabled. 4946 - remove EV_PERSIST from libevent timeout code to make the code 4947 compatible with the libevent-2.0. Works with older libevent too. 4948 - fix memory leak in python code. 4949 49503 September 2009: Wouter 4951 - Got a patch from Luca Bruno for libunbound support on windows to 4952 pick up the system resolvconf nameservers and hosts there. 4953 - included ldns updated (enum warning fixed). 4954 - makefile fix for parallel makes. 4955 - Patch from Zdenek Vasicek and Attila Nagy for using the source IP 4956 from python scripts. See pythonmod/examples/resip.py. 4957 - doxygen comment fixes. 4958 49592 September 2009: Wouter 4960 - TRAFFIC keyword for testbound. Simplifies test generation. 4961 ${range lower val upper} to check probe timeout values. 4962 - test with 5011-prepublish rollover and revocation. 4963 - fix revocation of RR for autotrust, stray exclamation mark. 4964 49651 September 2009: Wouter 4966 - testbound variable arithmetic. 4967 - autotrust probe time is randomised. 4968 - autotrust: the probe is active and does not fetch from cache. 4969 497031 August 2009: Wouter 4971 - testbound variable processing. 4972 497328 August 2009: Wouter 4974 - fixup unbound-control lookup to print forward and stub servers. 4975 497627 August 2009: Wouter 4977 - autotrust: mesh answer callback is empty. 4978 497926 August 2009: Wouter 4980 - autotrust probing. 4981 - iana portlist updated. 4982 498325 August 2009: Wouter 4984 - fixup memleak in trust anchor unsupported algorithm check. 4985 - iana portlist updated. 4986 - autotrust options: add-holddown, del-holddown, keep-missing. 4987 - autotrust store revoked status of trust points. 4988 - ctime_r compat definition. 4989 - detect yylex_destroy() in configure. 4990 - detect SSL_get_compression_methods declaration in configure. 4991 - fixup DS lookup at anchor point with unsigned parent. 4992 - fixup DLV lookup for DS queries to unsigned domains. 4993 499424 August 2009: Wouter 4995 - cleaner memory allocation on exit. autotrust test routines. 4996 - free all memory on program exit, fix for ssl and flex. 4997 499821 August 2009: Wouter 4999 - autotrust: debug routines. Read,write and conversions work. 5000 500120 August 2009: Wouter 5002 - autotrust: save and read trustpoint variables. 5003 500419 August 2009: Wouter 5005 - autotrust: state table updates. 5006 - iana portlist updated. 5007 500817 August 2009: Wouter 5009 - autotrust: process events. 5010 501117 August 2009: Wouter 5012 - Fix so that servers are only blacklisted if they fail to reply 5013 to 16 queries in a row and the timeout gets above 2 minutes. 5014 - autotrust work, split up DS verification of DNSKEYs. 5015 501614 August 2009: Wouter 5017 - unbound-control lookup prints out infra cache information, like RTT. 5018 - Fix bug in DLV lookup reported by Amanda from Secure64. 5019 It could sometimes wrongly classify a domain as unsigned, which 5020 does not give the AD bit on replies. 5021 502213 August 2009: Wouter 5023 - autotrust read anchor files. locked trust anchors. 5024 502512 August 2009: Wouter 5026 - autotrust import work. 5027 502811 August 2009: Wouter 5029 - Check for openssl compatible with gost if enabled. 5030 - updated unit test for GOST=211 code. 5031 Nicer naming of test files. 5032 - iana portlist updated. 5033 50347 August 2009: Wouter 5035 - call OPENSSL_config() in unbound and unit test so that the 5036 operator can use openssl.cnf for configuration options. 5037 - removed small memory leak from config file reader. 5038 50396 August 2009: Wouter 5040 - configure --enable-gost for GOST support, experimental 5041 implementation of draft-dolmatov-dnsext-dnssec-gost-01. 5042 - iana portlist updated. 5043 - ldns tarball updated (with GOST support). 5044 50455 August 2009: Wouter 5046 - trunk moved to 1.3.4. 5047 50484 August 2009: Wouter 5049 - Added test that the examples from draft rsasha256-14 verify. 5050 - iana portlist updated. 5051 - tagged 1.3.3 5052 50533 August 2009: Wouter 5054 - nicer warning when algorithm not supported, tells you to upgrade. 5055 - iana portlist updated. 5056 505727 July 2009: Wouter 5058 - Updated unbound-cacti contribution from Dmitriy Demidov, with 5059 the queue statistics displayed in its own graph. 5060 - iana portlist updated. 5061 506222 July 2009: Wouter 5063 - Fix bug found by Michael Tokarev where unbound would try to 5064 prime the root servers even though forwarders are configured for 5065 the root. 5066 - tagged 1.3.3rc1 5067 506821 July 2009: Wouter 5069 - Fix server selection, so that it waits for open target queries when 5070 faced with lameness. 5071 507220 July 2009: Wouter 5073 - Ignore transient sendto errors, no route to host, and host, net down. 5074 - contrib/update-anchor.sh has -r option for root-hints. 5075 - feature val-log-level: 1 prints validation failures so you can 5076 keep track of them during dnssec deployment. 5077 507816 July 2009: Wouter 5079 - fix replacement malloc code. Used in crosscompile. 5080 - makedist -w creates crosscompiled setup.exe on fedora11. 5081 508215 July 2009: Wouter 5083 - dependencies for compat items, for crosscompile. 5084 - mingw32 crosscompile changes, dependencies and zipfile creation. 5085 and with System.dll from the windows NSIS you can make setup.exe. 5086 - package libgcc_s_sjlj exception handler for NSISdl.dll. 5087 508814 July 2009: Wouter 5089 - updated ldns tarball for solaris x64 compile assistance. 5090 - no need to define RAND_MAX from config.h. 5091 - iana portlist updated. 5092 - configure changes and ldns update for mingw32 crosscompile. 5093 509413 July 2009: Wouter 5095 - Fix for crash at start on windows. 5096 - tag for release 1.3.2. 5097 - trunk has version 1.3.3. 5098 - Fix for ID bits on windows to use all 16. RAND_MAX was not 5099 defined like you'd expect on mingw. Reported by Mees de Roo. 5100 51019 July 2009: Wouter 5102 - tag for release 1.3.1. 5103 - trunk has version 1.3.2. 5104 51057 July 2009: Wouter 5106 - iana portlist updated. 5107 51086 July 2009: Wouter 5109 - prettier error handling in SSL setup. 5110 - makedist.sh uname fix (same as ldns). 5111 - updated fedora spec file. 5112 51133 July 2009: Wouter 5114 - fixup linking when ldnsdir is "". 5115 511630 June 2009: Wouter 5117 - more lenient truncation checks. 5118 511929 June 2009: Wouter 5120 - ldns trunk r2959 imported as tarball, because of solaris cc compile 5121 support for c99. r2960 for better configure. 5122 - better wrongly_truncated check. 5123 - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to 5124 avoid dropped packets at routers. 5125 512626 June 2009: Wouter 5127 - Fix EDNS fallback when EDNS works for short answers but long answers 5128 are dropped. 5129 513022 June 2009: Wouter 5131 - fixup iter priv strict aliasing while preserving size of sockaddr. 5132 - iana portlist updated. (one less port allocated, one more fraction 5133 of a bit for security!) 5134 - updated fedora specfile in contrib from Paul Wouters. 5135 513619 June 2009: Wouter 5137 - Fixup strict aliasing warning in iter priv code. 5138 and config_file code. 5139 - iana portlist updated. 5140 - harden-referral-path: handle cases where NS is in answer section. 5141 514218 June 2009: Wouter 5143 - Fix of message parse bug where (specifically) an NSEC and RRSIG 5144 in the wrong order would be parsed, but put wrongly into internal 5145 structures so that later validation would fail. 5146 - Extreme lenience for wrongly truncated replies where a positive 5147 reply has an NS in the authority but no signatures. They are 5148 turned into minimal responses with only the (secure) answer. 5149 - autoconf 2.63 for configure. 5150 - python warnings suppress. Keep python API away from header files. 5151 515217 June 2009: Wouter 5153 - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was 5154 used for the python code in unbound. (http://www.nic.cz/vip/ in cz). 5155 515616 June 2009: Wouter 5157 - Fixup opportunistic target query generation to it does not 5158 generate queries that are known to fail. 5159 - Touchup on munin total memory report. 5160 - messages picked out of the cache by the iterator are checked 5161 if their cname chain is still correct and if validation status 5162 has to be reexamined. 5163 516415 June 2009: Wouter 5165 - iana portlist updated. 5166 516714 June 2009: Wouter 5168 - Fixed bug where cached responses would lose their security 5169 status on second validation, which especially impacted dlv 5170 lookups. Reported by Hauke Lampe. 5171 517213 June 2009: Wouter 5173 - bug #254. removed random whitespace from example.conf. 5174 517512 June 2009: Wouter 5176 - Fixup potential wrong NSEC picked out of the cache. 5177 - If unfulfilled callbacks are deleted they are called with an error. 5178 - fptr wlist checks for mesh callbacks. 5179 - fwd above stub in configuration works. 5180 518111 June 2009: Wouter 5182 - Fix queries for type DS when forward or stub zones are there. 5183 They are performed to higherup domains, and thus treated as if 5184 going to higher zones when looking up the right forward or stub 5185 server. This makes a stub pointing to a local server that has 5186 a local view of example.com signed with the same keys as are 5187 publicly used work. Reported by Johan Ihren. 5188 - Added build-unbound-localzone-from-hosts.pl to contrib, from 5189 Dennis DeDonatis. It converts /etc/hosts into config statements. 5190 - same thing fixed for forward-zone and DS, chain of trust from 5191 public internet into the forward-zone works now. Added unit test. 5192 51939 June 2009: Wouter 5194 - openssl key files are opened apache-style, when user is root and 5195 before chrooting. This makes permissions on remote-control key 5196 files easier to set up. Fixes bug #251. 5197 - flush_type and flush_name remove msg cache entries. 5198 - codereview - dp copy bogus setting fix. 5199 52008 June 2009: Wouter 5201 - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause 5202 inadvertant behaviour. 5203 - 1.3.0 tarball for release created. 5204 - 1.3.1 development in svn trunk. 5205 - iana portlist updated. 5206 - fix lint from complaining on ldns/sha.h. 5207 - help compiler figure out aliasing in priv_rrset_bad() routine. 5208 - fail to configure with python if swig is not found. 5209 - unbound_munin_ in contrib uses ps to show rss if sbrk does not work. 5210 52113 June 2009: Wouter 5212 - fixup bad free() when wrongly encoded DSA signature is seen. 5213 Reported by Paul Wouters. 5214 - review comments from Matthijs. 5215 52162 June 2009: Wouter 5217 - --enable-sha2 option. The draft rsasha256 changed its algorithm 5218 numbers too often. Therefore it is more prudent to disable the 5219 RSASHA256 and RSASHA512 support by default. 5220 - ldns trunk included as new tarball. 5221 - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point. 5222 522329 May 2009: Wouter 5224 - fixup doc bug in README reported by Matthew Dempsky. 5225 522628 May 2009: Wouter 5227 - update iana port list 5228 - update ldns lib tarball 5229 523027 May 2009: Wouter 5231 - detect lack of IPv6 support on XP (with a different error code). 5232 - Fixup a crash-on-exit which was triggered by a very long queue. 5233 Unbound would try to re-use ports that came free, but this is 5234 of course not really possible because everything is deleted. 5235 Most easily triggered on XP (not Vista), maybe because of the 5236 network stack encouraging large messages backlogs. 5237 - change in debug statements. 5238 - Fixed bug that could cause a crash if root prime failed when there 5239 were message backlogs. 5240 524126 May 2009: Wouter 5242 - Thanks again to Brett Carr, found an assertion that was not true. 5243 Assertion checked if recursion parent query still existed. 5244 524529 April 2009: Wouter 5246 - Thanks to Brett Carr, caught windows resource leak, use 5247 closesocket() and not close() on sockets or else the network stack 5248 starts to leak handles. 5249 - Removed usage of windows Mutex because windows cannot handle enough 5250 mutexes open. Provide own mutex implementation using primitives. 5251 525228 April 2009: Wouter 5253 - created svn tag for 1.3.0. 5254 525527 April 2009: Wouter 5256 - optimised cname from cache. 5257 - ifdef windows functions in testbound. 5258 525923 April 2009: Wouter 5260 - fix for threadsafety in solaris thr_key_create() in tests. 5261 - iana portlist updated. 5262 - fix pylib test for Darwin. 5263 - fix pymod test for Darwin and a python threading bug in pymod init. 5264 - check python >= 2.4 in configure. 5265 - -ldl check for libcrypto 1.0.0beta. 5266 526721 April 2009: Wouter 5268 - fix for build outside sourcedir. 5269 - fix for configure script swig detection. 5270 527117 April 2009: Wouter 5272 - Fix reentrant in minievent handler for unix. Could have resulted 5273 in spurious event callbacks. 5274 - timers do not take up a fd slot for winsock handler. 5275 - faster fix for winsock reentrant check. 5276 - fix rsasha512 unit test for new (interim) algorithm number. 5277 - fix test:ldns doesn't like DOS line endings in keyfiles on unix. 5278 - fix compile warning on ubuntu (configlexer fwrite return value). 5279 - move python include directives into CPPFLAGS instead of CFLAGS. 5280 528116 April 2009: Wouter 5282 - winsock event handler exit very quickly on signal, even if 5283 under heavy load. 5284 - iana portlist updated. 5285 - fixup windows winsock handler reentrant problem. 5286 528714 April 2009: Wouter 5288 - bug #245: fix munin plugin, perform cleanup of stale lockfiles. 5289 - makedist.sh; better help text. 5290 - cache-min-ttl option and tests. 5291 - mingw detect error condition on TCP sockets (NOTCONN). 5292 52939 April 2009: Wouter 5294 - Fix for removal of RSASHA256_NSEC3 protonumber from ldns. 5295 - ldns tarball updated. 5296 - iana portlist update. 5297 - detect GOST support in openssl-1.0.0-beta1, and fix compile problem 5298 because that openssl defines the name STRING for itself. 5299 53006 April 2009: Wouter 5301 - windows compile fix. 5302 - Detect FreeBSD jail without ipv6 addresses assigned. 5303 - python libunbound wrapper unit test. 5304 - installs the following files. Default is to not build them. 5305 from configure --with-pythonmodule: 5306 /usr/lib/python2.x/site-packages/unboundmodule.py 5307 from configure --with-pyunbound: 5308 /usr/lib/python2.x/site-packages/unbound.py 5309 /usr/lib/python2.x/site-packages/_unbound.so* 5310 The example python scripts (pythonmod/examples and 5311 libunbound/python/examples) are not installed. 5312 - python invalidate routine respects packed rrset ids and locks. 5313 - clock skew checks in unbound, config statements. 5314 - nxdomain ttl considerations in requirements.txt 5315 53163 April 2009: Wouter 5317 - Fixed a bug that caused messages to be stored in the cache too 5318 long. Hard to trigger, but NXDOMAINs for nameservers or CNAME 5319 targets have been more vulnerable to the TTL miscalculation bug. 5320 - documentation test fixed for python addition. 5321 53222 April 2009: Wouter 5323 - pyunbound (libunbound python plugin) compiles using libtool. 5324 - documentation for pythonmod and pyunbound is generated in doc/html. 5325 - iana portlist updated. 5326 - fixed bug in unbound-control flush_zone where it would not flush 5327 every message in the target domain. This especially impacted 5328 NXDOMAIN messages which could remain in the cache regardless. 5329 - python module test package. 5330 53311 April 2009: Wouter 5332 - suppress errors when trying to contact authority servers that gave 5333 ipv6 AAAA records for their nameservers with ipv4 mapped contents. 5334 Still tries to do so, could work when deployed in intranet. 5335 Higher verbosity shows the error. 5336 - new libunbound calls documented. 5337 - pyunbound in libunbound/python. Removed compile warnings. 5338 Makefile to make it. 5339 534030 March 2009: Wouter 5341 - Fixup LDFLAGS from libevent sourcedir compile configure restore. 5342 - Fixup so no non-absolute rpaths are added. 5343 - Fixup validation of RRSIG queries, they are let through. 5344 - read /dev/random before chroot 5345 - checkconf fix no python checks when no python module enabled. 5346 - fix configure, pthread first, so other libs do not change outcome. 5347 534827 March 2009: Wouter 5349 - nicer -h output. report linked libraries and modules. 5350 - prints modules in intuitive order (config file friendly). 5351 - python compiles easily on BSD. 5352 535326 March 2009: Wouter 5354 - ignore swig varargs warnings with gcc. 5355 - remove duplicate example.conf text from python example configs. 5356 - outofdir compile fix for python. 5357 - pyunbound works. 5358 - print modules compiled in on -h. manpage. 5359 536025 March 2009: Wouter 5361 - initial import of the python contribution from Zdenek Vasicek and 5362 Marek Vavrusa. 5363 - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0. 5364 536524 March 2009: Wouter 5366 - more neat configure.ac. Removed duplicate config.h includes. 5367 - neater config.h.in. 5368 - iana portlist updated. 5369 - fix util/configlexer.c and solaris -std=c99 flag. 5370 - fix postcommit aclocal errors. 5371 - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R. 5372 - swap order of host detect and libtool generation. 5373 537423 March 2009: Wouter 5375 - added launchd plist example file for MacOSX to contrib. 5376 - deprecation test for daemon(3). 5377 - moved common configure actions to m4 include, prettier Makefile. 5378 537920 March 2009: Wouter 5380 - bug #239: module-config entries order is important. Documented. 5381 - build fix for test asynclook. 5382 538319 March 2009: Wouter 5384 - winrc/README.txt dos-format text file. 5385 - iana portlist updated. 5386 - use _beginthreadex() when available (performs stack alignment). 5387 - defaults for windows baked into configure.ac (used if on mingw). 5388 538918 March 2009: Wouter 5390 - Added tests, unknown algorithms become insecure. fallback works. 5391 - Fix for and test for unknown algorithms in a trust anchor 5392 definition. Trust anchors with no supported algos are ignored. 5393 This means a (higher)DS or DLV entry for them could succeed, and 5394 otherwise they are treated as insecure. 5395 - domain-insecure: "example.com" statement added. Sets domain 5396 insecure regardless of chain of trust DSs or DLVs. The inverse 5397 of a trust-anchor. 5398 539917 March 2009: Wouter 5400 - unit test for unsupported algorithm in anchor warning. 5401 - fixed so queries do not fail on opportunistic target queries. 5402 540316 March 2009: Wouter 5404 - fixup diff error printout in contrib/update-itar.sh. 5405 - added contrib/unbound_cacti for statistics support in cacti, 5406 contributed by Dmitriy Demidov. 5407 540813 March 2009: Wouter 5409 - doxygen and lex/yacc on linux. 5410 - strip update-anchor on makedist -w. 5411 - fix testbound on windows. 5412 - default log to syslog for windows. 5413 - uninstaller can stop unbound - changed text on it to reflect that. 5414 - remove debugging from windows 'cron' actions. 5415 541612 March 2009: Wouter 5417 - log to App.logs on windows prints executable identity. 5418 - fixup tests. 5419 - munin plugin fix benign locking error printout. 5420 - anchor-update for windows, called every 24 hours; unbound reloads. 5421 542211 March 2009: Wouter 5423 - winsock event handler resets WSAevents after signalled. 5424 - winsock event handler tests if signals are really signalled. 5425 - install and service with log to file works on XP and Vista on 5426 default install location. 5427 - on windows logging to the Application logbook works (as a service). 5428 - fix RUN_DIR on windows compile setting in makedist. 5429 - windows registry has Software\Unbound\ConfigFile element. 5430 If does not exist, the default is used. The -c switch overrides it. 5431 - fix makedist version cleanup function. 5432 543310 March 2009: Wouter 5434 - makedist -w strips out old rc.. and snapshot info from version. 5435 - setup.exe starts and stops unbound after install, before uninstall. 5436 - unbound-checkconf recognizes absolute pathnames on windows (C:...). 5437 54389 March 2009: Wouter 5439 - Nullsoft NSIS installer creation script. 5440 54415 March 2009: Wouter 5442 - fixup memory leak introduced on 18feb in mesh reentrant fix. 5443 54443 March 2009: Wouter 5445 - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8). 5446 - service works on xp/vista, no config necessary (using defaults). 5447 - windows registry settings. 5448 54492 March 2009: Wouter 5450 - fixup --export-symbols to be -export-symbls for libtool. 5451 This should fix extraneous symbols exported from libunbound. 5452 Thanks to Ondrej Sury and Robert Edmonds for finding it. 5453 - iana portlist updated. 5454 - document FAQ entry on stub/forward zones and default blocking. 5455 - fix asynclook test app for libunbound not exporting symbols. 5456 - service install and remove utils that work with vista UAC. 5457 545827 February 2009: Wouter 5459 - Fixup lexer, to not give warnings about fwrite. Appeared in 5460 new lexer features. 5461 - makedistro functionality for mingw. Has RC support. 5462 - support spaces and backslashes in configured defaults paths. 5463 - register, deregister in service control manager. 5464 546525 February 2009: Wouter 5466 - windres usage for application resources. 5467 546824 February 2009: Wouter 5469 - isc moved their dlv key download location. 5470 - fixup warning on vista/mingw. 5471 - makedist -w for window zip distribution first version. 5472 547320 February 2009: Wouter 5474 - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped. 5475 Nicer script layout. Added url to site in -h output. 5476 547719 February 2009: Wouter 5478 - unbound-checkconf and unbound print warnings when trust anchors 5479 have unsupported algorithms. 5480 - added contrib/update-itar.sh This script is similar to 5481 update-anchor.sh, and updates from the IANA ITAR repository. 5482 You can provide your own PGP key and trust repo, or can use the 5483 builtin. The program uses wget and gpg to work. 5484 - iana portlist updated. 5485 - update-itar.sh: using ftp:// urls because https godaddy certificate 5486 is not available everywhere and then gives fatal errors. The 5487 security is provided by pgp signature. 5488 548918 February 2009: Wouter 5490 - more cycle detection. Also for target queries. 5491 - fixup bug where during deletion of the mesh queries the callbacks 5492 that were reentrant caused assertion failures. Keep the mesh in 5493 a reentrant safe state. Affects libunbound, reload of server, 5494 on quit and flush_requestlist. 5495 - iana portlist updated. 5496 549713 February 2009: Wouter 5498 - forwarder information now per-thread duplicated. 5499 This keeps it read only for speed, with no locking necessary. 5500 - forward command for unbound control to change forwarders to use 5501 on the fly. 5502 - document that unbound-host reads no config file by default. 5503 - updated iana portlist. 5504 550512 February 2009: Wouter 5506 - call setusercontext if available (on BSD). 5507 - small refactor of stats clearing. 5508 - #227: flush_stats feature for unbound-control. 5509 - stats_noreset feature for unbound-control. 5510 - flush_requestlist feature for unbound-control. 5511 - libunbound version upped API (was changed 5 feb). 5512 - unbound-control status shows if root forwarding is in use. 5513 - slightly nicer memory management in iter-fwd code. 5514 551510 February 2009: Wouter 5516 - keys with rfc5011 REVOKE flag are skipped and not considered when 5517 validating data. 5518 - iana portlist updated 5519 - #226: dump_requestlist feature for unbound-control. 5520 55216 February 2009: Wouter 5522 - contrib contains specfile for fedora 1.2.1 (from Paul Wouters). 5523 - iana portlist updated. 5524 - fixup EOL in include directive (reported by Paul Wouters). 5525 You can no longer specify newlines in the names of included files. 5526 - config parser changed. Gives some syntax errors closer to where they 5527 occurred. Does not enforce a space after keyword anymore. 5528 Does not allow literal newlines inside quoted strings anymore. 5529 - verbosity level 5 logs customer IP for new requestlist entries. 5530 - test fix, lexer and cancel test. 5531 - new option log-time-ascii: yes if you enable it prints timestamps 5532 in the log file as Feb 06 13:45:26 (like syslog does). 5533 - detect event_base_new in libevent-1.4.1 and later and use it. 5534 - #231 unbound-checkconf -o option prints that value from config file. 5535 Useful for scripting in management scripts and the like. 5536 55375 February 2009: Wouter 5538 - ldns 1.5.0 rc as tarball included. 5539 - 1.3.0 development continues: 5540 change in libunbound API: ub_cancel can return an error, that 5541 the async_id did not exist, or that it was already delivered. 5542 The result could have been delivered just before the cancel 5543 routine managed to acquire the lock, so a caller may get the 5544 result at the same time they call cancel. For this case, 5545 ub_cancel tries to return an error code. 5546 Fixes race condition in ub_cancel() libunbound function. 5547 - MacOSX Leopard cleaner text output from configure. 5548 - initgroups(3) is called to drop secondary group permissions, if 5549 applicable. 5550 - configure option --with-ldns-builtin forces the use of the 5551 inluded ldns package with the unbound source. The -I include 5552 is put before the others, so it avoids bad include files from 5553 an older ldns install. 5554 - daemon(3) posix call is used when available. 5555 - testbound test for older fix added. 5556 55574 February 2009: Wouter 5558 - tag for release 1.2.1. 5559 - trunk setup for 1.3.0 development. 5560 55613 February 2009: Wouter 5562 - noted feature requests in doc/TODO. 5563 - printout more detailed errors on ssl certificate loading failures. 5564 - updated IANA portlist. 5565 556616 January 2009: Wouter 5567 - more quiet about ipv6 network failures, i.e. when ipv6 is not 5568 available (network unreachable). Debug still printed on high 5569 verbosity. 5570 - unbound-host -4 and -6 options. Stops annoying ipv6 errors when 5571 debugging with unbound-host -4 -d ... 5572 - more cycle detection for NS-check, addr-check, root-prime and 5573 stub-prime queries in the iterator. Avoids possible deadlock 5574 when priming fails. 5575 557615 January 2009: Wouter 5577 - bug #229: fixup configure checks for compilation with Solaris 5578 Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc 5579 - fixup suncc warnings. 5580 - fix bug where unbound could crash using libevent 1.3 and older. 5581 - update testset for recent retry change. 5582 558314 January 2009: Wouter 5584 - 1.2.1 feature: negative caching for failed queries. 5585 Queries that failed are cached for 5 seconds (NORR_TTL). 5586 If the failure is local, like out of memory, it is not cached. 5587 - the TTL comparison for the cache used different comparisons, 5588 causing many cache responses that used the iterator and validator 5589 state machines unnecessarily. 5590 - retry from 4 to 5 so that EDNS drop retry is part of the first 5591 query resolve attempt, and cached error does not stop EDNS fallback. 5592 - remove debug prints that protect against bad referrals. 5593 - honor QUIET=no on make commandline (or QUIET=yes ). 5594 559513 January 2009: Wouter 5596 - fixed bug in lameness marking, removed printouts. 5597 - find NS rrset more cleanly for qtype NS. 5598 - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for 5599 reporting and logs. 5600 - 1.2.1 feature: stops resolving AAAAs promiscuously when they 5601 are in the negative cache. 5602 560312 January 2009: Wouter 5604 - fixed bug in infrastructure lameness cache, did not lowercase 5605 name of zone to hash when setting lame. 5606 - lameness debugging printouts. 5607 56089 January 2009: Wouter 5609 - created svn tag for 1.2.0 release. 5610 - svn trunk contains 1.2.1 version number. 5611 - iana portlist updated for todays list. 5612 - removed debug print. 5613 56148 January 2009: Wouter 5615 - new version of ldns-trunk (today) included as tarball, fixed 5616 bug #224, building with -j race condition. 5617 - remove possible race condition in the test for race conditions. 5618 56197 January 2009: Wouter 5620 - version 1.2.0 in preparation. 5621 - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file 5622 statements. (Adapted from patch by Paul Wouters). 5623 - typo fix and iana portlist updated. 5624 - porting testsuite; unused var warning, and type fixup. 5625 56266 January 2009: Wouter 5627 - fixup packet-of-death when compiled with --enable-debug. 5628 A malformed packet could cause an internal assertion failure. 5629 - added test for HINFO canonicalisation behaviour. 5630 - fixup reported problem with transparent local-zone data where 5631 queries with different type could get nxdomain. Now queries 5632 with a different name get resolved normally, with different type 5633 get a correct NOERROR/NODATA answer. 5634 - HINFO no longer downcased for validation, making unbound compatible 5635 with bind and ldns. 5636 - fix reading included config files when chrooted. 5637 Give full path names for include files. 5638 Relative path names work if the start dir equals the working dir. 5639 - fix libunbound message transport when no packet buffer is available. 5640 56415 January 2009: Wouter 5642 - fixup getaddrinfo failure handling for remote control port. 5643 - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints. 5644 - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/ 5645 - comm_timer_set performs base_set operation after event_add. 5646 564718 December 2008: Wouter 5648 - fixed bug reported by Duane Wessels: error in DLV lookup, would make 5649 some zones that had correct DLV keys as insecure. 5650 - follows -rc makedist from ldns changes (no _rc). 5651 - ldns tarball updated with 1.4.1rc for DLV unit test. 5652 - verbose prints about recursion lame detection and server selection. 5653 - fixup BSD port for infra host storage. It hashed wrongly. 5654 - fixup makedist snapshot name generation. 5655 - do not reopen syslog to avoid dev/log dependency. 5656 565717 December 2008: Wouter 5658 - follows ldns makedist.sh. -rc option. autom4te dir removed. 5659 - unbound-control status command. 5660 - extended statistics has a number of ipv6 queries counter. 5661 contrib/unbound_munin_ was updated to draw ipv6 in the hits graph. 5662 566316 December 2008: Wouter 5664 - follow makedist improvements from ldns, for maintainers prereleases. 5665 - snapshot version uses _ not - to help rpm distinguish the 5666 version number. 5667 566811 December 2008: Wouter 5669 - better fix for bug #219: use LOG_NDELAY with openlog() call. 5670 Thanks to Tamas Tevesz. 5671 56729 December 2008: Wouter 5673 - bug #221 fixed: unbound checkconf checks if key files exist if 5674 remote control is enabled. Also fixed NULL printf when not chrooted. 5675 - iana portlist updated. 5676 56773 December 2008: Wouter 5678 - Fix problem reported by Jaco Engelbrecht where unbound-control stats 5679 freezes up unbound if this was compiled without threading, and 5680 was using multiple processes. 5681 - iana portlist updated. 5682 - test for remote control with interprocess communication. 5683 - created command distribution mechanism so that remote control 5684 commands other than 'stats' work on all processes in a nonthreaded 5685 compiled version. dump/load cache work, on the first process. 5686 - fixup remote control local_data addition memory corruption bug. 5687 56881 December 2008: Wouter 5689 - SElinux policy files in contrib/selinux for the unbound daemon, 5690 by Paul Wouters and Adam Tkac. 5691 569225 November 2008: Wouter 5693 - configure complains when --without-ssl is given (bug #220). 5694 - skip unsupported feature tests on vista/mingw. 5695 - fixup testcode/streamtcp to work on vista/mingw. 5696 - root-hints test checks version of dig required. 5697 - blacklisted servers are polled at a low rate (1%) to see if they 5698 come back up. But not if there is some other working server. 5699 570024 November 2008: Wouter 5701 - document that the user of the server daemon needs read privileges 5702 on the keys and certificates generated by unbound-control-setup. 5703 This is different per system or distribution, usually, running the 5704 script under the same username as the server uses suffices. 5705 i.e. sudo -u unbound unbound-control-setup 5706 - testset port to vista/mingw. 5707 - tcp_sigpipe to freebsd port. 5708 570921 November 2008: Wouter 5710 - fixed tcp accept, errors were printed when they should not. 5711 - unbound-control-setup.sh removes read/write permissions other 5712 from the keys it creates (as suggested by Dmitriy Demidov). 5713 571420 November 2008: Wouter 5715 - fixup fatal error due to faulty error checking after tcp accept. 5716 - add check in rlimit to avoid integer underflow. 5717 - rlimit check with new formula; better estimate for number interfaces 5718 - nicer comments in rlimit check. 5719 - tag 1.1.1 created in svn. 5720 - trunk label is 1.1.2 5721 572219 November 2008: Wouter 5723 - bug #219: fixed so that syslog which delays opening until the first 5724 log line is written, gets a log line while not chroot'ed yet. 5725 572618 November 2008: Wouter 5727 - iana portlist updated. 5728 - removed cast in unit test debug print that was not 64bit safe. 5729 - trunk back to 1.1.0; copied to tags 1.1.0 release. 5730 - trunk to has version number 1.1.1 again. 5731 - in 1.1.1; make clean nicer. grammar in manpage. 5732 573317 November 2008: Wouter 5734 - theoretical fix for problems reported on mailing list. 5735 If a delegation point has no A but only AAAA and do-ip6 is no, 5736 resolution would fail. Fixed to ask for the A and AAAA records. 5737 It has to ask for both always, so that it can fail quietly, from 5738 TLD perspective, when a zone is only reachable on one transport. 5739 - test for above, only AAAA and doip6 is no. Fix causes A record 5740 for nameserver to be fetched. 5741 - fixup address duplication on cache fillup for delegation points. 5742 - testset updated for new query answer requirements. 5743 574414 November 2008: Wouter 5745 - created 1.1.0 release tag in svn. 5746 - trunk moved to 1.1.1 5747 - fixup unittest-neg for locking. 5748 574913 November 2008: Wouter 5750 - added fedora init and specfile to contrib (by Paul Wouters). 5751 - added configure check for ldns 1.4.0 (using its compat funcs). 5752 - neater comments in worker.h. 5753 - removed doc/plan and updated doc/TODO. 5754 - silenced EHOSTDOWN (verbosity 2 or higher to see it). 5755 - review comments from Jelte, Matthijs. Neater code. 5756 575712 November 2008: Wouter 5758 - add unbound-control manpage to makedist replace list. 5759 576011 November 2008: Wouter 5761 - unit test for negative cache, stress tests the refcounting. 5762 - fix for refcounting error that could cause fptr_wlist fatal exit 5763 in the negative cache rbtree (upcoming 1.1 feature). (Thanks to 5764 Attila Nagy for testing). 5765 - nicer comments in cachedump about failed RR to string conversion. 5766 - fix 32bit wrap around when printing large (4G and more) mem usage 5767 for extended statistics. 5768 576910 November 2008: Wouter 5770 - fixup the getaddrinfo compat code rename. 5771 57728 November 2008: Wouter 5773 - added configure check for eee build warning. 5774 57757 November 2008: Wouter 5776 - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4. 5777 - detect nonblocking problems in network stack in configure script. 5778 57796 November 2008: Wouter 5780 - dname_priv must decompress the name before comparison. 5781 - iana portlist updated. 5782 57835 November 2008: Wouter 5784 - fixed possible memory leak in key_entry_key deletion. 5785 Would leak a couple bytes when trust anchors were replaced. 5786 - if query and reply qname overlap, the bytes are skipped not copied. 5787 - fixed file descriptor leak when messages were jostled out that 5788 had outstanding (TCP) replies. 5789 - DNAMEs used from cache have their synthesized CNAMEs initialized 5790 properly. 5791 - fixed file descriptor leak for localzone type deny (for TCP). 5792 - fixed memleak at exit for nsec3 negative cached zones. 5793 - fixed memleak for the keyword 'nodefault' when reading config. 5794 - made verbosity of 'edns incapable peer' warning higher, so you 5795 do not get spammed by it. 5796 - caught elusive Bad file descriptor error bug, that would print the 5797 error while unnecessarily try to listen to a closed fd. Fixed. 5798 57994 November 2008: Wouter 5800 - fixed -Wwrite-strings warnings that result in better code. 5801 58023 November 2008: Wouter 5803 - fixup build process for Mac OSX linker, use ldns b32 compat funcs. 5804 - generated configure with autoconf-2.61. 5805 - iana portlist updated. 5806 - detect if libssl needs libdl. For static linking with libssl. 5807 - changed to use new algorithm identifiers for sha256/sha512 5808 from ldns 1.4.0 (need very latest version). 5809 - updated the included ldns tarball. 5810 - proper detection of SHA256 and SHA512 functions (not just sizes). 5811 581223 October 2008: Wouter 5813 - a little more debug info for failure on signer names. prints names. 5814 581522 October 2008: Wouter 5816 - CFLAGS are picked up by configure from the environment. 5817 - iana portlist updated. 5818 - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too. 5819 - new stub-prime: yesno option. Default is off, so it does not prime. 5820 can be turned on to get same behaviour as previous unbound release. 5821 - made automated test that checks if builtin root hints are uptodate. 5822 - finished draft-wijngaards-dnsext-resolver-side-mitigation 5823 implementation. The unwanted-reply-threshold can be set. 5824 - fixup so fptr_whitelist test in alloc.c works. 5825 582621 October 2008: Wouter 5827 - fix update-anchors.sh, so it does not report different RR order 5828 as an update. Sorts the keys in the file. Updated copyright. 5829 - fixup testbound on windows, the command control pipe doesn't exist. 5830 - skip 08hostlib test on windows, no fork() available. 5831 - made unbound-remote work on windows. 5832 583320 October 2008: Wouter 5834 - quench a log message that is debug only. 5835 - iana portlist updated. 5836 - do not query bogus nameservers. It is like nameservers that have 5837 the NS or A or AAAA record bogus are listed as donotquery. 5838 - if server selection is faced with only bad choices, it will 5839 attempt to get more options to be fetched. 5840 - changed bogus-ttl default value from 900 to 60 seconds. 5841 In anticipation that operator caused failures are more likely than 5842 actual attacks at this time. And thus repeated validation helps 5843 the operators get the problem fixed sooner. It makes validation 5844 failures go away sooner (60 seconds after the zone is fixed). 5845 Also it is likely to try different nameserver targets every minute, 5846 so that if a zone is bad on one server but not another, it is 5847 likely to pick up the 'correct' one after a couple minutes, 5848 and if the TTL is big enough that solves validation for the zone. 5849 - fixup unbound-control compilation on windows. 5850 585117 October 2008: Wouter 5852 - port Leopard/G5: fixup type conversion size_t/uint32. 5853 please ranlib, stop file without symbols warning. 5854 - harden referral path now also validates the root after priming. 5855 It looks up the root NS authoritatively as well as the root servers 5856 and attemps to validate the entries. 5857 585816 October 2008: Wouter 5859 - Fixup negative TTL values appearing (reported by Attila Nagy). 5860 586115 October 2008: Wouter 5862 - better documentation for 0x20; remove fallback TODO, it is done. 5863 - harden-referral-path feature includes A, AAAA queries for glue, 5864 as well as very careful NS caching (only when doing NS query). 5865 A, AAAA use the delegation from the NS-query. 5866 586714 October 2008: Wouter 5868 - fwd_three.tpkg test was flaky. If the three requests hit the 5869 wrong threads by chance (or bad OS) then the test would fail. 5870 Made less flaky by increasing number of retries. 5871 - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs. 5872 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014). 5873 Which includes the ldns_dname_absolute fix. 5874 - fwd_three test remains flaky now that unbound does not stop 5875 listening when full. Thus, removed timeout problem. 5876 It may be serviced by three threads, or maybe by one. 5877 Mostly only useful for lock-check testing now. 5878 587913 October 2008: Wouter 5880 - fixed recursion servers deployed as authoritative detection, so 5881 that as a last resort, a +RD query is sent there to get the 5882 correct answer. 5883 - iana port list update. 5884 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013). 5885 588610 October 2008: Wouter 5887 - fixup tests - the negative cache contained the correct NSEC3s for 5888 two tests that are supposed to fail to validate. 5889 58909 October 2008: Wouter 5891 - negative cache caps max iterations of NSEC3 done. 5892 - NSEC3 negative cache for qtype DS works. 5893 58948 October 2008: Wouter 5895 - NSEC negative cache for DS. 5896 58976 October 2008: Wouter 5898 - jostle-timeout option, so you can config for slow links. 5899 - 0x20 fallback code. Tries 3xnumber of nameserver addresses 5900 queries that must all be the same. Sent to random nameservers. 5901 - documented choices for DoS, EDNS, 0x20. 5902 59032 October 2008: Wouter 5904 - fixup unlink of pidfile. 5905 - fixup SHA256 algorithm collation code. 5906 - contrib/update-anchor.sh does not overwrite anchors if not needed. 5907 exits 0 when a restart is needed, other values if not. 5908 so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart 5909 can restart unbound exactly when needed. 5910 591130 September 2008: Wouter 5912 - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1. 5913 - tests for sha256 support and downgrade resistance. 5914 - RSASHA256 and RSASHA512 support (using the draft in dnsext), 5915 using the drafted protocol numbers. 5916 - when using stub on localhost (127.0.0.1@10053) unbound works. 5917 Like when running NSD to host a local zone, on the same machine. 5918 The noprime feature. manpages more explanation. Added a test for it. 5919 - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com" 5920 592129 September 2008: Wouter 5922 - EDNS lameness detection, if EDNS packets are dropped this is 5923 detected, eventually. 5924 - multiple query timeout rtt backoff does not backoff too much. 5925 592626 September 2008: Wouter 5927 - tests for remote-control. 5928 - small memory leak in exception during remote control fixed. 5929 - fixup for lock checking but not unchecking in remote control. 5930 - iana portlist updated. 5931 593223 September 2008: Wouter 5933 - Msg cache is loaded. A cache load enables cache responses. 5934 - unbound-control flush [name], flush_type and flush_zone. 5935 593622 September 2008: Wouter 5937 - dump_cache and load_cache statements in unbound-control. 5938 RRsets are dumped and loaded correctly. 5939 Msg cache is dumped. 5940 594119 September 2008: Wouter 5942 - locking on the localdata structure. 5943 - add and remove local zone and data with unbound-control. 5944 - ldns trunk snapshot updated, make tests work again. 5945 594618 September 2008: Wouter 5947 - fixup error in time calculation. 5948 - munin plugin improvements. 5949 - nicer abbreviations for high query types values (ixfr, axfr, any...) 5950 - documented the statistics output in unbound-control man page. 5951 - extended statistics prints out histogram, over unbound-control. 5952 595317 September 2008: Wouter 5954 - locking for threadsafe bogus rrset counter. 5955 - ldns trunk no longer exports b32 functions, provide compat. 5956 - ldns tarball updated. 5957 - testcode/ldns-testpkts.c const fixups. 5958 - fixed rcode stat printout. 5959 - munin plugin in contrib. 5960 - stats always printout uptime, because stats plugins need it. 5961 596216 September 2008: Wouter 5963 - extended-statistics: yesno config option. 5964 - unwanted replies spoof nearmiss detector. 5965 - iana portlist updated. 5966 596715 September 2008: Wouter 5968 - working start, stop, reload commands for unbound-control. 5969 - test for unbound-control working; better exit value for control. 5970 - verbosity control via unbound-control. 5971 - unbound-control stats. 5972 597312 September 2008: Wouter 5974 - removed browser control mentions. Proto speccy. 5975 597611 September 2008: Wouter 5977 - set nonblocking on new TCP streams, because linux does not inherit 5978 the socket options to the accepted socket. 5979 - fix TCP timeouts. 5980 - SSL protected connection between server and unbound-control. 5981 598210 September 2008: Wouter 5983 - remove memleak in privacy addresses on reloads and quits. 5984 - remote control work. 5985 59869 September 2008: Wouter 5987 - smallapp/unbound-control-setup.sh script to set up certificates. 5988 59894 September 2008: Wouter 5990 - scrubber scrubs away private addresses. 5991 - test for private addresses. man page entry. 5992 - code refactored for name and address tree lookups. 5993 59943 September 2008: Wouter 5995 - options for 'DNS Rebinding' protection: private-address and 5996 private-domain. 5997 - dnstree for reuse of routines that help with domain, addr lookups. 5998 - private-address and private-domain config option read, stored. 5999 60002 September 2008: Wouter 6001 - DoS protection features. Queries are jostled out to make room. 6002 - testbound can pass time, increasing the internal timer. 6003 - do not mark unsigned additionals bogus, leave unchecked, which 6004 is removed too. 6005 60061 September 2008: Wouter 6007 - disallow nonrecursive queries for cache snooping by default. 6008 You can allow is using access-control: <subnet> allow_snoop. 6009 The defaults do allow access no authoritative data without RD bit. 6010 - two tests for it and fixups of tests for nonrec refused. 6011 601229 August 2008: Wouter 6013 - version 1.1 number in trunk. 6014 - harden-referral-path option for query for NS records. 6015 Default turns off expensive, experimental option. 6016 601728 August 2008: Wouter 6018 - fixup logfile handling; it is created with correct permissions 6019 again. (from bugfix#199). 6020 Some errors are not written to logfile (pidfile writing, forking), 6021 and these are only visible by using the -d commandline flag. 6022 602327 August 2008: Wouter 6024 - daemon(3) is causing problems for people. Reverting the patch. 6025 bug#200, and 199 and 203 contain sideline discussion on it. 6026 - bug#199 fixed: pidfile can be outside chroot. openlog is done before 6027 chroot and drop permissions. 6028 - config option to set size of aggressive negative cache, 6029 neg-cache-size. 6030 - bug#203 fixed: dlv has been implemented. 6031 603226 August 2008: Wouter 6033 - test for insecure zone when DLV is in use, also does negative cache. 6034 - test for trustanchor when DLV is in use (the anchor works). 6035 - test for DLV used for a zone below a trustanchor. 6036 - added scrub filter for overreaching NSEC records and unit test. 6037 - iana portlist update 6038 - use of setresuid or setreuid when available. 6039 - use daemon(3) if available. 6040 604125 August 2008: Wouter 6042 - realclean patch from Robert Edmonds. 6043 604422 August 2008: Wouter 6045 - nicer debuglogging of DLV. 6046 - test with secure delegation inside the DLV repository. 6047 604821 August 2008: Wouter 6049 - negative cache code linked into validator, for DLV use. 6050 negative cache works for DLV. 6051 - iana portlist update. 6052 - dlv-anchor option for unit tests. 6053 - fixup NSEC_AT_APEX classification for short typemaps. 6054 - ldns-testns has subdomain checks, for unit tests. 6055 605620 August 2008: Wouter 6057 - negative cache code, reviewed. 6058 605918 August 2008: Wouter 6060 - changes info: in logfile to notice: info: or debug: depending on 6061 the verbosity of the statements. Better logfile message 6062 classification. 6063 - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd. 6064 606515 August 2008: Wouter 6066 - DLV nsec code fixed for better detection of closest existing 6067 enclosers from NSEC responses. 6068 - DLV works, straight to the dlv repository, so not for production. 6069 - Iana port update. 6070 607114 August 2008: Wouter 6072 - synthesize DLV messages from the rrset cache, like done for DS. 6073 607413 August 2008: Wouter 6075 - bug #203: nicer do-auto log message when user sets incompatible 6076 options. 6077 - bug #204: variable name ameliorated in log.c. 6078 - bug #206: in iana_update, no egrep, but awk use. 6079 - ldns snapshot r2699 taken (includes DLV type). 6080 - DLV work, config file element, trust anchor read in. 6081 608212 August 2008: Wouter 6083 - finished adjusting testset to provide qtype NS answers. 6084 608511 August 2008: Wouter 6086 - Fixup rrset security updates overwriting 2181 trust status. 6087 This makes validated to be insecure data just as worthless as 6088 nonvalidated data, and 2181 rules prevent cache overwrites to them. 6089 - Fix assertion fail on bogus key handling. 6090 - dnssec lameness detection works on first query at trust apex. 6091 - NS queries get proper cache and dnssec lameness treatment. 6092 - fixup compilation without pthreads on linux. 6093 60948 August 2008: Wouter 6095 - NS queries are done after every referral. 6096 validator is used on those NS records (if anchors enabled). 6097 60987 August 2008: Wouter 6099 - Scrubber more strict. CNAME chains, DNAMEs from cache, other 6100 irrelevant rrsets removed. 6101 - 1.0.2 released from 1.0 support branch. 6102 - fixup update-anchor.sh to work both in BSD shell and bash. 6103 61045 August 2008: Wouter 6105 - fixup DS test so apex nodata works again. 6106 61074 August 2008: Wouter 6108 - iana port update. 6109 - TODO update. 6110 - fix bug 201: null ptr deref on cleanup while udp pkts wait for port. 6111 - added explanatory text for outgoing-port-permit in manpage. 6112 611330 July 2008: Wouter 6114 - fixup bug qtype DS for unsigned zone and signed parent validation. 6115 611625 July 2008: Wouter 6117 - added original copyright statement of OpenBSD arc4random code. 6118 - created tube signaling solution on windows, as a pipe replacement. 6119 this makes background asynchronous resolution work on windows. 6120 - removed very insecure socketpair compat code. It also did not 6121 work with event_waiting. Solved by pipe replacement. 6122 - unbound -h prints openssl version number as well. 6123 612422 July 2008: Wouter 6125 - moved pipe actions to util/tube.c. easier porting and shared code. 6126 - check _raw() commpoint callbacks with fptr_wlist. 6127 - iana port update. 6128 612921 July 2008: Wouter 6130 - #198: nicer entropy warning message. manpage OS hints. 6131 613219 July 2008: Wouter 6133 - #198: fixup man page to suggest chroot entropy fix. 6134 613518 July 2008: Wouter 6136 - branch for 1.0 support. 6137 - trunk work on tube.c. 6138 613917 July 2008: Wouter 6140 - fix bug #196, compile outside source tree. 6141 - fix bug #195, add --with-username=user configure option. 6142 - print error and exit if started with config that requires more 6143 fds than the builtin minievent can handle. 6144 614516 July 2008: Wouter 6146 - made svn tag 1.0.1, trunk now 1.0.2 6147 - sha256 checksums enabled in makedist.sh 6148 614915 July 2008: Wouter 6150 - Follow draft-ietf-dnsop-default-local-zones-06 added reverse 6151 IPv6 example prefix to AS112 default blocklist. 6152 - fixup lookup of DS records by client with trustanchor for same. 6153 - libunbound ub_resolve, fix handling of error condition during setup. 6154 - lowered log_hex blocksize to fit through BSD syslog linesize. 6155 - no useless initialisation if getpwnam not available. 6156 - iana, ldns snapshot updated. 6157 61583 July 2008: Wouter 6159 - Matthijs fixed memory leaks in root hints file reading. 6160 616126 June 2008: Wouter 6162 - fixup streamtcp bounds setting for udp mode, in the test framework. 6163 - contrib item for updating trust anchors. 6164 616525 June 2008: Wouter 6166 - fixup fwd_ancil test typos. 6167 - Fix for newegg lameness : ok for qtype=A, but lame for others. 6168 - fixup unit test for infra cache, test lame merging. 6169 - porting to mingw, bind, listen, getsockopt and setsockopt error 6170 handling. 6171 617224 June 2008: Wouter 6173 - removed testcode/checklocks from production code compilation path. 6174 - streamtcp can use UDP mode (connected UDP socket), for testing IPv6 6175 on windows. 6176 - fwd_ancil test fails if platform support is lacking. 6177 617823 June 2008: Wouter 6179 - fixup minitpkg to cleanup on windows with its file locking troubles. 6180 - minitpkg shows skipped tests in report. 6181 - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not 6182 ipv6 connectivity). 6183 - winsock event handler keeps track of sticky TCP events, that have 6184 not been fully handled yet. when interest in the event(s) resumes, 6185 they are sent again. When WOULDBLOCK is returned events are cleared. 6186 - skip tests that need signals when testing on mingw. 6187 618818 June 2008: Wouter 6189 - open testbound replay files in binary mode, because fseek/ftell 6190 do not work in ascii-mode on windows. The b does nothing on unix. 6191 unittest and testbound tests work on windows (xp too). 6192 - ioctlsocket prints nicer error message. 6193 - fixed up some TCP porting for winsock. 6194 - lack of IPv6 gives a warning, no fatal error. 6195 - use WSAGetLastError() on windows instead of errno for some errors. 6196 619717 June 2008: Wouter 6198 - outgoing num fds 32 by default on windows ; it supports less 6199 fds for waiting on than unixes. 6200 - winsock_event minievent handler for windows. (you could also 6201 attempt to link with libevent/libev ports for windows). 6202 - neater crypto check and gdi32 detection. 6203 - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista. 6204 620516 June 2008: Wouter 6206 - on windows, use windows threads, mutex and thread-local-storage(Tls). 6207 - detect if openssl needs gdi32. 6208 - if no threading, THREADS_DISABLED is defined for use in the code. 6209 - sets USE_WINSOCK if using ws2_32 on windows. 6210 - wsa_strerror() function for more readable errors. 6211 - WSA Startup and Cleanup called in unbound.exe. 6212 621313 June 2008: Wouter 6214 - port mingw32, more signal ifdefs, detect sleep, usleep, 6215 random, srandom (used inside the tests). 6216 - signed or unsigned FD_SET is cast. 6217 621810 June 2008: Wouter 6219 - fixup warnings compiling on eeepc xandros linux. 6220 62219 June 2008: Wouter 6222 - in iteration response type code 6223 * first check for SOA record (negative answer) before NS record 6224 and lameness. 6225 * check if no AA bit for non-forwarder, and thus lame zone. 6226 In response to error report by Richard Doty for mail.opusnet.com. 6227 - fixup unput warning from lexer on freeBSD. 6228 - bug#183. pidfile, rundir, and chroot configure options. Also the 6229 example.conf and manual pages get the configured defaults. 6230 You can use: (or accept the defaults to /usr/local/etc/unbound/) 6231 --with-conf-file=filename 6232 --with-pidfile=filename 6233 --with-run-dir=path 6234 --with-chroot-dir=path 6235 62368 June 2008: Wouter 6237 - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug. 6238 Reported by Robert Edmonds. 6239 - iana port updated. 6240 62414 June 2008: Wouter 6242 - updated libtool files with newer version. 6243 - iana portlist updated. 6244 62453 June 2008: Wouter 6246 - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the 6247 trailing dot is not used during comparison. 6248 62492 June 2008: Wouter 6250 - Jelte fixed bugs in my absence 6251 - bug 178: fixed unportable shell usage in configure (relied on 6252 bash shell). 6253 - bug 180: fixed buffer overflow in unbound-checkconf use of strncat. 6254 - bug 181: fixed buffer overflow in ldns (called by unbound to parse 6255 config file parts). 6256 - fixes by Wouter 6257 - bug 177: fixed compilation failure on opensuse, the 6258 --disable-static configure flag caused problems. (Patch from 6259 Klaus Singvogel) 6260 - bug 179: same fix as 177. 6261 - bug 185: --disable-shared not passed along to ldns included with 6262 unbound. Fixed so that configure parameters are passed to the 6263 subdir configure script. 6264 fixed that ./libtool is used always, you can still override 6265 manually with ./configure libtool=mylibtool or set $libtool in 6266 the environment. 6267 - update of the ldns tarball to current ldns svn version (fix 181). 6268 - bug 184: -r option for unbound-host, read resolv.conf for 6269 forwarder. (Note that forwarder must support DNSSEC for validation 6270 to succeed). 6271 627223 May 2008: Wouter 6273 - mingw32 porting. 6274 - test for sys/wait.h 6275 - WSAEWOULDBLOCK test after nonblocking TCP connect. 6276 - write_iov_buffer removed: unused and no struct iov on windows. 6277 - signed/unsigned warning fixup mini_event. 6278 - use ioctlsocket to set nonblocking I/O if fnctl is unavailable. 6279 - skip signals that are not defined 6280 - detect pwd.h. 6281 - detect getpwnam, getrlimit, setsid, sbrk, chroot. 6282 - default config has no chroot if chroot() unavailable. 6283 - if no kill() then no pidfile is read or written. 6284 - gmtime_r is replaced by nonthreadsafe alternative if unavail. 6285 used in rrsig time validation errors. 6286 628722 May 2008: Wouter 6288 - contrib unbound.spec from Patrick Vande Walle. 6289 - fixup bug#175: call tzset before chroot to have correct timestamps 6290 in system log. 6291 - do not generate lex input and lex unput functions. 6292 - mingw port. replacement functions labelled _unbound. 6293 - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed. 6294 629519 May 2008: Wouter 6296 - fedora 9, check in6_pktinfo define in configure. 6297 - CREDITS fixup of history. 6298 - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative. 6299 630016 May 2008: Wouter 6301 - fixup for MacOSX hosts file reading (reported by John Dickinson). 6302 - created 1.0.0 svn tag. 6303 - trunk version 1.0.1. 6304 630514 May 2008: Wouter 6306 - accepted patch from Ondrej Sury for library version libtool option. 6307 - configure --disable-rpath fixes up libtool for rpath trouble. 6308 Adapted from debian package patch file. 6309 631013 May 2008: Wouter 6311 - Added root ipv6 addresses to builtin root hints. 6312 - TODO modified for post 1.0 plans. 6313 - trunk version set to 1.0.0. 6314 - no unnecessary linking with librt (only when libevent/libev used). 6315 63167 May 2008: Wouter 6317 - fixup no-ip4 problem with error callback in outside network. 6318 631925 April 2008: Wouter 6320 - DESTDIR is honored by the Makefile for rpms. 6321 - contrib files unbound.spec and unbound.init, builds working RPM 6322 on FC7 Linux, a chrooted caching resolver, and libunbound. 6323 - iana ports update. 6324 632524 April 2008: Wouter 6326 - chroot checks improved. working directory relative to chroot. 6327 checks if config file path is inside chroot. Documentation on it. 6328 - nicer example.conf text. 6329 - created 0.11 tag. 6330 633123 April 2008: Wouter 6332 - parseunbound.pl contrib update from Kai Storbeck for threads. 6333 - iana ports update 6334 633522 April 2008: Wouter 6336 - ignore SIGPIPE. 6337 - unit test for SIGPIPE ignore. 6338 633921 April 2008: Wouter 6340 - FEATURES document. 6341 - fixup reread of config file if it was given as a full path 6342 and chroot was used. 6343 634416 April 2008: Wouter 6345 - requirements doc, updated clean query returns. 6346 - parseunbound.pl update from Kai Storbeck. 6347 - sunos4 porting changes. 6348 634915 April 2008: Wouter 6350 - fixup default rc.d pidfile location to /usr/local/etc. 6351 - iana ports updated. 6352 - copyright updated in ldns-testpkts to keep same as in ldns. 6353 - fixup checkconf chroot tests a bit more, chdir must be inside 6354 chroot dir. 6355 - documented 'gcc: unrecognized -KPIC option' errors on Solaris. 6356 - example.conf values changed to /usr/local/etc/unbound 6357 - DSA test work. 6358 - DSA signatures: unbound is compatible with both encodings found. 6359 It will detect and convert when necessary. 6360 636114 April 2008: Wouter 6362 - got update for parseunbound.pl statistics script from Kai Storbeck. 6363 - tpkg tests for udp wait list. 6364 - documented 0x20 status. 6365 - fixup chroot and checkconf, it is much smarter now. 6366 - fixup DSA EVP signature decoding. Solution that Jelte found copied. 6367 - and check first sig byte for the encoding type. 6368 636911 April 2008: Wouter 6370 - random port selection out of the configged ports. 6371 - fixup threadsafety for libevent-1.4.3+ (event_base_get_method). 6372 - removed base_port. 6373 - created 256-port ephemeral space for the OS, 59802 available. 6374 - fixup consistency of port_if out array during heavy use. 6375 637610 April 2008: Wouter 6377 - --with-libevent works with latest libevent 1.4.99-trunk. 6378 - added log file statistics perl script to contrib. 6379 - automatic iana ports update from makefile. 60058 available. 6380 63819 April 2008: Wouter 6382 - configure can detect libev(from its build directory) when passed 6383 --with-libevent=/home/wouter/libev-3.2 6384 libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%). 6385 - unused commpoints not listed in epoll list. 6386 - statistics-cumulative option so that the values are not reset. 6387 - config creates array of available ports, 61841 available, 6388 it excludes <1024 and iana assigned numbers. 6389 config statements to modify the available port numbers. 6390 63918 April 2008: Wouter 6392 - unbound tries to set the ulimit fds when started as server. 6393 if that does not work, it will scale back its requirements. 6394 639527 March 2008: Wouter 6396 - documented /dev/random symlink from chrootdir as FAQ entry. 6397 639826 March 2008: Wouter 6399 - implemented AD bit signaling. If a query sets AD bit (but not DO) 6400 then the AD bit is set in the reply if the answer validated. 6401 Without including DNSSEC signatures. Useful if you have a trusted 6402 path from the client to the resolver. Follows dnssec-updates draft. 6403 640425 March 2008: Wouter 6405 - implemented check that for NXDOMAIN and NOERROR answers a query 6406 section must be present in the reply (by the scrubber). And it must 6407 be equal to the question sent, at least lowercase folded. 6408 Previously this feature happened because the cache code refused 6409 to store such messages. However blocking by the scrubber makes 6410 sure nothing gets into the RRset cache. Also, this looks like a 6411 timeout (instead of an allocation failure) and this retries are 6412 done (which is useful in a spoofing situation). 6413 - RTT banding. Band size 400 msec, this makes band around zero (fast) 6414 include unknown servers. This makes unbound explore unknown servers. 6415 64167 March 2008: Wouter 6417 - -C config feature for harvest program. 6418 - harvest handles CNAMEs too. 6419 64205 March 2008: Wouter 6421 - patch from Hugo Koji Kobayashi for iterator logs spelling. 6422 64234 March 2008: Wouter 6424 - From report by Jinmei Tatuya, rfc2181 trust value for remainder 6425 of a cname trust chain is lower; not full answer_AA. 6426 - test for this fix. 6427 - default config file location is /usr/local/etc/unbound. 6428 Thus prefix is used to determine the location. This is also the 6429 chroot and pidfile default location. 6430 64313 March 2008: Wouter 6432 - Create 0.10 svn tag. 6433 - 0.11 version in trunk. 6434 - indentation nicer. 6435 643629 February 2008: Wouter 6437 - documentation update. 6438 - fixup port to Solaris of perf test tool. 6439 - updated ldns-tarball with decl-after-statement fixes. 6440 644128 February 2008: Wouter 6442 - fixed memory leaks in libunbound (during cancellation and wait). 6443 - libunbound returns the answer packet in full. 6444 - snprintf compat update. 6445 - harvest performs lookup. 6446 - ldns-tarball update with fix for ldns_dname_label. 6447 - installs to sbin by default. 6448 - install all manual pages (unbound-host and libunbound too). 6449 645027 February 2008: Wouter 6451 - option to use caps for id randomness. 6452 - config file option use-caps-for-id: yes 6453 - harvest debug tool 6454 645526 February 2008: Wouter 6456 - delay utility delays TCP as well. If the server that is forwarded 6457 to has a TCP error, the delay utility closes the connection. 6458 - delay does REUSE_ADDR, and can handle a server that closes its end. 6459 - answers use casing from query. 6460 646125 February 2008: Wouter 6462 - delay utility works. Gets decent thoughput too (>20000). 6463 646422 February 2008: Wouter 6465 - +2% for recursions, if identical queries (except for destination 6466 and query ID) in the reply list, avoid re-encoding the answer. 6467 - removed TODO items for optimizations that do not show up in 6468 profile reports. 6469 - default is now minievent - not libevent. As its faster and 6470 not needed for regular installs, only for very large port ranges. 6471 - loop check different speedup pkt-dname-reading, 1% faster for 6472 nocache-recursion check. 6473 - less hashing during msg parse, 4% for recursion. 6474 - small speed fix for dname_count_size_labels, +1 or +2% recursion. 6475 - some speed results noted: 6476 optimization resulted in +40% for recursion (cache miss) and 6477 +70 to +80 for cache hits, and +96% for version.bind. 6478 zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4 6479 www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3 6480 www with DO bit set : BIND 8269.31 Ub 28735.6 qps. 6481 So, unbound can be about equal qps to NSD in cache hits. 6482 And about 3.4x faster than BIND in cache performance. 6483 - delay utility for testing. 6484 648521 February 2008: Wouter 6486 - speedup of root-delegation message encoding by 15%. 6487 - minor speedup of compress tree_lookup, maybe 1%. 6488 - speedup of dname_lab_cmp and memlowercmp - the top functions in 6489 profiler output, maybe a couple percent when it matters. 6490 649120 February 2008: Wouter 6492 - setup speec_cache for need-ldns-testns in dotests. 6493 - check number of queued replies on incoming queries to avoid overload 6494 on that account. 6495 - fptr whitelist checks are not disabled in optimize mode. 6496 - do-daemonize config file option. 6497 - minievent time share initializes time at start. 6498 - updated testdata for nsec3 new algorithm numbers (6, 7). 6499 - small performance test of packet encoding (root delegation). 6500 650119 February 2008: Wouter 6502 - applied patch to unbound-host man page from Jan-Piet Mens. 6503 - fix donotquery-localhost: yes default (it erroneously was switched 6504 to default 'no'). 6505 - time is only gotten once and the value is shared across unbound. 6506 - unittest cleans up crypto, so that it has no memory leaks. 6507 - mini_event shares the time value with unbound this results in 6508 +3% speed for cache responses and +9% for recursions. 6509 - ldns tarball update with new NSEC3 sign code numbers. 6510 - perform several reads per UDP operation. This improves performance 6511 in DoS conditions, and costs very little in normal conditions. 6512 improves cache response +50%, and recursions +10%. 6513 - modified asynclook test. because the callback from async is not 6514 in any sort of lock (and thus can use all library functions freely), 6515 this causes a tiny race condition window when the last lock is 6516 released for a callback and a new cancel() for that callback. 6517 The only way to remove this is by putting callbacks into some 6518 lock window. I'd rather have the small possibility of a callback 6519 for a cancelled function then no use of library functions in 6520 callbacks. Could be possible to only outlaw process(), wait(), 6521 cancel() from callbacks, by adding another lock, but I'd rather not. 6522 652318 February 2008: Wouter 6524 - patch to unbound-host from Jan-Piet Mens. 6525 - unbound host prints errors if fails to configure context. 6526 - fixup perf to resend faster, so that long waiting requests do 6527 not hold up the queue, they become lost packets or SERVFAILs, 6528 or can be sent a little while later (i.e. processing time may 6529 take long, but throughput has to be high). 6530 - fixup iterator operating in no cache conditions (RD flag unset 6531 after a CNAME). 6532 - streamlined code for RD flag setting. 6533 - profiled code and changed dname compares to be faster. 6534 The speedup is about +3% to +8% (depending on the test). 6535 - minievent tests for eintr and eagain. 6536 653715 February 2008: Wouter 6538 - added FreeBSD rc.d script to contrib. 6539 - --prefix option for configure also changes directory: pidfile: 6540 and chroot: defaults in config file. 6541 - added cache speed test, for cache size OK and cache too small. 6542 654314 February 2008: Wouter 6544 - start without a config file (will complain, but start with 6545 defaults). 6546 - perf test program works. 6547 654813 February 2008: Wouter 6549 - 0.9 released. 6550 - 1.0 development. Printout ldns version on unbound -h. 6551 - start of perf tool. 6552 - bugfix to read empty lines from /etc/hosts. 6553 655412 February 2008: Wouter 6555 - fixup problem with configure calling itself if ldns-src tarball 6556 is not present. 6557 655811 February 2008: Wouter 6559 - changed library to use ub_ instead of ub_val_ as prefix. 6560 - statistics output text nice. 6561 - etc/hosts handling. 6562 - library function to put logging to a stream. 6563 - set any option interface. 6564 65658 February 2008: Wouter 6566 - test program for multiple queries over a TCP channel. 6567 - tpkg test for stream tcp queries. 6568 - unbound replies to multiple TCP queries on a TCP channel. 6569 - fixup misclassification of root referral with NS in answer 6570 when validating a nonrec query. 6571 - tag 0.9 6572 - layout of manpages, spelling fix in header, manpages process by 6573 makedist, list asynclook and tcpstream tests as ldns-testns 6574 required. 6575 65767 February 2008: Wouter 6577 - moved up all current level 2 to be level 3. And 3 to 4. 6578 to make room for new debug level 2 for detailed information 6579 for operators. 6580 - verbosity level 2. Describes recursion and validation. 6581 - cleaner configure script and fixes for libevent solaris. 6582 - signedness for log output memory sizes in high verbosity. 6583 65846 February 2008: Wouter 6585 - clearer explanation of threading configure options. 6586 - fixup asynclook test for nothreading (it creates only one process 6587 to do the extended test). 6588 - changed name of ub_val_result_free to ub_val_resolve_free. 6589 - removes warning message during library linking, renamed 6590 libunbound/unbound.c -> libunbound.c and worker to libworker. 6591 - fallback without EDNS if result is NOTIMPL as well as on FORMERR. 6592 65935 February 2008: Wouter 6594 - statistics-interval: seconds option added. 6595 - test for statistics option 6596 - ignore errors making directories, these can occur in parallel builds 6597 - fixup Makefile strip command and libunbound docs typo. 6598 659931 January 2008: Wouter 6600 - bg thread/process reads and writes the pipe nonblocking all the time 6601 so that even if the pipe is buffered or so, the bg thread does not 6602 block, and services both pipes and queries. 6603 660430 January 2008: Wouter 6605 - check trailing / on chrootdir in checkconf. 6606 - check if root hints and anchor files are in chrootdir. 6607 - no route to host tcp error is verbosity level 2. 6608 - removed unused send_reply_iov. and its configure check. 6609 - added prints of 'remote address is 1.2.3.4 port 53' to errors 6610 from netevent; the basic socket errors. 6611 661228 January 2008: Wouter 6613 - fixup uninit use of buffer by libunbound (query id, flags) for 6614 local_zone answers. 6615 - fixup uninit warning from random.c; also seems to fix sporadic 6616 sigFPE coming out of openssl. 6617 - made openssl entropy warning more silent for library use. Needs 6618 verbosity 1 now. 6619 - fixup forgotten locks for rbtree_searches on ctx->query tree. 6620 - random generator cleanup - RND_STATE_SIZE removed, and instead 6621 a super-rnd can be passed at init to chain init random states. 6622 - test also does lock checks if available. 6623 - protect config access in libworker_setup(). 6624 - libevent doesn't like comm_base_exit outside of runloop. 6625 - close fds after removing commpoints only (for epoll, kqueue). 6626 662725 January 2008: Wouter 6628 - added tpkg for asynclook and library use. 6629 - allows localhost to be queried when as a library. 6630 - fixup race condition between cancel and answer (in case of 6631 really fast answers that beat the cancel). 6632 - please doxygen, put doxygen comment in one place. 6633 - asynclook -b blocking mode and test. 6634 - refactor asynclook, nicer code. 6635 - fixup race problems from opensll in rand init from library, with 6636 a mutex around the rand init. 6637 - fix pass async_id=NULL to _async resolve(). 6638 - rewrote _wait() routine, so that it is threadsafe. 6639 - cancelation is threadsafe. 6640 - asynclook extended test in tpkg. 6641 - fixed two races where forked bg process waits for (somehow shared?) 6642 locks, so does not service the query pipe on the bg side. 6643 Now those locks are only held for fg_threads and for bg_as_a_thread. 6644 664524 January 2008: Wouter 6646 - tested the cancel() function. 6647 - asynclook -c (cancel) feature. 6648 - fix fail to allocate context actions. 6649 - make pipe nonblocking at start. 6650 - update plane for retry mode with caution to limit bandwidth. 6651 - fix Makefile for concurrent make of unbound-host. 6652 - renamed ub_val_ctx_wait/poll/process/fd to ub_val*. 6653 - new calls to set forwarding added to header and docs. 6654 665523 January 2008: Wouter 6656 - removed debug prints from if-auto, verb-algo enables some. 6657 - libunbound QUIT setup, remove memory leaks, when using threads 6658 will share memory for passing results instead of writing it over 6659 the pipe, only writes ID number over the pipe (towards the handler 6660 thread that does process() ). 6661 666222 January 2008: Wouter 6663 - library code for async in libunbound/unbound.c. 6664 - fix link testbound. 6665 - fixup exit bug in mini_event. 6666 - background worker query enter and result functions. 6667 - bg query test application asynclook, it looks up multiple 6668 hostaddresses (A records) at the same time. 6669 667021 January 2008: Wouter 6671 - libworker work, netevent raw commpoints, write_msg, serialize. 6672 667318 January 2008: Wouter 6674 - touch up of manpage for libunbound. 6675 - support for IP_RECVDSTADDR (for *BSD ip4). 6676 - fix for BSD, do not use ip4to6 mapping, make two sockets, once 6677 ip6 and once ip4, uses socket options. 6678 - goodbye ip4to6 mapping. 6679 - update ldns-testpkts with latest version from ldns-trunk. 6680 - updated makedist for relative ldns pathnames. 6681 - library API with more information inside the result structure. 6682 - work on background resolves. 6683 668417 January 2008: Wouter 6685 - fixup configure in case -lldns is installed. 6686 - fixup a couple of doxygen warnings, about enum variables. 6687 - interface-automatic now copies the interface address from the 6688 PKT_INFO structure as well. 6689 - manual page with library API, all on one page 'man libunbound'. 6690 - rewrite of PKTINFO structure, it also captures IP4 PKTINFO. 6691 669216 January 2008: Wouter 6693 - incoming queries to the server with TC bit on are replied FORMERR. 6694 - interface-automatic replied the wrong source address on localhost 6695 queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying 6696 to use ifnum=-1 to mean 'no interface, use kernel route'. 6697 669815 January 2008: Wouter 6699 - interface-automatic feature. experimental. Nice for anycast. 6700 - tpkg test for ip6 ancillary data. 6701 - removed debug prints. 6702 - porting experience, define for Solaris, test refined for BSD 6703 compatibility. The feature probably will not work on OpenBSD. 6704 - makedist fixup for ldns-src in build-dir. 6705 670614 January 2008: Wouter 6707 - in no debug sets NDEBUG to remove asserts. 6708 - configure --enable-debug is needed for dependency generation 6709 for assertions and for compiler warnings. 6710 - ldns.tgz updated with ldns-trunk (where buffer.h is updated). 6711 - fix lint, unit test in optimize mode. 6712 - default access control allows ::ffff:127.0.0.1 v6mapped localhost. 6713 671411 January 2008: Wouter 6715 - man page, warning removed. 6716 - added text describing the use of stub zones for private zones. 6717 - checkconf tests for bad hostnames (IP address), and for doubled 6718 interface lines. 6719 - memory sizes can be given with 'k', 'Kb', or M or G appended. 6720 672110 January 2008: Wouter 6722 - typo in example.conf. 6723 - made using ldns-src that is included the package more portable 6724 by linking with .lo instead of .o files in the ldns package. 6725 - nicer do-ip6: yes/no documentation. 6726 - nicer linking of libevent .o files. 6727 - man pages render correctly on solaris. 6728 67299 January 2008: Wouter 6730 - fixup openssl RAND problem, when the system is not configured to 6731 give entropy, and the rng needs to be seeded. 6732 67338 January 2008: Wouter 6734 - print median and quartiles with extensive logging. 6735 67364 January 2008: Wouter 6737 - document misconfiguration in private network. 6738 67392 January 2008: Wouter 6740 - fixup typo in requirements. 6741 - document that 'refused' is a better choice than 'drop' for 6742 the access control list, as refused will stop retries. 6743 67447 December 2007: Wouter 6745 - unbound-host has a -d option to show what happens. This can help 6746 with debugging (why do I get this answer). 6747 - fixup CNAME handling, on nodata, sets and display canonname. 6748 - dot removed from CNAME display. 6749 - respect -v for NXDOMAINs. 6750 - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes). 6751 - size_t to int for portability of the header file. 6752 - fixup bogus handling. 6753 - dependencies and lint for unbound-host. 6754 67556 December 2007: Wouter 6756 - library resolution works in foreground mode, unbound-host app 6757 receives data. 6758 - unbound-host prints rdata using ldns. 6759 - unbound-host accepts trust anchors, and prints validation 6760 information when you give -v. 6761 67625 December 2007: Wouter 6763 - locking in context_new() inside the function. 6764 - setup of libworker. 6765 67664 December 2007: Wouter 6767 - minor Makefile fixup. 6768 - moved module-stack code out of daemon/daemon into services/modstack, 6769 preparing for code-reuse. 6770 - move context into own header file. 6771 - context query structure. 6772 - removed unused variable pwd from checkconf. 6773 - removed unused assignment from outside netw. 6774 - check timeval length of string. 6775 - fixup error in val_utils getsigner. 6776 - fixup same (*var) error in netblocktostr. 6777 - fixup memleak on parse error in localzone. 6778 - fixup memleak on packet parse error. 6779 - put ; after union in parser.y. 6780 - small hardening in iter_operate against iq==NULL. 6781 - hardening, if error reply with rcode=0 (noerror) send servfail. 6782 - fixup same (*var) error in find_rrset in msgparse, was harmless. 6783 - check return value of evtimer_add(). 6784 - fixup lockorder in lruhash_reclaim(), building up a list of locked 6785 entries one at a time. Instead they are removed and unlocked. 6786 - fptr_wlist for markdelfunc. 6787 - removed is_locked param from lruhash delkeyfunc. 6788 - moved bin_unlock during bin_split purely to please. 6789 67903 December 2007: Wouter 6791 - changed checkconf/ to smallapp/ to make room for more support tools. 6792 (such as unbound-host). 6793 - install dirs created with -m 755 because they need to be accessible. 6794 - library extensive featurelist added to TODO. 6795 - please doxygen, lint. 6796 - library test application, with basic functionality. 6797 - fix for building in a subdirectory. 6798 - link lib fix for Leopard. 6799 680030 November 2007: Wouter 6801 - makefile that creates libunbound.la, basic file or libunbound.a 6802 when creating static executables (no libtool). 6803 - more API setup. 6804 680529 November 2007: Wouter 6806 - 0.9 public API start. 6807 680828 November 2007: Wouter 6809 - Changeup plan for 0.8 - no complication needed, a simple solution 6810 has been chosen for authoritative features. 6811 - you can use single quotes in the config file, so it is possible 6812 to specify TXT records in local data. 6813 - fixup small memory problem in implicit transparent zone creation. 6814 - test for implicit zone creation and multiple RR RRsets local data. 6815 - local-zone nodefault test. 6816 - show testbound testlist on commit. 6817 - iterator normalizer changes CNAME chains ending in NXDOMAIN where 6818 the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial 6819 domain exists). 6820 - nicer verbosity: 0 and 1 levels. 6821 - lower nonRDquery chance of eliciting wrongly typed validation 6822 requiring message from the cache. 6823 - fix for nonRDquery validation typing; nodata is detected when 6824 SOA record in auth section (all validation-requiring nodata messages 6825 have a SOA record in authority, so this is OK for the validator), 6826 and NS record is needed to be a referral. 6827 - duplicate checking when adding NSECs for a CNAME, and test. 6828 - created svn tag 0.8, after completing testbed tests. 6829 683027 November 2007: Wouter 6831 - per suggestion in rfc2308, replaced default max-ttl value with 1 day. 6832 - set size of msgparse lookup table to 32, from 1024, so that its size 6833 is below the 2048 regional large size threshold, and does not cause 6834 a call to malloc when a message is parsed. 6835 - update of memstats tool to print number of allocation calls. 6836 This is what is taking time (not space) and indicates the avg size 6837 of the allocations as well. region_alloc stat is removed. 6838 683922 November 2007: Wouter 6840 - noted EDNS in-the-middle dropping trouble as a TODO. 6841 At this point theoretical, no user trouble has been reported. 6842 - added all default AS112 zones. 6843 - answers from local zone content. 6844 * positive answer, the rrset in question 6845 * nodata answer (exist, but not that type). 6846 * nxdomain answer (domain does not exist). 6847 * empty-nonterminal answer. 6848 * But not: wildcard, nsec, referral, rrsig, cname/dname, 6849 or additional section processing, NS put in auth. 6850 - test for correct working of static and transparent and couple 6851 of important defaults (localhost, as112, reverses). 6852 Also checks deny and refuse settings. 6853 - fixup implicit zone generation and AA bit for NXDOMAIN on localdata. 6854 685521 November 2007: Wouter 6856 - local zone internal data setup. 6857 685820 November 2007: Wouter 6859 - 0.8 - str2list config support for double string config options. 6860 - local-zone and local-data options, config storage and documentation. 6861 686219 November 2007: Wouter 6863 - do not downcase NSEC and RRSIG for verification. Follows 6864 draft-ietf-dnsext-dnssec-bis-updates-06.txt. 6865 - fixup leaking unbound daemons at end of tests. 6866 - README file updated. 6867 - nice libevent not found error. 6868 - README talks about gnu make. 6869 - 0.8: unit test for addr_mask and fixups for it. 6870 and unit test for addr_in_common(). 6871 - 0.8: access-control config file element. 6872 and unit test rpl replay file. 6873 - 0.8: fixup address reporting from netevent. 6874 687516 November 2007: Wouter 6876 - privilege separation is not needed in unbound at this time. 6877 TODO item marked as such. 6878 - created beta-0.7 branch for support. 6879 - tagged 0.7 for beta release. 6880 - moved trunk to 0.8 for 0.8(auth features) development. 6881 - 0.8: access control list setup. 6882 688315 November 2007: Wouter 6884 - review fixups from Jelte. 6885 688614 November 2007: Wouter 6887 - testbed script does not recreate configure, since its in svn now. 6888 - fixup checkconf test so that it does not test 6889 /etc/unbound/unbound.conf. 6890 - tag 0.6. 6891 689213 November 2007: Wouter 6893 - remove debug print. 6894 - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists. 6895 689612 November 2007: Wouter 6897 - fixup signal handling where SIGTERM could be ignored if a SIGHUP 6898 arrives later on. 6899 - bugreports to unbound-bugs@nlnetlabs.nl 6900 - fixup testbound so it exits cleanly. 6901 - cleanup the caches on a reload, so that rrsetID numbers won't clash. 6902 69039 November 2007: Wouter 6904 - took ldns snapshot in repo. 6905 - default config file is /etc/unbound/unbound.conf. 6906 If it doesn't exist, it is installed with the doc/example.conf file. 6907 The file is not deleted on uninstall. 6908 - default listening is not all, but localhost interfaces. 6909 69108 November 2007: Wouter 6911 - Fixup chroot and drop user privileges. 6912 - new L root ip address in default hints. 6913 69141 November 2007: Wouter 6915 - Fixup of crash on reload, due to anchors in env not NULLed after 6916 dealloc during deinit. 6917 - Fixup of chroot call. Happens after privileges are dropped, so 6918 that checking the passwd entry still works. 6919 - minor touch up of clear() hashtable function. 6920 - VERB_DETAIL prints out what chdir, username, chroot is being done. 6921 - when id numbers run out, caches are cleared, as in design notes. 6922 Tested with a mock setup with very few bits in id, it worked. 6923 - harden-dnssec-stripped: yes is now default. It insists on dnssec 6924 data for trust anchors. Included tests for the feature. 6925 692631 October 2007: Wouter 6927 - cache-max-ttl config option. 6928 - building outside sourcedir works again. 6929 - defaults more secure: 6930 username: "unbound" 6931 chroot: "/etc/unbound" 6932 The operator can override them to be less secure ("") if necessary. 6933 - fix horrible oversight in sorting rrset references in a message, 6934 sort per reference key pointer, not on referencepointer itself. 6935 - pidfile: "/etc/unbound/unbound.pid" is now the default. 6936 - tests changed to reflect the updated default. 6937 - created hashtable clear() function that respects locks. 6938 693930 October 2007: Wouter 6940 - fixup assertion failure that relied on compressed names to be 6941 smaller than uncompressed names. A packet from comrite.com was seen 6942 to be compressed to a larger size. Added it as unit test. 6943 - quieter logging at low verbosity level for common tcp messages. 6944 - no greedy TTL update. 6945 694623 October 2007: Wouter 6947 - fixup (grand-)parent problem for dnssec-lameness detection. 6948 - fixup tests to do additional section processing for lame replies, 6949 since the detection needs that. 6950 - no longer trust in query section in reply during dnssec lame detect. 6951 - dnssec lameness does not make the server never ever queried, but 6952 non-preferred. If no other servers exist or answer, the dnssec lame 6953 server is used; the fastest dnssec lame server is chosen. 6954 - added test then when trust anchor cannot be primed (nodata), the 6955 insecure mode from unbound works. 6956 - Fixup max queries per thread, any more are dropped. 6957 695822 October 2007: Wouter 6959 - added donotquerylocalhost config option. Can be turned off for 6960 out test cases. 6961 - ISO C compat changes. 6962 - detect RA-no-AA lameness, as LAME. 6963 - DNSSEC-lameness detection, as LAME. 6964 See notes in requirements.txt for choices made. 6965 - tests for lameness detection. 6966 - added all to make test target; need unbound for fwd tests. 6967 - testbound does not pollute /etc/unbound. 6968 696919 October 2007: Wouter 6970 - added configure (and its files) to svn, so that the trunk is easier 6971 to use. ./configure, config.guess, config.sub, ltmain.sh, 6972 and config.h.in. 6973 - added yacc/lex generated files, util/configlexer.c, 6974 util/configparser.c util/configparser.h, to svn. 6975 - without lex no attempt to use it. 6976 - unsecure response validation collated into one block. 6977 - remove warning about const cast of cfgfile name. 6978 - outgoing-interfaces can be different from service interfaces. 6979 - ldns-src configure is done during unbound configure and 6980 ldns-src make is done during unbound make, and so inherits the 6981 make arguments from the unbound make invocation. 6982 - nicer error when libevent problem causes instant exit on signal. 6983 - read root hints from a root hint file (like BIND does). 6984 698518 October 2007: Wouter 6986 - addresses are logged with errors. 6987 - fixup testcode fake event to remove pending before callback 6988 since the callback may create new pending items. 6989 - tests updated because retries are now in iterator module. 6990 - ldns-testpkts code is checked for differences between unbound 6991 and ldns by makedist.sh. 6992 - ldns trunk from today added in svn repo for fallback in case 6993 no ldns is installed on the system. 6994 make download_ldns refreshes the tarball with ldns svn trunk. 6995 - ldns-src.tar.gz is used if no ldns is found on the system, and 6996 statically linked into unbound. 6997 - start of regional allocator code. 6998 - regional uses less memory and variables, simplified code. 6999 - remove of region-allocator. 7000 - alloc cache keeps a cache of recently released regional blocks, 7001 up to a maximum. 7002 - make unit test cleanly free memory. 7003 700417 October 2007: Wouter 7005 - fixup another cycle detect and ns-addr timeout resolution bug. 7006 This time by refusing delegations from the cache without addresses 7007 when resolving a mandatory-glue nameserver-address for that zone. 7008 We're going to have to ask a TLD server anyway; might as well be 7009 the TLD server for this name. And this resolves a lot of cases where 7010 the other nameserver names lead to cycles or are not available. 7011 - changed random generator from random(3) clone to arc4random wrapped 7012 for thread safety. The random generator is initialised with 7013 entropy from the system. 7014 - fix crash where failure to prime DNSKEY tried to print null pointer 7015 in the log message. 7016 - removed some debug prints, only verb_algo (4) enables them. 7017 - fixup test; new random generator took new paths; such as one 7018 where no scripted answer was available. 7019 - mark insecure RRs as insecure. 7020 - fixup removal of nonsecure items from the additional. 7021 - reduced timeout values to more realistic, 376 msec (262 msec has 7022 90% of roundtrip times, 512 msec has 99% of roundtrip times.) 7023 - server selection failover to next server after timeout (376 msec). 7024 702516 October 2007: Wouter 7026 - no malloc in log_hex. 7027 - assertions around system calls. 7028 - protect against gethostname without ending zero. 7029 - ntop output is null terminated by unbound. 7030 - pidfile content null termination 7031 - various snprintf use sizeof(stringbuf) instead of fixed constant. 7032 - changed loopdetect % 8 with & 0x7 since % can become negative for 7033 weird negative input and particular interpretation of integer math. 7034 - dname_pkt_copy checks length of result, to protect result buffers. 7035 prints an error, this should not happen. Bad strings should have 7036 been rejected earlier in the program. 7037 - remove a size_t underflow from msgreply size func. 7038 703915 October 2007: Wouter 7040 - nicer warning. 7041 - fix IP6 TCP, wrong definition check. With test package. 7042 - fixup the fact that the query section was not compressed to, 7043 the code was there but was called by value instead of by reference. 7044 And test for the case, uses xxd and nc. 7045 - more portable ip6 check for sockaddr types. 7046 70478 October 2007: Wouter 7048 - --disable-rpath option in configure for 64bit systems with 7049 several dynamic lib dirs. 7050 70517 October 2007: Wouter 7052 - fixup tests for no AD bit in non-DO queries. 7053 - test that makes sure AD bit is not set on non-DO query. 7054 70556 October 2007: Wouter 7056 - removed logfile open early. It did not have the proper permissions; 7057 it was opened as root instead of the user. And we cannot change user 7058 id yet, since chroot and bind ports need to be done. 7059 - callback checks for event callbacks done from mini_event. Because 7060 of deletions cannot do this from netevent. This means when using 7061 libevent the protection does not work on event-callbacks. 7062 - fixup too small reply (did not zero counts). 7063 - fixup reply no longer AD bit when query without DO bit. 7064 70655 October 2007: Wouter 7066 - function pointer whitelist. 7067 70684 October 2007: Wouter 7069 - overwrite sensitive random seed value after use. 7070 - switch to logfile very soon if not -d (console attached). 7071 - error messages do not reveal the trustanchor contents. 7072 - start work on function pointer whitelists. 7073 70743 October 2007: Wouter 7075 - fix for multiple empty nonterminals, after multiple DSes in the 7076 chain of trust. 7077 - mesh checks if modules are looping, and stops them. 7078 - refetch with CNAMEd nameserver address regression test added. 7079 - fixup line count bug in testcode, so testbound prints correct line 7080 number with parse errors. 7081 - unit test for multiple ENT case. 7082 - fix for cname out of validated unsec zone. 7083 - fixup nasty id=0 reuse. Also added assertions to detect its 7084 return (the assertion catches in the existing test cases). 7085 70861 October 2007: Wouter 7087 - skip F77, CXX, objC tests in configure step. 7088 - fixup crash in refetch glue after a CNAME. 7089 and protection against similar failures (with error print). 7090 709128 September 2007: Wouter 7092 - test case for unbound-checkconf, fixed so it also checks the 7093 interface: statements. 7094 709526 September 2007: Wouter 7096 - SIGHUP will reopen the log file. 7097 - Option to log to syslog. 7098 - please lint, fixup tests (that went to syslog on open, oops). 7099 - config check program. 7100 710125 September 2007: Wouter 7102 - tests for NSEC3. Fixup bitmap checks for NSEC3. 7103 - positive ANY response needs to check if wildcard expansion, and 7104 check that original data did not exist. 7105 - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure 7106 delegation, for abuse of child zone apex nsec3. 7107 - create 0.5 release tag. 7108 710924 September 2007: Wouter 7110 - do not make test programs by default. 7111 - But 'make test' will perform all of the tests. 7112 - Advertise builtin select libevent alternative when no libevent 7113 is found. 7114 - signit can generate NSEC3 hashes, for generating tests. 7115 - multiple nsec3 parameters in message test. 7116 - too high nsec3 iterations becomes insecure test. 7117 711821 September 2007: Wouter 7119 - fixup empty_DS_name allocated in wrong region (port DEC Alpha). 7120 - fixup testcode lock safety (port FreeBSD). 7121 - removes subscript has type char warnings (port Solaris 9). 7122 - fixup of field with format type to int (port MacOS/X intel). 7123 - added test for infinite loop case in nonRD answer validation. 7124 It was a more general problem, but hard to reproduce. When an 7125 unsigned rrset is being validated and the key fetched, the DS 7126 sequence is followed, but if the final name has no DS, then no 7127 proof is possible - the signature has been stripped off. 7128 712920 September 2007: Wouter 7130 - fixup and test for NSEC wildcard with empty nonterminals. 7131 - makedist.sh fixup for svn info. 7132 - acl features request in plan. 7133 - improved DS empty nonterminal handling. 7134 - compat with ANS nxdomain for empty nonterminals. Attempts the nodata 7135 proof anyway, which succeeds in ANS failure case. 7136 - striplab protection in case it becomes -1. 7137 - plans for static and blacklist config. 7138 713919 September 2007: Wouter 7140 - comments about non-packed usage. 7141 - plan for overload support in 0.6. 7142 - added testbound tests for a failed resolution from the logs 7143 and for failed prime when missing glue. 7144 - fixup so useless delegation points are not returned from the 7145 cache. Also the safety belt is used if priming fails to complete. 7146 - fixup NSEC rdata not to be lowercased, bind compat. 7147 714818 September 2007: Wouter 7149 - wildcard nsec3 testcases, and fixup to get correct wildcard name. 7150 - validator prints subtype classification for debug. 7151 715217 September 2007: Wouter 7153 - NSEC3 hash cache unit test. 7154 - validator nsec3 nameerror test. 7155 715614 September 2007: Wouter 7157 - nsec3 nodata proof, nods proof, wildcard proof. 7158 - nsec3 support for cname chain ending in noerror or nodata. 7159 - validator calls nsec3 proof routines if no NSECs prove anything. 7160 - fixup iterator bug where it stored the answer to a cname under 7161 the wrong qname into the cache. When prepending the cnames, the 7162 qname has to be reset to the original qname. 7163 716413 September 2007: Wouter 7165 - nsec3 find matching and covering, ce proof, prove namerror msg. 7166 716712 September 2007: Wouter 7168 - fixup of manual page warnings, like for NSD bugreport. 7169 - nsec3 work, config, max iterations, filter, and hash cache. 7170 71716 September 2007: Wouter 7172 - fixup to find libevent on mac port install. 7173 - fixup size_t vs unsigned portability in validator/sigcrypt. 7174 - please compiler on different platforms, for unreachable code. 7175 - val_nsec3 file. 7176 - pthread_rwlock type is optional, in case of old pthread libs. 7177 71785 September 2007: Wouter 7179 - cname, name error validator tests. 7180 - logging of qtype ANY works. 7181 - ANY type answers get RRSIG in answer section of replies (but not 7182 in other sections, unless DO bit is on). 7183 - testbound can replay a TCP query (set MATCH TCP in the QUERY). 7184 - DS and noDS referral validation test. 7185 - if you configure many trust anchors, parent trust anchors can 7186 securely deny existence of child trust anchors, if validated. 7187 - not all *.name NSECs are present because a wildcard was matched, 7188 and *.name NSECs can prove nodata for empty nonterminals. 7189 Also, for wildcard name NSECs, check they are not from the parent 7190 zone (for wildcarded zone cuts), and check absence of CNAME bit, 7191 for a nodata proof. 7192 - configure option for memory allocation debugging. 7193 - port configure option for memory allocation to solaris10. 7194 71954 September 2007: Wouter 7196 - fixup of Leakage warning when serviced queries processed multiple 7197 callbacks for the same query from the same server. 7198 - testbound removes config file from /tmp on failed exit. 7199 - fixup for referral cleanup of the additional section. 7200 - tests for cname, referral validation. 7201 - neater testbound tpkg output. 7202 - DNAMEs no longer match their apex when synthesized from the cache. 7203 - find correct signer name for DNAME responses. 7204 - wildcarded DNAME test and fixup code to detect. 7205 - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs. 7206 So that wildcarded CNAMEs get their NSEC with them to the answer. 7207 - test for a CNAME to a DNAME to a CNAME to an answer, all from 7208 different domains, for key fetching and signature checking of 7209 CNAME'd messages. 7210 72113 September 2007: Wouter 7212 - Fixed error in iterator that would cause assertion failure in 7213 validator. CNAME to a NXDOMAIN response was collated into a response 7214 with both a CNAME and the NXDOMAIN rcode. Added a test that the 7215 rcode is changed to NOERROR (because of the CNAME). 7216 - timeout on tcp does not lead to spurious leakage detect. 7217 - account memory for name of lame zones, so that memory leakages does 7218 not show lame cache growth as a leakage growth. 7219 - config setting for lameness cache expressed in bytes, instead of 7220 number of entries. 7221 - tool too summarize allocations per code line. 7222 722331 August 2007: Wouter 7224 - can read bind trusted-keys { ... }; files, in a compatibility mode. 7225 - iterator should not detach target queries that it still could need. 7226 the protection against multiple outstanding queries is moved to a 7227 current_query num check. 7228 - validator nodata, positive, referral tests. 7229 - dname print can print '*' wildcard. 7230 723130 August 2007: Wouter 7232 - fixup override date config option. 7233 - config options to control memory usage. 7234 - caught bad free of un-alloced data in worker_send error case. 7235 - memory accounting for key cache (trust anchors and temporary cache). 7236 - memory accounting fixup for outside network tcp pending waits. 7237 - memory accounting fixup for outside network tcp callbacks. 7238 - memory accounting for iterator fixed storage. 7239 - key cache size and slabs config options. 7240 - lib crypto cleanups at exit. 7241 724229 August 2007: Wouter 7243 - test tool to sign rrsets for testing validator with. 7244 - added RSA and DSA test keys, public and private pairs, 512 bits. 7245 - default configuration is with validation enabled. 7246 Only a trust-anchor needs to be configured for DNSSEC to work. 7247 - do not convert to DER for DSA signature verification. 7248 - validator replay test file, for a DS to DNSKEY DSA key prime and 7249 positive response. 7250 725128 August 2007: Wouter 7252 - removed double use for udp buffers, that could fail, 7253 instead performs a malloc to do the backup. 7254 - validator validates referral messages, by validating all the rrsets 7255 and stores the rrsets in the cache. Further referral (nonRD queries) 7256 replies are made from the rrset cache directly. Unless unchecked 7257 rrsets are encountered, there are then validated. 7258 - enforce that signing is done by a parent domain (or same domain). 7259 - adjust TTL downwards if rrset TTL bigger than signature allows. 7260 - permissive mode feature, sets AD bit for secure, but bogus does 7261 not give servfail (bogus is changed into indeterminate). 7262 - optimization of rrset verification. rr canonical sorting is reused, 7263 for the same rrset. canonical rrset image in buffer is reused for 7264 the same signature. 7265 - if the rrset is too big (64k exactly + large owner name) the 7266 canonicalization routine will fail if it does not fit in buffer. 7267 - faster verification for large sigsets. 7268 - verb_detail mode reports validation failures, but not the entire 7269 algorithm for validation. Key prime failures are reported as 7270 verb_ops level. 7271 727227 August 2007: Wouter 7273 - do not garble the edns if a cache answer fails. 7274 - answer norecursive from cache if possible. 7275 - honor clean_additional setting when returning secure non-recursive 7276 referrals. 7277 - do not store referral in msg cache for nonRD queries. 7278 - store verification status in the rrset cache to speed up future 7279 verification. 7280 - mark rrsets indeterminate and insecure if they are found to be so. 7281 and store this in the cache. 7282 728324 August 2007: Wouter 7284 - message is bogus if unsecure authority rrsets are present. 7285 - val-clean-additional option, so you can turn it off. 7286 - move rrset verification out of the specific proof types into one 7287 routine. This makes the proof routines prettier. 7288 - fixup cname handling in validator, cname-to-positive and cname-to- 7289 nodata work. 7290 - Do not synthesize DNSKEY and DS responses from the rrset cache if 7291 the rrset is from the additional section. Signatures may have 7292 fallen off the packet, and cause validation failure. 7293 - more verbose signature date errors (with the date attached). 7294 - increased default infrastructure cache size. It is important for 7295 performance, and 1000 entries are only 212k (or a 400 k total cache 7296 size). To 10000 entries (for 2M entries, 4M cache size). 7297 729823 August 2007: Wouter 7299 - CNAME handling - move needs_validation to before val_new(). 7300 val_new() setups the chase-reply to be an edited copy of the msg. 7301 new classification, and find signer can find for it. 7302 removal of unsigned crap from additional, and query restart for 7303 cname. 7304 - refuse to follow wildcarded DNAMEs when validating. 7305 But you can query for qtype ANY, or qtype DNAME and validate that. 7306 730722 August 2007: Wouter 7308 - bogus TTL. 7309 - review - use val_error(). 7310 731121 August 2007: Wouter 7312 - ANY response validation. 7313 - store security status in cache. 7314 - check cache security status and either send the query to be 7315 validated, return the query to client, or send servfail to client. 7316 Sets AD bit on validated replies. 7317 - do not examine security status on an error reply in mesh_done. 7318 - construct DS, DNSKEY messages from rrset cache. 7319 - manual page entry for override-date. 7320 732120 August 2007: Wouter 7322 - validate and positive validation, positive wildcard NSEC validation. 7323 - nodata validation, nxdomain validation. 7324 732518 August 2007: Wouter 7326 - process DNSKEY response in FINDKEY state. 7327 732817 August 2007: Wouter 7329 - work on DS2KE routine. 7330 - val_nsec.c for validator NSEC proofs. 7331 - unit test for NSEC bitmap reading. 7332 - dname iswild and canonical_compare with unit tests. 7333 733416 August 2007: Wouter 7335 - DS sig unit test. 7336 - latest release libevent 1.3c and 1.3d have threading fixed. 7337 - key entry fixup data pointer and ttl absolute. 7338 - This makes a key-prime succeed in validator, with DS or DNSKEY as 7339 trust-anchor. 7340 - fixup canonical compare byfield routine, fix bug and also neater. 7341 - fixed iterator response type classification for queries of type 7342 ANY and NS. 7343 dig ANY gives sometimes NS rrset in AN and NS section, and parser 7344 removes the NS section duplicate. dig NS gives sometimes the NS 7345 in the answer section, as referral. 7346 - validator FINDKEY state. 7347 734815 August 2007: Wouter 7349 - crypto calls to verify signatures. 7350 - unit test for rrsig verification. 7351 735214 August 2007: Wouter 7353 - default outgoing ports changed to avoid port 2049 by default. 7354 This port is widely blocked by firewalls. 7355 - count infra lameness cache in memory size. 7356 - accounting of memory improved 7357 - outbound entries are allocated in the query region they are for. 7358 - extensive debugging for memory allocations. 7359 - --enable-lock-checks can be used to enable lock checking. 7360 - protect undefs in config.h from autoheaders ministrations. 7361 - print all received udp packets. log hex will print on multiple 7362 lines if needed. 7363 - fixed error in parser with backwards rrsig references. 7364 - mark cycle targets for iterator did not have CD flag so failed 7365 its task. 7366 736713 August 2007: Wouter 7368 - fixup makefile, if lexer is missing give nice error and do not 7369 mess up the dependencies. 7370 - canonical compare routine updated. 7371 - canonical hinfo compare. 7372 - printout list of the queries that the mesh is working on. 7373 737410 August 2007: Wouter 7375 - malloc and free overrides that track total allocation and frees. 7376 for memory debugging. 7377 - work on canonical sort. 7378 73799 August 2007: Wouter 7380 - canonicalization, signature checks 7381 - dname signature label count and unit test. 7382 - added debug heap size print to memory printout. 7383 - typo fixup in worker.c 7384 - -R needed on solaris. 7385 - validator override option for date check testing. 7386 73878 August 2007: Wouter 7388 - ldns _raw routines created (in ldns trunk). 7389 - sigcrypt DS digest routines 7390 - val_utils uses sigcrypt to perform signature cryptography. 7391 - sigcrypt keyset processing 7392 73937 August 2007: Wouter 7394 - security status type. 7395 - security status is copied when rdata is equal for rrsets. 7396 - rrset id is updated to invalidate all the message cache entries 7397 that refer to NSEC, NSEC3, DNAME rrsets that have changed. 7398 - val_util work 7399 - val_sigcrypt file for validator signature checks. 7400 74016 August 2007: Wouter 7402 - key cache for validator. 7403 - moved isroot and dellabel to own dname routines, with unit test. 7404 74053 August 2007: Wouter 7406 - replanning. 7407 - scrubber check section of lame NS set. 7408 - trust anchors can be in config file or read from zone file, 7409 DS and DNSKEY entries. 7410 - unit test trust anchor storage. 7411 - trust anchors converted to packed rrsets. 7412 - key entry definition. 7413 74142 August 2007: Wouter 7415 - configure change for latest libevent trunk version (needs -lrt). 7416 - query_done and walk_supers are moved out of module interface. 7417 - fixup delegation point duplicates. 7418 - fixup iterator scrubber; lame NS set is let through the scrubber 7419 so that the classification is lame. 7420 - validator module exists, and does nothing but pass through, 7421 with calling of next module and return. 7422 - validator work. 7423 74241 August 2007: Wouter 7425 - set version to 0.5 7426 - module work for module to module interconnections. 7427 - config of modules. 7428 - detect cycle takes flags. 7429 743031 July 2007: Wouter 7431 - updated plan 7432 - release 0.4 tag. 7433 743430 July 2007: Wouter 7435 - changed random state init, so that sequential process IDs are not 7436 cancelled out by sequential thread-ids in the random number seed. 7437 - the fwd_three test, which sends three queries to unbound, and 7438 unbound is kept waiting by ldns-testns for 3 seconds, failed 7439 because the retry timeout for default by unbound is 3 seconds too, 7440 it would hit that timeout and fail the test. Changed so that unbound 7441 is kept waiting for 2 seconds instead. 7442 744327 July 2007: Wouter 7444 - removed useless -C debug option. It did not work. 7445 - text edit of documentation. 7446 - added doc/CREDITS file, referred to by the manpages. 7447 - updated planning. 7448 744926 July 2007: Wouter 7450 - cycle detection, for query state dependencies. Will attempt to 7451 circumvent the cycle, but if no other targets available fails. 7452 - unit test for AXFR, IXFR response. 7453 - test for cycle detection. 7454 745525 July 2007: Wouter 7456 - testbound read ADDRESS and check it. 7457 - test for version.bind and friends. 7458 - test for iterator chaining through several referrals. 7459 - test and fixup for refetch for glue. Refetch fails if glue 7460 is still not provided. 7461 746224 July 2007: Wouter 7463 - Example section in config manual. 7464 - Addr stored for range and moment in replay. 7465 746620 July 2007: Wouter 7467 - Check CNAME chain before returning cache entry with CNAMEs. 7468 - Option harden-glue, default is on. It will discard out of zone 7469 data. If disabled, performance is faster, but spoofing attempts 7470 become a possibility. Note that still normalize scrubbing is done, 7471 and that the potentially spoofed data is used for infrastructure 7472 and not returned to the client. 7473 - if glue times out, refetch by asking parent of delegation again. 7474 Much like asking for DS at the parent side. 7475 - TODO items from forgery-resilience draft. 7476 and on memory handling improvements. 7477 - renamed module_event_timeout to module_event_noreply. 7478 - memory reporting code; reports on memory usage after handling 7479 a network packet (not on cache replies). 7480 748119 July 2007: Wouter 7482 - shuffle NS selection when getting nameserver target addresses. 7483 - fixup of deadlock warnings, yield cpu in checklock code so that 7484 freebsd scheduler selects correct process to run. 7485 - added identity and version config options and replies. 7486 - store cname messages complete answers. 7487 748818 July 2007: Wouter 7489 - do not query addresses, 127.0.0.1, and ::1 by default. 7490 749117 July 2007: Wouter 7492 - forward zone options in config file. 7493 - forward per zone in iterator. takes precedence over stubs. 7494 - fixup commithooks. 7495 - removed forward-to and forward-to-port features, subsumed by 7496 new forward zones. 7497 - fix parser to handle absent server: clause. 7498 - change untrusted rrset test to account for scrubber that is now 7499 applied during the test (which removes the poison, by the way). 7500 - feature, addresses can be specified with @portnumber, like nsd.conf. 7501 - test config files changed over to new forwarder syntax. 7502 750327 June 2007: Wouter 7504 - delete of mesh does a postorder traverse of the tree. 7505 - found and fixed a memory leak. For TTL=0 messages, that would 7506 not be cached, instead the msg-replyinfo structure was leaked. 7507 - changed server selection so it will filter out hosts that are 7508 unresponsive. This is defined as a host with the maximum rto value. 7509 This means that unbound tried the host for retries up to 120 secs. 7510 The rto value will time out after host-ttl seconds from the cache. 7511 This keeps such unresolvable queries from taking up resources. 7512 - utility for keeping histogram. 7513 751426 June 2007: Wouter 7515 - mesh is called by worker, and iterator uses it. 7516 This removes the hierarchical code. 7517 QueryTargets state and Finished state are merged for iterator. 7518 - forwarder mode no longer sets AA bit on first reply. 7519 - rcode in walk_supers is not needed. 7520 752125 June 2007: Wouter 7522 - more mesh work. 7523 - error encode routine for ease. 7524 752522 June 2007: Wouter 7526 - removed unused _node iterator value from rbtree_t. Takes up space. 7527 - iterator can handle querytargets state without a delegation point 7528 set, so that a priming(stub) subquery error can be handled. 7529 - iterator stores if it is priming or not. 7530 - log_query_info() neater logging. 7531 - changed iterator so that it does not alter module_qstate.qinfo 7532 but keeps a chase query info. Also query_flags are not altered, 7533 the iterator uses chase_flags. 7534 - fixup crash in case no ports for the family exist. 7535 753621 June 2007: Wouter 7537 - Fixup secondary buffer in case of error callback. 7538 - cleanup slumber list of runnable states. 7539 - module_subreq_depth fails to work in slumber list. 7540 - fixup query release for cached results to sub targets. 7541 - neater error for tcp connection failure, shows addr in verbose. 7542 - rbtree_init so that it can be used with preallocated memory. 7543 754420 June 2007: Wouter 7545 - new -C option to enable coredumps after forking away. 7546 - doc update. 7547 - fixup CNAME generation by scrubber, and memory allocation of it. 7548 - fixup deletion of serviced queries when all callbacks delete too. 7549 - set num target queries to 0 when you move them to slumber list. 7550 - typo in check caused subquery errors to be ignored, fixed. 7551 - make lint happy about rlim_t. 7552 - freeup of modules after freeup of module-states. 7553 - duplicate replies work, this uses secondary udp buffer in outnet. 7554 755519 June 2007: Wouter 7556 - nicer layout in stats.c, review 0.3 change. 7557 - spelling improvement, review 0.3 change. 7558 - uncapped timeout for server selection, so that very fast or slow 7559 servers will stand out from the rest. 7560 - target-fetch-policy: "3 2 1 0 0" config setting. 7561 - fixup queries answered without RD bit (for root prime results). 7562 - refuse AXFR and IXFR requests. 7563 - fixup RD flag in error reply from iterator. fixup RA flag from 7564 worker error reply. 7565 - fixup encoding of very short edns buffer sizes, now sets TC bit. 7566 - config options harden-short-bufsize and harden-large-queries. 7567 756818 June 2007: Wouter 7569 - same, move subqueries to slumber list when first has resolved. 7570 - fixup last fix for duplicate callbacks. 7571 - another offbyone in targetcounter. Also in Java prototype by the way. 7572 757315 June 2007: Wouter 7574 - if a query asks to be notified of the same serviced query result 7575 multiple times, this will succeed. Only one callback will happen; 7576 multiple outbound-list entries result (but the double cleanup of it 7577 will not matter). 7578 - when iterator moves on due to CNAME or referral, it will remove 7579 the subqueries (for other targets). These are put on the slumber 7580 list. 7581 - state module wait subq is OK with no new subqs, an old one may have 7582 stopped, with an error, and it is still waiting for other ones. 7583 - if a query loops, halt entire query (easy way to clean up properly). 7584 758514 June 2007: Wouter 7586 - num query targets was > 0 , not >= 0 compared, so that fetch 7587 policy of 0 did nothing. 7588 758913 June 2007: Wouter 7590 - debug option: configure --enable-static-exe for compile where 7591 ldns and libevent are linked statically. Default is off. 7592 - make install and make uninstall. Works with static-exe and without. 7593 installation of unbound binary and manual pages. 7594 - alignment problem fix on solaris 64. 7595 - fixup address in case of TCP error. 7596 759712 June 2007: Wouter 7598 - num target queries was set to 0 at a bad time. Default it to 0 and 7599 increase as target queries are done. 7600 - synthesize CNAME and DNAME responses from the cache. 7601 - Updated doxygen config for doxygen 1.5. 7602 - aclocal newer version. 7603 - doxygen 1.5 fixes for comments (for the strict check on docs). 7604 760511 June 2007: Wouter 7606 - replies on TCP queries have the address field set in replyinfo, 7607 for serviced queries, because the initiator does not know that 7608 a TCP fallback has occured. 7609 - omit DNSSEC types from nonDO replies, except if qtype is ANY or 7610 if qtype directly queries for the type (and then only show that 7611 'unknown type' in the answer section). 7612 - fixed message parsing where rrsigs on their own would be put 7613 in the signature list over the rrsig type. 7614 76157 June 2007: Wouter 7616 - fixup error in double linked list insertion for subqueries and 7617 for outbound list of serviced queries for iterator module. 7618 - nicer printout of outgoing port selection. 7619 - fixup cname target readout. 7620 - nicer debug output. 7621 - fixup rrset counts when prepending CNAMEs to the answer. 7622 - fixup rrset TTL for prepended CNAMEs. 7623 - process better check for looping modules, and which submodule to 7624 run next. 7625 - subreq insertion code fixup for slumber list. 7626 - VERB_DETAIL, verbosity: 2 level gives short but readable output. 7627 VERB_ALGO, verbosity: 3 gives extensive output. 7628 - fixup RA bit in cached replies. 7629 - fixup CNAME responses from the cache no longer partial response. 7630 - error in network send handled without leakage. 7631 - enable ip6 from config, and try ip6 addresses if available, 7632 if ip6 is not connected, skips to next server. 7633 76345 June 2007: Wouter 7635 - iterator state finished. 7636 - subrequests without parent store in cache and stop. 7637 - worker slumber list for ongoing promiscuous queries. 7638 - subrequest error handling. 7639 - priming failure returns SERVFAIL. 7640 - priming gives LAME result, returns SERVFAIL. 7641 - debug routine to print dns_msg as handled by iterator. 7642 - memleak in config file stubs fixup. 7643 - more small bugs, in scrubber, query compare no ID for lookup, 7644 in dname validation for NS targets. 7645 - sets entry.key for new special allocs. 7646 - lognametypeclass can display unknown types and classes. 7647 76484 June 2007: Wouter 7649 - random selection of equally preferred nameserver targets. 7650 - reply info copy routine. Reuses existing code. 7651 - cache lameness in response handling. 7652 - do not touch qstate after worker_process_query because it may have 7653 been deleted by that routine. 7654 - Prime response state. 7655 - Process target response state. 7656 - some memcmp changed to dname_compare for case preservation. 7657 76581 June 2007: Wouter 7659 - normalize incoming messages. Like unbound-java, with CNAME chain 7660 checked, DNAME checked, CNAME's synthesized, glue checked. 7661 - sanitize incoming messages. 7662 - split msgreply encode functions into own file msgencode.c. 7663 - msg_parse to queryinfo/replyinfo conversion more versatile. 7664 - process_response, classify response, delegpt_from_message. 7665 766631 May 2007: Wouter 7667 - querytargets state. 7668 - dname_subdomain_c() routine. 7669 - server selection, based on RTT. ip6 is filtered out if not available, 7670 and lameness is checked too. 7671 - delegation point copy routine. 7672 767330 May 2007: Wouter 7674 - removed FLAG_CD from message and rrset caches. This was useful for 7675 an agnostic forwarder, but not for a sophisticated (trust value per 7676 rrset enabled) cache. 7677 - iterator response typing. 7678 - iterator cname handle. 7679 - iterator prime start. 7680 - subquery work. 7681 - processInitRequest and processInitRequest2. 7682 - cache synthesizes referral messages, with DS and NSEC. 7683 - processInitRequest3. 7684 - if a request creates multiple subrequests these are all activated. 7685 768629 May 2007: Wouter 7687 - routines to lock and unlock array of rrsets moved to cache/rrset. 7688 - lookup message from msg cache (and copy to region). 7689 - fixed cast error in dns msg lookup. 7690 - message with duplicate rrset does not increase its TTLs twice. 7691 - 'qnamesize' changed to 'qname_len' for similar naming scheme. 7692 769325 May 2007: Wouter 7694 - Acknowledge use of unbound-java code in iterator. Nicer readme. 7695 - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and 7696 rrset cache from module environment. 7697 - packed rrset key has type and class as easily accessible struct 7698 members. They are still kept in network format for fast msg encode. 7699 - dns cache find_delegation routine. 7700 - iterator main functions setup. 7701 - dns cache lookup setup. 7702 770324 May 2007: Wouter 7704 - small changes to prepare for subqueries. 7705 - iterator forwarder feature separated out. 7706 - iterator hints stub code, config file stub code, so that first 7707 testing can proceed locally. 7708 - replay tests now have config option to enable forwarding mode. 7709 771023 May 2007: Wouter 7711 - outside network does precise timers for roundtrip estimates for rtt 7712 and for setting timeout for UDP. Pending_udp takes milliseconds. 7713 - cleaner iterator sockaddr conversion of forwarder address. 7714 - iterator/iter_utils and iter_delegpt setup. 7715 - root hints. 7716 771722 May 2007: Wouter 7718 - outbound query list for modules and support to callback with the 7719 outbound entry to the module. 7720 - testbound support for new serviced queries. 7721 - test for retry to TCP cannot use testbound any longer. 7722 - testns test for EDNS fallback, test for TCP fallback already exists. 7723 - fixes for no-locking compile. 7724 - mini_event timer precision and fix for change in timeouts during 7725 timeout callback. Fix for fwd_three tests, performed nonexit query. 7726 772721 May 2007: Wouter 7728 - small comment on hash table locking. 7729 - outside network serviced queries, contain edns and tcp fallback, 7730 and udp retries and rtt timing. 7731 773216 May 2007: Wouter 7733 - lruhash_touch() would cause locking order problems. Fixup in 7734 lock-verify in case locking cycle is found. 7735 - services/cache/rrset.c for rrset cache code. 7736 - special rrset_cache LRU updating function that uses the rrset id. 7737 - no dependencies calculation when make clean is called. 7738 - config settings for infra cache. 7739 - daemon code slightly cleaner, only creates caches once. 7740 774115 May 2007: Wouter 7742 - host cache code. 7743 - unit test for host cache. 7744 774514 May 2007: Wouter 7746 - Port to OS/X and Dec Alpha. Printf format and alignment fixes. 7747 - extensive lock debug report on join timeout. 7748 - proper RTT calculation, in utility code. 7749 - setup of services/cache/infra, host cache. 7750 775111 May 2007: Wouter 7752 - iterator/iterator.c module. 7753 - fixup to pass reply_info in testcode and in netevent. 7754 775510 May 2007: Wouter 7756 - created release-0.3 svn tag. 7757 - util/module.h 7758 - fixed compression - no longer compresses root name. 7759 77609 May 2007: Wouter 7761 - outside network cleans up waiting tcp queries on exit. 7762 - fallback to TCP. 7763 - testbound replay with retry in TCP mode. 7764 - tpkg test for retry in TCP mode, against ldns-testns server. 7765 - daemon checks max number of open files and complains if not enough. 7766 - test where data expires in the cache. 7767 - compiletests: fixed empty body ifstatements in alloc.c, in case 7768 locks are disabled. 7769 77708 May 2007: Wouter 7771 - outgoing network keeps list of available tcp buffers for outgoing 7772 tcp queries. 7773 - outgoing-num-tcp config option. 7774 - outgoing network keeps waiting list of queries waiting for buffer. 7775 - netevent supports outgoing tcp commpoints, nonblocking connects. 7776 77777 May 2007: Wouter 7778 - EDNS read from query, used to make reply smaller. 7779 - advertised edns value constants. 7780 - EDNS BADVERS response, if asked for too high edns version. 7781 - EDNS extended error responses once the EDNS record from the query 7782 has successfully been parsed. 7783 77844 May 2007: Wouter 7785 - msgreply sizefunc is more accurate. 7786 - config settings for rrset cache size and slabs. 7787 - hashtable insert takes argument so that a thread can use its own 7788 alloc cache to store released keys. 7789 - alloc cache special_release() locks if necessary. 7790 - rrset trustworthiness type added. 7791 - thread keeps a scratchpad region for handling messages. 7792 - writev used in netevent to write tcp length and data after another. 7793 This saves a roundtrip on tcp replies. 7794 - test for one rrset updated in the cache. 7795 - test for one rrset which is not updated, as it is not deemed 7796 trustworthy enough. 7797 - test for TTL refreshed in rrset. 7798 77993 May 2007: Wouter 7800 - fill refs. Use new parse and encode to answer queries. 7801 - stores rrsets in cache. 7802 - uses new msgreply format in cache. 7803 78042 May 2007: Wouter 7805 - dname unit tests in own file and spread out neatly in functions. 7806 - more dname unit tests. 7807 - message encoding creates truncated TC flagged messages if they do 7808 not fit, and will leave out (whole)rrsets from additional if needed. 7809 78101 May 2007: Wouter 7811 - decompress query section, extremely lenient acceptance. 7812 But only for answers from other servers, not for plain queries. 7813 - compression and decompression test cases. 7814 - some stats added. 7815 - example.conf interface: line is changed from 127.0.0.1 which leads 7816 to problems if used (restricting communication to the localhost), 7817 to a documentation and test address. 7818 781927 April 2007: Wouter 7820 - removed iov usage, it is not good for dns message encoding. 7821 - owner name compression more optimal. 7822 - rrsig owner name compression. 7823 - rdata domain name compression. 7824 782526 April 2007: Wouter 7826 - floating point exception fix in lock-verify. 7827 - lint uses make dependency 7828 - fixup lint in dname owner domain name compression code. 7829 - define for offset range that can be compressed to. 7830 783125 April 2007: Wouter 7832 - prettier code; parse_rrset->type kept in host byte order. 7833 - datatype used for hashvalue of converted rrsig structure. 7834 - unit test compares edns section data too. 7835 783624 April 2007: Wouter 7837 - ttl per RR, for RRSIG rrsets and others. 7838 - dname_print debug function. 7839 - if type is not known, size calc will skip DNAME decompression. 7840 - RRSIG parsing and storing and putting in messages. 7841 - dnssec enabled unit tests (from nlnetlabs.nl and se queries). 7842 - EDNS extraction routine. 7843 784420 April 2007: Wouter 7845 - code comes through all of the unit tests now. 7846 - disabled warning about spurious extra data. 7847 - documented the RRSIG parse plan in msgparse.h. 7848 - rrsig reading and outputting. 7849 785019 April 2007: Wouter 7851 - fix unit test to actually to tests. 7852 - fix write iov helper, and fakevent code. 7853 - extra builtin testcase (small packet). 7854 - ttl converted to network format in packets. 7855 - flags converted correctly 7856 - rdatalen off by 2 error fixup. 7857 - uses less iov space for header. 7858 785918 April 2007: Wouter 7860 - review of msgparse code. 7861 - smaller test cases. 7862 786317 April 2007: Wouter 7864 - copy and decompress dnames. 7865 - store calculated hash value too. 7866 - routine to create message out of stored information. 7867 - util/data/msgparse.c for message parsing code. 7868 - unit test, and first fixes because of test. 7869 * forgot rrset_count addition. 7870 * did & of ptr on stack for memory position calculation. 7871 * dname_pkt_copy forgot to read next label length. 7872 - test from file and fixes 7873 * double frees fixed in error conditions. 7874 * types with less than full rdata allowed by parser. 7875 Some dynamic update packets seem to use it. 7876 787716 April 2007: Wouter 7878 - following a small change in LDNS, parsing code calculates the 7879 memory size to allocate for rrs. 7880 - code to handle ID creation. 7881 788213 April 2007: Wouter 7883 - parse routines. Code that parses rrsets, rrs. 7884 788512 April 2007: Wouter 7886 - dname compare routine that preserves case, with unit tests. 7887 788811 April 2007: Wouter 7889 - parse work - dname packet parse, msgparse, querysection parse, 7890 start of sectionparse. 7891 789210 April 2007: Wouter 7893 - Improved alignment of reply_info packet, nice for 32 and 64 bit. 7894 - Put RRset counts in reply_info, because the number of RRs can change 7895 due to RRset updates. 7896 - import of region-allocator code from nsd. 7897 - set alloc special type to ub_packed_rrset_key. 7898 Uses lruhash entry overflow chain next pointer in alloc cache. 7899 - doxygen documentation for region-allocator. 7900 - setup for parse scratch data. 7901 79025 April 2007: Wouter 7903 - discussed packed rrset with Jelte. 7904 79054 April 2007: Wouter 7906 - moved to version 0.3. 7907 - added util/data/dname.c 7908 - layout of memory for rrsets. 7909 79103 April 2007: Wouter 7911 - detect sign of msghdr.msg_iovlen so that the cast to that type 7912 in netevent (which is there to please lint) can be correct. 7913 The type on several OSes ranges from int, int32, uint32, size_t. 7914 Detects unsigned or signed using math trick. 7915 - constants for DNS flags. 7916 - compilation without locks fixup. 7917 - removed include of unportable header from lookup3.c. 7918 - more portable use of struct msghdr. 7919 - casts for printf warning portability. 7920 - tweaks to tests to port them to the testbed. 7921 - 0.2 tag created. 7922 79232 April 2007: Wouter 7924 - check sizes of udp received messages, not too short. 7925 - review changes. Some memmoves can be memcpys: 4byte aligned. 7926 set id correctly on cached answers. 7927 - review changes msgreply.c, memleak on error condition. AA flag 7928 clear on cached reply. Lowercase queries on hashing. 7929 unit test on lowercasing. Test AA bit not set on cached reply. 7930 Note that no TTLs are managed. 7931 793229 March 2007: Wouter 7933 - writev or sendmsg used when answering from cache. 7934 This avoids a copy of the data. 7935 - do not do useless byteswap on query id. Store reply flags in uint16 7936 for easier access (and no repeated byteswapping). 7937 - reviewed code. 7938 - configure detects and config.h includes sys/uio.h for writev decl. 7939 794028 March 2007: Wouter 7941 - new config option: num-queries-per-thread. 7942 - added tpkg test for answering three queries at the same time 7943 using one thread (from the query service list). 7944 794527 March 2007: Wouter 7946 - added test for cache and not cached answers, in testbound replays. 7947 - testbound can give config file and commandline options from the 7948 replay file to unbound. 7949 - created test that checks if items drop out of the cache. 7950 - added word 'partitioned hash table' to documentation on slab hash. 7951 A slab hash is a partitioned hash table. 7952 - worker can handle multiple queries at a time. 7953 795426 March 2007: Wouter 7955 - config settings for slab hash message cache. 7956 - test for cached answer. 7957 - Fixup deleting fake answer from testbound list. 7958 795923 March 2007: Wouter 7960 - review of yesterday's commits. 7961 - covered up memory leak of the entry locks. 7962 - answers from the cache correctly. Copies flags correctly. 7963 - sanity check for incoming query replies. 7964 - slabbed hash table. Much nicer contention, need dual cpu to see. 7965 796622 March 2007: Wouter 7967 - AIX configure check. 7968 - lock-verify can handle references to locks that are created 7969 in files it has not yet read in. 7970 - threaded hash table test. 7971 - unit test runs lock-verify afterwards and checks result. 7972 - need writelock to update data on hash_insert. 7973 - message cache code, msgreply code. 7974 797521 March 2007: Wouter 7976 - unit test of hash table, fixup locking problem in table_grow(). 7977 - fixup accounting of sizes for removing items from hashtable. 7978 - unit test for hash table, single threaded test of integrity. 7979 - lock-verify reports errors nicely. More quiet in operation. 7980 798116 March 2007: Wouter 7982 - lock-verifier, checks consistent order of locking. 7983 798414 March 2007: Wouter 7985 - hash table insert (and subroutines) and lookup implemented. 7986 - hash table remove. 7987 - unit tests for hash internal bin, lru functions. 7988 798913 March 2007: Wouter 7990 - lock_unprotect in checklocks. 7991 - util/storage/lruhash.h for LRU hash table structure. 7992 799312 March 2007: Wouter 7994 - configure.ac moved to 0.2. 7995 - query_info and replymsg util/data structure. 7996 79979 March 2007: Wouter 7998 - added rwlock writelock checking. 7999 So it will keep track of the writelock, and readlocks are enforced 8000 to not change protected memory areas. 8001 - log_hex function to dump hex strings to the logfile. 8002 - checklocks zeroes its destroyed lock after checking memory areas. 8003 - unit test for alloc. 8004 - identifier for union in checklocks to please older compilers. 8005 - created 0.1 tag. 8006 80078 March 2007: Wouter 8008 - Reviewed checklock code. 8009 80107 March 2007: Wouter 8011 - created a wrapper around thread calls that performs some basic 8012 checking for data race and deadlock, and basic performance 8013 contention measurement. 8014 80156 March 2007: Wouter 8016 - Testbed works with threading (different machines, different options). 8017 - alloc work, does the special type. 8018 80192 March 2007: Wouter 8020 - do not compile fork funcs unless needed. Otherwise will give 8021 type errors as their typedefs have not been enabled. 8022 - log shows thread numbers much more nicely (and portably). 8023 - even on systems with nonthreadsafe libevent signal handling, 8024 unbound will exit if given a signal. 8025 Reloads will not work, and exit is not graceful. 8026 - start of alloc framework layout. 8027 80281 March 2007: Wouter 8029 - Signals, libevent and threads work well, with libevent patch and 8030 changes to code (close after event_del). 8031 - set ipc pipes nonblocking. 8032 803327 February 2007: Wouter 8034 - ub_thread_join portable definition. 8035 - forking is used if no threading is available. 8036 Tested, it works, since pipes work across processes as well. 8037 Thread_join is replaced with waitpid. 8038 - During reloads the daemon will temporarily handle signals, 8039 so that they do not result in problems. 8040 - Also randomize the outgoing port range for tests. 8041 - If query list is full, will stop selecting listening ports for read. 8042 This makes all threads service incoming requests, instead of one. 8043 No memory is leaking during reloads, service of queries, etc. 8044 - test that uses ldns-testns -f to test threading. Have to answer 8045 three queries at the same time. 8046 - with verbose=0 operates quietly. 8047 804826 February 2007: Wouter 8049 - ub_random code used to select ID and port. 8050 - log code prints thread id. 8051 - unbound can thread itself, with reload(HUP) and quit working 8052 correctly. 8053 - don't open pipes for #0, doesn't need it. 8054 - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload). 8055 805623 February 2007: Wouter 8057 - Can do reloads on sigHUP. Everything is stopped, and freed, 8058 except the listening ports. Then the config file is reread. 8059 And everything is started again (and listening ports if needed). 8060 - Ports for queries are shared. 8061 - config file added interface:, chroot: and username:. 8062 - config file: directory, logfile, pidfile. And they work too. 8063 - will daemonize by default now. Use -d to stay in the foreground. 8064 - got BSD random[256 state] code, made it threadsafe. util/random. 8065 806622 February 2007: Wouter 8067 - Have a config file. Removed commandline options, moved to config. 8068 - tests use config file. 8069 807021 February 2007: Wouter 8071 - put -c option in man page. 8072 - minievent fd array capped by FD_SETSIZE. 8073 807420 February 2007: Wouter 8075 - Added locks code and pthread spinlock detection. 8076 - can use no locks, or solaris native thread library. 8077 - added yacc and lex configure, and config file parsing code. 8078 also makedist.sh, and manpage. 8079 - put include errno.h in config.h 8080 808119 February 2007: Wouter 8082 - Created 0.0 svn tag. 8083 - added acx_pthread.m4 autoconf check for pthreads from 8084 the autoconf archive. It is GPL-with-autoconf-exception Licensed. 8085 You can specify --with-pthreads, or --without-pthreads to configure. 8086 808716 February 2007: Wouter 8088 - Updated testbed script, works better by using make on remote end. 8089 - removed check decls, we can compile without them. 8090 - makefile supports LIBOBJ replacements. 8091 - docs checks ignore compat code. 8092 - added util/mini-event.c and .h, a select based alternative used with 8093 ./configure --with-libevent=no 8094 It is limited to 1024 file descriptors, and has less features. 8095 - will not create ip6 sockets if ip6 not on the machine. 8096 809715 February 2007: Wouter 8098 - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64, 8099 Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc. 8100 - malloc rndstate, so that it is aligned for access. 8101 - fixed rbtree cleanup with postorder traverse. 8102 - fixed pending messages are deleted when handled. 8103 - You can control verbosity; default is not verbose, every -v 8104 adds more verbosity. 8105 810614 February 2007: Wouter 8107 - Included configure.ac changes from ldns. 8108 - detect (some) headers before the standards check. 8109 - do not use isblank to test c99, since its not available on solaris9. 8110 - review of testcode. 8111 * entries in a RANGE are no longer reversed. 8112 * print name of file with replay entry parse errors. 8113 - port to OSX: cast to int for some prints of sizet. 8114 - Makefile copies ldnstestpkts.c before doing dependencies on it. 8115 811613 February 2007: Wouter 8117 - work on fake events, first fwd replay works. 8118 - events can do timeouts and errors on queries to servers. 8119 - test package that runs replay scenarios. 8120 812112 February 2007: Wouter 8122 - work on fake events. 8123 81249 February 2007: Wouter 8125 - replay file reading. 8126 - fake event setup, it creates fake structures, and teardowns, 8127 added signal callbacks to reply to be able to fake those, 8128 and main structure of event replay routines. 8129 81308 February 2007: Wouter 8131 - added tcp test. 8132 - replay storage. 8133 - testcode/fake_event work. 8134 81357 February 2007: Wouter 8136 - return answer with the same ID as query was sent with. 8137 - created udp forwarder test. I've done some effort to make it perform 8138 quickly. After servers are created, no big sleep statements but 8139 it checks the logfiles to see if servers have come up. Takes 0.14s. 8140 - set addrlen value when calling recvfrom. 8141 - comparison of addrs more portable. 8142 - LIBEVENT option for testbed to set libevent directory. 8143 - work on tcp input. 8144 81456 February 2007: Wouter 8146 - reviewed code and improved in places. 8147 81485 February 2007: Wouter 8149 - Picked up stdc99 and other define tests from ldns. Improved 8150 POSIX define test to include getaddrinfo. 8151 - defined constants for netevent callback error code. 8152 - unit test for strisip6. 8153 81542 February 2007: Wouter 8155 - Created udp4 and udp6 port arrays to provide service for both 8156 address families. 8157 - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets. 8158 - listens on both ip4 and ip6 ports to provide correct return address. 8159 - worker fwder address filled correctly. 8160 - fixup timer code. 8161 - forwards udp queries and sends answer. 8162 81631 February 2007: Wouter 8164 - outside network more UDP work. 8165 - moved * closer to type. 8166 - comm_timer object and events. 8167 816831 January 2007: Wouter 8169 - Added makedist.sh script to make release tarball. 8170 - Removed listen callback layer, did not add anything. 8171 - Added UDP recv to netevent, worker callback for udp. 8172 - netevent communication reply storage structure. 8173 - minimal query header sanity checking for worker. 8174 - copied over rbtree implementation from NSD (BSD licensed too). 8175 - outgoing network query service work. 8176 817730 January 2007: Wouter 8178 - links in example/ldns-testpkts.c and .h for premade packet support. 8179 - added callback argument to listen_dnsport and daemon/worker. 8180 818129 January 2007: Wouter 8182 - unbound.8 a short manpage. 8183 818426 January 2007: Wouter 8185 - fixed memleak. 8186 - make lint works on BSD and Linux (openssl defines). 8187 - make tags works. 8188 - testbound program start. 8189 819025 January 2007: Wouter 8191 - fixed lint so it may work on BSD. 8192 - put license into header of every file. 8193 - created verbosity flag. 8194 - fixed libevent configure flag. 8195 - detects event_base_free() in new libevent 1.2 version. 8196 - getopt in daemon. fatal_exit() and verbose() logging funcs. 8197 - created log_assert, that throws assertions to the logfile. 8198 - listen_dnsport service. Binds ports. 8199 820024 January 2007: Wouter 8201 - cleaned up configure.ac. 8202 820323 January 2007: Wouter 8204 - added libevent to configure to link with. 8205 - util/netevent setup work. 8206 - configure searches for libevent. 8207 - search for libs at end of configure (when other headers and types 8208 have been found). 8209 - doxygen works with ATTR_UNUSED(). 8210 - util/netevent implementation. 8211 821222 January 2007: Wouter 8213 - Designed header file for network communication. 8214 821516 January 2007: Wouter 8216 - added readme.svn and readme.tests. 8217 82184 January 2007: Wouter 8219 - Testbed script (run on multiple platforms the test set). 8220 Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5. 8221 - added unit test tpkg. 8222 82233 January 2007: Wouter 8224 - committed first set of files into subversion repository. 8225 svn co svn+ssh://unbound.net/svn/unbound 8226 You need a ssh login. There is no https access yet. 8227 - Added LICENSE, the BSD license. 8228 - Added doc/README with compile help. 8229 - main program stub and quiet makefile. 8230 - minimal logging service (to stderr). 8231 - added postcommit hook that serves emails. 8232 - added first test 00-lint. postcommit also checks if build succeeds. 8233 - 01-doc: doxygen doc target added for html docs. And stringent test 8234 on documented files, functions and parameters. 8235 823615 December 2006: Wouter 8237 - Created Makefile.in and configure.ac. 8238