Lines Matching +full:readme +full:. +full:installer
2 - Set version number to 1.19.0.
3 - Tag for 1.19.0rc1 release.
6 - Mention flex and bison in README.md when building from repository
7 source.
10 - Fix SSL compile failure for definition in log_crypto_err_io_code_arg.
12 log_crypto_err_io_code_arg.
13 - Fix compilation without openssl, remove unused function warning.
17 suggestion by dukeartem to also fix the udp_ancil with dnscrypt.
21 log_ident_revert_to_default declaration.
24 - autoconf.
27 - Clearer configure text for missing protobuf-c development libraries.
30 - Merge #951: Cachedb no store. The cachedb-no-store: yes option is
31 used to stop cachedb from writing messages to the backend storage.
32 It reads messages when data is available from the backend. The
33 default is no.
37 SSL_get_error.
42 refactoring for better readability.
43 - Fixes for the DNS64 patches.
44 - Update the dns64_lookup.rpl test for the DNS64 fallback patch.
45 - Merge #955 from buevsan: fix ipset wrong behavior.
46 - Update testdata/ipset.tdir test for ipset fix.
50 CNAME.
55 of scripts in a multi Python module setup; fixes #79.
58 current Swig object proxy; fixes #79.
61 module functions are registered.
66 same as transmission end. Addesses #947 and #948.
69 - Merge #944: Disable EDNS DO.
70 Disable the EDNS DO flag in upstream requests. This can be helpful
71 for devices that cannot handle DNSSEC information. But it should not
72 be enabled otherwise, because that would stop DNSSEC validation. The
74 for downstream users. Default is no. The option
79 redis-logical-db configuration option.
82 - Fix #949: "could not create control compt".
84 use of serve-expired-reply-ttl and serve-expired-client-timeout.
85 - Fix for #949: Fix pythonmod/ubmodule-tst.py for Python 3.x.
89 remote control socket. Addesses #947 and #948.
93 the recursor send no edns subnet option to the upstream.
95 name.
99 data.
102 - Merge #881: Generalise the proxy protocol code.
105 - Fix misplaced comment.
108 - Fix #942: 1.18.0 libunbound DNS regression when built without
109 OpenSSL.
112 - Fix rpz tcp-only action with rpz triggers nsdname and nsip.
115 - Merge #936: Check for c99 with autoconf versions prior to 2.70.
116 - Fix to remove two c99 notations.
119 - Fix authority zone answers for obscured DNAMEs and delegations.
122 - Fix send of udp retries when ENOBUFS is returned. It stops looping
123 and also waits for the condition to go away. Reported by Florian
124 Obser.
128 inappropriate size. They are removed from responses.
129 - Fix to move msgparse_rrset_remove_rr code to util/msgparse.c.
130 - Fix to add EDE text when RRs have been removed due to length.
131 - Fix to set ede match in unit test for rr length removal.
132 - Fix to print EDE text in readable form in output logs.
135 - Merge #931: Prevent warnings from -Wmissing-prototypes.
138 - Fix autoconf 2.69 warnings in configure.
139 - Fix #927: unbound 1.18.0 make test error. Fix make test without SHA1.
144 list later.
147 - Fix for version generation race condition that ignored changes.
150 - Fix compile error on NetBSD in util/netevent.h.
153 - Tag for 1.18.0rc1 release. This became the 1.18.0 release on
155 included. The repository continues with version 1.18.1.
158 - Set version number to 1.18.0.
161 - Debug Windows ci workflow.
162 - Fix windows ci workflow to install bison and flex.
163 - Fix for #925: unbound.service: Main process exited, code=killed,
164 status=11/SEGV. Fixes cachedb configuration handling.
166 fail_reply.
168 and fix cache dump check.
172 capsforid and qname minimisation, depending on the settings.
173 - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg.
174 - Fix stat_values test to work with dig that enables DNS cookies.
178 RFC9018. Create server cookies for clients that send client cookies.
180 `answer-cookie: yes`. A `cookie-secret:` can be configured for
181 anycast setups. Without one, a random cookie secret is generated.
183 cookie or over a stateful transport. The statistics output has
185 `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:`
186 value determines a rate limit for queries with cookies, if desired.
187 - Fix regional_alloc_init for potential unaligned source of the copy.
188 - Fix ip_ratelimit test to work with dig that enables DNS cookies.
191 - Move a cache reply callback in worker.c closer to the cache reply
192 generation.
196 when there isn't enough space.
198 altogether) before giving up on attaching EDE options.
200 avoid future bugs.
201 - Fix to use the now cached EDE, if any, for CD_bit queries.
204 - Fix for EDNS EDE size calculation.
208 and subnetcache.
211 - iana portlist update.
214 - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching.
218 netevent.c
222 happen.
223 - For #857: fix mixed declarations and code.
225 deinit.
227 module.
228 - Cleaner failure code for callback functions in interface.i.
230 unused function.
231 - For #889: use netcat-openbsd instead of netcat-traditional.
233 mesh_state_delete when erroring out.
237 CLASSXX representation.
238 - For #909: Fix return values.
240 unknown modules.
243 - For #909: Fix RR class comparison.
247 man page.
250 - Merge #880 from chipitsine: services/authzone.c: remove redundant
251 check.
255 entries.
256 - For #664: Easier code flow for subnetcache prefetching.
257 - For #664: Add testcase.
259 differentiate from the new subnet prefetch support.
262 - Merge #739: Add SVCB dohpath support.
263 - Code cleanup for sldns_str2wire_svcparam_key_lookup.
264 - Merge #802: add validation EDEs to queries where the CD bit is set.
265 - For #802: Cleanup comments and add RCODE check for CD bit test case.
266 - Skip the 00-lint test. splint is not maintained; it either does not
267 work or produces false positives. Static analysis is handled in the
268 clang test.
271 - Fix #906: warning: ‘Py_SetProgramName’ is deprecated.
272 - Fix dereference of NULL variable warning in mesh_do_callback.
276 failure code.
278 which causes memory leaks.
282 counts.
285 - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as
286 a new statistical counter.
287 - Remove warning about unknown cast-function-type warning pragma.
290 - Merge #903: contrib: add yocto compatible init script.
299 early EDE code.
300 - Do not check the incoming request more than once.
304 directories to sys.path.
306 distutils.
307 - Fix for uncertain unit test for doh buffer size events.
310 - Fix unbound-dnstap-socket printout when no query is present.
311 - Fix unbound-dnstap-socket time fraction conversion for printout.
314 - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR.
315 - Fix to remove unused variables from RPZ clientip data structure.
318 - Fix #888: [FR] Use kernel timestamps for dnstap.
319 - Fix to print debug log for ancillary data with correct IP address.
322 - Fix warning in windows compile, in set_recvtimestamp.
325 - Fix #885: Error: util/configlexer.c: No such file or directory,
326 adds error messages explaining to install flex and bison.
327 - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h.
328 - Fix doxygen in addr_to_nat64 header definition.
331 - Merge #722 from David 'eqvinox' Lamparter: NAT64 support.
332 - For #722: minor fixes, formatting, refactoring.
336 they are dropped.
344 socket queue for too long. Added statistics num.queries_timed_out
345 and query.queue_time_us.max that track the socket queue timeouts.
347 util/timeval_func.c and util/timeval_func.h. Man page entries and
348 example entry.
349 - Fix for #882: document variable to stop doxygen warning.
352 - Fix for #878: Invalid IP address in unbound.conf causes Segmentation
353 Fault on OpenBSD.
356 - Merge #875: change obsolete txt URL in unbound-anchor.c to point
357 to RFC 7958, and Fix #874.
360 - Fix build badge, from failing travis link to github ci action link.
363 - Fix for #870: Add test case for the qname minimisation and CNAME.
367 CNAME record.
373 either we set up a TLS connection or we return an error.
379 - iana portlist update.
383 to ignore the unexpected eof while reading in openssl >= 3.
386 - Fix ssl.h include brackets, instead of quotes.
390 over a TLS connection correctly.
393 - Fix for #852: Completion of error handling.
400 - Clean up iterator/iterator.c::error_response_cache() and allow for
402 responses.
405 - Allow TTL refresh of expired error responses.
406 - Add testcase for refreshing expired error responses.
409 - Fix to ignore entirely empty responses, and try at another authority.
412 fetch improved content.
413 - Fix unit tests for spurious empty messages.
415 cnametooptout unit test.
416 - Fix to git ignore the library symbol file that configure can create.
419 - Fix #841: Unbound won't build with aaaa-filter-iterator.patch.
422 - Add duration variable for speed_local.test.
425 - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes.
428 - Fix #833: [FR] Ability to set the Redis password.
431 - Fix #835: [FR] Ability to use Redis unix sockets.
435 queries for specific zones.
438 - Set max-udp-size default to 1232. This is the same default value as
439 the default value for edns-buffer-size. It restricts client edns
441 resolvers. The new choice, down from 4096 means it is harder to get
442 large responses from Unbound. Thanks to Xiang Li, from NISL Lab,
443 Tsinghua University.
444 - Add harden-unknown-additional option. It removes
445 unknown records from the authority section and additional section.
446 Thanks to Xiang Li, from NISL Lab, Tsinghua University.
447 - Set default for harden-unknown-additional to no. So that it does
448 not hamper future protocol developments.
449 - Fix test for new default.
454 Tsinghua University. The fix stops query loops, by refusing to send
455 RD=0 queries to a forwarder, they still get answered from cache.
459 lrushah.
460 - Improve documentation for #826, describe the large collisions amount.
463 - Fix python module install path detection.
464 - Fix python version detection in configure.
468 1.12, tested on 1.16.1.
470 by Sergey Kacheev. This fix is included in 1.17.1rc2.
471 That became 1.17.1 on 12 Jan 2023, the code repo continues
472 with 1.17.2. 1.17.1 excludes fix #823, it is included forwards.
475 - Tag for 1.17.1 release.
478 - Fix windows compile for libunbound subprocess reap comm point closes.
479 - Update github workflows to use checkout v3.
483 'unbound-control reload' to keep caches.
487 default value retains Unbound's behavior.
489 default value retains Unbound's behavior.
490 - Merge #461 from Christian Allred: Add max-query-restarts option.
492 Unbound's behavior.
495 - Merge #808: Wrap Makefile script's directory variables in quotes.
496 - Fix to wrap Makefile scripts directory in quotes for uninstall.
500 until systemd-networkd-wait-online.service times out.
503 - Add SVCB and HTTPS to the types removed by 'unbound-control flush'.
505 the serve-expired and prefetch configuration options.
508 - Fix #782: Segmentation fault in stats.c:404.
512 the use after free protection features.
516 WSACreateEvent() fails.
519 - Ignore expired error responses.
523 callback parameter was_ratelimited.
526 - Complementary fix for distutils.sysconfig deprecation in Python 3.10
527 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2.
530 - Fix to ignore tcp events for closed comm points.
531 - Fix to make sure to not read again after a tcp comm point is closed.
533 to hang.
534 - iana portlist update.
538 unbound.conf.5.
541 - Fix that cachedb does not store failures in the external cache.
544 - Clarify the use of MAX_SENT_COUNT in the iterator code.
547 - testcode/dohclient sets log identity to its name.
551 extension.
552 - In unit test, print python script name list correctly.
555 - Tag for 1.17.0 release. The code repository continues with 1.17.1.
559 are provided.
562 - Tag for 1.17.0rc1 release.
566 and tcp_wait list). Based on analysis and patch from Prad Seniappan
567 and Karthik Umashankar.
568 - Fix unit test to properly test the reuse_write_wait_pop function.
572 responses. It retries to fetch the data elsewhere, or fails the
573 query and in depth fix removes the TC flag from the cached item.
574 - Fix proxy length debug output printout typecasts.
577 - Fix dnscrypt compile for proxy protocol code changes.
580 - Use DEBUG_TDIR from environment in mini_tdir.sh for debugging.
581 - Fix string comparison in mini_tdir.sh.
582 - Make ede.tdir test more predictable by using static data.
583 - Fix checkconf test for dnscrypt and proxy port.
587 NRDelegation changes).
591 rpz_callback_from_iterator_module function.
592 - Fix to clean up after the acl_interface unit test.
595 - Merge #760: PROXYv2 downstream support. (New proxy-protocol-port
596 configuration option).
599 - Fix to remove erroneous TC flag from TCP upstream.
600 - Fix test tdir skip report printout.
601 - Fix windows compile, the identifier interface is defined in headers.
603 ifdef.
606 - Better output for skipped tdir tests.
609 - Patch for CVE-2022-3204 Non-Responsive Delegation Attack.
610 - This patch was released in 1.16.3, the code repository continues
611 with the previous features and fixes for 1.17.0.
612 - Fix doxygen warning in respip.h.
615 - Convert tdir tests to use the new skip_test functionality.
616 - Remove unused testcode/mini_tpkg.sh file.
619 - Merge #753: ACL per interface. (New interface-* configuration
620 options).
623 - Remove include that was there for debug purposes.
624 - Fix to check pthread_t size after pthread has been detected.
628 work on OpenBSD.
629 - Slow down log frequency of write wait failures.
630 - Fix to set out of file descriptor warning to operational verbosity.
632 thread is not responding, to stats requests. It is logged with
633 thread identifiers.
637 operations after a blocked write.
640 blocking socket operations.
642 takes too long the packet is dropped.
643 - Fix for wait for udp send to stop when packet is successfully sent.
646 - Fix #741: systemd socket activation fails on IPv6.
650 per 10 seconds. Also log accept failures when no slow down is used.
654 errors.
658 amount allowed, like for ratelimits.
662 queries for answers from cache if from a query with sourcemask 0.
663 - Fix unittest for edns subnet change.
665 to unsupported IPV6_USER_MTU socket option being set.
668 - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699.
669 - Tests for ghost domain fixes.
670 - Tag for 1.16.2 release. The code repo continues with 1.16.3.
671 - Fix #728: alloc_reg_obtain() core dump. Stop double
672 alloc_reg_release when serviced_create fails.
675 - Update documentation for 'outbound-msg-retry:'.
679 retransmit timeout.
682 - Merge PR 714: Avoid treat normal hosts as unresponsive servers.
683 And fixup the lock code.
684 - iana portlist update.
689 cross-compiler versions.
692 - Fix dname count in sldns parse type descriptor for SVCB and HTTPS.
695 - Fix verbose EDE error printout.
698 - Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing for
699 one loop pass'.
701 outbound tcp sockets.
704 - Tag for 1.16.1rc1 release. This became 1.16.1 on 11 July 2022.
705 The code repo continues with version 1.16.2 under development.
709 mode on openssl3.
710 - Merge PR #660 from Petr Menšík: Sha1 runtime insecure.
711 - For #660: formatting, less verbose logging, add EDE information.
713 the openssl trust store.
714 - Improve val_sigcrypt.c::algo_needs_missing for one loop pass.
716 val_sigcrypt.c::dnskeyset_verify_rrset_sig.
719 - Merge PR #706: NXNS fallback.
721 responses.
723 have the lame records in cache.
725 generate target queries when the missing targets are all lame.
728 - iana portlist update.
729 - Fix detection of libz on windows compile with static option.
730 - Fix compile warning for windows compile.
733 - Add debug option to the mini_tdir.sh test code.
735 sent; introduces 'num.query.udpout' to the 'unbound-control stats'
736 command.
737 - Fix to not count cached NXDOMAIN for MAX_TARGET_NX.
738 - Allow fallback to the parent side when MAX_TARGET_NX is reached.
739 This will also allow MAX_TARGET_NX more NXDOMAINs.
742 - Show the output of the exact .rpl run that failed with 'make test'.
744 serve-expired-client-timeout is set.
747 - Fix test program dohclient close to use portability routine.
753 - Fix #663: use after free issue with edns options.
757 blanks and comments.
760 - Remove unused LDNS function check for GOST Engine unloading.
763 - Merge PR #688: Rpz url notify issue.
764 - Note in the unbound.conf text that NOTIFY is allowed from the url:
765 addresses for auth and rpz zones.
769 instructed to do so (e.g., prefetch).
772 - makedist.sh picks up 32bit libssp-0.dll when 32bit compile.
776 - Version is set to 1.16.0 for release. Release tag 1.16.0rc1. This
777 became release 1.16.0 on 2 June 2022. The source code branch
778 continues with version 1.16.1 under development.
782 test setup script.
783 - Fix ede test to not use default pidfile, and use local interface.
784 - Fix some lint type warnings.
788 'ede-serve-expired' options.
792 by updating unbound-control's documentation.
796 together.
800 from pemensik.
801 - For #677: Added tls-system-cert to config parser and documentation.
805 host.
809 Michael Tokarev.
812 - Merge PR #604: Add basic support for EDE (RFC8914).
815 - Fix #670: SERVFAIL problems with unbound 1.15.0 running on
816 OpenBSD 7.1.
819 - Fix zonemd check to allow unsupported algorithms to load.
822 or bad ZONEMD records, the unsupported records allow the zone load.
823 - Fix zonemd unsupported algo check.
825 and check for success for debug printout.
827 zeroing it.
830 output when the digest matches.
833 - Fix spelling error in comment in sldns_str2wire_svcparam_key_lookup.
836 - Fix #651: [FR] Better logging for refused queries.
840 'unbound-control stats_shm'.
844 configuration option, to allow for more broadly view of the options.
847 - Fix to ensure uniform handling of spaces and tabs when parsing RRs.
851 file.
855 deprecated. It uses sysutils when available, distutils otherwise.
858 - Fix #637: Integer Overflow in sldns_str2period function.
859 - Fix for #637: fix integer overflow checks in sldns_str2period.
862 - Merge PR #632 from scottrw93: Match cnames in ipset.
864 to str once, accept trailing dot in the local-zone ipset option.
867 - Fix compile warnings for printf ll format on mingw compile.
870 - Fix pythonmod for change in iter_dp_is_useless function prototype.
873 - Fix #630: Unify the RPZ log messages.
874 - Merge #623 from rex4539: Fix typos.
877 - Fix #633: Document unix domain socket support for unbound-control.
878 - Fix for #633: updated fix with new text.
881 double EDNS options.
882 - Fix for edns client subnet option add fix in removal code, from review.
886 useless for delegation point lookups.
887 - update Makefile dependencies.
888 - Fix check interface existence for support detection in remote lookup.
892 udp connect failures. It is visible on verbosity 4 and more.
894 ERR_GET_REASON.
897 - Fix for #628: fix rpz-passthru for qname trigger by localzone type.
900 - Fix #628: A rpz-passthru action is not ending RPZ zone processing.
904 respond to CTRL+C command).
905 - Fix #618: enabling interface-automatic disables DNS-over-TLS.
906 Adds the option to list interface-automatic-ports.
907 - Remove debug info from #618 fix.
910 - Fix that TCP interface does not use TLS when TLS is also configured.
913 - Fix #412: cache invalidation issue with CNAME+A.
916 - Fix for #611: Integer overflow in sldns_wire2str_pkt_scan.
917 - Tag for 1.15.0rc1 created. That became 1.15.0 on 10 feb 2022.
918 The repository continues with version 1.15.1.
921 - Merge PR #532 from Shchelk: Fix: buffer overflow bug.
922 - Merge PR #616: Update ratelimit logic. It also introduces
923 ratelimit-backoff and ip-ratelimit-backoff configuration options.
924 - Change aggressive-nsec default to yes.
926 tls-auth-name.
927 - Update stream_ssl.tdir test to also use the new forward-host
928 notation.
931 - Update version number in repo to 1.15.0 for upcoming release,
932 since it changes the aggressive-nsec default and the ratelimit change.
933 - Fix header comment for doxygen for authextstrtoaddr.
934 - please clang analyzer for loop in test code.
935 - Fix docker splint test to use more portable uname.
936 - Update contrib/aaaa-filter-iterator.patch with diff for current
937 software version.
941 internals.
944 - Fix review comment for use-after-free when failing to send UDP out.
947 - iana portlist update.
951 through remote-control and unbound-checkconf.
952 - Better cleanup on failed DoT/DoH listening socket creation.
956 document.
959 - Test for NSID in SERVFAIL response due to DNSSEC bogus.
962 - Fix #588: Unbound 1.13.2 crashes due to p->pc is NULL in
963 serviced_udp_callback.
964 - Merge PR #612: TCP race condition.
967 - Fix #610: Undefine-shift in sldns_str2wire_hip_buf.
970 - For dnstap, do not wakeupnow right there. Instead zero the timer to
971 force the wakeup callback asap.
976 more than once.
977 - Add a region to serviced_query for allocations.
982 checked with DNS queries directed at the RPZ zone.
984 iterator".
987 - Fix prematurely terminated TCP queries when a reply has the same ID.
991 owner.
995 the rcode from the iterator return path. This fixes signal unset RA
996 after a CNAME.
998 the iterator loop.
999 - Fix for #596: add unit test for nsdname trigger and signal unset RA.
1000 - Fix for #596: add unit test for nsip trigger and signal unset RA.
1002 'respip dns64 validator iterator' is not known to work.
1004 triggered operation.
1008 RPZ nxdomain reply. The option rpz-signal-nxdomain-ra allows to
1010 is blocked with NXDOMAIN by unsetting RA.
1011 - Fix to add test for rpz-signal-nxdomain-ra.
1012 - Fix #596: only unset RA when NXDOMAIN is signalled.
1014 from the query.
1017 - contrib/aaaa-filter-iterator.patch file renewed diff content to
1018 apply cleanly to the current coderepo for the current code version.
1021 - Fix #591: Unbound-anchor manpage links to non-existent license file.
1025 documentation.
1026 - Fix Unbound capitalization in the documentation.
1029 - Fix to pick up other class local zone information before unlock.
1034 transparent as per the implicit rule.
1038 consistency, the test case was not broken.
1042 warnings in rpz.
1043 - Fix validator debug output about DS support, print correct algorithm.
1046 - Fix compile warning for if_nametoindex on windows 64bit.
1049 - configure is set to 1.14.0, and release branch.
1050 This was released as version 1.14.0 on 9 Dec 2021, with the doxygen
1051 fix below included. The main branch continues as 1.14.1.
1052 - Fix doc/unbound.doxygen to remove obsolete tag warning.
1055 - Merge PR #511 from yan12125: Reduce unnecessary linking.
1056 - Merge PR #493 from Jaap: Fix generation of libunbound.pc.
1058 link-local addresses.
1059 - Merge PR #562 from Willem: Reset keepalive per new tcp session.
1060 - Merge PR #522 from sibeream: memory management violations fixed.
1061 - Merge PR #530 from Shchelk: Fix: dereferencing a null pointer.
1062 - Fix #454: listen_dnsport.c:825: error: ‘IPV6_TCLASS’ undeclared.
1063 - Fix #574: Review fixes for size allocation.
1066 - Fix to remove git tracking and ci information from release tarballs.
1067 - iana portlist update.
1070 - Merge PR #570 from rex4539: Fix typos.
1071 - Fix for #570: regen aclocal.m4, fix configure.ac for spelling.
1072 - Fix to make python module opt_list use opt_list_in.
1075 - Fix #574: Review fixes for it.
1076 - Fix #576: [FR] UB_* error codes in unbound.h
1077 - Fix #574: Review fix for spelling.
1081 responses such as local-data and server.id CH TXT responses.
1085 reclaimed more than once during callbacks.
1086 - Fix for #558: clear the UB_EV_TIMEOUT bit before adding an event.
1090 zone. It is not relative but a fully qualified domain name.
1092 crash on unlocking the local zone lock.
1094 function.
1095 - Merge #565: unbound.service.in: Disable ProtectKernelTunables again.
1098 - Fix #552: Unbound assumes index.html exists on RPZ host.
1102 or long reply strings.
1103 - Fix to protect custom regional create against small values.
1106 - Fix to add example.conf note for outbound-msg-retry.
1109 - Implement RFC8375: Special-Use Domain 'home.arpa.'.
1112 - For crosscompile on windows, detect 64bit stackprotector library.
1113 - Fix crosscompile shell syntax.
1114 - Fix crosscompile windows to use libssp when it exists.
1115 - For the windows compile script disable gost.
1117 BIO_set_callback.
1118 - Fix crosscompile script for the shared build flags.
1121 - Fix crosscompile on windows to work with openssl 3.0.0 the
1122 link with ws2_32 needs -l:libssp.a for __strcpy_chk.
1123 Also copy results from lib64 directory if needed.
1126 - Fix initialisation errors reported by gcc sanitizer.
1127 - Fix lock debug code for gcc sanitizer reports.
1128 - Fix more initialisation errors reported by gcc sanitizer.
1132 configurable.
1136 and some whitespace style, to make it similar to the rest.
1138 warnings.
1139 - Fix root_anchor test to check with new icannbundle date.
1142 - Fix #538: Fix subnetcache statistics.
1145 - Fix tcp fastopen failure when disabled, try normal connect instead.
1152 - Merge #401: RPZ triggers. This add additional RPZ triggers,
1154 includes nsdname, nsip and clientip triggers. Also actions
1155 are fully supported, and this now includes the tcp-only action.
1156 - Fix #536: error: RPZ: name of record (drop.spamhaus.org.rpz.local.)
1157 to insert into RPZ.
1159 setup and desetup from race condition.
1160 - Fix RPZ locks. Do not unlock zones lock if requested and rpz find
1161 zone does not find the zone. Readlock the clientip that is found
1162 for ipbased triggers. Unlock the nsdname zone lock when done.
1163 Unlock zone and ip in rpz nsip and nsdname callback. Unlock
1164 authzone and localzone if clientip found in rpz worker call.
1165 - Fix compile warning in libunbound for listen desetup routine.
1166 - Fix asynclook unit test for setup of lockchecks before log.
1170 undefined.
1171 - Fix #531: Fix: passed to proc after free.
1175 location of a different openssl version.
1176 - Fix #527: not sending quad9 cert to syslog (and may be more).
1177 - Fix sed script in ssldir split handling.
1181 static.
1184 - Fix to support harden-algo-downgrade for ZONEMD dnssec checks.
1187 - Support using system-wide crypto policies.
1189 and udp send, they are visible at higher verbosity settings.
1191 and needs a chain of trust.
1192 - zonemd, fix order of bogus printout string manipulation.
1195 - Merge PR #514, from ziollek: Docker environment for run tests.
1196 - For #514: generate configure.
1199 - And 1.13.2rc1 became the 1.13.2 with the fix for the python module
1200 build. The current code repository continues with version 1.13.3.
1201 - Add test tool readzone to .gitignore.
1202 - Merge #521: Update mini_event.c.
1203 - Merge #523: fix: free() call more than once with the same pointer.
1205 stub/forward zones.
1207 the example configuration file.
1208 - For #519: yacc and lex. And fix python bindings, and test program
1209 unbound-dnstap-socket.
1210 - For #519: fix comments for doxygen.
1212 file, also when not verbose.
1215 - Tag for 1.13.2rc1 release.
1216 - Fix #520: Unbound 1.13.2rc1 fails to build python module.
1221 ports. (New --enable-linux-ip-local-port-range configuration option)
1222 - Bump MAX_RESTART_COUNT to 11 from 8; in relation to #438. This
1223 allows longer CNAME chains in Unbound.
1226 - In unit test use openssl set security level to allow keys in test.
1227 - Fix static analysis warnings about localzone locks that are unused.
1228 - Fix missing locks in zonemd unit test.
1229 - Fix readzone compile under debug config.
1230 - Fix out of sourcedir run of zonemd unit tests.
1231 - Fix libnettle zonemd unit test.
1232 - Fix unit test zonemd_reload for use in run_vm.
1235 - Listen to read or write events after the SSL handshake.
1236 Sticky events on windows would stick on read when write was needed.
1240 function that need to reuse the dns answer.
1242 error, but the situation looks harmless.
1243 - Fix sign comparison warning on FreeBSD.
1246 - Prepare for OpenSSL 3.0.0 provider API usage, move the sldns
1247 keyraw functions to produce EVP_PKEY results.
1248 - Move RSA and DSA to use OpenSSL 3.0.0 API.
1249 - Move ECDSA functions to use OpenSSL 3.0.0 API.
1250 - iana portlist update.
1251 - Fix verbose printout failure in tcp reuse unit test.
1254 - Fix #515: Compilation against openssl 3.0.0 beta2 is failing to
1255 build unbound.
1256 - For #515: Fix compilation with openssl 3.0.0 beta2, lib64 dir and
1257 SSL_get_peer_certificate.
1258 - Move acx_nlnetlabs.m4 to version 41, with lib64 openssl dir check.
1261 - Merge #513: Stream reuse, attempt to fix #411, #439, #469. This
1263 that could result in broken internal structures.
1266 - Merge #512: unbound.service.in: upgrade hardening to latest
1267 standards.
1268 - Fix readzone unknown type print for memory resize.
1272 line after a comment.
1275 - Introduce 'http-user-agent:' and 'hide-http-user-agent:' options.
1279 defined.
1280 - Fix for #510: in depth, use ifdefs for windows api event calls.
1281 - Fix spelling in doc/unbound.doxygen comment.
1282 - Fix spelling in localzone.h comment.
1284 syntax errors.
1285 - review fix to remove duplicate error printout.
1286 - Insert header into testcode/readzone.c, it was missing.
1287 - Fix from lint for ignored return value.
1288 - Fix for older parsers for function call in serve expired get cached.
1291 - iana portlist update.
1294 - Fix compiler warnings for #491.
1295 - Fix clang-analysis warnings for testcode/readzone.c.
1298 - Fix Wunused-result compile warnings.
1302 draft-ietf-dnsop-svcb-https.
1306 Unhandled Exception.
1309 - Fix up permissions on rpl data file in tests.
1310 - Fix testbound newline treatment in moment_read and tempfile write.
1311 - Fix configure grep for reuseport default for failure.
1313 - Fix configure does not require pkg-config if not needed.
1314 - Fix unit test in the ctime_r calls for autotrust and in testbound.
1315 - Fix auth zone download on windows to unlink before rename.
1318 - Add analyzer and port compile github workflow.
1321 - Fix #503: DNS over HTTPS response truncated.
1322 - Fix warnings reported by the gcc analyzer.
1325 - Fix #495: Documentation or implementation of "verbosity" option.
1328 - Fix a number of warnings reported by the gcc analyzer.
1331 - Merge #440 by kimheino: Various fixes to contrib/unbound_munin_ file.
1334 - Fix configure nonblocking test and onmingw test to use host.
1337 - Fix #500: SPEC file in version 1.13.1 references version 1.4;
1338 unable to build RPM from source.
1339 - Fix contrib/unbound.spec, fixed url and comment.
1342 - Merge #486 by fobster: Make VAL_MAX_RESTART_COUNT configurable.
1343 - Generated lexer and parser for #486; updated example.conf.
1345 on macOS 11.1-x86_64 host.
1346 - Use host_os instead of target_os in configure for Darwin8 build.
1349 - Fix unused variable warning when compiling with --enable-dnstap.
1352 - Merge #448 from shoeper: Update unbound-control.8.in, fix
1353 rpz_disable typo.
1355 primary on nondefault port.
1358 - Fix test for zonemd-check option.
1362 available, otherwise try to work it out.
1364 of ZONEMD records for that zone.
1368 used by BIND, Knot and PowerDNS. This sets the default value
1369 for it in the configuration to 150 for all key sizes.
1370 - Fix #492: module-config respip missing in unbound.conf.5.in man
1371 page. Merges #494 from he32.
1372 - For #492: Fix font highlighting for the man page on emacs.
1375 - Test code has -q option for quiet output.
1379 between TCP streams.
1380 - Refactor for uniform way to produce random DNS message IDs.
1383 - Fix #489: Compile using MSYS2 MinGW 64-bit.
1386 - Fix that auth-zone zonefiles use last TTL if no TTL is specified.
1389 - Merge PR #487: ifdef RLIMIT_AS in recently added check.
1392 - Fix #485: Unbound occasionally reports broken stats.
1393 - Add ./configure --with-deprecate-rsa-1024 that turns off RSA 1024.
1394 - Remove case fallthrough from deprecate-rsa-1024 code.
1398 longer on the tcp_waiting_list.
1399 - Add more logging for out-of-memory cases.
1403 response.
1404 - Fix to squelch tcp socket bind failures when the interface is gone.
1405 - Rerun flex and bison.
1408 - Fix #481: Fix comment in configuration file.
1412 about one of the last failures for that query.
1416 max_reuse_tcp_queries.
1419 - Fix #474: always_null and others inside view.
1423 connections.
1427 SSL_get0_alpn_selected.
1428 - Fix #468: OpenSSL 1.0.1 can no longer build Unbound.
1430 OpenSSL 1.0.1.
1431 - Fix that testcode dohclient has OpenSSL initialisation calls.
1434 - Fix documentation comment for files previously residing in checkconf/.
1435 - Remove unused functions worker_handle_reply and libworker_handle_reply.
1439 forward definition.
1443 processQueryTargets().
1447 unless high verbosity is set.
1450 - rebuild configure to set EXTRALINK to libunbound.la for #460.
1453 - Fix for #411: Depth protect for crash on deleted element timeout.
1456 - Merge #460 from orbea: build: Link with the libtool archive.
1457 - Fix to stop IPv6 PMTU discovery.
1460 - Clean makedist.sh.
1463 - Fix stack-protector change to not override other CFLAGS options.
1467 builds; relates to #444.
1470 - Fix #429: Also fix end of transfer for http download of auth zones.
1474 CFLAGS and CPPFLAGS and also checks if the item is unavailable.
1475 - Travis, fix script to fail when tasks fail.
1476 - Travis, fix warning in ubsan compile.
1477 - Fix configure Targetconfiditionals.h header check, to use compile.
1478 - Fix that cachedb does not produce empty object files when disabled.
1481 - Travis enable all tests again. Clang analyzer only a couple times,
1482 when there is a difference. homebrew updates disabled, so it does
1483 not hang. removed trailing slashes from configure paths. Moved iOS
1484 tests to allow-failure.
1486 run anway. Turn off failing tests except one. Update iOS test
1487 to xcode image 12.2.
1490 - Fix unused-function warning when compiling with --enable-dnscrypt.
1491 - Fix for #367: fix memory leak when cannot bind to listening port.
1492 - Reformat pythonmod/pythonmod_utils.{c,h}.
1495 - Merge #449 from orbea: build: Add missing linker flags.
1496 - iana portlist update.
1497 - Comment out nonworking OSX and IOS travis tests, vm fails to start.
1498 - Fix compile error in listen_dnsport on Android.
1499 - Fix memory leak reported by asan in rpz SOA record query name.
1503 from the log, unless verbosity is high.
1506 - Fix #441: Minimal NSEC range not accepted for top level domains.
1509 - Fix parse of LOC RR type for decimetres.
1512 - Workaround for #439: prevent loops in the reuse rbtree.
1513 - Debug output for #411 and #439: printout internal error and details.
1516 - iana portlist update.
1518 memory". The mesh detect cycle routine no longer wrongly stops
1519 the check when the calling mesh state is unique.
1522 - Fix for #367: rc_ports don't have ub_sock; skip cleaning up.
1525 - Fix: Resolve interface names on control-interface too.
1528 - Merge PR #367 : DNSTAP log local address. With code from PR #365
1530 FORWARDER_QUERY.
1531 - Fix to allow rpz with wildcard that applies to all TLDs at once.
1535 log message.
1537 A/AAAA subquery.
1541 sufficient for the configured cache size, and logs warning if not.
1542 - Fix function documentation.
1543 - Fix unit test for added ulimit checks.
1544 - spelling fix in header.
1547 - Fix for zonemd, that domain-insecure zones work without dnssec.
1549 validation step in dnssec chain of trust.
1553 and udp connect from the logs, unless at high verbosity.
1555 for island zones, it is treated as an insecure zone for verification.
1558 - Merge PR #317: ZONEMD Zone Verification, with RFC 8976 support.
1560 with DNSSEC if available. There is an added option
1561 zonemd-permissive-mode that makes it log but not fail wrong zones.
1563 zonemd can be mandated for specific zones.
1564 - Fix doxygen and pydoc warnings.
1565 - Fix #429: rpz: url: with https: broken (regression in 1.13.1).
1566 - rpz skip nsec3param records, and nicer log for unsupported actions.
1570 enabled/configured.
1571 - Fix to make tests work with support indicators set for iterator.
1572 - Fix build on Python 3.10.
1576 "http2_query_read_done failure" logged.
1581 none), PyParser_SimpleParseFile (now Py_CompileString).
1584 - release 1.13.1rc2 tag on branch-1.13.1 with added changes of 2 feb.
1585 This became 1.13.1 release tag on 9 feb. The main branch is set
1586 to version 1.13.2.
1589 - branch-1.13.1 is created, with release-1.13.1rc1 tag.
1590 - Fix dynlibmod link on rhel8 for -ldl inclusion.
1591 - Fix windows dependency on libssp.dll because of default stack
1592 protector in mingw.
1593 - Fix indentation of root anchor for use by windows install script.
1596 - Attempt to fix NULL keys in the reuse_tcp tree; relates to #411.
1599 - Fix for doxygen 1.8.20 compatibility.
1602 - Annotate that we ignore the return value of if_indextoname.
1603 - Fix to use correct type for label count in rpz routine.
1604 - Fix empty clause warning in config_file nsid parse.
1605 - Fix to use correct type for label count in ipdnametoaddr rpz routine.
1606 - Fix empty clause warning in edns pass for padding.
1607 - Fix fwd ancil test post script when not supported.
1610 - Merge PR #408 from fobser: Prevent a few more yacc clashes.
1614 static data.
1616 cache (#394).
1619 - Fix compile of unbound-dnstap-socket without dnstap installed.
1623 RFC7830 and RFC8467.
1627 authzone data) to be the minimum of the SOA TTL and the SOA.MINIMUM.
1631 with the nsid: option in unbound.conf
1634 - Fix #404: DNS query with small edns bufsize fail.
1636 dns64.
1640 to RFC6052.
1643 - Fix for #93: dynlibmodule import library is named libunbound.dll.a.
1647 unlocked after markdel entry.
1648 - Fix for #93: dynlibmodule link fix for Windows.
1652 similar to always_nxdomain.
1654 from the config file.
1658 modules can compute the response time.
1659 - For #391: use struct timeval* start_time for callback information.
1660 - For #391: fix indentation.
1661 - For #391: more double casts in python start time calculation.
1662 - Add comment documentation.
1663 - Fix clang analysis warning.
1666 - Fix #379: zone loading over HTTP appears to have buffer issues.
1667 - Merge PR #395 from mptre: add missing null check.
1674 to unbound-control.
1678 added to event map.
1679 - iana portlist updated.
1683 (modified patch from Xin Li @delphij).
1686 - Fix #371: unbound-control timeout when Unbound is not running.
1688 they are logged at higher verbosity but not on low verbosity.
1690 missing prototype warnings.
1692 is a GNU extension.
1693 - Fix missing prototypes in the code.
1696 - make depend.
1697 - iana portlist updated.
1702 happening with the error in the logs.
1703 - Fix #356: deadlock when listening tcp.
1705 handler and not print so frequently when invoked in sequence.
1706 - Fix on windows to ignore connection failure on UDP, unless verbose.
1707 - Fix for #283: fix stream reuse and tcp fast open.
1708 - Fix update, with write event check with streamreuse and fastopen.
1712 verbosity.
1717 not kept for reuse.
1718 - tag for the 1.13.0rc4 release. This also became the 1.13.0
1720 fix from 2 dec 2020. The code repo continues for 1.13.1 in
1721 development.
1724 - Fix compile warning for type cast in http2_submit_dns_response.
1725 - Fix when use free buffer to initialize rbtree for stream reuse.
1726 - Fix compile warnings for windows.
1727 - Fix compile warnings in rpz initialization.
1728 - Fix contrib/metrics.awk for FreeBSD awk compatibility.
1729 - tag for the 1.13.0rc3 release.
1732 - Fix to omit UDP receive errors from log, if verbosity low.
1733 These happen because of udp-connect.
1734 - For #352: contrib/metrics.awk for Prometheus style metrics output.
1735 - Fix that after failed read, the readagain cannot activate.
1736 - Clear readagain upon decommission of pending tcp structure.
1739 - with udp-connect ignore connection refused with UDP timeouts.
1740 - Fix udp-connect on FreeBSD, do send calls on connected UDP socket.
1741 - Better fix for reuse tree comparison for is-tls sockets. Where
1742 the tree key identity is preserved after cleanup of the TLS state.
1743 - Remove debug commands from reuse tests.
1744 - Fix memory leak for edns client tag opcode config element.
1746 is written.
1748 cleanup.
1749 - tag for the 1.13.0rc2 release.
1752 - Merge PR #283 : Stream reuse. This implements upstream stream
1754 channel.
1755 - set version of main branch to 1.13.0 for upcoming release.
1756 - iana portlist updated.
1757 - Fix one port unit test for udp-connect.
1758 - tag for the 1.13.0rc1 release.
1760 reuse tree comparison is not properly identical to insertion.
1761 - Fix padding of struct regional for 32bit systems.
1765 edns-client-string option.
1769 address families.
1770 - Fix #350: with the AF_NETLINK permission, to fix 1.12.0 error:
1772 supported by protocol.
1773 - Fix #347: IP_DONTFRAG broken on Apple xcode 12.2.
1774 - Option to toggle udp-connect, default is enabled.
1776 with chown of pidfile.
1777 - Further fix for it and retvalue 0 fix for it.
1781 this lowers vulnerability to ICMP side channels.
1782 - Retry for interfaces with unused ports if possible.
1785 - Fix #341: fixing a possible memory leak.
1786 - Fix memory leak after fix for possible memory leak failure.
1788 undeclared.
1792 drop and chroot.
1796 Python Mod.
1798 query response.
1801 - Fix #327: net/if.h check fails on some darwin versions; contribution by
1802 Joshua Root.
1804 custom region alloc init.
1808 down. Add infra-keep-probing: yes option. Hosts that are down are
1809 probed more frequently.
1811 eventually after exponential backoff, and that keeps that way. If
1812 traffic keeps up for the domain. It probes with one at a time, eg.
1814 interval are turned away.
1817 - Merge PR #324 from James Renken: Add modern X.509v3 extensions to
1818 unbound-control TLS certificates.
1820 certificate.
1828 http-response-buffer-size, and http-nodelay.
1829 - Fix memory leak of https port string when reading config.
1830 - Fix #330: [Feature request] Add unencrypted DNS over HTTPS support.
1832 and the dohclient test code has the -n option.
1833 - Fix python documentation warning on functions.rst inplace_cb_reply.
1834 - Fix dnstap test to wait for log timer to see if queries are logged.
1835 - Log ip address when http session recv fails, eg. due to tls fail.
1837 the handler structure is reused.
1839 of queries. It was tested to work.
1843 number of outstanding queries over a connection.
1848 by the call.
1850 during the mesh state and update the documentation on that.
1856 statement and fix cast warning.
1861 not drop it and attempt to modify the reply list during reply.
1863 reply and a new message created if that was modified by the call.
1868 if systemd support is build.
1872 socket path.
1873 - Fix warning in libnss compile, nss_buf2dsa is not used without DSA.
1876 - Tag for 1.12.0 release.
1877 - Current repo is version 1.12.1 in development.
1878 - Fix #319: potential memory leak on config failure, in rpz config.
1881 - Current repo is version 1.12.0 for release. Tag for 1.12.0rc1.
1884 - Fix doh tests when not compiled in.
1885 - Add dohclient test executable to gitignore.
1887 alloc check debug output.
1888 - Easier kill of unbound-dnstap-socket tool in test.
1889 - Fix memory leak of edns tags at libunbound context delete.
1890 - Fix double loopexit for unbound-dnstap-socket after sigterm.
1893 - DNS Flag Day 2020: change edns-buffer-size default to 1232.
1896 - Fix unit test for dnstap changes, so that it waits for the timer.
1900 (regression in 1.11).
1901 - Fix #305: only wake up thread when threshold reached.
1902 - Fix to ifdef fptr wlist item for dnstap.
1913 - Merge PR #311 by luismerino: Dynlibmod leak.
1914 - Error message is logged for dynlibmod malloc failures.
1915 - iana portlist updated.
1920 output function.
1921 - iana portlist updated.
1924 - Introduce test for statistics.
1927 - Spelling fix.
1930 - Remove x file mode on ipset/ipset.c and h files.
1933 - Fix num.expired statistics output.
1936 - Merge PR #293: Add missing prototype. Also refactor to use the new
1937 shorthand function to clean up the code.
1938 - Refactor to use sock_strerr shorthand function.
1939 - Fix #296: systemd nss-lookup.target is reached before unbound can
1940 successfully answer queries. Changed contrib/unbound.service.in.
1944 eg. something like interface: eth0 is resolved at server start and
1945 uses the IP addresses for that named interface.
1946 - Review fix, doxygen and assign null in case of error free.
1949 - Update documentation in python example code.
1953 attempts. Attempts on the timer are only logged on high verbosity,
1954 if they produce a connection failure error.
1955 - Fix to apply chroot to dnstap-socket-path, if chroot is enabled.
1957 openssl-3.0.0.
1960 - Fix stats double count issue (#289).
1963 - Create and init edns tags data for libunbound.
1967 by Vítězslav Čížek.
1970 - Fix #287: doc typo: "Additionaly".
1974 - Merge PR #284 and Fix #246: Remove DLV entirely from Unbound.
1975 The DLV has been decommisioned and in unbound 1.5.4, in 2015, there
1976 was advise to stop using it. The current code base does not contain
1977 DLV code any more. The use of dlv options displays a warning.
1980 - contrib/aaaa-filter-iterator.patch file renewed diff content to
1981 apply cleanly to the current coderepo for the current code version.
1984 - Merge PR #272: Add EDNS client tag functionality.
1987 - Improve error log message when inserting rpz RR.
1989 definedness, by Felipe Gasper.
1992 - Fix mini_event.h on OpenBSD cannot find fd_set.
1996 routine.
2000 March 2020, by and0x000.
2007 - branch now named 1.11.1. 1.11.0rc1 became the 1.11.0 release.
2011 - Fix streamtcp to print packet data to stdout. This makes the
2012 stdout and stderr not mix together lines, when parsing its output.
2013 - Fix contrib/fastrpz.patch to apply cleanly. It fixes for changes
2015 new rpz code.
2016 - branch now named 1.11.0 and 1.11.0rc1 tag.
2020 changes.
2021 - Fix lock dependency cycle in rpz zone config setup.
2025 Courrèges-Anglas.
2026 - Fix PR #234 log_assert sizeof to use union buffer.
2029 - Fix check conf test for referencing installation paths.
2030 - Fix unused variable warning for clang analyzer.
2033 - Introduce 'include-toplevel:' configuration option.
2036 - Add bidirectional frame streams support.
2040 OpenSSL APIs.
2042 3.0.0-alpha4.
2043 - Longer keys for the test set, this avoids weak crypto errors.
2046 - Fix #259: Fix unbound-checkconf does not check view existence.
2048 access-control-tag-actions and access-control-tag-datas.
2049 - Fix offset of error printout for access-control-tag-datas.
2050 - Review fixes for checkconf #259 change.
2053 - run_vm cleanup better and removes trailing slash on single argument.
2057 the reply is sent, so that script callbacks have reply_info.
2059 can see the reply_info.
2061 with.
2063 tcp stream waiting for it.
2065 after end of loop.
2067 removal of mesh state during mesh send reply.
2070 - iana portlist updated.
2071 - doxygen file comments for dynlibmodule.
2074 - Fix default explanation in man page for qname-minimisation-strict.
2075 - Fix display of event loop method with libev.
2079 man page.
2082 - Merge PR #241 by Robert Edmonds: contrib/libunbound.pc.in: Do not use
2083 "Requires:".
2086 - Update contrib/aaaa-filter-iterator.patch for the recent
2087 generate_sub_request() change and to apply cleanly.
2090 - Fix for integer overflow when printing RDF_TYPE_TIME.
2094 query into a large number of queries directed to a target.
2096 used to make Unbound unresponsive.
2097 - Release 1.10.1 is 1.10.0 with fixes, code repository continues,
2098 including those fixes, towards the next release. Configure has
2099 version 1.10.2 version number in it.
2101 - windows compile warnings removal for ip dscp option code.
2102 - For PR #93: unit test for dynlib module.
2106 with dlclose and dlopen of the library again. Also for multiple
2107 modules. Fix memory leak by not closing dlopened content. Fix
2108 to allow one dynlibmod instance by unbound-checkconf.
2110 a couple cases.
2112 a couple cases.
2113 - For PR #93: man page spelling reference fix.
2114 - For PR #93: fix link of other executables for dynlibmod dependency.
2117 - Merge PR #93: Add dynamic library support.
2118 - Fixed conflicts for PR #93 and make configure, yacc, lex.
2119 - For PR #93: Fix warnings for dynlibmodule.
2122 - Cache ECS answers with longest scope of CNAME chain.
2125 - Explicitly use 'rrset-roundrobin: no' for test cases.
2128 - Merge #225 from akhait: KSK-2010 has been revoked. It removes the
2130 revocation period is over. KSK-2017 is the only trust anchor in
2131 the shipped default now.
2134 - Change default value for 'rrset-roundrobin' to yes.
2135 - Fix tests for new rrset-roundrobin default.
2138 - Fix #222: --enable-rpath, fails to rpath python lib.
2139 - Fix for count of reply states in the mesh.
2140 - Remove unneeded was_mesh_reply check.
2143 - Add SNI support on more TLS connections (fixes #193).
2144 - Add SNI support to unbound-anchor.
2147 - Add doxygen documentation for DSCP.
2150 - Fix help return code in unbound-control-setup script.
2151 - Fix for posix shell syntax for trap in nsd-control-setup.
2152 - Fix for posix shell syntax for trap in run_msg.sh test script.
2155 - Fix #220: auth-zone section in config may lead to segfault.
2159 certificates. With the -r option the certificates are created
2160 again, without it, only the files that do not exist are created.
2163 - Keep track of number of timeouts. Use this counter to determine if
2164 capsforid fallback should be started.
2167 - More documentation for redis-expire-records option.
2170 - Merge PR #206: Redis TTL, by Talkabout.
2173 - Merge PR #207: Clarify if-automatic listens on 0.0.0.0 and ::
2175 transports.
2178 - Merge PR #203 from noloader: Update README-Travis.md with current
2179 procedures.
2183 friendly.
2186 - Fix RPZ concurrency issue when using auth_zone_reload.
2189 - Merge PR #201 from noloader: Fix OpenSSL cross-compaile warnings.
2190 - Fix on #201.
2194 tag for outgoing packets.
2195 - Fixes on #200.
2196 - Travis fix for ios by omitting tools from install.
2199 - Fix compile on Solaris for unbound-checkconf.
2203 only used in this file.
2207 proper prototype.
2210 - Merge PR#191: Update iOS testing on Travis, by Jeffrey Walton.
2211 - Fix #158: open tls-session-ticket-keys as binary, for Windows. By
2212 Daisuke HIGASHI.
2213 - Merge PR#134, Allow the kernel to provide random source ports. By
2214 Florian Obser.
2216 while explicit port randomisation is disabled.
2217 - Merge PR#194: Add libevent testing to Travis, by Jeffrey Walton.
2218 - Fix .travis.yml error, missing 'env' option.
2223 reported it seems to work.
2226 - Fix compile of test tools without protobuf.
2230 zone origin.
2233 - Fix #189: mini_event.h:142:17: error: field 'ev_timeout' has incomplete
2234 type, by noloader.
2235 - Changelog entry for (Fix #189, Merge PR #190).
2238 - Fix #188: unbound-control.c:882:6: error: 'execlp' is
2239 unavailable: not available on tvOS.
2246 - Fix PR #182 from noloader: Add iOS testing to Travis.
2249 - Update README-Travis.md (from PR #179), by Jeffrey Walton.
2252 - Merge PR #181 from noloader: Fix OpenSSL -pie warning on Android.
2255 - Merge PR #180 from noloader: Avoid calling exit in Travis script.
2258 - Upgrade config.guess(2020-01-01) and config.sub(2020-01-01).
2262 with no-engine, thanks noloader.
2265 - Fix compiler warning in dns64/dns64.c
2266 - Merge PR #174: Add Android to Travis testing, by noloader.
2267 - Move android build scripts to contrib/ and allow android tests to fail.
2270 - Fix #177: dnstap does not build on macOS.
2273 - Merge PR #172: Add IBM s390x arch for testing, by noloader.
2276 - Merge PR #173: updated makedist.sh for config.guess and
2277 config.sub and sha256 digest for gpg, by noloader.
2279 unidirectional connectivity in unbound. This has a number of
2280 new features.
2282 The dependency on libfstrm is removed. The fstrm protocol code
2283 resides in dnstap/dnstap_fstrm.h and dnstap/dnstap_fstrm.c. This
2284 contains a brief definition of what unbound needs.
2287 unbound-dnstap-socket. It can listen, accept multiple DNSTAP
2288 streams and print information. Commandline options control it.
2291 closed. This uses exponential backoff after which it uses a
2292 one second timer to throttle cpu down. There is also support
2293 to use TCP and TLS for connecting to the log server. There
2295 in the man page and example config file. dnstap-ip with IP
2296 address of server for TCP or TLS use. dnstap-tls to turn
2297 on TLS. And dnstap-tls-server-name, dnstap-tls-cert-bundle,
2300 client authentication, or leave at "" to not use that.
2304 testing, by noloader.
2307 - Fix #169: Fix warning for daemon/remote.c output may be truncated
2308 from snprintf.
2310 warning in signature expiry RFC1982 serial number arithmetic.
2312 dname, and in the client_info_compare routine for null memcmp.
2315 - iana portlist updated.
2320 by one operator, and thus reputation is shared.
2323 - Merge PR #166: Fix typo in unbound.service.in, by glitsj16.
2326 - Updated contrib/unbound_smf23.tar.gz with Solaris SMF service for
2327 Unbound from Yuri Voinov.
2328 - master branch has 1.10.1 version.
2332 different openssl versions.
2335 - changelog point where the tag for 1.10.0rc2 release is. And with
2336 the unbound_smf23 commit added to it, that is the 1.10.0 release.
2339 - Add respip to supported module-config options in unbound-checkconf.
2342 - Remove unused variable.
2346 in RPZ-Format, contributed by Andreas Schulze.
2349 - Fix spelling in unbound.conf.5.in.
2351 zonefiles have to exist. They can not exist, and download later.
2354 - tag for 1.10.0rc1 release.
2357 - Fix with libnettle make test with dsa disabled.
2358 - Fix contrib/fastrpz.patch to apply cleanly. Fix for serve-stale
2359 fixes, but it does not compile, conflicts with new rpz code.
2360 - Fix to clean memory leak of respip_addr.lock when ip_tree deleted.
2361 - Fix compile warning when threads disabled.
2362 - updated version number to 1.10.0.
2365 - Document 'ub_result.was_ratelimited' in libunbound.
2366 - Fix use after free on log-identity after a reload; Fixes #163.
2370 serve_expired_callback.
2371 - Cleaner code in mesh_serve_expired_lookup.
2372 - Document in unbound.conf manpage that configuration clauses can be
2373 repeated in the configuration file.
2377 after serve_stale commit.
2378 - Fix to create and destroy rpz_lock in auth_zones structure.
2379 - Fix to lock zone before adding rpz qname trigger.
2380 - Fix to lock and release once in mesh_serve_expired_lookup.
2381 - Fix to put braces around empty if body when threading is disabled.
2385 draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used
2386 to configure the behavior.
2387 - Updated cachedb to honor `serve-expired-ttl`; Fixes #107.
2388 - Renamed statistic `num.zero_ttl` to `num.expired` as expired replies
2389 come with a configurable TTL value (`serve-expired-reply-ttl`).
2390 - Fixed stats when replying with cached, cname-aliased records.
2391 - Added missing default values for redis cachedb backend.
2397 - Fix fclose on error in TLS session ticket code.
2400 - Fix memory leak in error condition remote.c
2401 - Fix double free in error condition view.c
2403 - Merge RPZ support into master. Only QNAME and Response IP triggers are
2404 supported.
2405 - Stop working on socket when socket() call returns an error.
2409 - Fix subnet tests for disabled DSA algorithm by default.
2410 - Update contrib/fastrpz.patch for clean diff with current code.
2412 and Frzk. Updates the unbound.service systemd file and adds
2413 a portable systemd service file.
2414 - updated .gitignore for added contrib file.
2416 - Add getentropy_freebsd.o to Makefile dependencies.
2420 view_local_datas_remove command.
2423 - Fix #157: undefined reference to `htobe64'.
2426 - Merge PR#147; change rfc reference for reserved top level dns names.
2429 - iana portlist updated.
2431 by peer, unless verbosity is set to 2 or higher.
2435 --with-libbsd. By Robert Edmonds and Steven Chamberlain.
2436 - Merge PR#148; Add some TLS stats to unbound_munin_. By Fredrik Pettai.
2439 - Merge PR#155 from Robert Edmonds: contrib/libunbound.pc.in: Fixes
2440 to Libs/Requires for crypto library dependencies.
2441 - Fix #153: Disable validation for DSA algorithms. RFC 8624
2442 compliance.
2445 - Merge PR#150 from Frzk: Systemd unit without chroot. It add
2446 contrib/unbound_nochroot.service.in, a systemd file for use with
2448 instead.
2452 because dnscrypt-proxy (2.0.36) does not support the test setup
2454 the appropriate keys to recreate that setup.
2456 cache and neg cache structures.
2458 compiled without edns subnet support.
2459 - Fix auth zone support for NSEC3 records without salt.
2463 patch from Saksham Manchanda from Secure64.
2464 - Fix unreachable code in ssl set options code.
2468 file.
2471 - Fix 'make test' to work for --disable-sha1 configure option.
2473 parsing type WKS, reported by Luis Merino from X41 D-Sec.
2475 delimiter after the character. And update for more spare space.
2478 - Downgrade compat/getentropy_solaris.c to version 1.4 from OpenBSD.
2480 compilation errors on solaris 10.
2481 - Changes to compat/getentropy_solaris.c for,
2482 ifdef stdint.h inclusion for older systems.
2483 ifdef sha2.h inclusion for older systems.
2487 if non-NULL.
2488 - Fix #140: Document slave not downloading new zonefile upon update.
2491 - Update mailing list URL.
2494 - Master is 1.9.7 in development.
2500 response RR is received over TCP with the SOA in it.
2503 - Fix ipsecmod compile.
2504 - Fix Makefile.in for ipset module compile, from Adi Prasaja.
2505 - release-1.9.6 tag, which became the 1.9.6 release
2508 - unbound-fuzzers.tar.bz2: three programs for fuzzing, that are 1:1
2509 replacements for unbound-fuzzme.c that gets created after applying
2510 the contrib/unbound-fuzzme.patch. They are contributed by
2511 Eric Sesterhenn from X41 D-Sec.
2512 - tag for 1.9.6rc1.
2515 - Fix lock type for memory purify log lock deletion.
2516 - Fix testbound for alloccheck runs, memory purify and lock checks.
2517 - update contrib/fastrpz.patch to apply more cleanly.
2519 reported by X41 D-Sec.
2523 from 'quick' to 'basic' because this is an I/O lock.
2525 to correct RFC number.
2527 reported by X41 D-Sec.
2528 - Fix similar code in auth_zone synth cname to add the extra checks.
2530 reported by X41 D-Sec.
2532 reported by X41 D-Sec.
2534 reported by X41 D-Sec.
2537 reported by X41 D-Sec.
2539 reported by X41 D-Sec.
2541 reported by X41 D-Sec.
2543 reported by X41 D-Sec.
2544 This further lowers the max to 256.
2546 reported by X41 D-Sec.
2547 - Fix Bad Indentation, in dnscrypt.c,
2548 reported by X41 D-Sec.
2550 reported by X41 D-Sec.
2551 - Fix compile error in dnscrypt.
2553 reported by X41 D-Sec.
2554 - Fix Hardcoded Constant, reported by X41 D-Sec.
2559 don't disable time-out when changing to read.
2562 - Fix compiler warnings.
2565 - Fix dname loop maximum, reported by Eric Sesterhenn from X41 D-Sec.
2567 and make maintainer-clean that removes bison and flex output.
2571 reported by X41 D-Sec.
2573 reported by X41 D-Sec.
2575 reported by X41 D-Sec.
2576 - Adjust unbound-control to make stats_shm a read only operation.
2578 reported by X41 D-Sec.
2580 reported by X41 D-Sec.
2582 reported by X41 D-Sec.
2583 - Fix Config Injection in create_unbound_ad_servers.sh,
2584 reported by X41 D-Sec.
2586 reported by X41 D-Sec.
2588 reported by X41 D-Sec.
2589 - Upgrade compat/getentropy_linux.c to version 1.46 from OpenBSD.
2590 - Synchronize compat/getentropy_win.c with version 1.5 from
2591 OpenBSD, no changes but makes the file, comments, identical.
2592 - Upgrade compat/getentropy_solaris.c to version 1.13 from OpenBSD.
2593 - Upgrade compat/getentropy_osx.c to version 1.12 from OpenBSD.
2595 no link to openssl if using nettle, and hence config.h for
2596 HAVE_NETTLE variable.
2597 compat definition of MAP_ANON, for older systems.
2598 ifdef stdint.h inclusion for older systems.
2599 ifdef sha2.h inclusion for older systems.
2600 - Fixed Compat Code Diverging from Upstream, reported by X41 D-Sec.
2601 - Fix compile with --enable-alloc-checks, reported by X41 D-Sec.
2602 - Fix Terminating Quotes not Written, reported by X41 D-Sec.
2603 - Fix Useless memset() in validator, reported by X41 D-Sec.
2604 - Fix Unrequired Checks, reported by X41 D-Sec.
2605 - Fix Enum Name not Used, reported by X41 D-Sec.
2607 reported by X41 D-Sec.
2608 - Fix Bad Randomness in Seed, reported by X41 D-Sec.
2609 - Fix python examples/calc.py for eval, reported by X41 D-Sec.
2610 - Fix comments for doxygen in dns64.
2613 - Fix CVE-2019-18934, shell execution in ipsecmod.
2614 - 1.9.5 is 1.9.4 with bugfix, trunk is 1.9.6 in development.
2615 - Fix authzone printout buffer length check.
2616 - Fixes to please lint checks.
2618 reported by X41 D-Sec.
2620 and ipsecmod_new(), reported by X41 D-Sec.
2622 reported by X41 D-Sec.
2624 reported by X41 D-Sec.
2626 sldns_str2wire_dname_buf_origin(), reported by X41 D-Sec.
2628 reported by X41 D-Sec.
2630 reported by X41 D-Sec.
2634 code checkers.
2635 - update to bison output of 3.4.1 in code repository.
2636 - Provide a prototype for compat malloc to remove compile warning.
2637 - Portable grep usage for reuseport configure test.
2638 - Check return type of HMAC_Init_ex for openssl 0.9.8.
2639 - gitignore .source tempfile used for compatible make.
2642 - iana portlist updated.
2643 - contrib/fastrpz.patch updated to apply for current code.
2644 - fixes for splint cleanliness, long vs int in SSL set_mode.
2648 unbound-control and fail if too many arguments.
2649 - Merge #102 from jrtc27: Add getentropy emulation for FreeBSD.
2652 - Fix #99: Memory leak in ub_ctx (event_base will never be freed).
2656 build if requested; in relation to #91.
2659 - Merge #97: manpage: Add missing word on unbound.conf,
2660 from Erethon.
2663 - drop-tld.diff: adds option drop-tld: yesno that drops 2 label
2664 queries, to stop random floods. Apply with
2665 patch -p1 < contrib/drop-tld.diff and compile.
2666 From Saksham Manchanda (Secure64). Please note that we think this
2668 lookups for downstream clients.
2671 - Add doxygen comments to unbound-anchor source address code, in #86.
2674 - Merge #90 from vcunat: fix build with nettle-3.5.
2675 - Merge 1.9.4 release with fix for vulnerability CVE-2019-16866.
2676 - Continue with development of 1.9.5.
2678 smallapp/unbound-anchor.c, from Lukas Wunner.
2681 - Merge #87 from hardfalcon: Fix contrib/unbound.service.in,
2682 Drop CAP_KILL, use + prefix for ExecReload= instead.
2685 - The unbound.conf includes are sorted ascending, for include
2686 statements with a '*' from glob.
2690 service file to fix that systemctl reload fails.
2694 in unbound.service.
2696 of /dev/random in scripts and docs.
2697 - Merge #83 from Maryse47: contrib/unbound.service.in: do not fork
2698 into the background.
2701 - Fix #78: Memory leak in outside_network.c.
2703 systemd unbound.service.
2704 - oss-fuzz badge on README.md.
2705 - Fix fix for #78 to also free service callback struct.
2706 - Fix for oss-fuzz build warning.
2708 create a wrong zero_ttl response count with serve-expired enabled.
2709 - Merge #80 from stasic: Improve wording in man page.
2713 reported by Eric Sesterhenn from X41 D-Sec.
2718 uses to log messages.
2721 - Fix #71: fix openssl error squelch commit compilation error.
2727 remote failure. Specifically filters the high volume errors.
2730 - ipset module #28: log that an address is added, when verbosity high.
2731 - ipset: refactor long routine into three smaller ones.
2732 - updated Makefile dependencies.
2735 - Fix contrib/fastrpz.patch asprintf return value checks.
2738 - Fix that pkg-config is setup before --enable-systemd needs it.
2739 - 1.9.3rc2 release candidate tag. And this became the 1.9.3 release.
2740 Master is 1.9.4 in development.
2743 - Fix log_dns_msg to log irrespective of minimal responses config.
2746 - Document limitation of pidfile removal outside of chroot directory.
2750 where if gcc 9.1.1 uses -O2 (but not -O1) then valgrind 3.15.0
2751 issues an uninitialised value for the token buffer at the str2wire.c
2752 rrinternal_get_owner() strcmp with the '@' value. Rewritten to use
2753 straight character comparisons removes the false positive. Also
2755 positive.
2756 - Please doxygen's parser for "@" occurrence in doxygen comment.
2757 - Fixup contrib/fastrpz.patch
2758 - Remove warning about unknown cast-function-type warning pragma.
2761 - iana portlist updated.
2762 - Fix autotrust temp file uniqueness windows compile.
2763 - avoid warning about upcast on 32bit systems for autotrust.
2764 - escape commandline contents for -V.
2765 - Fix character buffer size in ub_ctx_hosts.
2766 - 1.9.3rc1 release candidate tag.
2767 - Option -V prints if TCP fastopen is available.
2771 communicate with systemd through the `NOTIFY_SOCKET`.
2774 - Generate configlexer with newer flex.
2775 - Fix warning for unused variable for compilation without systemd.
2778 - Introduce `-V` option to print the version number and build options.
2780 are now moved from `-h` to `-V` as well for consistency.
2781 - PACKAGE_BUGREPORT now also includes link to GitHub issues.
2784 - For #52 #53, second context does not close logfile override.
2785 - Fix #52 #53, fix for example fail program.
2786 - Fix to return after failed auth zone http chunk write.
2787 - Fix to remove unused test for task_probe existance.
2788 - Fix to timeval_add for remaining second in microseconds.
2789 - Check repinfo in worker_handle_request, if null, drop it.
2792 - Add verbose log message when auth zone file is written, at level 4.
2794 name to make it unique, for libunbound created multiple contexts.
2797 - Fix question section mismatch in local zone redirect.
2801 session renegotiation.
2806 responses is removed.
2809 - Fix in respip addrtree selection. Absence of addr_tree_init_parents()
2811 too specific.
2815 cache.
2818 - For #45, check that 127.0.0.1 and ::1 are not used in unbound.conf
2821 stub-addr statements.
2824 - Fix memleak in unit test, reported from the clang 8.0 static analyzer.
2827 - PR #28: IPSet module, by Kevin Chou. Created a module to support
2828 the ipset that could add the domain's ip to a list easily.
2829 Needs libmnl, and --enable-ipset and config it, doc/README.ipset.md.
2830 - Fix to omit RRSIGs from addition to the ipset.
2833 of compare with it. Remade lex and yacc output.
2835 - Added documentation to the ipset files (for doxygen output).
2840 - Fix python dict reference and double free in config.
2843 - Master contains version 1.9.3 in development.
2844 - Fix #39: In libunbound, leftover logfile is close()d unpredictably.
2846 address from previous scan.
2849 - Fix another spoolbuf storage code point, in prefetch.
2850 - 1.9.2rc3 release candidate tag. Which became the 1.9.2 release
2851 on 17 June 2019.
2856 error cases that did not use the correct spoolbuf.
2857 - 1.9.2rc2 release candidate tag.
2860 - 1.9.2rc1 release candidate tag.
2863 - iana portlist updated.
2866 - Fix to guard _OPENBSD_SOURCE from redefinition.
2869 - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.
2870 - gitignore config.h.in~.
2873 - Fix double file close in tcp pipelined response code.
2877 between mesh send and callback end.
2881 otherwise queries are not distributed evenly, on Linux 4.4.x.
2884 - Fix #31: swig 4.0 and python module.
2887 - Squelch log messages from tcp send about connection reset by peer.
2889 network connectivity issues.
2890 - Attempt to fix malformed tcp response.
2894 unconditionally includes .o files detected by configure, also
2895 when the machine architecture uses different LIBOBJS files.
2898 - Attempt to fix build failure in oss-fuzz because of reallocarray.
2899 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14648.
2900 Does not omit compile flags from commandline.
2903 - Fix edns-subnet locks, in error cases the lock was not unlocked.
2904 - Fix doxygen output error on readme markdown vignettes.
2907 - Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64.
2908 - Fix #30: AddressSanitizer finding in lookup3.c. This sets the
2910 not read beyond array boundaries. This makes code better security
2911 checkable, and is better for security. It is fixed to be slower,
2912 but not read outside of the array.
2915 - contrib/fastrpz.patch updated for code changes, and with git diff.
2916 - Fix .gitignore, add pythonmod and dnstap generated files.
2917 And unit test generated files, and generated doc files.
2920 - Update makedist for git.
2921 - Nicer travis output for clang analysis.
2923 master: <ip>#<authname> in unbound.conf. This uses TLS to
2924 download the AXFR (or IXFR).
2928 the copy of the local alias is in unpacked form.
2932 subdomain answers.
2934 when message contains a CNAME record.
2937 - travis build file.
2940 - Better braces in if statement in TCP fastopen code.
2941 - iana portlist updated.
2945 not resume the TLS handshake.
2948 - Update python documentation for init_standard().
2949 - Typos.
2953 SOA serial probes. This fixes that probes fail because earlier
2954 probe addresses are unreachable.
2955 - Fix that auth zone fails over to next master for timeout in tcp.
2957 messages. Verbosity 2 and higher enables them.
2960 - Fix to use event_assign with libevent for thread-safety.
2962 start, timeout and fail.
2965 multicast DNS [RFC 6762] via Avahi. The plugin communicates
2966 with Avahi via DBus. The comment section at the beginning of
2967 the file contains detailed documentation.
2969 if available.
2972 - Fix to reinit event structure for accepted TCP (and TLS) sockets.
2975 - Fix spelling error in log output for event method.
2979 where it is more visible.
2981 include the closest encloser in the answer.
2985 match nsec3 records.
2986 - Fix for out of bounds integers, thanks to OSTIF audit. It is in
2987 allocation debug code.
2988 - Fix for auth zone nsec3 ent fix for wildcard nodata.
2991 - Fix that tls-session-ticket-keys: "" on its own in unbound.conf
2992 disables the tls session ticker key calls into the OpenSSL API.
2993 - Fix crash if tls-servic-pem not filled in when necessary.
2996 - Fix #4240: Fix whitespace cleanup in example.conf.
2999 - add type CAA to libpyunbound (accessing libunbound from python).
3003 with TLS, if that is enabled for the query.
3004 - Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482.
3008 CFLAGS into configure.
3011 - Tag release 1.9.1rc1. Which became 1.9.1 on 12 March 2019. Trunk
3012 has 1.9.2 in development.
3015 - output forwarder log in ssl_req_order test.
3018 - Remove memory leak on pythonmod python2 script file init.
3019 - Remove swig gcc8 python function cast warnings, they are ignored.
3020 - Print correct module that failed when module-config is wrong.
3024 order and local zone tags, and elements in views.
3025 - Fix #14: contrib/unbound.init: Fix wrong comparison judgment
3026 before copying.
3027 - Fix for python module on Windows, fix fopen.
3030 - Fix #4227: pair event del and add for libevent for tcp_req_info.
3034 and explains it was not compiled in and where to see the list.
3035 - In example.conf explain where to put cachedb module in module-config.
3037 be listed at the start of module-config.
3041 Windows, and for libunbound.
3044 - Print query name with ip_ratelimit exceeded log lines.
3045 - Spaces instead of tabs in that log message.
3046 - Print query name and IP address when domain rate limit exceeded.
3049 - Fix capsforid canonical sort qsort callback.
3052 - Note default for module-config in man page.
3054 that were not present in the set of prepared answers.
3055 - Fix #13: Remove left-over requirements on OpenSSL >= 1.1.0 for
3056 cert name matching, from man page.
3057 - make depend, with newer gcc, nicer layout.
3060 - Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2.
3062 nameserver targets need to be fetched.
3064 DNS-over-TLS and qname-minimisation.
3068 names, for names that have a CNAME in local-data configuration.
3069 It logs the original query name, not the target of the CNAME.
3071 and redirects like type redirect.
3074 comparison, so that out of order rrsets do not cause failure.
3078 libunbound in contrib/libunbound.so.conf.
3079 - improve documentation for tls-service-key and forward-first.
3081 conditional section, fixes systemd builds, from Enrico Scholz.
3082 - #9: For openssl 1.0.2 use the CRYPTO_THREADID locking callbacks,
3083 still supports the set_id_callback previous API. And for 1.1.0
3084 no locking callbacks are needed.
3085 - #8: Fix OpenSSL without ENGINE support compilation.
3086 - Wipe TLS session key data from memory on exit.
3090 as edns_lame_known.
3093 - Fix spelling of tls-ciphers in example.conf.in.
3094 - Fix #4224: auth_xfr_notify.rpl test broken due to typo
3095 - Fix locking for libunbound context setup with broken port config.
3099 set with ub_ctx_set_fwd. Patch from Florian Obser.
3100 - Set build system for added call in the libunbound API.
3102 as suggested from draft-ietf-dnsop-7706-bis-02. But with updated
3103 B root address.
3104 - set version to 1.9.0 for release. And this was released with the
3105 spelling for tls-ciphers fix as 1.9.0 on Feb 5. Trunk has 1.9.1 in
3106 development.
3110 then gets the ssl read again applied to the deleted commpoint.
3111 - updated contrib/fastrpz.patch to cleanly diff.
3112 - no lock when threads disabled in tcp request buffer count.
3113 - remove compile warnings from libnettle compile.
3114 - output of newer lex 2.6.1 and bison 3.0.5.
3118 aclocal 1.16.1 and libtoolize 2.4.6.
3119 - Fix unit test for python 3.7 new keyword 'async'.
3123 from NULL start list when growing capacity. Adjust host and file
3124 only when present in test header read to please checker. In
3125 testcode for unknown macro operand give zero result. Initialise the
3126 passed argv array in test code. In test code add EDNS data
3127 segment copy only when nonempty.
3129 include mini_event.h to have a prototype for mini_ev_cmp
3130 include edns.h to have a prototype for apply_edns_options
3140 no previous prototype for function...
3145 declaration shadows a local variable in libunbound.c
3147 declaration shadows a local variable in iterator.c
3148 - Moved includes and make depend.
3152 options for unbound.conf.
3153 - Fixes for the patch, and man page entry.
3155 library compatibility when compiling.
3157 enable with tls-session-ticket-keys in unbound.conf.
3158 - Fixes for patch (includes, declarations, warnings). Free at end
3160 one as the first one.
3161 - Fix for IXFR fallback to reset counter when IXFR does not timeout.
3164 - Fix space calculation for tcp req buffer size.
3165 - Doc for stream-wait-size and unit test.
3166 - unbound-control stats has mem.streamwait that counts TCP and TLS
3167 waiting result buffers.
3169 falls back to AXFR after IXFR gives several timeout failures.
3170 - Fix that auth zone after IXFR fallback tries the same master.
3173 - Fix tcp idle timeout test, for difference in the tcp reply code.
3174 - Unit test for tcp request reorder and timeouts.
3175 - Unit tests for ssl out of order processing.
3176 - Fix that multiple dns fragments can be carried in one TLS frame.
3178 memory used by waiting tcp and tls stream replies. This avoids
3179 a denial of service where these replies use up all of the memory.
3183 starting a fallback sequence for it.
3184 - increase mesh max activation count for capsforid long fetches.
3188 re-query without EDNS after timeout.
3192 partial read.
3193 - Review fixes in out of order processing.
3197 as they arrive.
3198 - Fix for out of order processing administration quit cleanup.
3199 - unit test for tcp out of order processing.
3202 - Initial commit for out-of-order processing for TCP and TLS.
3205 - Log query name for looping module errors.
3208 - Fix syntax in comment of local alias processing.
3210 auth-zone zones with NSEC3 and wildcards.
3214 and server tcp fastopen is enabled at compile time.
3216 section and forward-tls-upstream option in the forward-zone sections.
3217 - Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews,
3218 the patch adds a program used for fuzzing.
3221 - Fix for crash in dns64 module if response is null.
3224 - Fix config parser memory leaks.
3226 previous blocking everything.
3227 - Fix for FreeBSD port make with dnscrypt and dnstap enabled.
3228 - Fix #4206: support openssl 1.0.2 for TLS hostname verification,
3229 alongside the 1.1.0 and later support that is already there.
3230 - Fixup openssl 1.0.2 compile
3233 - Fix dns64 allocation in wrong region for returned internal queries.
3236 - Fix icon, no ragged edges and nicer resolutions available, for eg.
3237 Win 7 and Windows 10 display.
3238 - cache-max-ttl also defines upperbound of initial TTL in response.
3241 - Patch for typo in unbound.conf man page.
3242 - log-tag-queryreply: yes in unbound.conf tags the log-queries and
3243 log-replies in the log file for easier log filter maintenance.
3246 - iana portlist updated.
3247 - Fix chroot auth-zone fix to remove chroot prefix.
3248 - tag for 1.8.2rc1, which became 1.8.2 on 4 dec 2018, with icon
3249 updated. Trunk contains 1.8.3 in development.
3250 Which became 1.8.3 on 11 december with only the dns64 fix of 6 dec.
3251 Trunk then became 1.8.4 in development.
3253 is not placed inside the chroot.
3254 - Refuse to start with no ports.
3255 - Remove clang analysis warnings.
3258 - Fix leak in chroot fix for auth-zone.
3259 - Fix clang analysis for outside directory build test.
3263 other threads from picking up the wrong data. The module restores
3264 the previous no_cache_store setting when the the module is finished.
3265 - Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work.
3267 not overwrite valid cache entry with SERVFAIL.
3269 expired, and this is documented in the man page.
3270 - stat count SERVFAIL downstream auth-zone queries for expired zones.
3271 - Put new logos into windows installer.
3272 - Fix windows compile for new rrset roundrobin fix.
3273 - Update contrib fastrpz patch for latest release.
3276 - Fix to not set GLOB_NOSORT so the unbound.conf include: files are
3277 sorted and in a predictable order.
3279 entry with SERVFAIL.
3280 - Add unbound-control view_local_datas command, like local_datas.
3281 - Fix that unbound-control can send file for view_local_datas.
3284 - With ./configure --with-pyunbound --with-pythonmodule
3286 succeed for the python module.
3287 - pythonmod logs the python error and traceback on failure.
3288 - ignore debug python module for test in doxygen output.
3289 - review fixes for python module.
3290 - Fix #4209: Crash in libunbound when called from getdns.
3292 components are removed before use.
3293 - Fix that empty zonefile means the zonefile is not set and not used.
3294 - make depend.
3297 - Scrub NS records from NODATA responses as well.
3301 poisoning of the cache.
3304 allow raw address access via comm_reply and update API documentation.
3305 - Removed compile warnings in pythonmod sockaddr routines.
3309 option in unbound.conf.
3315 - Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options.
3318 - Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query.
3320 deny-any: yes in unbound.conf. This responds with an empty message
3321 to queries of type ANY.
3322 - Fix #4141: More randomness to rrset-roundrobin.
3323 - Fix #4132: Openness/closeness of RANGE intervals in rpl files.
3325 adds the option unknown-server-time-limit to unbound.conf that
3326 can be increased to avoid the problem.
3327 - remade makefile dependencies.
3328 - Fix #4152: Logs shows wrong time when using log-time-ascii: yes.
3331 - Add markdel function to ECS slabhash.
3332 - Limit ECS scope returned to client to the scope used for caching.
3333 - Make lint like previous #4154 fix.
3337 group.
3339 error if not.
3341 the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options.
3344 - Change fast-server-num default to 3.
3347 - Add fast-server-permil and fast-server-num options.
3348 - Deprecate low-rtt and low-rtt-permil options.
3351 - Squelch log of failed to tcp initiate after TCP Fastopen failure.
3356 verbosity is set to a high value.
3357 - Set default for so-reuseport to no for FreeBSD. It is enabled
3358 by default for Linux and DragonFlyBSD. The setting can
3359 be configured in unbound.conf to override the default.
3360 - iana port update.
3363 - updated contrib/fastrpz.patch to apply for this version
3364 - dnscrypt.c removed sizeof to get array bounds.
3365 - Fix testlock code to set noreturn on error routine.
3366 - Remove unused variable from contrib fastrpz/rpz.c and
3368 - clang analyze test is used only when assertions are enabled.
3371 - tag for release 1.8.1rc1. Became release 1.8.1 on 8 oct, with
3372 fastrpz.patch fix included. Trunk has 1.8.2 in development.
3377 from rejecting responses.
3381 for DNS over TLS service. It sets the configured tls auth name.
3383 also provide other (web) services.
3384 - Fix #4149: Add SSL cleanup for tcp timeout.
3388 does not have it.
3390 the EVP call contexts.
3393 state where they waited for an empty list.
3396 because that causes the UDP part to not be measured as timeout.
3397 - Fix #4156: Fix systemd service manager state change notification.
3400 - Fix seed for random backup code to use explicit zero when wiped.
3401 - exit log routine is annotated as noreturn function.
3402 - free memory leaks in config strlist and str2list insert functions.
3403 - do not move unused argv variable after getopt.
3404 - Remove unused if clause in testcode.
3406 pointer during test of the test. And use exit for return to note
3407 irregular program stop.
3408 - Free memory leak in config strlist append.
3409 - make sure nsec3 comparison salt is initialized.
3410 - unit test has clang analysis.
3411 - remove unused variable assignment from iterator scrub routine.
3413 in forward zone.
3414 - neater pointer cast in libunbound context quit routine.
3415 - initialize statistics totals for printout.
3416 - in authzone check that node exists before adding rrset.
3417 - in unbound-anchor, use readwrite memory BIO.
3418 - assertion in autotrust that packed rrset is formed correctly.
3419 - Fix memory leak when message parse fails partway through copy.
3420 - remove unused udpsize assignment in message encode.
3421 - nicer bio free code in unbound-anchor.
3422 - annotate exit functions with noreturn in unbound-control.
3425 - Fixed unused return value warnings in contrib/fastrpz.patch for
3426 asprintf.
3428 higher verbosity settings.
3429 - Fix spelling errors.
3430 - Fix initialisation in remote.c
3433 - 1.8.1 in svn trunk. (changes from 4,5,.. sep apply).
3434 - iana port update.
3437 - Fix spelling error in header, from getdns commit by Andreas Gelmini.
3441 ip-ratelimit.
3444 - Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018.
3447 - Disable minimal-responses in subnet unit tests.
3452 local-zones defined outside of views.
3455 - Disable minimal-responses in ipsecmod unit tests.
3456 - Added serve-expired-ttl and serve-expired-ttl-reset options.
3460 resilience of the server. The so-reuseport, harden-below-nxdomain,
3461 and minimal-responses options are enabled by default. They used
3462 to be disabled by default, waiting to make sure they worked. They
3464 setting them to "no" in the unbound.conf config file. The reuseport
3466 otherwise harmless. The harden-below-nxdomain option works well
3468 causes more fetches to use information from the cache.
3469 - next release is called 1.8.0.
3470 - Fix lintflags for lint on FreeBSD.
3473 - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This
3475 point when the callback is called before the mesh state (modules).
3477 necessary.
3480 - log-local-actions: yes option for unbound.conf that logs all the
3481 local zone actions, a patch from Saksham Manchanda (Secure64).
3482 - #4146: num.query.subnet and num.query.subnet_cache counters.
3484 enabled.
3488 enabled.
3492 to the event callback function signature. That needs programs,
3493 that use it, to recompile against the new header definition.
3494 - print servfail info to log as error.
3495 - added more servfail printout statements, to the iterator.
3497 returning SERVFAIL to clients.
3500 - Fix warning on compile without threads.
3501 - Fix contrib/fastrpz.patch.
3504 - Fix segfault in auth-zone read and reorder of RRSIGs.
3508 printout and does not wrongly print it is a memory error.
3510 zipfile.
3513 - Fix #4144: dns64 module caches wrong (negative) information.
3517 not compiled in the name of the wrong module.
3518 - document --enable-subnet in doc/README.
3521 want immediate changes visible, from Bjoern A. Zeeb.
3524 - Make capsforid fallback QNAME minimisation aware.
3527 - Fix #4142: unbound.service.in: improvements and fixes.
3528 Add unit dependency ordering (based on systemd-resolved).
3530 about missing privileges during startup). Add 'AF_INET6' to
3531 'RestrictAddressFamilies' (without it IPV6 can't work). From
3532 Guido Shanahan.
3533 - Patch to implement tcp-connection-limit from Jim Hague (Sinodun).
3535 from a nominated netblock.
3536 - make depend, yacc, lex, doc, headers. And log the limit exceeded
3538 it is busy.
3541 - Fix for #4136: Fix to unconditionally call destroy in daemon.c.
3545 ratelimiting) to libunbound under 'ub_result.was_ratelimited'.
3547 libunbound/unbound-event.h.
3548 - Tidy pylib tests.
3552 problems.
3554 yylex_destroy.
3558 always present. Make socket activation more lenient. But not
3559 different when socket activation is not used.
3560 - iana port list update.
3563 - Patches from Jim Hague (Sinodun) for EDNS KeepAlive.
3565 root directory.
3566 - Add config tcp-idle-timeout (default 30s). This applies to
3568 is unaffected.
3569 - Error if EDNS Keepalive received over UDP.
3571 and implement option in client responses.
3572 - Correct and expand manual page entries for keepalive and idle timeout.
3573 - Implement progressive backoff of TCP idle/keepalive timeout.
3574 - Fix 'make depend' to work when build dir is not project root.
3575 - Add delay parameter to streamtcp, -d secs.
3576 To be used when testing idle timeout.
3578 apply cleanly. Also remade yacc and lex.
3579 - Fix mesh.c incompatible pointer pass.
3580 - Please doxygen so it passes.
3581 - Fix #4139: Fix unbound-host leaks memory on ANY.
3585 released tarball and build host.
3588 - Fix man page, say that chroot is enabled by default.
3591 - Fix #4135: 64-bit Windows Installer Creates Entries Under The
3592 Wrong Registry Key, reported by Brian White.
3596 and not in signal handler.
3601 away by the startup process.
3602 - Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared.
3606 is too cryptic.
3609 - Fix #4127 unbound -h does not list -p help.
3611 in the ssl library.
3613 changed config file.
3614 - Resize ratelimit and ip-ratelimit caches if changed on reload.
3618 error_supers assertion fails.
3620 verbosity is 4 or higher, for UDP outgoing sockets.
3624 assignment.
3626 easily changed to adjust default rtt assumptions.
3630 OpenSSL 1.1.0 or later to be enabled.
3634 forward-tls-upstream docs.
3635 - iana port update.
3636 - Note RFC8162 support. SMIMEA record type can be read in by the
3637 zone record parser.
3641 - Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass
3642 if DNSSEC is not enabled. New option -R allows fallback from
3643 resolv.conf to direct queries.
3647 config statements.
3648 - Fix permission denied printed for auth zone probe random port nrs.
3651 - Fix checking for libhiredis printout in configure output.
3652 - Fix typo on man page in ip-address description.
3653 - Update libunbound/python/examples/dnssec_test.py example code to
3654 also set the 20326 trust anchor for the root in the example code.
3659 record.
3662 - num.queries.tls counter for queries over TLS.
3663 - log port number with err_addr logs.
3666 - #4109: Fix that package config depends on python unconditionally.
3667 - Patch, do not export python from pkg-config, from Petr Menšík.
3670 - Partial fix for permission denied on IPv6 address on FreeBSD.
3672 stop scan of masters for an updated zone.
3674 if the wait timer has already been started.
3677 - #4108: systemd reload hang fix.
3679 argument on BSDs and Windows.
3683 more closely.
3684 This fix is part of 1.7.3.
3685 - Windows example service.conf edited with more windows specific
3686 configuration.
3687 - Fix windows unbound-control no cert bad file descriptor error.
3688 This fix is part of 1.7.3.
3691 - Fix that control-use-cert: no works for 127.0.0.1 to disable certs.
3692 This fix is part of 1.7.3rc2.
3693 - Fix unbound-checkconf for control-use-cert.
3694 This fix is part of 1.7.3.
3697 - tag for 1.7.3rc1.
3698 - trunk has 1.7.4.
3699 - unbound-control auth_zone_reload _zone_ option rereads the zonefile.
3702 a new zone version is available.
3706 file for url downloads.
3707 - Fix that first control-interface determines if TLS is used. Warn
3708 when IP address interfaces are used without TLS.
3709 - Fix nettle compile.
3713 query restart.
3716 - #4102 for NSD, but for Unbound. Named unix pipes do not use
3718 directory permissions. The option control-use-cert is no longer
3719 used, and ignored if found in unbound.conf.
3721 line adds one port.
3722 - Fix buffer size warning in unit test.
3723 - remade dependencies in the Makefile.
3726 - Patch to fix openwrt for mac os build darwin detection in configure.
3730 instead of with unbound.conf.
3733 - Fix deadlock caused by incoming notify for auth-zone.
3734 - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018,
3735 trunk is 1.7.3 in development from this point.
3736 - #4100: Fix stub reprime when it becomes useless.
3739 - Rename additional-tls-port to tls-additional-ports.
3740 The older name is accepted for backwards compatibility.
3744 requests as if the RD bit is set.
3748 with ENOSYS.
3749 - Fix that fallback for windows port.
3752 - Fix windows tcp and tls spin on events.
3753 - Add routine from getdns to add windows cert store to the SSL_CTX.
3755 authenticating DNS-over-TLS connections. It can be used instead
3756 of the tls-cert-bundle option, or with it to add certificates.
3760 update in infra cache, so future selections can exclude them.
3761 - Fix that tcp sticky events are removed for closed fd on windows.
3762 - Fix close events for tcp only.
3765 - Fix that libunbound can do DNS-over-TLS, when configured.
3766 - Fix that windows unbound service can use DNS-over-TLS.
3768 inside libunbound), when ssl upstream or a cert-bundle is configured.
3772 available on Linux, FreeBSD and OpenBSD.
3775 - Qname minimisation default changed to yes.
3778 - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand.
3781 - Fix contrib/libunbound.pc for libssl libcrypto references,
3782 from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914
3785 - Fix windows to not have sticky TLS events for TCP.
3786 - Fix read of DNS over TLS length and data in one read call.
3787 - Fix mesh state assertion failure due to callback removal.
3790 - Fix that configure --with-libhiredis also turns on cachedb.
3791 - Fix gcc 8 buffer warning in testcode.
3792 - Fix function type cast warning in libunbound context callback type.
3795 - Fix fail to reject dead peers in forward-zone, with ssl-upstream.
3799 the memory pages to the system.
3803 off.
3807 from Saksham Manchanda.
3808 - Also that for dnscrypt.
3809 - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk
3810 is from here 1.7.2 in development.
3816 - Fix contrib/fastrpz.patch for this release.
3817 - Fix auth https for libev.
3823 - makedist uses bz2 for expat code, instead of tar.gz.
3825 config_set_option.
3827 including comments in the file.
3828 - Fix sldns parse failure for CDS alternate delete syntax empty hex.
3830 callback does not skip callback of result.
3831 - Fix cname classification with qname minimisation enabled.
3832 - list_auth_zones unbound-control command.
3835 - man page documentation for dns-over-tls forward-addr '#' notation.
3836 - removed free from failed parse case.
3838 with the previous contents.
3839 - Delete auth zone when removed from config.
3842 - Can set tls authentication with forward-addr: IP#tls.auth.name
3843 And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem".
3844 such as forward-addr: 9.9.9.9@853#dns.quad9.net or
3845 1.1.1.1@853#cloudflare-dns.com
3847 verify the server's certificate (RFC 8310 support).
3848 - For addr with #authname and no @port notation, the default is 853.
3852 with backoff. Also time a refresh at the zone expiry.
3855 - auth zone notify work.
3856 - allow-notify: config statement for auth-zones.
3860 - Fix auth zone target lookup iterator.
3862 - auth zone notify work.
3865 - Fix for max include depth for authzones.
3866 - Fix memory free on fail for $INCLUDE in authzone.
3868 auth zone gets stopped, before trying to send there.
3869 - auth zone notify work.
3872 - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN
3873 statistics counters.
3876 - documentation for low-rtt and low-rtt-pct.
3877 - auth zone notify work.
3881 serve-expired enabled it'll start prefetching those entries.
3882 - num.query.authzone.up and num.query.authzone.down statistics counters.
3884 answer and fallback is enabled.
3886 and set_option.
3887 - low-rtt and low-rtt-pct in unbound.conf enable the server selection
3888 of fast servers for some percentage of the time.
3891 - Combine write of tcp length and tcp query for dns over tls.
3892 - nitpick fixes in example.conf.
3893 - Fix above stub queries for type NS and useless delegation point.
3894 - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3
3896 so use TLSv1.2.
3897 - ED448 support.
3900 - Fix #4043: make test fails due to v6 presentation issue in macOS.
3902 failing with a forwarder set. Now, auth-zone is only used for
3903 answers (not referrals) when a forwarder is set.
3906 - Check "result" in dup_all(), by Florian Obser.
3913 domains under DNSSEC Negative Trust Anchors.
3916 - iana port update.
3919 - corrected a minor typo in the changelog.
3920 - move htobe64/be64toh portability code to cachedb.c.
3924 that uses a Redis server as the storage. This implementation
3925 depends on the hiredis client library (https://redislabs.com/lp/hiredis/).
3927 --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h
3928 should exist). Patch from Jinmei Tatuya (Infoblox).
3930 servfail hits deleted message queue.
3932 portnumbers and listing the portnumbers as additional-tls-port: nr.
3935 - Fix typo in documentation.
3937 flushed with serve-expired on.
3940 - Added documentation for aggressive-nsec: yes.
3941 - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk
3942 now has 1.7.1 in development.
3944 documentation is not consistent.
3945 - Check IXFR start serial.
3948 - Fix #3598: Fix swig build issue on rhel6 based system.
3949 configure --disable-swig-version-check stops the swig version check.
3952 - tag 1.7.0rc2.
3955 - Fixed contrib/fastrpz.patch, even though this already applied
3956 cleanly for me, now also for others.
3957 - patch to log creates keytag queries, from A. Schulze.
3959 A. Schulze.
3960 - Attempt to remove warning about trailing whitespace.
3965 other implementations.
3966 - svn trunk contains 1.7.0, this is the number for the next release.
3967 - Fix for windows compile.
3968 - tag 1.7.0rc1.
3971 - Fix to check define of DSA for when openssl is without deprecated.
3972 - iana port update.
3974 causes same port to be used twice for tcp connections.
3977 - Fixup contrib/fastrpz.patch so that it applies.
3978 - Fix compile without threads, and remove unused variable.
3979 - Fix compile with staticexe and python module.
3980 - Fix nettle compile.
3984 aggressive NSEC.
3988 when there is a CNAME loop.
3989 - Fix validation for CNAME loops. When it detects a cname loop,
3991 the partial result with the validation result up to then.
3992 - more robust cachedump rrset routine.
3996 wrong RFC.
3998 to the global local zone contents, for queries for that zone.
3999 - Fix for more maintainable code in localzone.
4003 edns-subnet/addrtree.c after the assert made clang analyzer
4004 produce a failure to analyze it.
4010 - tls-cert-bundle option in unbound.conf enables TLS authentication.
4011 - iana port update.
4014 - Unit test for auth zone https url download.
4021 - Aggressive use of NSEC implementation. Use cached NSEC records to
4022 generate NXDOMAIN, NODATA and positive wildcard answers.
4025 - iana port update.
4026 - auth zone url config.
4029 - Fix #3451: dnstap not building when you have a separate build dir.
4030 And removed protoc warning, set dnstap.proto syntax to proto2.
4031 - auth-zone provides a way to configure RFC7706 from unbound.conf,
4032 eg. with auth-zone: name: "." for-downstream: no for-upstream: yes
4033 fallback-enabled: yes and masters or a zonefile with data.
4036 - Fix unfreed locks in log and arc4random at exit of unbound.
4038 - Fix lock race condition in dns cache dname synthesis.
4040 no modification of critical regions outside of lock region.
4044 unitialised memory.
4047 - Use NSEC with longest ce to prove wildcard absence.
4048 - Only use *.ce to prove wildcard absence, no longer names.
4051 - ltrace.conf file for libunbound in contrib.
4055 for startup scripts to get the full pathname(s) of anchor file(s).
4057 so that it is printed to console.
4060 - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is
4061 also recognized and means the same. Also for tls-port,
4063 forward-tls-upstream.
4064 - Fix #3397: Fix that cachedb could return a partial CNAME chain.
4067 be returned.
4070 - tag 1.6.8 for release with CVE fix.
4071 - trunk has 1.6.9 with fix and previous commits.
4073 wildcard synthesized NSEC records.
4074 - iana port update.
4075 - make depend: code dependencies updated in Makefile.
4079 snooping is not allowed.
4082 - Fix queries being leaked above stub when refetching glue.
4086 away, without a repeat query picking the DS from cache.
4088 by the scrubber to have the answer in the answer section.
4090 Fix that expiration date checks don't fail with clang -O2.
4094 disabling -O2 when the compiler --version is clang.
4095 - iana port update.
4097 work.
4103 - authzone work, transfer connect.
4107 or --with-nss.
4110 - Fix link failure on OmniOS.
4113 - auth zone work.
4120 set for stub zone. It no longer searches for DNSSEC information.
4121 - auth xfer work on probe timer and lookup.
4124 - Fix #2801: Install libunbound.pc.
4125 - Fix qname minimisation to send AAAA queries at zonecut like type A.
4126 - reverted AAAA change.
4129 - Fix #2492: Documentation libunbound.
4132 - Fix #2362: TLS1.3/openssl-1.1.1 not working.
4133 - Fix #2034 - Autoconf and -flto.
4135 a message and exit.
4138 - Fix #1913: ub_ctx_config is under circumstances thread-safe.
4139 - make ip-transparent option work on OpenBSD.
4143 fail.
4144 - lexer output.
4145 - iana port update.
4148 - Fixed libunbound manual typo.
4149 - Fix #1949: [dnscrypt] make provider name mismatch more obvious.
4153 - Update B root ipv4 address.
4156 - authzone work, probe timer setup.
4159 - lint for recent authzone commit.
4163 circular dependency in NS and DS lookups.
4167 from Manu Bretelle.
4169 distributing some of them.
4172 cert. Likewise, in order to know which ES version should be used.
4175 using the old certs's public key.
4177 publish the cert as part of the DNS's provider_name's TXT answer.
4178 - Better documentation for cache-max-negative-ttl.
4179 - Work on local root zone code.
4182 - tag 1.6.7
4183 - trunk has version 1.6.8.
4186 - Fix spelling in unbound-control man page.
4189 - Fix trust-anchor-signaling works in libunbound.
4190 - Fix some more crpls in testdata for different signaling default.
4191 - tag 1.6.7rc1
4195 - Use RCODE from A query on DNS64 synthesized answer.
4198 - Fix param unused warning for windows exportsymbol compile.
4201 - Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
4202 (by Danilo G. Baio).
4209 (patch from Jinmei Tatuya).
4214 - Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
4218 always-forward.
4221 - tag 1.6.6 (is 1.6.6rc2)
4223 control.
4225 downstream.
4226 - Fix #1440: [dnscrypt] client nonce cache.
4229 - Fix unbound-host to report error for DNSSEC state of failed lookups.
4230 - Spelling fixes, from Josh Soref.
4233 - tag 1.6.6rc2, became 1.6.6 on 18 sep. trunk 1.6.7 in development.
4236 - Add dns64 for client-subnet in unbound-checkconf.
4240 - Fix #1434: Fix windows openssl 1.1.0 linking.
4243 - tag 1.6.6rc1
4244 - makedist fix for windows binaries, with openssl 1.1.0 windres fix,
4245 and expat 2.2.4 install target fix.
4248 - Recommend 1472 buffer size in unbound.conf
4251 - Fix #1424: cachedb:testframe is not thread safe.
4252 - For #1417: escape ; in dnscrypt tests.
4253 - but reverted that, tests fails with that escape.
4255 dnscrypt is not enabled. And cache size configuration option.
4258 ip-ratelimit-slabs.
4261 - updated contrib/fastrpz.patch to apply with configparser changes.
4262 - Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
4265 - Fix #1414: fix segfault on parse failure and log_replies.
4267 qname member.
4268 - new keys and certs for dnscrypt tests.
4269 - fixup WKS test on buildhost without servicebyname.
4272 - Fix #1415: patch to free dnscrypt environment on reload.
4275 Manu Bretelle.
4276 - Small fixes for the shared secret cache patch.
4278 entries for udp and tcp.
4281 - Fix #1407: Add ECS options check to unbound-checkconf.
4284 allocation failure.
4288 valid. Checks hash of DS but not signature of new key. This fixes
4289 the root.key file if created when unbound is installed between
4290 sep11 and oct11 2017.
4291 - tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix).
4292 - trunk version 1.6.6 in development.
4294 implemented causing TCP to fail. The fix allows fallback to regular
4296 fails for some reason.
4297 - Fix #1402: squelch invalid argument error for fd_set_block on windows.
4301 Strotmann.
4304 - Fix #1398: make cachedb secret configurable.
4305 - Remove spaces from Makefile.
4308 - Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
4312 - Do not reset rrset.bogus stats when called using stats_noreset.
4314 recursion.
4316 module stats are global.
4319 - Fix #1394: mix of serve-expired and response-ip could cause a crash.
4322 - upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
4323 config.sub(2016-09-05).
4324 - annotate case statement fallthrough for gcc 7.1.1.
4325 - flex output from flex 2.6.1.
4326 - snprintf of thread number does not warn about truncated string.
4328 unless verbosity is high.
4329 - remove warning from windows compile.
4331 - Fix DSA configure switch (--disable dsa) for libnettle and libnss.
4332 - Fix #1365: Add Ed25519 support using libnettle.
4336 - Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
4337 - Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
4338 With the -p option unbound does not create a pidfile.
4341 - Fix #1344: RFC6761-reserved domains: test. and invalid.
4342 - Redirect all localhost names to localhost address for RFC6761.
4345 - Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
4346 - Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists)..
4349 - Fix 1332: Bump verbosity of failed chown'ing of the control socket.
4353 on.
4355 deleted.
4356 - Fix pythonmod link line option flag.
4357 - Fix openssl 1.1.0 load of ssl error strings from ssl init.
4360 - Fix python example0 return module wait instead of error for pass.
4362 - enhancement for hardened-tls for DNS over TLS. Removed duplicated
4363 security settings.
4366 - Tag 1.6.4 is created with the 1.6.4rc2 contents.
4367 - Trunk contains 1.6.5, with changes from 26, 27 june.
4368 - Remove signed unsigned warning from authzone.
4369 - Fix that infra cache host hash does not change after reconfig.
4372 - (for 1.6.5)
4373 Better fixup of dnscrypt_cert_chacha test for different escapes.
4374 - First fix for zero b64 and hex text zone format in sldns.
4375 - unbound-control dump_infra prints port number for address if not 53.
4378 - (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
4381 - Tag 1.6.4rc2
4387 - Fix #1316: heap read buffer overflow in parse_edns_options.
4390 - Fix warning in pythonmod under clang compiler.
4391 - Tag 1.6.4rc1
4392 - Fix lintian typo.
4395 - Fix #1277: disable domain ratelimit by setting value to 0.
4398 - Fix #1301: memory leak in respip and tests.
4399 - Free callback in edns-subnetmod on exit and restart.
4400 - Fix memory leak in sldns_buffer_new_frm_data.
4401 - Fix memory leak in dnscrypt config read.
4402 - Fix dnscrypt chacha cert support ifdefs.
4403 - Fix dnscrypt chacha cert unit test escapes in grep.
4404 - Remove asynclook tests that cause test and purifier problems.
4405 - Fix to unlock view in view test.
4409 harden-referral-path ns checks.
4410 - Fix query for refetch_glue of stub leaking to internet.
4413 - Fix #1279: Memory leak on reload when python module is enabled.
4415 contains malformed qname. When 0x20 caps-for-id is enabled, when
4416 assertions are not enabled the malformed qname is handled correctly.
4417 - 1.6.3 tag created, with only #1280 fix, trunk is 1.6.4 development.
4418 - More fixes in depth for buffer checks in 0x20 qname checks.
4421 - Fix #1278: Incomplete wildcard proof.
4424 - Added domain name based ECS whitelist.
4427 - Detect chacha for dnscrypt at configure time.
4428 - dnscrypt unit tests with chacha.
4431 - Fix that unbound-control can set val_clean_additional and val_permissive_mode.
4432 - Add dnscrypt XChaCha20 tests.
4435 - Add an explicit type cast for TCP FASTOPEN fix.
4436 - renumbering B-Root's IPv6 address to 2001:500:200::b.
4437 - Fix #1275: cached data in cachedb is never used.
4438 - Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
4442 (from Manu Bretelle).
4445 - Fix fastopen EPIPE fallthrough to perform connect.
4449 not have any local-zone specified.
4452 - Fix #1273: cachedb.c doesn't compile with -Wextra.
4453 - If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
4456 - Fix #1269: inconsistent use of built-in local zones with views.
4458 unbound-control.
4461 - Support for openssl EVP_DigestVerify.
4462 - Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
4466 overrides udpsize.
4469 - Added redirect-bogus.patch to contrib directory.
4472 - Fix #1270: unitauth.c doesn't compile with higher warning level
4474 - exec_prefix is by default equal to prefix.
4475 - printout localzone for duplicate local-zone warnings.
4479 rrsets added for cname chain.
4483 zonefiles.
4487 - Fix #1268: SIGSEGV after log_reopen.
4490 - Fix #1265 to use /bin/kill.
4491 - Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
4492 and compatibility with BoringSSL.
4495 - Fix #1265: contrib/unbound.service contains hardcoded path.
4498 - Use qstate's region for IPSECKEY rrset (ipsecmod).
4501 - Implemented opportunistic IPsec support module (ipsecmod).
4502 - Some whitespace fixup.
4505 - updated dependencies in the makefile.
4506 - document trust-anchor-signaling in example config file.
4507 - updated configure, dependencies and flex output.
4509 module memory printout of statistics.
4510 - Fix type AVC sldns rrdef.
4514 is enabled, to avoid overwriting useful information there.
4515 - Fix queries for nameservers under a stub leaking to the internet.
4518 - Add 'c' to getopt() in testbound.
4522 - Fix tcp-mss failure printout text.
4524 connect limited tcp connections. With the option tcp connections
4525 can share the same source port (for different destinations).
4528 - Added mesh_add_sub to add detached mesh entries.
4529 - Use mesh_add_sub for key tag signaling query.
4532 - Added test for leak of stub information.
4533 - Fix sldns wire2str printout of RR type CAA tags.
4534 - Fix sldns int16_data parse.
4535 - Fix sldns parse and printout of TSIG RRs.
4536 - sldns SMIMEA and AVC definitions, same as getdns definitions.
4540 by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
4542 - Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
4543 and fix that 64bit getting installed in C:\Program Files (x86).
4546 - Implemented trust anchor signaling using key tag query.
4550 string parse routine.
4553 - unbound-checkconf -o allows query of dnstap config variables.
4554 Also unbound-control get_option. Also for dnscrypt.
4555 - trunk contains 1.6.3 version number (changes from 1.6.2 back from
4556 when the 1.6.2rc1 tag has been created).
4559 - Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
4563 - Fix #1252: more indentation inconsistencies.
4564 - Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
4567 - Added ECS unit test (from Manu Bretelle).
4568 - ECS documentation fix (from Manu Bretelle).
4571 - Fix #1250: inconsistent indentation in services/listen_dnsport.c.
4572 - tag for 1.6.2rc1
4573 - (for 1.6.3:) unbound.h exports the shm stats structures. They use
4574 type long long and no ifdefs, and ub_ before the typenames.
4579 independent of the configuration of unbound.
4583 forwarding ECS.
4584 - Properly check for allocation failure in local_data_find_tag_datas.
4585 - Fix #1249: unbound doesn't return FORMERR to bogus ECS.
4586 - Set SHM ECS memory usage to 0 when module not loaded.
4589 - Display ECS module memory usage.
4593 digest algorithms in DS records.
4596 - Remove ECS option after REFUSED answer.
4597 - Fix small memory leak in edns_opt_copy_alloc.
4598 - Respip dereference after NULL check.
4599 - Zero initialize addrtree allocation.
4600 - Use correct identifier for SHM destroy.
4603 - Fix pythonmod for cb changes.
4604 - Some whitespace fixup.
4622 - Small fixup for documentation.
4624 - Fix respip for braces when locks arent used.
4625 - Fix pythonmod for cb changes.
4629 be under chroot.
4633 - Do not add current time twice to TTL before ECS cache store.
4634 - Do not touch rrset cache after ECS cache message generation.
4635 - Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode.
4640 Manu Bretelle).
4644 - Remove (now unused) event2 include from dnscrypt code.
4648 no_cache_store flag was set.
4652 prints warning.
4657 (configured) local zones.
4658 - Fix #1229: Systemd service sandboxing, options in wrong sections.
4662 branch, using new EDNS processing framework.
4665 - Fix doxygen for dnscrypt files.
4668 - #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then
4669 enabled in the config file from Manu Bretelle.
4670 - make depend, autoconf, remove warnings about statement before var.
4671 - lru_demote and lruhash_insert_or_retrieve functions for getdns.
4672 - fixup for lruhash (whitespace and header file comment).
4673 - dnscrypt tests.
4676 - Patch for view functionality for local-data-ptr from Björn Ketelaars.
4678 SERVFAIL returned.
4681 - Fix that SHM is not inited if not enabled.
4682 - Add trustanchor.unbound CH TXT that gets a response with a number
4683 of TXT RRs with a string like "example.com. 2345 1234" with
4684 the trust anchors and their keytags.
4685 - Fix that looped DNAMEs do not cause unbound to spend effort.
4686 - trustanchor tags are sorted. reusable routine to fetch taglist.
4689 - testbound understands Deckard MATCH rcode question answer commands.
4691 of YXDOMAIN + query loop, reported by Petr Spacek.
4695 in ANSWER section.
4699 DS records. NSEC3 is not disabled.
4700 - fake-sha1 test option; print warning if used. To make unit tests.
4702 help output.
4705 - make depend for build dependencies.
4706 - swig version 2.0.1 required.
4710 - Fix #1230: swig version 2.0.0 is required for pythonmod, with
4711 1.3.40 it crashes when running repeatly unbound-control reload.
4712 - Response actions based on IP address from Jinmei Tatuya (Infoblox).
4715 - Fix #1229: Systemd service sandboxing in contrib/unbound.service.
4719 - Fix testpkts.c, check if DO bit is set, not only if there is an OPT
4720 record.
4724 known vulns.
4727 - Fix #1227: Fix that Unbound control allows weak ciphersuits.
4728 - Fix #1226: provide official 32bit binary for windows.
4731 - include sys/time.h for new shm code on NetBSD.
4734 - Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to
4735 redirect.
4736 - Patch from Luiz Fernando Softov for Stats Shared Memory.
4738 which uses less cpu.
4739 - make depend, autoconf, doxygen and lint fixed up.
4743 (x86) if Unbound is 64bit by default on windows.
4749 - sldns updated for vfixed and buffer resize indication from getdns.
4752 - sldns has ED25519 and ED448 algorithm number and name for display.
4755 - tag 1.6.1rc3. -- which became 1.6.1 on 21feb, trunk has 1.6.2
4758 - Fix autoconf of systemd check for lack of pkg-config.
4761 - Fix pythonmod for typedef changes.
4762 - Fix dnstap for warning of set but not used.
4763 - tag 1.6.1rc2.
4766 - tag 1.6.1rc1.
4769 - Fix for type name change and fix warning on windows compile.
4772 - Include root trust anchor id 20326 in unbound-anchor.
4775 - Fix compile on solaris of the fix to use $host detect.
4778 - fix root_anchor test for updated icannbundle.pem lower certificates.
4782 more helpful error message.
4785 - Increase MAX_MODULE to 16.
4789 reserves _t typedefs.
4791 type names are reserved by POSIX.
4795 - Fix to also block meta types 128 through to 248 with formerr.
4800 'packed'.
4803 - Fix #1201: Fix missing unlock in answer_from_cache error condition.
4807 packet amplification if this meta-type is sent on to upstream.
4808 - Fix #1184: Log DNS replies. This includes the same logging
4810 patch from Larissa Feng.
4811 - Fix #1187: Source IP rate limiting, patch from Larissa Feng.
4815 you enable use-systemd: yes in unbound.conf.
4816 Also there are contrib/unbound.socket and contrib/unbound.service:
4817 systemd files for unbound, install them in /usr/lib/systemd/system.
4818 Contributed by Sami Kerola and Pavel Odintsov.
4819 - Fix reload chdir failure when also chrooted to that directory.
4822 - Fix #1194: Cross build fails when $host isn't `uname` for getentropy.
4825 - Fix #1190: Do not echo back EDNS options in local-zone error response.
4829 - Fix #1188: Unresolved symbol 'fake_dsa' in libunbound.so when built
4833 - Fix #1191: remove comment about view deletion.
4837 - 64bit is default for windows builds.
4838 - Fix inet_ntop and inet_pton warnings in windows compile.
4842 at end of install.
4845 - Fix #1182: Fix Resource leak (socket), at startup.
4846 - Fix unbound-control and ipv6 only.
4849 - Fix #1176: stack size too small for Alpine Linux.
4852 - Fix downcast warnings from visual studio in sldns code.
4853 - tag 1.6.0rc1 which became 1.6.0 on 15 dec, and trunk is 1.6.1.
4856 - Add DSA support for OpenSSL 1.1.0
4861 bypassing the cache response stage and uniquifying mesh states. Four EDNS
4862 option lists were added to module_qstate (module_qstate.edns_opts_*) to
4863 store EDNS options from/to front/back side.
4865 control the modules' cache interactions.
4866 - Added code for registering inplace callback functions. The registered
4869 query, sending a query to a nameserver. The functions can inspect the
4870 available data and maybe change response/query related data (i.e. append
4871 EDNS options).
4872 - Updated Python module for the above.
4873 - Updated Python documentation.
4877 tag_actions element.
4880 - Fix #1170: document that 'inform' local-zone uses local-data.
4888 local_datas and local_datas_remove).
4892 - version 1.6.0 is in the development branch.
4893 - braces in view.c around lock statements.
4896 - new install-sh.
4900 using no encryption over the unix socket.
4903 - Make access-control-tag-data RDATA absolute. This makes the RDATA
4904 origin consistent between local-data and access-control-tag-data.
4905 - Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
4906 subdomain of the NSEC owner.
4908 this type in harden-below-nxdomain functionality.
4910 synergy.
4913 - iana portlist update.
4914 - Fix unit tests for DS hash processing for fake-dsa test option.
4916 on sbrk().
4920 Underneath" for the harden-below-nxdomain option.
4924 not the status code from the tee command.
4927 - Added stub-ssl-upstream and forward-ssl-upstream options.
4931 manner. Every function on its own, so that other libraries (eg.
4932 LibreSSL) can develop their API without hindrance.
4933 - Fix #1154: segfault when reading config with duplicate zones.
4935 this means nsec3 with optout is insufficient.
4938 - Set OpenSSL security level to 0 when using aNULL ciphers.
4941 - .gitattributes line for githubs code language display.
4943 "Robin H. Johnson" <robbat2@gentoo.org>
4946 - iana portlist update.
4949 - Fix failure to build on arm64 with no sbrk.
4950 - iana portlist update.
4953 - Patch for server.num.zero_ttl stats for count of expired replies,
4954 from Pavel Odintsov.
4958 with the undocumented switch 'fake-dsa'. It logs a warning.
4962 immediately to ignore datetime, or back to 0 to enable it again.
4963 The -- is to ignore the '-1' as an option flag.
4966 - serve-expired config option: serve expired responses with TTL 0.
4967 - g.root-servers.net has AAAA address.
4970 - Ported tests for local_cname unit test to testbound framework.
4973 - suppress compile warning in lex files.
4974 - init lzt variable, for older gcc compiler warnings.
4975 - fix --enable-dsa to work, instead of copying ecdsa enable.
4976 - Fix DNSSEC validation of query type ANY with DNAME answers.
4977 - Fixup query_info local_alias init.
4980 - Fix #1130: whitespace in example.conf.in more consistent.
4984 point to data on the internet, from Jinmei Tatuya (Infoblox).
4985 - Removed patch comments from acllist.c and msgencode.c
4986 - Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf,
4987 from Jinmei Tatuya (Infoblox).
4989 clients with different EDNS parameters, from Jinmei Tatuya.
4990 - Fix #1118: libunbound.pc sets strange Libs, Libs.private values.
4991 - Added Requires line to libunbound.pc
4992 - Please doxygen by modifying mesh.h
4995 - Re-fix #839 from view commit overwrite.
4996 - Fixup const void cast warning.
4999 - Free view config elements.
5002 - Added qname-minimisation-strict config option.
5003 - iana portlist update.
5004 - fix memoryleak logfile when in debug mode.
5007 - Added views functionality.
5008 - Fix #1117: spelling errors, from Robert Edmonds.
5011 - Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.
5014 - Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
5015 - Fix #839: Memory grows unexpectedly with large RPZ files.
5016 - Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile.
5017 - Fix #841: big local-zone's make it consume large amounts of memory.
5020 - tag for 1.5.10 release
5021 - trunk contains 1.5.11 in development.
5023 responses, from Nikolay Edigaryev.
5024 - Fix #836: unbound could echo back EDNS options in an error response.
5027 - iana portlist update.
5028 - Fix #835: fix --disable-dsa with nettle verify.
5029 - tag for 1.5.10rc1 release.
5032 - Fix 883: error for duplicate local zone entry.
5033 - Test for openssl init_crypto and init_ssl functions.
5036 - fix potential memory leak in daemon/remote.c and nullpointer
5037 dereference in validator/autotrust.
5038 - iana portlist update.
5042 diagnostic pragma.
5043 - Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len.
5046 - Fix #831: workaround for spurious fread_chk warning against petal.c
5050 to original TTL from RRSIG.
5054 off-by-one typo, from Jinmei Tatuya (Infoblox).
5055 - Fix incomplete prototypes reported by Dag-Erling Smørgrav.
5057 in NXDOMAIN.
5060 - Fix compile with openssl 1.1.0 with api=1.1.0.
5063 - RFC 7958 is now out, updated docs for unbound-anchor.
5064 - Fix for compile without warnings with openssl 1.1.0.
5065 - Fix #826: Fix refuse_non_local could result in a broken response.
5066 - iana portlist update.
5069 - Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A.
5070 Siewior.
5071 - Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
5074 - Clarify local-zone-override entry in unbound.conf.5
5077 - 64bit build option for makedist windows compile, -w64.
5081 in each iteration in find_tag_datas().
5082 - unbound.conf.5 entries for define-tag, access-control-tag,
5084 and local-zone-override.
5087 - Fix #804: unbound stops responding after outage. Fixes queries
5088 that attempt to wait for an empty list of subqueries.
5090 lookups.
5093 - Note that OPENPGPKEY type is RFC 7929.
5097 in test code, from Jinmei Tatuya.
5100 - use sendmsg instead of sendto for TFO.
5103 - Fix #806: wrong comment removed.
5106 - nicer ratelimit-below-domain explanation.
5110 daemon_create_workers().
5112 without log_assert.
5113 - Fix #803: confusing (and incorrect) code comment in daemon_cleanup().
5116 - Fix typo in unbound.conf.
5119 - Fix #798: Client-side TCP fast open fails (Linux).
5122 - TCP Fast open patch from Sara Dickinson.
5123 - Fixed unbound.doxygen for 1.8.11.
5126 - access-control-tag-data implemented. verbose(4) prints tag debug.
5129 - Fix dynamic link of anchor-update.exe on windows.
5130 - Fix detect of mingw for MXE package build.
5131 - Fixes for 64bit windows compile.
5133 --with-libunbound-only --with-nettle.
5136 - For #787: prefer-ip6 option for unbound.conf prefers to send
5137 upstream queries to ipv6 servers.
5140 part.
5143 - Document always_transparent, always_refuse, always_nxdomain types.
5146 - Fix static compile on windows missing gdi32.
5149 - Create a pkg-config file for libunbound in contrib.
5153 is endpwent function available.
5154 - Updated repository with newer flex and bison output.
5164 - Fix tcp timeouts in tv.usec.
5167 - TCP_TIMEOUT is specified in milliseconds.
5169 is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
5172 - QNAME minimisation unit test for dropped QTYPE=A queries.
5176 null delete for wsaevent.
5177 - Fix spelling in freebind option man page text.
5178 - Fix windows link of ssl with crypt32.
5179 - Fix 779: Union casting is non-portable.
5180 - Fix 780: MAP_ANON not defined in HP-UX 11.31.
5181 - Fix 781: prealloc() is an HP-UX system library call.
5184 - Use QTYPE=A for QNAME minimisation.
5185 - Keep track of number of time-outs when performing QNAME minimisation.
5187 more than three.
5190 - Fix #778: unbound 1.5.9: -h segfault (null deref).
5191 - Fix directory: fix for unbound-checkconf, it restores cwd.
5194 - And delete service.conf.shipped on uninstall.
5195 - In unbound.conf directory: dir immediately changes to that directory,
5196 so that include: file below that is relative to that directory.
5197 With chroot, make the directory an absolute path inside chroot.
5198 - keep debug symbols in windows build.
5199 - do not delete service.conf on windows uninstall.
5201 on windows.
5204 - Trunk is called 1.5.10 (with previous fixes already in there to 2
5205 june).
5207 it causes.
5208 - Fix that windows install will not overwrite existing service.conf
5209 file (and ignore gui config choices if it exists).
5212 - Lookup localzones by taglist from acl.
5213 - Possibility to lookup local_zone, regardless the taglist.
5214 - Added local_zone/taglist/acl unit test.
5217 - Fix #773: Non-standard Python location build failure with pyunbound.
5218 - Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
5221 - Better help text from -h (from Ray Griffith).
5222 - access-control-tag config directive.
5223 - local-zone-override config directive.
5225 directives.
5227 initialisation to free up memory for more entries.
5230 - Fix to not ignore return value of chown() in daemon startup.
5233 - Fix libubound for edns optlist feature.
5234 - Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc.
5235 - Fix #752: retry resource temporarily unavailable on control pipe.
5236 - un-document localzone tags.
5237 - tag for release 1.5.9rc1.
5238 And this also became release 1.5.9.
5239 - Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to
5240 Program Files with (x86) appended.
5241 - re-documented localzone tags in example.conf.
5245 network service account, from Mario Turschmann.
5246 - compat strsep implementation.
5247 - generic edns option parse and store code.
5248 - and also generic edns options for upstream messages (and replies).
5249 after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID),
5251 the opt_list passed to send_query, or in edns_opt_inplace_reply.
5254 - Fix time in case answer comes from cache in ub_resolve_event().
5255 - Attempted fix for #765: _unboundmodule missing for python3.
5259 if unbound control uses a unix local named pipe.
5260 - Document write permission to directory of trust anchor needed.
5262 Completely, WER Report Shown Up. Close handle before closing WSA.
5265 - Updated patch from Charles Walker.
5268 - disable-dnssec-lame-check config option from Charles Walker.
5269 - remove memory leak from lame-check patch.
5270 - iana portlist update.
5274 harden-below-nxdomain documentation.
5278 signed zones.
5279 - iana portlist update.
5282 - Fix #766: dns64 should synthesize results on timeout/errors.
5285 - Fix #761: DNSSEC LAME false positive resolving nic.club.
5288 - trunk updated with output of flex 2.6.0.
5291 - Fix memory leak in out-of-memory conditions of local zone add.
5294 - Fix sldns with static checking fixes copied from getdns.
5298 compatibility with cisco dns guard. This lowers false positives.
5301 - Fix some malformed responses to edns queries get fallback to nonedns.
5304 - cachedb module event handling design.
5307 - cachedb module framework (empty).
5308 - iana portlist update.
5311 - Fix #753: document dump_requestlist is for first thread.
5314 - Document permit-small-holddown for 5011 debug.
5316 malformatted conf file.
5319 - OpenSSL 1.1.0 portability, --disable-dsa configure option.
5322 - Fix compile of getentropy_linux for SLES11 servicepack 4.
5323 - Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev.
5324 - Fix test for openssl to use HMAC_Update for 1.1.0.
5325 - acx_nlnetlabs.m4 to v33, with HMAC_Update.
5326 - acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto.
5327 - ERR_remove_state deprecated since openssl 1.0.0.
5328 - OPENSSL_config is deprecated, removing.
5331 - Validate QNAME minimised NXDOMAIN responses.
5333 harden-below-nxdomain.
5336 - Limit number of QNAME minimisation iterations.
5339 - Fix #746: Fix unbound sets CD bit on all forwards.
5341 server. If a trust anchor, no CD bit on the first attempt to a
5342 forwarder, but CD bit thereafter on repeated attempts to get DNSSEC.
5343 - iana portlist update.
5346 - Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma.
5347 - Fix ip-transparent for tcp on freebsd.
5350 - ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for
5351 binding to an IP address while the interface or address is down.
5354 - Fix warnings in ifdef corner case, older or unknown libevent.
5355 - Fix compile for ub_event code with older libev.
5358 - Remove warning about unused parameter in event_pluggable.c.
5359 - Fix libev usage of dispatch return value.
5360 - No side effects in tolower() call, in case it is a macro.
5361 - For test put free in pluggable api in parenthesis.
5364 - Fixup backend2str for libev.
5368 - Fixup of compile fix for pluggable event API from P.Y. Adi
5369 Prasaja.
5372 - Updated configure and ltmain.sh.
5373 - Updated L root IPv6 address.
5376 - Fix #747: assert in outnet_serviced_query_stop.
5377 - iana ports fetched via https.
5378 - iana portlist update.
5381 - configure tests for the weak attribute support by the compiler.
5384 - 1.5.8 release tag
5385 - trunk contains 1.5.9 in development.
5386 - iana portlist update.
5387 - Fix #745: unbound.py - idn2dname throws UnicodeError when idnname
5388 contains trailing dot.
5391 - Fix OpenBSD asynclook lock free that gets used later (fix test code).
5392 - Fix that NSEC3 negative cache is used when there is no salt.
5395 - ub_ctx_set_stub() function for libunbound to config stub zones.
5396 - sorted ubsyms.def file with exported libunbound functions.
5399 - Print understandable debug log when unusable DS record is seen.
5400 - load gost algorithm if digest is seen before key algorithm.
5401 - iana portlist update.
5404 - Fix that "make install" fails due to "text file busy" error.
5407 - Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
5410 - ip-transparent option for FreeBSD with IP_BINDANY socket option.
5411 - wait for sendto to drain socket buffers when they are full.
5414 - Test for type OPENPGPKEY.
5416 Smørgrav.
5419 - Fix patch typo in prevuous commit for 734 from Adi Prasaja.
5420 - RR Type CSYNC support RFC 7477, in debug printout and config input.
5421 - RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
5424 - Neater cmdline_verbose increment patch from Edgar Pettijohn.
5427 - Made netbsd sendmsg test nonfatal, in case of false positives.
5428 - Fix #741: log message for dnstap socket connection is more clear.
5431 - Fix #734: chown the pidfile if it resides inside the chroot.
5433 available, possibly as compat, anyway).
5434 - Fix cmsg alignment for argument to sendmsg on NetBSD.
5436 sendmsg on NetBSD (for interface-automatic).
5439 - Fix #738: Swig should not be invoked with CPPFLAGS.
5443 verbosity is high, it was spammed after network down.
5446 - Fix to simplify empty string checking from Michael McConville.
5447 - iana portlist update.
5450 - Fix #734: Do not log an error when the PID file cannot be chown'ed.
5451 Patch from Simon Deziel.
5454 - Fix test if -pthreads unused to use better grep for portability.
5457 - Fix mingw crosscompile for recent mingw.
5458 - Update aclocal, autoconf output with new versions (1.15, 2.4.6).
5461 - #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch
5462 from Daisuke Higashi.
5463 - Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
5464 by default, and can be unblocked with "nodefault" localzone config.
5468 for Linux glibc 2.20.
5469 - Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
5470 source code, so it applies cleanly again. Removed unused variable
5471 warnings.
5475 portable (unbound-control-setup).
5478 - remove NULL-checks before free, patch from Michael McConville.
5479 - updated ax_pthread.m4 to version 21 with clang support, this
5480 removes a warning from compilation.
5481 - OSX portability, detect if sbrk is deprecated.
5482 - OSX clang, stop -pthread unused during link stage warnings.
5483 - OSX clang new flto check.
5486 - 1.5.7 release
5487 - trunk has 1.5.8 in development.
5490 - Fixup 724 for unbound-control.
5493 - Do not minimise forwarded requests.
5496 - Removed unneeded whitespace from example.conf.
5500 - Committed fix to qname minimisation and unit test case for it.
5503 - iana portlist update.
5504 - 1.5.7rc1 prerelease tag.
5507 - Fixup 724: Fix PCA prompt for unbound-service-install.exe.
5508 re-enable stdout printout.
5509 - For 724: Add Changelog to windows binary dist.
5515 - Fixup 724 fix for fname_after_chroot() calls.
5516 - Remove stdout printout for unbound-service-install.exe
5517 - .gitignore for git users.
5523 - Fix for #724: conf syntax to read files from run dir (on Windows).
5526 - Fix for #720, fix unbound-control-setup windows batch file.
5529 - Fix #720: add windows scripts to zip bundle.
5530 - iana portlist update.
5533 - Added assert on rrset cache correctness.
5534 - Fix that malformed EDNS query gets a response without malformed EDNS.
5537 - newer acx_nlnetlabs.m4.
5538 - spelling fixes from Igor Sobrado Delgado.
5541 - Fix #594. libunbound: optionally use libnettle for crypto.
5542 Contributed by Luca Bruno. Added --with-nettle for use with
5543 --with-libunbound-only.
5544 - refactor nsec3 hash implementation to be more library-portable.
5545 - iana portlist update.
5546 - Fixup DER encoded DSA signatures for libnettle.
5549 - Fix for lenient accept of reverse order DNAME and CNAME.
5552 - Change example.conf: ftp.internic.net to https://www.internic.net
5555 - ACX_SSL_CHECKS no longer adds -ldl needlessly.
5559 without HEREDOC bash support.
5562 - patch from Doug Hogan for SSL_OP_NO_SSLvx options.
5563 - Fix #716: nodata proof with empty non-terminals and wildcards.
5566 - Fix checklock testcode for linux threads on exit.
5569 - isblank() compat implementation.
5570 - detect libexpat without xml_StopParser function.
5571 - portability fixes.
5572 - portability, replace snprintf if return value broken.
5576 mapped IPv6 addresses.
5579 - Fix #712: unbound-anchor appears to not fsync root.key.
5582 - 1.5.6 release.
5583 - trunk tracks development of 1.5.7.
5586 - Fix segfault in the dns64 module in the formaterror error path.
5587 - Fix sldns_wire2str_rdata_scan for malformed RRs.
5588 - tag for 1.5.6rc1 release.
5592 remark in dnsop.
5593 - Fix manpage to suggest using SIGTERM to terminate the server.
5597 for secure domain name system traffic.
5599 to put a clause in unbound.conf for that. The new value is likely
5600 going to be the standardised port number for this traffic.
5601 - iana portlist update.
5604 - 1.5.5 release.
5605 - trunk tracks the development of 1.5.6.
5609 failures.
5610 - tag for 1.5.5rc1 release.
5611 - makedist.sh: pgp sig echo commands.
5614 - Fix unbound-control flush that does not succeed in removing data.
5618 globs (patch from Dag-Erling Smørgrav).
5619 - iana portlist update.
5620 - Fix #702: New IPs for for h.root-servers.net.
5621 - Remove confusion comment from canonical_compare() function.
5622 - Fix #705: ub_ctx_set_fwd() return value mishandled on windows.
5623 - testbound selftest also works in non-debug mode.
5624 - Fix minor error in unbound.conf.5.in
5625 - Fix unbound.conf(5) access-control description for precedence
5626 and default.
5629 - changed windows setup compression to be more transparent.
5633 2.4 to 2.6.
5634 - Feature #699: --enable-pie option to that builds PIE binary.
5636 relocation.
5640 list_local_data printout is interrupted.
5641 - iana portlist update.
5642 - Change default of harden-algo-downgrade to off. This is lenient
5643 for algorithm rollover.
5647 harden-algo-downgrade is turned off.
5648 - Reap the child process that libunbound spawns.
5651 - Fix #694: configure script does not detect LibreSSL 2.2.2
5655 can be used to release a subzone.
5659 zones.
5660 - Fix 5011 anchor update timer after reload.
5661 - Fix mktime in unbound-anchor not using UTC.
5664 - please afl-gcc (llvm) for uninitialised variable warning.
5665 - Added permit-small-holddown config to debug fast 5011 rollover.
5669 num-threads.
5670 - iana portlist update.
5673 - Fix configure to detect SSL_CTX_set_ecdh_auto.
5674 - iana portlist update.
5677 - Enable ECDHE for servers. Where available, use
5679 enable ECDHE. Otherwise, manually offer curve p256.
5680 Client connections should automatically use ECDHE when available.
5684 - Allow certificate chain files to allow for intermediate certificates.
5688 - makedist produces sha1 and sha256 files for created binaries too.
5691 - 1.5.4 release tag
5692 - trunk has 1.5.5 in development.
5694 implicitly turns on forward-first.
5697 - iana portlist update.
5698 - Fix alloc with log for allocation size checks.
5702 test.
5703 - iana portlist update.
5707 and was therefore always synthesized (thanks to Valentin Dietrich).
5710 - RFC 7553 RR type URI support, is now enabled by default.
5713 - Fix #674: Do not free pointers given by getenv.
5716 - Fix that unparseable error responses are ratelimited.
5717 - SOA negative TTL is capped at minimumttl in its rdata section.
5718 - cache-max-negative-ttl config option, default 3600.
5721 - Document that ratelimit works with unbound-control set_option.
5724 - iana portlist update.
5726 servers expect from us).
5729 - DLV is going to be decommissioned. Advice to stop using it, and
5730 put text in the example configuration and man page to that effect.
5735 validation failure <www.example.nl. TXT IN>: signature crypto
5736 failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
5739 - caps-whitelist in unbound.conf allows whitelist of loadbalancers
5740 that cannot work with caps-for-id or its fallback.
5743 - Unit test for type ANY synthesis.
5746 - Removed contrib/unbound_unixsock.diff, because it has been
5747 integrated, use control-interface: /path in unbound.conf.
5748 - iana portlist update.
5751 - Synthesize ANY responses from cache. Does not search exhaustively,
5752 but MX,A,AAAA,SOA,NS also CNAME.
5753 - Fix leaked dns64prefix configuration string.
5756 - Add local-zone type inform_deny, that logs query and drops answer.
5758 is default 10. Repeated normal queries get resolved and with
5759 prefetch stay in the cache.
5761 Use print_function also for Python2.
5762 libunbound examples: produce sorted output.
5763 libunbound-Python: libldns is not used anymore.
5764 Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
5767 - unbound-control ratelimit_list lists high rate domains.
5769 used to turn it on. It ratelimits recursion effort per zone.
5770 For particular names you can configure exceptions in unbound.conf.
5771 - Fix that get_option for cache-sizes does not print double newline.
5773 is too small.
5776 - Fix crash in dnstap: Do not try to log TCP responses after timeout.
5779 - Libunbound skips dos-line-endings from etc/hosts.
5781 fails to be writable. This is seconds after startup. You can
5782 load a readonly auto-trust-anchor-file with trust-anchor-file.
5785 will then become inoperable.
5787 anchors currently configured, patch from Jelte Jansen.
5791 asymmetric routing.
5794 - remote.c probedelay line is easier to read.
5795 - rename ldns subdirectory to sldns to avoid name collision.
5799 CRYPTO_set_id_callback.
5801 message encourages upgrade of the libressl package.
5804 - Fix segfault on user not found at startup (from Maciej Soltysiak).
5807 - Fixed to add integer overflow checks on allocation (defense in depth).
5810 - Add ip-transparent config option for bind to non-local addresses.
5814 by Loganaden Velvindron.
5817 - Fixup compile on cygwin, more portable openssl thread id.
5820 - Updated default keylength in unbound-control-setup to 3k.
5824 Schulze).
5825 - print svnroot when building windows dist.
5826 - iana portlist update.
5827 - Fix warning on sign compare in getentropy_linux.
5832 are present. It allows the weakest algorithm to validate the zone.
5833 - iana portlist update.
5836 - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
5837 scripts. Contributed by Yuri Voinov.
5838 - Document that incoming-num-tcp increase is good for large servers.
5839 - stats reports tcp usage, of incoming-num-tcp buffers.
5843 OpenBSD's version (2015-03-04).
5848 parse failures start 0x20 fallback procedure.
5850 happens to be the last one.
5851 - Document windows 8 tests.
5854 - tag 1.5.3rc1
5855 [ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ]
5858 - iana portlist update.
5862 Kallweit).
5863 - Fix #645 Portability to Solaris 10, use AF_LOCAL.
5864 - Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
5865 - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after
5866 reload.
5869 - 1.5.2 release tag.
5870 - svn trunk contains 1.5.3 under development.
5873 - Fix #643: doc/example.conf.in: unnecessary whitespace.
5876 - tag 1.5.2rc1
5879 - iana portlist update.
5883 not-address) records.
5888 record in authority section.
5892 uplink roundtrip times.
5896 section changes.
5897 - Portability fix for Solaris ('sun' is not usable for a variable).
5900 - Fix pyunbound byte string representation for python3.
5904 compile with pedantic c99 compliance (from Daniel Dickman).
5907 - windows port fixes, no AF_LOCAL, no chown, no chmod(grp).
5910 - unit test for local unix connection. Documentation and log_addr
5911 does not inspect port for AF_LOCAL.
5912 - unbound-checkconf -f prints chroot with pidfile path.
5915 - iana portlist update.
5918 - Cast sun_len sizeof to socklen_t.
5919 - Fix pyunbound ord call, portable for python 2 and 3.
5922 - Fix warnings in pythonmod changes.
5925 - iana portlist update.
5927 Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and
5928 control-use-cert: no.
5929 - Fixup that patch and uid lookup (only for daemon).
5930 - coded the default of control-use-cert, to yes.
5933 - getauxval test for ppc64 linux compatibility.
5934 - make strip works for unbound-host and unbound-anchor.
5936 exposes struct delegpt, and adds the find_delegation function.
5937 - print query name when max target count is exceeded.
5940 the prefix location.
5941 - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing
5942 IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne).
5943 - Updated contrib warmup.cmd/sh to support two modes - load
5946 unbound_cache.sh/cmd to support loading/save/reload cache to/from
5948 from Yuri Voinov.
5950 type ABSOLUTE. Allows munin.conf: [idleserver.example.net]
5951 unbound_munin_hits.graph_period minute
5954 - svn trunk has 1.5.2 in development.
5955 - config.guess and config.sub update from libtoolize.
5956 - local-zone: example.com inform makes unbound log a message with
5957 client IP for queries in that zone. Eg. for finding infected hosts.
5961 endless series of delegations.
5965 getentropy compat code from calling sysctl if it is has been removed.
5968 - Add include to getentropy_linux.c, hopefully fixing debian build.
5971 - Fix makefile for build from noexec source tree.
5974 - Fix libunbound undefined symbol errors for main.
5975 Referencing main does not seem to be possible for libunbound.
5978 - Fix log at high verbosity and memory allocation failure.
5979 - iana portlist update.
5983 arc4random.
5986 - fix compat/getentropy_win.c check if CryptGenRandom works and no
5987 immediate exit on windows.
5990 - Fix cdflag dns64 processing.
5994 signed AAAA denial.
5995 - iana portlist update.
5999 checked.
6006 added to contrib/aaaa-filter-iterator.patch.
6009 - trunk has 1.5.1 in development.
6011 differently. No versioninfo, with -shared and without $(LIBS).
6012 - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page.
6014 to console. It is only written on verbosity 4 and higher.
6015 This keeps system bootup console cleaner.
6016 - Patch from James Raftery, always print stats for rcodes 0..5.
6019 - iana portlist update.
6021 different port number were not tried.
6022 - version number in svn trunk is 1.5.0
6023 - tag 1.5.0rc1
6024 - review fix from Ralph.
6028 dnstap/dnstap.m4: cosmetic fixes
6030 dnstap/dnstap.m4: Error out if required libraries are not found
6032 protobuf-c 1.0.0
6033 dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0)
6037 tracked trust anchor to libunbound.
6039 linking on platforms where the linker leaks names across modules.
6042 - Disabled use of SSLv3 in remote-control and ssl-upstream.
6043 - iana portlist update.
6046 - Documented dns64 configuration in unbound.conf man page.
6049 - Fix #617: in ldns in unbound, lowercase WKS services.
6050 - Fix ctype invocation casts.
6053 - Fix unbound-checkconf check for module config with dns64 module.
6054 - Fix unbound capsforid fallback, it ignores TTLs in comparison.
6057 - Fix #614: man page variable substitution bug.
6059 - Whitespaces after $ORIGIN are not part of the origin dname (ldns).
6060 - $TTL's value starts at position 5 (ldns).
6063 - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire).
6066 - Fix #612: create service with service.conf in present directory and
6067 auto load it.
6068 - Fix for mingw compile openssl ranlib.
6071 - updated configure and aclocal with newer autoconf 1.13.
6074 - Fix swig and python examples for Python 3.x.
6075 - Fix for mingw compile with openssl-1.0.1i.
6078 - improve python configuration detection to build on Fedora 22.
6081 - patches to also build with Python 3.x (from Pavel Simerda).
6084 - Fix tcp timer waiting list removal code.
6085 - iana portlist update.
6087 is longer and more tcp connections can be handled.
6090 - Fix unit test for CDS typecode.
6093 - type CDS and CDNSKEY types in sldns.
6097 dependency.
6098 - iana portlist update.
6099 - Removed necessity for pkg-config from the dnstap.m4, new are
6100 the --with-libfstrm and --with-protobuf-c configure options.
6103 - Update unbound manpage with more explanation (from Florian Obser).
6107 checks.
6108 - iana portlist update.
6109 - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings.
6113 Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c.
6114 It is BSD licensed (see dnstap/dnstap.c).
6115 Building with --enable-dnstap needs pkg-config with this patch.
6116 - Noted dnstap in doc/README and doc/CREDITS.
6117 - Changes to the dnstap patch.
6118 - lint fixes.
6119 - dnstap/dnstap_config.h should not have been added to the repo,
6120 because is it generated.
6124 from Maciej Soltysiak.
6125 - iana portlist update.
6128 - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault.
6129 Initial commit of the patch from the FreeBSD base (with its fixes).
6130 This adds a module (for module-config in unbound.conf) dns64 that
6131 performs DNS64 processing, see README.DNS64.
6133 strcpy changed to memmove.
6134 arraybound check fixed from prefix_net/8/4 to prefix_net/8+4.
6135 allocation of result consistently in the correct region.
6136 time_t is now used for ttl in unbound (since the patch's version).
6137 - testdata/dns64_lookup.rpl for unit test for dns64 functionality.
6141 does not fork in the background and also logs to stderr.
6144 - Fix endian.h include for OpenBSD.
6148 write fails.
6152 write fails.
6153 - iana portlist update.
6156 - Configure tests if main can be linked to from getentropy compat.
6159 - Fix getentropy compat code, function refs were not portable.
6160 - Fix to check openssl version number only for OpenSSL.
6161 - LibreSSL provides compat items, check for that in configure.
6162 - Fix bug in fix for log locks that caused deadlock in signal handler.
6163 - update compat/getentropy and arc4random to the most recent ones from OpenBSD.
6166 - fake-rfc2553 patch (thanks Benjamin Baier).
6170 dependencies, from OpenBSD. arc4_lock and sha512 in compat.
6172 compiled with LIBNSS (it uses libNSS crypto random).
6173 - fix strptime implicit declaration error on OpenBSD.
6174 - arc4random, getentropy and explicit_bzero compat for Windows.
6177 - Fix #593: segfault or crash upon rotating logfile.
6180 - DLV tests added.
6181 - signit tool fixup for compile with libldns library.
6182 - iana portlist updated.
6185 - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X.
6188 - unbound-control status reports if so-reuseport was successful.
6189 - iana portlist updated.
6193 drop 0x20 perturbed queries.
6194 - Fixup testsetup for VM tests (run testcode/run_vm.sh).
6197 - iana portlist updated.
6200 - Add AAAA for B root server to default root hints.
6203 - Remove unused define from iterator.h
6206 - Fixup sldns_enum_edns_option typedef definition.
6211 Generate unbound-control-setup.sh at build time so it respects
6212 prefix and sysconfdir from the configure script. Also fix the
6213 umask to match the comment, and the comment to match the umask.
6214 Add const and static where needed. Use unions instead of
6215 playing pointer poker. Move declarations that are needed in
6216 multiple source files into a shared header. Move sldns_bgetc()
6217 from parse.c to buffer.c where it belongs. Introduce a new
6218 header file, worker.h, which declares the callbacks that
6219 all workers must define. Remove those declarations from
6220 libworker.h. Include the correct headers in the correct places.
6221 Fix a few dummy callbacks that don't match their prototype.
6222 Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK.
6223 Remove a useless printf which breaks reproducible builds.
6225 no longer used. Add unbound-control-setup.sh to the list of
6226 generated files. The prototype for libworker_event_done_cb()
6227 needs to be moved from libunbound/libworker.h to
6228 libunbound/worker.h.
6229 - Fixup out-of-directory compile with unbound-control-setup.sh.in.
6230 - make depend.
6234 the default root key file that was compiled in.
6238 perform 10.0.0.0/8 and other reverse lookups normally, for use if
6239 unbound is running service for localhost on localhost.
6243 Yuri Voinov in the source/contrib directory. Added
6244 warmup.cmd (and .sh): warm up the DNS cache with your MRU domains.
6247 - Implement draft-ietf-dnsop-rfc6598-rfc6303-01.
6248 - iana portlist updated.
6252 create_unbound_ad_servers.cmd: enters anti-ad server lists.
6253 unbound_cache.cmd: saves and loads the cache.
6254 - Added unbound-control-setup.cmd from Yuri Voinov to the windows
6255 unbound distribution set. It requires openssl installed in %PATH%.
6258 - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier.
6262 easier to parse.
6265 - iana portlist updated.
6267 and errors from the cache. For dnssec-trigger and NetworkManager,
6269 negatively cached from the previous network.
6273 if available on the OS, it gets entropy from the OS.
6276 - Fix compile with libevent2 on FreeBSD.
6280 but it stops the use of the ipv6 transport layer for DNS traffic.
6281 - iana portlist updated.
6284 - iana portlist updated.
6286 option for DNS fragmentation defense.
6287 - Document that dump_requestlist only prints queries from thread 0.
6288 - unbound-control stats prints num.query.tcpout with number of TCP
6289 outgoing queries made in the previous statistics interval.
6292 (for NetworkManager integration.)
6294 64bit systems.
6296 but delays next prefetch (in lieu of caching a SERVFAIL).
6298 on the same log-line as the error.
6301 - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control
6302 in testbound scripts.
6303 - iana portlist updated.
6306 - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root
6307 hints (patch from Anand Buddhdev).
6309 /etc/services.
6312 - Fix #569: do_tcp is do-tcp in unbound.conf man page.
6315 - Patch from Stuart Henderson to build unbound-host man from .1.in.
6318 - Fix print filename of encompassing config file on read failure.
6321 - tag 1.4.22
6322 - trunk has 1.4.23 in development.
6326 because of spelling. Patch from Chris Coates.
6329 - tag 1.4.22rc1
6332 - iana portlist updated.
6336 received. This is okay according 4035, but not after revising
6337 existence in 4592. NSEC empty non-terminals exist and thus the
6338 RCODE should have been NOERROR. If this occurs, and the RRsets
6340 of the response is also considered secure.
6343 - Works on Minix (3.2.1).
6346 - Fix parse of #553(NSD) string in sldns, quotes without spaces.
6349 - iana portlist updated.
6350 - add body to ifstatement if locks disabled.
6351 - add TXT string"string" test case to unit test.
6353 the BSD license on opensource.org.
6356 - sldns has type HIP.
6357 - code documentation on the module interface.
6360 - Fix sldns parse tests on osx.
6363 - Detect libevent2 install automatically by configure.
6364 - Fixup link with lib/event2 subdir.
6365 - Fix parse in sldns of quoted parenthesized text strings.
6369 and types.sidnlabs.
6370 - Fix for hex to string in unknown, atma and nsap.
6371 - fixup nss compile (no ldns in it).
6374 are not portable; they cannot be read (for sure) on other computers.
6376 parse sldns.
6380 it does not make a socketdrain DoS easier.
6383 - iana portlist updated.
6385 if there are no changes.
6387 the UDP reply has timed out. Keeps the port open, only accepts
6388 the correct reply. This correct reply is not used, but the port
6389 is open so that no port-denied ICMPs are generated.
6392 - reuseport is attempted, then fallback to without on failure.
6395 - Change unbound-event.h to use void* buffer, length idiom.
6396 - iana portlist updated.
6397 - unbound-event.h is installed if you configure --enable-event-api.
6399 lock contention on localzones.lock. It is changed to an rwlock.
6401 threads on Linux (Thanks Robert Edmonds).
6402 - made lint clean.
6405 - Fix #547: no trustanchor written if filesystem full, fclose checked.
6408 - Fix isprint() portability in sldns, uses unsigned int.
6409 - iana portlist updated.
6413 "iterator".
6414 - Windows port, adjust %lld to %I64d, and warning in win_event.c.
6417 - iana portlist updated.
6420 - Fix bug in cachedump that uses sldns.
6421 - update pythonmod for ldns_ to sldns_ name change.
6424 - Fix sldns to use sldns_ prefix for all ldns_ variables.
6425 - Fix windows compile to compile with sldns.
6428 - Fix sldns to make globals use sldns_ prefix. This fixes
6429 linking with libldns that uses global variables ldns_ .
6432 - Fix bug#537: compile python plugin without ldns library.
6435 - Fix bug#536: acl_deny_non_local and refuse_non_local added.
6439 is called by libunbound in the mesh attach.
6441 consistency with nsd.conf syntax.
6444 - Patch from Neel Goyal to fix callback in libunbound.
6447 - if configured --with-libunbound-only fix make install.
6452 one of the daemons is unbound.
6453 - iana portlist update.
6454 - separate ldns into core ldns inside ldns/ subdirectory. No more
6455 --with-ldns is needed and unbound does not rely on libldns.
6456 - portability fixes for new USE_SLDNS ldns subdir codebase.
6460 existing ub_ctx. This basically just destroys the current worker and
6461 sets the event base to the current. And fix a deadlock in
6463 called. This ends up trying to acquire the lock again in
6464 context_obtain_alloc in the call chain.
6465 - Fix #528: if very high logging (4 or more) segfault on allow_snoop.
6468 - unbound-event.h is installed if configured --with-libevent. It
6471 resolution in the client's eventloop.
6474 - 1.4.21 tag created.
6475 - trunk has 1.4.22 number inside it.
6476 - iana portlist updated.
6477 - acx_nlnetlabs.m4 to 26; improve FLTO help text.
6481 Daisuke HIGASHI.
6484 - MIN_TTL and MAX_TTL also in time_t.
6485 - tag 1.4.21rc1 made again.
6489 thread has been killed, on ub_ctx_delete, to avoid hangs.
6492 - more fixes that I overlooked.
6493 - review fixes from Willem.
6496 - Fix#520: Errors found by static analysis from Tomas Hozza(redhat).
6499 - Fix for 2038, with time_t instead of uint32_t.
6502 - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound).
6505 - Fix uninit variable in fix#516.
6508 - Fix#516 dnssec lameness detection for answers that are improper.
6511 - tag 1.4.21rc1
6514 - Fix#512 memleak in testcode for testbound (if it fails).
6515 - Fix#512 NSS returned arrays out of setup function to be statics.
6518 - max include of 100.000 files (depth and globbed at one time).
6519 This is to preserve system memory in bug cases, or endless cases.
6520 - iana portlist updated.
6523 - streamtcp man page, contributed by Tomas Hozza.
6524 - iana portlist updated.
6525 - libunbound documentation on how to avoid openssl race conditions.
6529 not connected, to avoid spamming syslog.
6530 - configure --disable-flto option (from Robert Edmonds).
6534 Slany.
6535 - iana portlist updated.
6538 - Fixup manpage syntax.
6542 val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect
6543 immediately. The others are mostly useful for libunbound users.
6547 getoption and setoption support cache-min-ttl and cache-max-ttl.
6550 - Fix#501: forward-first does not recurse, when forward name is ".".
6551 - iana portlist update.
6552 - Max include depth is unlimited.
6555 - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply
6557 autoconf-archives.
6558 - iana portlist update.
6561 - Explain bogus and secure flags in libunbound more.
6565 Montgomery).
6566 - Fix#500 use on non-initialised values on socket bind failures.
6570 Bakulin).
6573 - update acx_nlnetlabs.m4 to v23, sleep w32 fix.
6577 administration of negative trust anchors.
6581 Daisuke Higashi).
6582 - Robust checks on dname validity from rdata for dname compare.
6583 - updated iana portlist.
6586 - Fixup snprintf return value usage, fixed libunbound_get_option.
6589 - fix bug #491: pick program name (0th argument) as syslog identity.
6590 - own implementation of compat/snprintf.c.
6593 - Fix so that for a configuration line of include: "*.conf" it is not
6594 an error if there are no files matching the glob pattern.
6596 has successfully appended a zero length string.
6600 nameservers all fail to answer.
6603 - code improve for minimal responses, small speed increase.
6606 - updated iana portlist.
6607 - Fix crash in previous private address fixup of 22 March.
6611 commented-out in the example config file.
6614 - more fixes to lookup3.c endianness detection.
6617 - #492: Fix endianness detection, revert to older lookup3.c detection
6619 but allow new detections to succeed.
6620 And add detection for machine/endian.h to it.
6623 - Fix resolve of names that use a mix of public and private addresses.
6624 - iana portlist update.
6625 - Fix makedist for new svn for -d option.
6626 - unbound.h header file has UNBOUND_VERSION_MAJOR define.
6627 - Fix windows RSRC version for long version numbers.
6630 - release 1.4.20
6631 - trunk has 1.4.21
6632 - committed libunbound version 4:1:2 for binary API updated in 1.4.20
6633 - install copy of unbound-control.8 man page for unbound-control-setup
6636 - iana portlist update.
6637 - tag 1.4.20rc1
6640 - Fixup makedist.sh for windows compile.
6643 - iana portlist update.
6644 - testcode/ldns-testpkts.c check for makedist is informational.
6650 - Fixup openssl_thread init code to only run if compiled with SSL.
6653 - detect endianness in lookup3 on BSD.
6654 - add libunbound.ttl at end of result structure, version bump for
6655 libunbound and binary backwards compatible, but 1.4.19 is not
6656 forward compatible with 1.4.20.
6657 - update iana port list.
6660 - includes and have_ssl fixes for nss.
6663 - printout name of zone with duplicate fwd and hint errors.
6666 - updated fwd_zero for newer nc. Updated common.sh for newer netstat.
6670 root.xml file, default is dnssec@iana.org. It also checks that
6671 the signer has the correct key usage for a digital signature.
6672 - update iana port list.
6675 - Test that unbound-control checks client credentials.
6677 the chain of trust (where it seeks a DS record).
6678 - Check the commonName of the signer of the root.xml file in
6679 unbound-anchor, default is dnssec@iana.org.
6682 - Fix openssl lock free on exit (reported by Robert Fleischman).
6683 - iana portlist updated.
6684 - Tested that unbound implements the RFC5155 Technical Errata id 3441.
6686 nonterminal in NSEC3 optout zone.
6689 - Fix unbound-anchor xml parse of entity declarations for safety.
6692 - iana portlist updated.
6695 - iana portlist updated.
6698 - Change of D.ROOT-SERVERS.NET A address in default root hints.
6701 - 1.4.19 release.
6702 - trunk has 1.4.20 under development.
6705 - note support for AAAA RR type RFC.
6708 - 1.4.19rc1 tag.
6711 - bug 481: fix python example0.
6712 - iana portlist updated.
6715 - iana portlist updated.
6718 - Fix unbound-control forward disables configured stubs below it.
6721 - Fixup ldns-testpkts, identical to ldns/examples.
6722 - iana portlist updated.
6725 - Fix bug #477: unbound-anchor segfaults if EDNS is blocked.
6729 expanded CNAME records in answer section.
6732 - update ldns-testpkts.c to ldns 1.6.14 version.
6733 - fix build of pythonmod in objdir, for unbound.py.
6734 - make clean and makerealclean remove generated python and docs.
6737 - fix build of pythonmod in objdir (thanks Jakob Schlyter).
6740 - fix text in unbound-anchor man page.
6743 - ignore trusted-keys globs that have no files (from Paul Wouters).
6746 - include: directive in config file accepts wildcards. Patch from
6747 Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*"
6748 - unbound-control -q option is quiet, patch from Mariano Absatz.
6749 - iana portlist updated.
6750 - updated contrib/unbound.spec, patch from Valentin Bud.
6753 - chdir to / after chroot call (suggested by Camiel Dobbelaar).
6756 - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation
6757 otherwise it is treated as insecure. The RSAMD5 algorithm is
6758 deprecated (RFC6725). The MD5 hash is considered weak for some
6760 uncontested hash.
6763 - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled.
6764 - iana portlist updated.
6767 - Nicer comments outgoing-port-avoid, thanks Stu (bug #465).
6770 - Fallback to 1472 and 1232, one fragment size without headers.
6775 server selection again.
6778 - Add documentation to libunbound for default nonuse of resolv.conf.
6781 - trunk has 1.4.19 under development (fixes from 1 aug and 31 july
6782 are for 1.4.19).
6783 - iana portlist updated.
6787 by Einar Lonn and Patrik Wallstrom.
6790 - Improved forward-first and stub-first documentation.
6792 serviced_query, without race conditions or administration issues.
6793 This should not happen with the current codebase, but it is robust.
6794 - Fix forward-first option where it sets the RD flag wrongly.
6795 - added manpage links for libunbound calls (Thanks Paul Wouters).
6798 - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012).
6803 (Thanks Peter van Dijk).
6806 - iana portlist updated.
6807 - tag 1.4.18rc1.
6810 - review fix for libnss, check hash prefix allocation size.
6813 - fix missing break for GOST DS hash function.
6814 - implemented forward_first for the root.
6817 - Fix bug#452 and another assertion failure in mesh.c, makes
6818 assertions in mesh.c resist duplicates. Fixes DS NS search to
6819 not generate duplicate sub queries.
6822 - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac,
6824 appended to CFLAGS, so that the user can override them.
6827 - Fix libunbound report of errors when in background mode.
6830 - updated iana ports list.
6837 non-optout NSEC3 zones.
6840 - compile libunbound with libnss on Suse, passes regression tests.
6843 - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.
6846 - updated iana ports list.
6850 Sven Ulland.
6853 - detect if openssl has FIPS_mode.
6855 performance in out of memory conditions.
6856 - fix edns-buffer-size and msg-buffer-size manpage documentation.
6857 - updated iana ports list.
6860 - disable RSAMD5 if in FIPS mode (for openssl and for libnss).
6863 - implement DS records, NSEC3 and ECDSA for compile with libnss.
6866 - fix error handling of alloc failure during rrsig verification.
6867 - nss check for verification failure.
6868 - nss crypto works for RSA and DSA.
6871 - work on --with-nss build option (for now, --with-libunbound-only).
6875 not the daemon and other tools.
6878 - code review.
6881 - implement log-time-ascii on windows.
6882 - The key-cache bad key ttl is now 60 seconds.
6883 - updated iana ports list.
6884 - code review.
6887 - bug #452: fix crash on assert in mesh_state_attachment.
6891 swig initmodule, due to ifdefs in swig-generated code).
6894 - Fix debian-bugs-658021: Please enable hardened build flags.
6897 - updated iana ports list.
6900 - tag for 1.4.17 release.
6901 - trunk is 1.4.18 in development.
6904 - Review comments, removed duplicate memset to zero in delegpt.
6907 - Updated doc/FEATURES with RFCs that are implemented but not listed.
6908 - Protect if statements in val_anchor for compile without locks.
6909 - tag for 1.4.17rc1.
6912 - fix configure ECDSA support in ldns detection for windows compile.
6913 - fix possible uninitialised variable in windows pipe implementation.
6916 - Fix alignment problem in util/random on sparc64/freebsd.
6919 - Fix for accept spinning reported by OpenBSD.
6920 - iana portlist updated.
6924 Ondrej Mikle.
6927 - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older
6928 openssl.
6932 minimal-responses features.
6933 - iana portlist updated.
6936 - fix bug #443: --with-chroot-dir not honoured by configure.
6938 Ketelaars).
6942 even using --without-pythonmodule.
6946 Augie Schwer).
6950 cornercases, and is more robust and considers forwarders.
6953 - iana portlist updated.
6954 - fix to locate nameservers for DS lookup with NS fetches.
6958 from Ondrej Mikle.
6961 - Applied line-buffer patch from Augie Schwer to validation.reporter.sh.
6964 - flush_infra cleans timeouted servers from the cache too.
6965 - removed warning from --enable-ecdsa.
6968 - forward-first option. Tries without forward if a query fails.
6969 Also stub-first option that is similar.
6973 differently.
6977 for unbound-control.exe, and unbound-checkconf.exe.
6981 logs, high verbosity will show them.
6984 - iter_hints is now thread-owned in module env, and thus threadsafe.
6985 - Fix prefetch and sticky NS, now the prefetch works. It picks
6988 parent again. If child NS has longer TTL, that TTL does not get
6989 refreshed from the lookup to the child nameserver.
6992 - Fix forward-zone memory, uses malloc and frees original root dp.
6993 - iter hints (stubs) uses malloc inside for more dynamicity.
6996 they can also add and remove domain-insecure for the zone.
6999 - Fix sticky NS (ghost domain problem) if prefetch is yes.
7000 - iter forwards uses malloc inside for more dynamicity.
7003 - RT#2955. Fix for cygwin compilation.
7004 - iana portlist updated.
7007 - Slightly smaller critical region in one case in infra cache.
7009 another has caused timeout blacklist, different type can still probe.
7010 - unit test fix for nomem_cnametopos.rpl race condition.
7013 - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h.
7019 been assigned). Needs recent ldns with --enable-ecdsa.
7020 - fix memory leak in errorcase for DSA signatures.
7021 - iana portlist updated.
7022 - workaround for openssl 0.9.8 ecdsa sha2 and evp problem.
7025 - fix for windows, rename() is not posix compliant on windows.
7028 - 1.4.16 release tag.
7029 - svn trunk is 1.4.17 in development.
7030 - iana portlist updated.
7034 closest encloser from yy for DS zz. while building chain of trust,
7035 because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata
7036 for an NSEC3. Now it does not change rdata, and fixes TTL.
7040 libunbound.so.2 like it should.
7043 - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release.
7044 - trunk 1.4.16; includes changes memset testcode, #424 openindiana,
7045 and keyfile write fixup.
7046 - applied patch to support outgoing-interface with ub_ctx_set_option.
7049 - Fix memset in test code.
7052 - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2.
7056 succeeds, replace the real key file. So failures leave a useful file.
7059 - tag 1.4.15rc1 created
7060 - updated libunbound/ubsyms.def and remade tag 1.4.15rc1.
7064 signer-name. This is mostly harmless because RRSIGs do not have
7065 to be sorted in canonical order, usually.
7068 - bug#428: add ub_version() call to libunbound. API version increase,
7069 with (binary) backwards compatibility for the previous version.
7074 cache.
7075 - iana portlist updated.
7076 - uninitialised variable in reprobe for rtt blocked domains fixed.
7077 - lintfix and new flex output.
7081 by Peter van Dijk.
7087 Robert Fleischmann.
7088 - iana portlist updated.
7093 http://www.unbound.net/downloads/CVE-2011-4528.txt
7094 - robust checks for next-closer NSEC3s.
7095 - tag 1.4.14 created.
7096 - trunk has 1.4.15 in development.
7099 - remove uninit warning from cachedump code.
7100 - Fix parse error on negative SOA RRSIGs if badly ordered in the packet.
7103 - iana portlist updated.
7104 - svn tag 1.4.14rc1
7105 - fix infra cache comparison.
7106 - Fix to constrain signer_name to be a parent of the lookupname.
7109 - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
7110 - Fix warnings with gcc 4.6 in compat/inet_ntop.c.
7111 - Fix warning unused in compat/strptime.c.
7112 - Fix malloc detection and double definition.
7115 - configure generated with autoconf 2.68.
7119 SERVFAILs. Also fixed for UDP (but less likely).
7122 - Fix quartile time estimate, it was too low, (thanks Jan Komissar).
7123 - iana ports updated.
7126 - Makefile compat with SunOS make, BSD make and GNU make.
7127 - iana ports updated.
7130 - Makefile changed for BSD make compatibility.
7133 - added unit test for SSL service and SSL-upstream.
7136 - can configure ssl service to one port number, and not on others.
7137 - fixup windows compile with ssl support.
7138 - Fix double free in unbound-host, reported by Steve Grubb.
7139 - iana portlist updated.
7142 - dns over ssl support as a client, ssl-upstream yes turns it on.
7143 It performs an SSL transaction for every DNS query (250 msec).
7145 ssl-service.pem.
7146 - iana portlist updated.
7147 - fix -flto detection on Lion for llvm-gcc.
7151 can be given and then TCP queries are serviced wrapped in SSL.
7155 with the host info. They are ignored (with verbose warning) if
7156 encountered to keep the config file backwards compatible.
7157 - fix iana-update for changing gzip compression of results.
7158 - fix export-all-symbols on OSX.
7161 - iana portlist updated.
7162 - Infra cache stores information about ping and lameness per IP, zone.
7163 This fixes bug #416.
7164 - fix iana_update target for gzipped file on iana site.
7167 - Fix resolve of partners.extranet.microsoft.com with a fix for the
7169 choices. (bug#415)
7172 resumed that then fails and sends an error message. (Thanks to
7173 Matthew Lee).
7177 option enabled because of memory layout exe vs dll.
7181 in configure.
7182 - Detect if GOST really works, openssl1.0 on OSX fails.
7183 - Implement ipv6%interface notation for scope_id usage.
7186 - better documentation for inform_super (Thanks Yang Zhe).
7190 Robert Fleischman).
7194 target platform, or fptr_wlist assertion failures could occur.
7199 /usr/local/share/munin/plugins/unbound_munin_ ).
7202 - unbound.exe -w windows option for start and stop service.
7206 are alternatives.
7210 parent-child server, and the answer has the AA flag for dir.slb.com.
7211 Thanks to Amanda Constant from Secure64.
7215 unused functions in lookup3.c.
7216 - iana portlist updated.
7217 - fix EDNS1480 change memleak and TCP fallback.
7218 - fix various compiler warnings (reported by Paul Wouters).
7219 - max sent count. EDNS1480 only for rtt < 5000. No promiscuous
7220 fetch if sentcount > 3, stop query if sentcount > 16. Count is
7221 reset when referral or CNAME happens. This makes unbound better
7223 interest (in the form of queries).
7226 - release 1.4.13.
7227 - trunk contains 1.4.14 in development.
7228 - Unbound probes at EDNS1480 if there an EDNS0 timeout.
7232 fragmentation fixes instead.
7233 - tag 1.4.13rc2
7236 - Fix operation in ipv6 only (do-ip4: no) mode.
7239 - fedora specfile updated.
7242 - tag 1.4.13rc1
7245 - iana portlist updated.
7248 - Fix num-threads 0 does not segfault, reported by Simon Deziel.
7253 the cache says it has this. This helps for DLV deployment when
7254 the DNSSEC status is not known for sure before the lookup concludes.
7258 unbound python module, in string conversions.
7262 Zhang and Luo Ce). Unbound responds with the RR types that are
7263 available at the name for qtype ANY and validates those RR types.
7264 It does not test for completeness (i.e. with NSEC or NSEC3 query),
7266 even more data for the already large response).
7267 - Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
7268 - Documented the options that work with control set_option command.
7269 - tcp-upstream yes/no option (works with set_option) for tunnels.
7272 - fix autoconf call in makedist crosscompile to RC or snapshot.
7275 - Fix validation of . DS query.
7276 - new xml format at IANA, new awk for iana_update.
7277 - iana portlist updated.
7280 - Fix python site-packages path to /usr/lib64.
7281 - updated patch from Tom.
7282 - fix memory and fd leak after out-of-memory condition.
7285 - patch from Tom Hendrikx fixes load of python modules.
7288 - make clean had ldns-src reference, removed.
7294 - Unbound implements RFC6303 (since version 1.4.7).
7295 - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
7296 meantime, those are for 1.4.13).
7297 - iana portlist updated.
7300 - Quick fix for contrib/unbound.spec example, no ldns-builtin any more.
7304 validated as insecure, reported by Jia Li (lijia@cnnic.cn).
7307 - 1.4.12rc1 tag created.
7310 - version number in example config file.
7311 - fix that --enable-static-exe does not complain about it unknown.
7314 - tag relase 1.4.11, trunk is 1.4.12 development.
7315 - iana portlist updated.
7318 eventual starvation where the daemon has no replyaddrs left to use.
7319 - fix comment about rndc port, that referred to the old port number.
7321 control connections are made at the same time.
7322 - removed ldns-src tarball inside the unbound tarball.
7325 - Changed -flto check to support clang compiler.
7326 - tag 1.4.11rc3 created.
7329 - tag 1.4.11rc1 created.
7330 - remove warning about signed/unsigned from flex (other flex version).
7331 - updated aclocal.m4 and libtool to match.
7332 - tag 1.4.11rc2 created.
7335 - log-queries: yesno option, default is no, prints querylog.
7336 - version is 1.4.11.
7339 - Use -flto compiler flag for link time optimization, if supported.
7340 - iana portlist updated.
7343 - IPv6 service address for d.root-servers.net (2001:500:2D::D).
7347 UBCT[version]_space_ is the header sent by the client now.
7350 This is the new default for the control-port config setting.
7351 - statistics-interval prints the number of jostled queries to log.
7355 deansification necessity.
7356 - iana portlist updated.
7357 - updated ldns tarball to 1.6.10rc2 snapshot of today.
7361 in response to a query, CVE-2011-1922 VU#531342.
7362 - This fix is in tag 1.4.10.
7364 instead of an assertion failure.
7368 and reduces install size significantly.
7369 - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
7370 - iana portlist updated.
7371 - Fix TTL of SOA so negative TTL is separately cached from normal TTL.
7374 - configure created with newer autoconf 2.66.
7377 - bug#378: Fix that configure checks for ldns_get_random presence.
7380 - iana portlist updated.
7382 not withheld if it is bogus. Thus, unbound will retry if it is bad
7384 downstream validators.
7385 - val-override-date: -1 ignores dates entirely, for NTP usage.
7389 cached nxdomain is dnssec secure. This avoids backwards
7390 incompatibility because those old servers do not have dnssec.
7393 - iana portlist updated.
7394 - release 1.4.9.
7395 - trunk is 1.5.0
7398 - bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
7399 Applied but did not do the --disable-gost.
7402 - tag 1.4.9 release candidate 1 created.
7405 - updated ldns to today.
7408 - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
7409 - give config parse error for multiple names on a stub or forward zone.
7410 - updated ldns tarball to 1.6.9(todays snapshot).
7413 - bug #361: Fix, time.elapsed variable not reset with stats_noreset.
7416 - iana portlist updated.
7417 - common.sh to version 3.
7420 - common.sh in testdata updated to version 2.
7425 and under the terms of our LICENSE (see that file in the source).
7428 - iana portlist updated.
7429 - tpkg updated with common.sh for common functionality.
7432 - Added regression test for addition of a .net DS to the root, and
7433 cache effects with different TTL for glue and DNSKEY.
7434 - iana portlist updated.
7437 - Fix remove private address does not throw away entire response.
7440 - release 1.4.8
7443 - fix bug#349: no -L/usr for ldns.
7446 - ldns 1.6.8 tarball included.
7447 - release 1.4.8rc1.
7450 - add get and set option for harden-below-nxdomain feature.
7451 - iana portlist updated.
7455 server, for type NS the TTL is not increased.
7458 - Fix prefetch so it does not get stuck on old server for moved names.
7461 - iana portlist updated.
7465 Hubert.
7468 - faster lruhash get_mem routine.
7471 - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root.
7472 - iana portlist updated.
7475 - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
7479 the DS record. Also, trust anchors, DLV, and RFC5011 receive this,
7481 then it will now behave different than before. Also, 5011 rollover
7483 is revoked.
7484 It is not an option, because I see no use to turn the security off.
7485 - iana portlist updated.
7488 - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them).
7490 NSEC3 insecure delegation, was bogus, fixed to be insecure.
7493 - Fix our 'BDS' license (typo reported by Xavier Belanger).
7496 - iana portlist updated.
7497 - review changes for unbound-anchor.
7500 - feature typetransparent localzone, does not block other RR types.
7503 - Fix bug#338: print address when socket creation fails.
7506 - Fix storage of EDNS failures in the infra cache.
7507 - iana portlist updated.
7511 software may be incompatible). We could enable it by default in
7512 the future.
7515 - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
7516 - make test output nicer.
7519 - silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
7520 - iana portlist updated.
7521 - so-sndbuf option for very busy servers, a bit like so-rcvbuf.
7524 - unbound-anchor compiles with openssl 0.9.7.
7527 - release tag 1.4.7.
7528 - trunk is version 1.4.8.
7529 - Be lenient and accept imgw.pl malformed packet (like BIND).
7532 - do not synthesize a CNAME message from cache for qtype DS.
7535 - Use central entropy to seed threads.
7538 - Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
7541 - tag 1.4.7rc1.
7542 - code review.
7545 - GOST code enabled by default (RFC 5933).
7548 - Fix uninit value in dump_infra print.
7550 insecure childzone and a CNAME from parent to child.
7551 - Configure detects libev-4.00.
7554 - dump_infra and flush_infra commands for unbound-control.
7555 - no timeout backoff if meanwhile a query succeeded.
7556 - Change of timeout code. No more lost and backoff in blockage.
7558 is allowed only. At 120sec, the IP is blocked. After 15min, a
7559 120sec entry has a single retry packet.
7562 - Configure errors if ldns is not found.
7565 - Windows 7 fix for the installer.
7569 observation to be noted in cache. Fix bug where EDNSprobe halted
7570 exponential backoff if EDNS status unknown.
7571 - new unresponsive host method, exponentially increasing block backoff.
7572 - iana portlist updated.
7575 - interface automatic works for some people with ip6 disabled.
7576 Therefore the error check is removed, so they can use the option.
7581 exponential backoff applied. Because the backoff is not working.
7584 for some queries.
7587 - iana portlist updated.
7590 - Fix TCP so it uses a random outgoing-interface.
7591 - unbound-anchor handles ADDPEND keystate.
7596 verify as secure (it was insecure by mistake).
7597 - iana portlist updated.
7598 - ldns tarball updated (for reading cachedumps with bad RR data).
7601 - test for unbound-anchor. fix for reading certs.
7602 - Fix alloc_reg_release for longer uptime in out of memory conditions.
7605 - unbound-anchor working, it creates or updates a root.key file.
7606 Use it before you start the validator (e.g. at system boot time).
7609 - iana portlist updated.
7612 - bug#329: in example.conf show correct ipv4 link-local 169.254/16.
7615 - unbound-anchor app, unbound requires libexpat (xml parser library).
7619 reverse ipv6 orchid prefix from builtin list.
7620 - iana portlist updated.
7623 - DLV has downgrade protection again, because the RFC says so.
7624 - iana portlist updated.
7628 5011-store, and DLV-anchor if one key matches it's good enough.
7629 - iana portlist updated.
7630 - Fix reported validation error in out of memory condition.
7633 - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
7637 like _tcp.slb.com with 262 servers.
7638 - iana portlist updated.
7641 - bug#327: Fix for cannot access stub zones until the root is primed.
7646 list size it generates). The probe rate is 1%.
7647 - iana portlist updated.
7650 - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
7651 iterator get_mem includes priv_get_mem. delegpt nodup removed.
7653 comm_point_set_cb_arg and listen_resume removed.
7656 - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20.
7657 Delegpt structures checked for duplicates always.
7658 No more nameserver lookups generated when depth is full anyway.
7659 - example.conf notes how to do DNSSEC validation and track the root.
7660 - iana portlist updated.
7663 - Fix bug#322: configure does not respect CFLAGS on Solaris.
7665 if use sun-cc, but some systems need different flags.
7668 - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP
7669 changes, uses m4_bpatsubst now.
7671 test and testbound scripts. (make longtest has special requirements).
7674 - More pleasant remote control command parsing.
7675 - documentation added for return values reported by doxygen 1.7.1.
7676 - iana portlist updated.
7679 - Fix name of rrset printed that failed validation.
7682 - Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
7686 unsupported algorithms.
7689 - updated ldns tarball with bugfixes.
7690 - release tag 1.4.6.
7691 - trunk becomes 1.4.7 develop.
7692 - iana portlist updated.
7695 - more error details on failed remote control connection.
7698 - rlimit adjustments for select and ulimit can happen at the same time.
7701 - Donation text added to README.
7702 - Fix integer underflow in prefetch ttl creation from cache. This
7703 fixes a potential negative prefetch ttl.
7706 - Changed the defaults for num-queries-per-thread/outgoing-range.
7708 windows 24/48 (because of win api). This makes the ratio this way
7709 to improve resilience under heavy load. For high performance, use
7710 libevent and possibly higher numbers.
7713 - GOST enabled if SSL is recent and ldns has GOST enabled too.
7714 - ldns tarball updated.
7717 - iana portlist updated.
7720 back up to the DS or trust-anchor to validate the DNSKEY.
7723 - Neat function prototypes, unshadowed local declarations.
7726 - failure to chown the pidfile is not fatal any more.
7727 - testbound uses UTC timezone.
7728 - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add
7729 /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake.
7733 at verbosity 4, to enable diagnosis why no queries to 127.0.0.1.
7734 - added feature to print configure date, target and options with -h.
7735 - added feature to print event backend system details with -h.
7736 - wdiff is not actually required by make test, updated requirements.
7740 must be signed with all algorithms from the DS rrset at the parent.
7741 This is now checked and becomes bogus if not.
7746 serviced queries.
7748 / (average time for such long queries) qps for long queries.
7750 qps for short queries, per thread.
7752 queries, and not for new query list entries. This raises the memory
7753 usage to a max of (16+1)*numqueriesperthread reply addresses.
7756 - Fix handling of corner case reply from lame server, follows rfc2308.
7758 for a non-lame server turned up other misconfigured servers.
7759 - unbound.h has extern "C" statement for easier include in c++.
7762 - iana portlist updated.
7764 ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost
7767 - Unbound reports libev or libevent correctly in logs in verbose mode.
7768 - Fix to unload gost dynamic library module for leak testing.
7771 - iana portlist updated.
7774 - Add AAAA to root hints for I.ROOT-SERVERS.NET.
7778 assertion was wrong.
7779 - updated ldns tarball.
7782 - tag 1.4.5 created.
7783 - trunk contains 1.4.6 in development.
7784 - Fix TCPreply on systems with no writev, if just 1 byte could be sent.
7785 - Fix to use one pointer less for iterator query state store_parent_NS.
7786 - makedist crosscompile to windows uses builtin ldns not host ldns.
7788 is valid DNS.
7789 - added documentation for the histogram printout to syslog.
7793 nameservers are not tried again.
7794 - iana portlist updated.
7798 has a loop-counter and maximum search amount.
7801 - iana portlist updated.
7802 - 1.4.5rc1 tag created.
7805 - ldns tarball updated, 1.6.5.
7807 last resort lookups for A and AAAA so there are more lookup options.
7810 - Fix compile warning if compiled without threads.
7811 - updated ldns-tarball with current ldns svn (pre 1.6.5).
7813 RFC is still has to pass AUTH48 at the IETF.
7816 - Ignore Z flag in incoming messages too.
7817 - Fix storage of negative parent glue if that last resort fails.
7818 - libtoolize 2.2.6b, autoconf 2.65 applied to configure.
7819 - new splint flags for newer splint install.
7823 flag from upstream servers.
7825 enabling unbound to continue longer in out of memory conditions.
7826 - parentside names are dispreferred but not said to be dnssec-lame.
7827 - parentside check for cached newname glue.
7828 - fix parentside and querytargets modulestate, for dump_requestlist.
7829 - unbound-control-setup makes keys -rw-r--- so not all users permitted.
7830 - fix parentside from cache to be marked dispreferred for bad names.
7833 - iana portlist updated.
7834 - parent-child disagreement approach altered. Older fixes are
7836 available via the parent of a delegation.
7838 parent if possible. Additionally the loop-counter is used.
7839 It also tests for NS RRset differences between parent and child.
7840 The fetch of misconfigured data should be more reliable and thorough.
7841 It should work reliably even with no or only partial data in cache.
7843 authoritative than information received from the delegation parent.
7844 The search for misconfigured data is not performed normally.
7848 unbound-host, in contrib/ (in the source tarball). Makes
7849 unbound-host suitable for monitoring dnssec(-chain) status.
7852 - EDNS timeout code will not fire if EDNS status already known.
7853 - EDNS failure not stored if EDNS status known to work.
7856 - Fix resolution for domains like safesvc.com.cn. If the iterator
7860 protection).
7861 - Fix comments in iter_utils:dp_is_useless.
7864 - Fix various compiler warnings from the clang llvm compiler.
7865 - iana portlist updated.
7868 - Fix bug#308: spelling error in variable name in parser and lexer.
7871 - Fix dnssec-missing detection that was turned off by server selection.
7872 - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default
7873 reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa,
7874 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa.
7877 - Fix for dnssec lameness detection to use the key cache.
7878 - infra cache entries that are expired are wiped clean. Previously
7879 it was possible to not expire host data (if accessed often).
7882 - ldns tarball updated and GOST support is detected and then enabled.
7883 - iana portlist updated.
7884 - Fix detection of gost support in ldns (reported by Chris Smith).
7887 - unbound-control get_option domain-insecure shows config file items.
7888 - fix retry sequence if prime hints are recursion-lame.
7889 - autotrust anchor file can be initialized with a ZSK key as well.
7890 - harden-referral-path does not result in failures due to max-depth.
7892 target-fetch-policy, this increases the depth to which is checked.
7896 CPPFLAGS during configure process.
7898 it from the event.h header file and link with -lev.
7899 - configlexer.lex gets config.h, and configyyrename.h added by make,
7900 no more double include.
7902 NS set must be pertinent to the query (qname subdomain nsname).
7904 outstanding queries does not become -1 and block the request.
7905 Fixed handling of recursion-lame in combination with 0x20 fallback.
7907 comparison fails, this makes it work around round-robin sites.
7911 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2).
7912 - Fix to fetch data as last resort more tenaciously. When cycle
7914 when they really are not there, the server selection is reinitiated.
7915 - Fix fetch from blacklisted dnssec lame servers as last resort. The
7916 server's IP address is then given in validator errors as well.
7918 the answer rrset.
7921 - tag 1.4.4.
7922 - trunk contains 1.4.5 in development.
7923 - Fix validation failure for qtype ANY caused by a RRSIG parse failure.
7924 The validator error message was 'no signatures from ...'.
7927 - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
7928 - tag 1.4.4rc1.
7931 - ECC-GOST algorithm number 12 that is assigned by IANA. New test
7932 example key and signatures for GOST. GOST requires openssl-1.0.0.
7933 GOST is still disabled by default.
7938 or particular broken packets are received.
7940 processing proof.
7943 - Fix validation of queries with wildcard names (*.example).
7946 - Fix EDNS probe for .de DNSSEC testbed failure, where the infra
7949 the backoff actually works and the domain is not expecting DNSSEC.
7950 - GOST support with correct algorithm numbers.
7953 - iana portlist updated.
7956 - unbound control flushed items are not counted when flushed again.
7959 - iana portlist updated.
7963 config file for the main server can be used more easily.
7965 '0.0.0.0@5353', even though unbound itself worked fine.
7968 - fix fwd_ancil test to pass if the socket options are not supported.
7971 - Fixed random numbers for port, interface and server selection.
7972 Removed very small bias.
7974 statistics entry in the unbound.conf man page.
7977 - Fix interface-automatic for OpenBSD: msg.controllen was too small,
7978 also assertions on ancillary data buffer.
7979 - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
7980 - for NSEC3 check if signatures are cached.
7983 - unit test for util/regional.c.
7987 earlier, and thus later checks benefit from and do not hinder them.
7988 - iana portlist updated.
7989 - ldns tarball updated.
7990 - Fix python use when multithreaded.
7991 - Fix solaris python compile.
7992 - Include less in config.h and include per code file for ldns, ssl.
7995 - another memory allocation option: --enable-alloc-nonregional.
7996 exposes the regional allocations to other memory purifiers.
7997 - fix for memory alignment in struct sock_list allocation.
7999 has dnssec functionality and uses the builtin if not.
8000 - Fix daemonize on Solaris 10, it did not detach from terminal.
8001 - tag 1.4.3 created.
8002 - trunk is 1.4.4 in development.
8003 - spelling fix in validation error involving cnames.
8006 - --enable-alloc-lite works with test set.
8007 - portability in the testset: printf format conversions, prototypes.
8010 - tag 1.4.2 created.
8011 - trunk is 1.4.3 in development.
8012 - --enable-alloc-lite debug option.
8015 - iana portlist updated.
8018 - Fix crash in control channel code.
8021 - better casts in pipe code, brackets placed wrongly.
8022 - iana portlist updated.
8025 - make install depends on make all.
8026 - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs.
8027 - --enable-checking: enables assertions but does not look nonproduction.
8029 nxdomain and nodata distinguished.
8030 - ldns tarball updated.
8031 - --disable-rpath fixed for libtool not found errors.
8032 - new fedora specfile from Fedora13 in contrib from Paul Wouters.
8035 - Fixup prototype for lexer cleanup in daemon code.
8037 list_local_data.
8040 - Fix scrubber bug that potentially let NS records through. Reported
8041 by Amanda Constant.
8042 - Also delete potential poison references from additional.
8043 - Fix: no classification of a forwarder as lame, throw away instead.
8046 - libunbound ub_ctx_get_option() added.
8047 - unbound-control set_option and get_option commands.
8048 - iana portlist updated.
8051 - A little more strict DS scrubbing.
8053 is backed off to.
8054 - RD flag not enabled for dnssec-blacklisted tries, unless necessary.
8055 - pickup ldns compile fix, libdl for libcrypto.
8056 - log 'tcp connect: connection timed out' only in high verbosity.
8057 - unbound-control log_reopen command.
8058 - moved get_option code from unbound-checkconf to util/config_file.c
8061 - Disregard DNSKEY from authority section for chain of trust.
8062 DS records that are irrelevant to a referral scrubbed. Anti-poison.
8063 - iana portlist updated.
8067 writing updated autotrust anchors and print errno to log.
8071 hardcoded. We made the choice to send out more conservatively,
8073 single user (from their own folly, perhaps in case of misconfig).
8076 - Re-query pattern changed on validation failure. To protect troubled
8078 records for the entire zone, and only retries that 900 seconds later.
8080 authority if the zone fails.
8083 - ldns tarball update for long label length syntax error fix.
8084 - iana portlist updated.
8087 - Fixup in compat snprintf routine, %f 1.02 and %g support.
8088 - include math.h for testbound test compile portability.
8091 - Updated url of IANA itar, interim trust anchor repository, in script.
8094 - iana portlist updated.
8095 - configure test for memcmp portability.
8098 - removed warning on format string in validator error log statement.
8099 - iana portlist updated.
8102 - libtool finish the install of unbound python dynamic library.
8105 - acx_nlnetlabs.m4 synchronised with nsd's version.
8108 - Fixup lookup trouble for parent-child domains on the first query.
8111 - Fixup ldns detection to also check for header files.
8116 queries. It takes some extra processing (CPU, a cache is needed).
8119 - Fix unbound-checkconf for auto-trust-anchor-file present checks.
8124 were different. There were two bugs, the parent-side information
8127 not enabled and then give up in failure.
8129 cache. Considers some rrsets 'already expired' but does not allow
8130 overwriting of rrsets considered more secure.
8133 - Fixup python documentation (thanks Leo Vandewoestijne).
8134 - Work on cache prefetch feature.
8136 and in unbound_munin plugin.
8139 - iana portlist updated.
8140 - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length.
8141 - verbose output includes parent-side-address notion for lameness.
8142 - documented val-log-level: 2 setting in example.conf and man page.
8143 - change unbound-control-setup from 1024(sha1) to 1536(sha256).
8146 - iana portlist updated.
8149 - configure with newer libtool 2.2.6b.
8152 - review comments.
8153 - tag 1.4.1.
8154 - trunk to version 1.4.2.
8157 - Answer to qclass=ANY queries, with class IN contents.
8158 Test that validation also works.
8159 - updated ldns snapshot tarball with latest fixes (parsing records).
8162 - on IPv4 UDP turn off DF flag.
8165 - requirements.txt updated with design choice explanations.
8167 and fix to avoid duplicate addresses in delegation point.
8168 - verify_rrsig routine checks expiration last.
8172 errors generated for domain names like '.example.com'.
8173 - Fix SOA excluded from negative DS responses. Reported by Hauke
8174 Lampe. The negative cache did not include proper SOA records for
8176 responses are now only used internally.
8177 - Fix negative cache lookup of closestencloser check of DS type bit.
8182 for itself, fixing domains such as motorcaravanners.eu.
8184 you can bind the same interface multiple times at different ports.
8188 data. Added check to tests.
8191 - Fix crash with module-config "iterator".
8192 - Added unit test that has "iterator" module-config.
8195 - bug#284: fix parse of # without end-of-line at end-of-file.
8198 - updated ldns with release candidate for version 1.6.3.
8199 - tag for 1.4.0 release.
8200 - 1.4.1 version in trunk.
8201 - Fixup major libtool version to 2 because of why_bogus change.
8202 It was 1:5:0 but should have been 2:0:0.
8205 - Patch from David Hubbard for libunbound manual page.
8207 Attila Nagy. Probably caused by clock reversal.
8210 - contrib/split-itar.sh contributed by Tom Hendrikx.
8213 - better argument help for unbound-control.
8214 - iana portlist updated.
8217 - noted multiple entries for multiple domain names in example.conf.
8218 - iana portlist updated.
8221 - Fixed signer detection of CNAME responses without signatures.
8222 - Fix#282 libunbound memleak on error condition by Eric Sesterhenn.
8223 - Tests for CNAMEs to deeper trust anchors, secure and bogus.
8224 - svn tag 1.4.0rc1 made.
8227 - Fixed validation failure for CNAME to optout NSEC3 nodata answer.
8228 - unbound-host does not fail on type ANY.
8230 long ANY mix cases, which fixes validation failures.
8233 - iana portlist updated.
8234 - fix manpage errors reported by debian lintian.
8235 - review comments.
8236 - fixup very long vallog2 level error strings.
8239 - ldns tarball updated (to 1.6.2).
8240 - review comments.
8244 to combine well when combined with DLV and a particular failure.
8245 - Fixed unbound-control -h output about argument optionality.
8246 - review comments.
8249 - lint fixes and portability tests.
8250 - better error text for multiple domain keys in one autotrust file.
8253 - Fix bug where autotrust does not work when started with a DS.
8255 and DNSKEY-format changes in draft version -01.
8258 - iana portlist updated.
8259 - edns-buffer-size option, default 4096.
8260 - fixed do-udp: no.
8263 - removed abort on prealloc failure, error still printed but softfail.
8264 - iana portlist updated.
8265 - RFC 5702: RSASHA256 and RSASHA512 support enabled by default.
8266 - ldns tarball updated (which also enables rsasha256 support).
8269 - iana portlist updated.
8273 - add val-log-level print to corner case (nameserver.epost.bg).
8274 - more detail to errors from insecure delegation checks.
8276 Amanda Constant and Hugh Mahon.
8278 applications. It is in result->why_bogus, a zero-terminated string.
8279 unbound-host prints it by default if a result is bogus.
8280 Also the errinf is public in module_qstate (for other modules).
8283 - retry for validation failure in DS and prime results. Less mem use.
8284 unit test. Provisioning in other tests for requeries.
8285 - retry for validation failure in DNSKEY in middle of chain of trust.
8286 unit test.
8287 - retry for empty non terminals in chain of trust and unit test.
8289 checked when checking for absence of DS records. This could have
8290 enabled the substitution of an insecure delegation.
8291 - moved version number to 1.4.0 because of 1.3.4 release with only
8292 the NSEC3 patch from the entry above.
8294 failures, but still one (longish) line per failure. For example:
8295 validation failure <example.com. DNSKEY IN>: signature expired from
8296 192.0.2.4 for trust anchor example.com. while building chain of trust
8297 validation failure <www.example.com. A IN>: no signatures from
8298 192.0.2.6 for key example.com. while building chain of trust
8301 - Test set updated to provide additional ns lookup result.
8303 for bogus data, and this needed to be provisioned in the tests.
8306 - first validation failure retry code. Retries for data failures.
8307 And unit test.
8310 - improve 5011 modularization.
8311 - fix unbound-host so -d can be given before -C.
8312 - iana portlist updated.
8315 - autotrust-anchor-file can read multiline input and $ORIGIN.
8316 - prevent integer overflow in holddown calculation. review fixes.
8317 - fixed race condition in trust point revocation. review fix.
8318 - review fixes to comments, removed unused code.
8321 - so-rcvbuf: 4m option added. Set this on large busy servers to not
8322 drop the occasional packet in spikes due to full socket buffers.
8323 netstat -su keeps a counter of UDP dropped due to full buffers.
8324 - review of validator/autotrust.c, small fixes and comments.
8327 - 5011 query failed counts verification failures, not lookup failures.
8328 - 5011 probe failure handling fixup.
8329 - test unbound reading of original autotrust data.
8331 picked up, otherwise performs initial probe like usual.
8335 assists in orderly rollover.
8336 - autotrust test with algorithm rollover to unknown algorithm.
8337 checks if new keys are supported before adding them.
8338 - autotrust test with trust point revocation, becomes unsigned.
8340 for qtype DNSKEY (assumes DNSKEY occurs at zone apex).
8343 - autotrust tests, fix trustpoint timer deletion code.
8344 fix count of valid anchors during missing remove.
8345 - autotrust: pick up REVOKE even if not signed with known other keys.
8348 - fix compile of unbound-host when --enable-alloc-checks.
8349 - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis.
8350 - Manual page fixes reported by Tony Finch.
8353 - Fix memory leak reported by Tao Ma.
8354 - Fix memstats test tool for log-time-ascii log format.
8357 - iana portlist updated.
8360 - increased MAXSYSLOGLEN so .bg key can be printed in debug output.
8363 resolvers to use high verbosity (for short periods).
8364 Not on windows, because line buffering does not work there.
8367 - Fix bug where DNSSEC-bogus messages were marked with too high TTL.
8369 keep messages bogus in the cache for too long.
8370 - regression test for that bug.
8371 - documented that load_cache is meant for debugging.
8375 SSL connection which broke, now to the log.
8376 - new ldns - with fixed parse of large SOA values.
8379 - autotrust testbound scenarios.
8380 - autotrust fix that failure count is written to file.
8382 alone, before the probe returns.
8385 - Changes to make unbound work with libevent-2.0.3 alpha. (in
8387 - do not call sphinx for documentation when python is disabled.
8389 compatible with the libevent-2.0. Works with older libevent too.
8390 - fix memory leak in python code.
8394 pick up the system resolvconf nameservers and hosts there.
8395 - included ldns updated (enum warning fixed).
8396 - makefile fix for parallel makes.
8398 from python scripts. See pythonmod/examples/resip.py.
8399 - doxygen comment fixes.
8402 - TRAFFIC keyword for testbound. Simplifies test generation.
8403 ${range lower val upper} to check probe timeout values.
8404 - test with 5011-prepublish rollover and revocation.
8405 - fix revocation of RR for autotrust, stray exclamation mark.
8408 - testbound variable arithmetic.
8409 - autotrust probe time is randomised.
8410 - autotrust: the probe is active and does not fetch from cache.
8413 - testbound variable processing.
8416 - fixup unbound-control lookup to print forward and stub servers.
8419 - autotrust: mesh answer callback is empty.
8422 - autotrust probing.
8423 - iana portlist updated.
8426 - fixup memleak in trust anchor unsupported algorithm check.
8427 - iana portlist updated.
8428 - autotrust options: add-holddown, del-holddown, keep-missing.
8429 - autotrust store revoked status of trust points.
8430 - ctime_r compat definition.
8431 - detect yylex_destroy() in configure.
8432 - detect SSL_get_compression_methods declaration in configure.
8433 - fixup DS lookup at anchor point with unsigned parent.
8434 - fixup DLV lookup for DS queries to unsigned domains.
8437 - cleaner memory allocation on exit. autotrust test routines.
8438 - free all memory on program exit, fix for ssl and flex.
8441 - autotrust: debug routines. Read,write and conversions work.
8444 - autotrust: save and read trustpoint variables.
8447 - autotrust: state table updates.
8448 - iana portlist updated.
8451 - autotrust: process events.
8455 to 16 queries in a row and the timeout gets above 2 minutes.
8456 - autotrust work, split up DS verification of DNSKEYs.
8459 - unbound-control lookup prints out infra cache information, like RTT.
8460 - Fix bug in DLV lookup reported by Amanda from Secure64.
8462 does not give the AD bit on replies.
8465 - autotrust read anchor files. locked trust anchors.
8468 - autotrust import work.
8471 - Check for openssl compatible with gost if enabled.
8472 - updated unit test for GOST=211 code.
8473 Nicer naming of test files.
8474 - iana portlist updated.
8478 operator can use openssl.cnf for configuration options.
8479 - removed small memory leak from config file reader.
8483 implementation of draft-dolmatov-dnsext-dnssec-gost-01.
8484 - iana portlist updated.
8485 - ldns tarball updated (with GOST support).
8488 - trunk moved to 1.3.4.
8491 - Added test that the examples from draft rsasha256-14 verify.
8492 - iana portlist updated.
8493 - tagged 1.3.3
8496 - nicer warning when algorithm not supported, tells you to upgrade.
8497 - iana portlist updated.
8501 the queue statistics displayed in its own graph.
8502 - iana portlist updated.
8507 the root.
8508 - tagged 1.3.3rc1
8512 faced with lameness.
8515 - Ignore transient sendto errors, no route to host, and host, net down.
8516 - contrib/update-anchor.sh has -r option for root-hints.
8518 keep track of them during dnssec deployment.
8521 - fix replacement malloc code. Used in crosscompile.
8522 - makedist -w creates crosscompiled setup.exe on fedora11.
8525 - dependencies for compat items, for crosscompile.
8526 - mingw32 crosscompile changes, dependencies and zipfile creation.
8527 and with System.dll from the windows NSIS you can make setup.exe.
8528 - package libgcc_s_sjlj exception handler for NSISdl.dll.
8531 - updated ldns tarball for solaris x64 compile assistance.
8532 - no need to define RAND_MAX from config.h.
8533 - iana portlist updated.
8534 - configure changes and ldns update for mingw32 crosscompile.
8537 - Fix for crash at start on windows.
8538 - tag for release 1.3.2.
8539 - trunk has version 1.3.3.
8540 - Fix for ID bits on windows to use all 16. RAND_MAX was not
8541 defined like you'd expect on mingw. Reported by Mees de Roo.
8544 - tag for release 1.3.1.
8545 - trunk has version 1.3.2.
8548 - iana portlist updated.
8551 - prettier error handling in SSL setup.
8552 - makedist.sh uname fix (same as ldns).
8553 - updated fedora spec file.
8556 - fixup linking when ldnsdir is "".
8559 - more lenient truncation checks.
8563 support for c99. r2960 for better configure.
8564 - better wrongly_truncated check.
8566 avoid dropped packets at routers.
8570 are dropped.
8573 - fixup iter priv strict aliasing while preserving size of sockaddr.
8574 - iana portlist updated. (one less port allocated, one more fraction
8576 - updated fedora specfile in contrib from Paul Wouters.
8579 - Fixup strict aliasing warning in iter priv code.
8580 and config_file code.
8581 - iana portlist updated.
8582 - harden-referral-path: handle cases where NS is in answer section.
8587 structures so that later validation would fail.
8589 reply has an NS in the authority but no signatures. They are
8590 turned into minimal responses with only the (secure) answer.
8591 - autoconf 2.63 for configure.
8592 - python warnings suppress. Keep python API away from header files.
8595 - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was
8596 used for the python code in unbound. (http://www.nic.cz/vip/ in cz).
8600 generate queries that are known to fail.
8601 - Touchup on munin total memory report.
8604 has to be reexamined.
8607 - iana portlist updated.
8612 lookups. Reported by Hauke Lampe.
8615 - bug #254. removed random whitespace from example.conf.
8618 - Fixup potential wrong NSEC picked out of the cache.
8619 - If unfulfilled callbacks are deleted they are called with an error.
8620 - fptr wlist checks for mesh callbacks.
8621 - fwd above stub in configuration works.
8624 - Fix queries for type DS when forward or stub zones are there.
8627 server. This makes a stub pointing to a local server that has
8628 a local view of example.com signed with the same keys as are
8629 publicly used work. Reported by Johan Ihren.
8630 - Added build-unbound-localzone-from-hosts.pl to contrib, from
8631 Dennis DeDonatis. It converts /etc/hosts into config statements.
8633 public internet into the forward-zone works now. Added unit test.
8637 before chrooting. This makes permissions on remote-control key
8638 files easier to set up. Fixes bug #251.
8639 - flush_type and flush_name remove msg cache entries.
8640 - codereview - dp copy bogus setting fix.
8643 - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause
8644 inadvertant behaviour.
8645 - 1.3.0 tarball for release created.
8646 - 1.3.1 development in svn trunk.
8647 - iana portlist updated.
8648 - fix lint from complaining on ldns/sha.h.
8649 - help compiler figure out aliasing in priv_rrset_bad() routine.
8650 - fail to configure with python if swig is not found.
8651 - unbound_munin_ in contrib uses ps to show rss if sbrk does not work.
8654 - fixup bad free() when wrongly encoded DSA signature is seen.
8655 Reported by Paul Wouters.
8656 - review comments from Matthijs.
8659 - --enable-sha2 option. The draft rsasha256 changed its algorithm
8660 numbers too often. Therefore it is more prudent to disable the
8661 RSASHA256 and RSASHA512 support by default.
8662 - ldns trunk included as new tarball.
8663 - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point.
8666 - fixup doc bug in README reported by Matthew Dempsky.
8673 - detect lack of IPv6 support on XP (with a different error code).
8674 - Fixup a crash-on-exit which was triggered by a very long queue.
8676 of course not really possible because everything is deleted.
8678 network stack encouraging large messages backlogs.
8679 - change in debug statements.
8681 were message backlogs.
8684 - Thanks again to Brett Carr, found an assertion that was not true.
8685 Assertion checked if recursion parent query still existed.
8690 starts to leak handles.
8692 mutexes open. Provide own mutex implementation using primitives.
8695 - created svn tag for 1.3.0.
8698 - optimised cname from cache.
8699 - ifdef windows functions in testbound.
8702 - fix for threadsafety in solaris thr_key_create() in tests.
8703 - iana portlist updated.
8704 - fix pylib test for Darwin.
8705 - fix pymod test for Darwin and a python threading bug in pymod init.
8706 - check python >= 2.4 in configure.
8707 - -ldl check for libcrypto 1.0.0beta.
8710 - fix for build outside sourcedir.
8711 - fix for configure script swig detection.
8714 - Fix reentrant in minievent handler for unix. Could have resulted
8715 in spurious event callbacks.
8716 - timers do not take up a fd slot for winsock handler.
8717 - faster fix for winsock reentrant check.
8718 - fix rsasha512 unit test for new (interim) algorithm number.
8719 - fix test:ldns doesn't like DOS line endings in keyfiles on unix.
8720 - fix compile warning on ubuntu (configlexer fwrite return value).
8721 - move python include directives into CPPFLAGS instead of CFLAGS.
8725 under heavy load.
8726 - iana portlist updated.
8727 - fixup windows winsock handler reentrant problem.
8730 - bug #245: fix munin plugin, perform cleanup of stale lockfiles.
8731 - makedist.sh; better help text.
8732 - cache-min-ttl option and tests.
8733 - mingw detect error condition on TCP sockets (NOTCONN).
8736 - Fix for removal of RSASHA256_NSEC3 protonumber from ldns.
8737 - ldns tarball updated.
8738 - iana portlist update.
8739 - detect GOST support in openssl-1.0.0-beta1, and fix compile problem
8740 because that openssl defines the name STRING for itself.
8743 - windows compile fix.
8744 - Detect FreeBSD jail without ipv6 addresses assigned.
8745 - python libunbound wrapper unit test.
8746 - installs the following files. Default is to not build them.
8748 /usr/lib/python2.x/site-packages/unboundmodule.py
8750 /usr/lib/python2.x/site-packages/unbound.py
8751 /usr/lib/python2.x/site-packages/_unbound.so*
8753 libunbound/python/examples) are not installed.
8754 - python invalidate routine respects packed rrset ids and locks.
8755 - clock skew checks in unbound, config statements.
8756 - nxdomain ttl considerations in requirements.txt
8760 long. Hard to trigger, but NXDOMAINs for nameservers or CNAME
8761 targets have been more vulnerable to the TTL miscalculation bug.
8762 - documentation test fixed for python addition.
8765 - pyunbound (libunbound python plugin) compiles using libtool.
8766 - documentation for pythonmod and pyunbound is generated in doc/html.
8767 - iana portlist updated.
8769 every message in the target domain. This especially impacted
8770 NXDOMAIN messages which could remain in the cache regardless.
8771 - python module test package.
8775 ipv6 AAAA records for their nameservers with ipv4 mapped contents.
8776 Still tries to do so, could work when deployed in intranet.
8777 Higher verbosity shows the error.
8778 - new libunbound calls documented.
8779 - pyunbound in libunbound/python. Removed compile warnings.
8780 Makefile to make it.
8783 - Fixup LDFLAGS from libevent sourcedir compile configure restore.
8784 - Fixup so no non-absolute rpaths are added.
8785 - Fixup validation of RRSIG queries, they are let through.
8787 - checkconf fix no python checks when no python module enabled.
8788 - fix configure, pthread first, so other libs do not change outcome.
8791 - nicer -h output. report linked libraries and modules.
8792 - prints modules in intuitive order (config file friendly).
8793 - python compiles easily on BSD.
8796 - ignore swig varargs warnings with gcc.
8797 - remove duplicate example.conf text from python example configs.
8798 - outofdir compile fix for python.
8799 - pyunbound works.
8800 - print modules compiled in on -h. manpage.
8804 Marek Vavrusa.
8805 - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0.
8808 - more neat configure.ac. Removed duplicate config.h includes.
8809 - neater config.h.in.
8810 - iana portlist updated.
8811 - fix util/configlexer.c and solaris -std=c99 flag.
8812 - fix postcommit aclocal errors.
8813 - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R.
8814 - swap order of host detect and libtool generation.
8817 - added launchd plist example file for MacOSX to contrib.
8818 - deprecation test for daemon(3).
8819 - moved common configure actions to m4 include, prettier Makefile.
8822 - bug #239: module-config entries order is important. Documented.
8823 - build fix for test asynclook.
8826 - winrc/README.txt dos-format text file.
8827 - iana portlist updated.
8828 - use _beginthreadex() when available (performs stack alignment).
8829 - defaults for windows baked into configure.ac (used if on mingw).
8832 - Added tests, unknown algorithms become insecure. fallback works.
8834 definition. Trust anchors with no supported algos are ignored.
8836 otherwise they are treated as insecure.
8837 - domain-insecure: "example.com" statement added. Sets domain
8838 insecure regardless of chain of trust DSs or DLVs. The inverse
8839 of a trust-anchor.
8842 - unit test for unsupported algorithm in anchor warning.
8843 - fixed so queries do not fail on opportunistic target queries.
8846 - fixup diff error printout in contrib/update-itar.sh.
8848 contributed by Dmitriy Demidov.
8851 - doxygen and lex/yacc on linux.
8852 - strip update-anchor on makedist -w.
8853 - fix testbound on windows.
8854 - default log to syslog for windows.
8855 - uninstaller can stop unbound - changed text on it to reflect that.
8856 - remove debugging from windows 'cron' actions.
8859 - log to App.logs on windows prints executable identity.
8860 - fixup tests.
8861 - munin plugin fix benign locking error printout.
8862 - anchor-update for windows, called every 24 hours; unbound reloads.
8865 - winsock event handler resets WSAevents after signalled.
8866 - winsock event handler tests if signals are really signalled.
8868 default install location.
8869 - on windows logging to the Application logbook works (as a service).
8870 - fix RUN_DIR on windows compile setting in makedist.
8871 - windows registry has Software\Unbound\ConfigFile element.
8872 If does not exist, the default is used. The -c switch overrides it.
8873 - fix makedist version cleanup function.
8876 - makedist -w strips out old rc.. and snapshot info from version.
8877 - setup.exe starts and stops unbound after install, before uninstall.
8878 - unbound-checkconf recognizes absolute pathnames on windows (C:...).
8881 - Nullsoft NSIS installer creation script.
8884 - fixup memory leak introduced on 18feb in mesh reentrant fix.
8887 - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8).
8888 - service works on xp/vista, no config necessary (using defaults).
8889 - windows registry settings.
8892 - fixup --export-symbols to be -export-symbls for libtool.
8893 This should fix extraneous symbols exported from libunbound.
8894 Thanks to Ondrej Sury and Robert Edmonds for finding it.
8895 - iana portlist updated.
8896 - document FAQ entry on stub/forward zones and default blocking.
8897 - fix asynclook test app for libunbound not exporting symbols.
8898 - service install and remove utils that work with vista UAC.
8901 - Fixup lexer, to not give warnings about fwrite. Appeared in
8902 new lexer features.
8903 - makedistro functionality for mingw. Has RC support.
8904 - support spaces and backslashes in configured defaults paths.
8905 - register, deregister in service control manager.
8908 - windres usage for application resources.
8911 - isc moved their dlv key download location.
8912 - fixup warning on vista/mingw.
8913 - makedist -w for window zip distribution first version.
8916 - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped.
8917 Nicer script layout. Added url to site in -h output.
8921 have unsupported algorithms.
8922 - added contrib/update-itar.sh This script is similar to
8923 update-anchor.sh, and updates from the IANA ITAR repository.
8925 builtin. The program uses wget and gpg to work.
8926 - iana portlist updated.
8927 - update-itar.sh: using ftp:// urls because https godaddy certificate
8928 is not available everywhere and then gives fatal errors. The
8929 security is provided by pgp signature.
8932 - more cycle detection. Also for target queries.
8934 that were reentrant caused assertion failures. Keep the mesh in
8935 a reentrant safe state. Affects libunbound, reload of server,
8936 on quit and flush_requestlist.
8937 - iana portlist updated.
8940 - forwarder information now per-thread duplicated.
8941 This keeps it read only for speed, with no locking necessary.
8943 on the fly.
8944 - document that unbound-host reads no config file by default.
8945 - updated iana portlist.
8948 - call setusercontext if available (on BSD).
8949 - small refactor of stats clearing.
8950 - #227: flush_stats feature for unbound-control.
8951 - stats_noreset feature for unbound-control.
8952 - flush_requestlist feature for unbound-control.
8953 - libunbound version upped API (was changed 5 feb).
8954 - unbound-control status shows if root forwarding is in use.
8955 - slightly nicer memory management in iter-fwd code.
8959 validating data.
8961 - #226: dump_requestlist feature for unbound-control.
8964 - contrib contains specfile for fedora 1.2.1 (from Paul Wouters).
8965 - iana portlist updated.
8966 - fixup EOL in include directive (reported by Paul Wouters).
8967 You can no longer specify newlines in the names of included files.
8968 - config parser changed. Gives some syntax errors closer to where they
8969 occurred. Does not enforce a space after keyword anymore.
8970 Does not allow literal newlines inside quoted strings anymore.
8971 - verbosity level 5 logs customer IP for new requestlist entries.
8972 - test fix, lexer and cancel test.
8974 in the log file as Feb 06 13:45:26 (like syslog does).
8975 - detect event_base_new in libevent-1.4.1 and later and use it.
8976 - #231 unbound-checkconf -o option prints that value from config file.
8977 Useful for scripting in management scripts and the like.
8980 - ldns 1.5.0 rc as tarball included.
8981 - 1.3.0 development continues:
8983 the async_id did not exist, or that it was already delivered.
8986 result at the same time they call cancel. For this case,
8987 ub_cancel tries to return an error code.
8988 Fixes race condition in ub_cancel() libunbound function.
8989 - MacOSX Leopard cleaner text output from configure.
8991 applicable.
8993 inluded ldns package with the unbound source. The -I include
8995 an older ldns install.
8996 - daemon(3) posix call is used when available.
8997 - testbound test for older fix added.
9000 - tag for release 1.2.1.
9001 - trunk setup for 1.3.0 development.
9004 - noted feature requests in doc/TODO.
9005 - printout more detailed errors on ssl certificate loading failures.
9006 - updated IANA portlist.
9009 - more quiet about ipv6 network failures, i.e. when ipv6 is not
9010 available (network unreachable). Debug still printed on high
9011 verbosity.
9012 - unbound-host -4 and -6 options. Stops annoying ipv6 errors when
9013 debugging with unbound-host -4 -d ...
9015 stub-prime queries in the iterator. Avoids possible deadlock
9016 when priming fails.
9020 Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc
9021 - fixup suncc warnings.
9022 - fix bug where unbound could crash using libevent 1.3 and older.
9023 - update testset for recent retry change.
9026 - 1.2.1 feature: negative caching for failed queries.
9027 Queries that failed are cached for 5 seconds (NORR_TTL).
9028 If the failure is local, like out of memory, it is not cached.
9031 state machines unnecessarily.
9033 query resolve attempt, and cached error does not stop EDNS fallback.
9034 - remove debug prints that protect against bad referrals.
9035 - honor QUIET=no on make commandline (or QUIET=yes ).
9038 - fixed bug in lameness marking, removed printouts.
9039 - find NS rrset more cleanly for qtype NS.
9040 - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for
9041 reporting and logs.
9042 - 1.2.1 feature: stops resolving AAAAs promiscuously when they
9043 are in the negative cache.
9047 name of zone to hash when setting lame.
9048 - lameness debugging printouts.
9051 - created svn tag for 1.2.0 release.
9052 - svn trunk contains 1.2.1 version number.
9053 - iana portlist updated for todays list.
9054 - removed debug print.
9058 bug #224, building with -j race condition.
9059 - remove possible race condition in the test for race conditions.
9062 - version 1.2.0 in preparation.
9063 - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file
9064 statements. (Adapted from patch by Paul Wouters).
9065 - typo fix and iana portlist updated.
9066 - porting testsuite; unused var warning, and type fixup.
9069 - fixup packet-of-death when compiled with --enable-debug.
9070 A malformed packet could cause an internal assertion failure.
9071 - added test for HINFO canonicalisation behaviour.
9073 queries with different type could get nxdomain. Now queries
9075 get a correct NOERROR/NODATA answer.
9077 with bind and ldns.
9078 - fix reading included config files when chrooted.
9079 Give full path names for include files.
9080 Relative path names work if the start dir equals the working dir.
9081 - fix libunbound message transport when no packet buffer is available.
9084 - fixup getaddrinfo failure handling for remote control port.
9085 - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints.
9086 - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/
9087 - comm_timer_set performs base_set operation after event_add.
9091 some zones that had correct DLV keys as insecure.
9092 - follows -rc makedist from ldns changes (no _rc).
9093 - ldns tarball updated with 1.4.1rc for DLV unit test.
9094 - verbose prints about recursion lame detection and server selection.
9095 - fixup BSD port for infra host storage. It hashed wrongly.
9096 - fixup makedist snapshot name generation.
9097 - do not reopen syslog to avoid dev/log dependency.
9100 - follows ldns makedist.sh. -rc option. autom4te dir removed.
9101 - unbound-control status command.
9102 - extended statistics has a number of ipv6 queries counter.
9103 contrib/unbound_munin_ was updated to draw ipv6 in the hits graph.
9106 - follow makedist improvements from ldns, for maintainers prereleases.
9108 version number.
9111 - better fix for bug #219: use LOG_NDELAY with openlog() call.
9112 Thanks to Tamas Tevesz.
9116 remote control is enabled. Also fixed NULL printf when not chrooted.
9117 - iana portlist updated.
9122 was using multiple processes.
9123 - iana portlist updated.
9124 - test for remote control with interprocess communication.
9127 compiled version. dump/load cache work, on the first process.
9128 - fixup remote control local_data addition memory corruption bug.
9132 by Paul Wouters and Adam Tkac.
9135 - configure complains when --without-ssl is given (bug #220).
9136 - skip unsupported feature tests on vista/mingw.
9137 - fixup testcode/streamtcp to work on vista/mingw.
9138 - root-hints test checks version of dig required.
9140 come back up. But not if there is some other working server.
9144 on the keys and certificates generated by unbound-control-setup.
9146 script under the same username as the server uses suffices.
9147 i.e. sudo -u unbound unbound-control-setup
9148 - testset port to vista/mingw.
9149 - tcp_sigpipe to freebsd port.
9152 - fixed tcp accept, errors were printed when they should not.
9153 - unbound-control-setup.sh removes read/write permissions other
9154 from the keys it creates (as suggested by Dmitriy Demidov).
9157 - fixup fatal error due to faulty error checking after tcp accept.
9158 - add check in rlimit to avoid integer underflow.
9160 - nicer comments in rlimit check.
9161 - tag 1.1.1 created in svn.
9162 - trunk label is 1.1.2
9166 log line is written, gets a log line while not chroot'ed yet.
9169 - iana portlist updated.
9170 - removed cast in unit test debug print that was not 64bit safe.
9171 - trunk back to 1.1.0; copied to tags 1.1.0 release.
9172 - trunk to has version number 1.1.1 again.
9173 - in 1.1.1; make clean nicer. grammar in manpage.
9176 - theoretical fix for problems reported on mailing list.
9178 resolution would fail. Fixed to ask for the A and AAAA records.
9180 TLD perspective, when a zone is only reachable on one transport.
9181 - test for above, only AAAA and doip6 is no. Fix causes A record
9182 for nameserver to be fetched.
9183 - fixup address duplication on cache fillup for delegation points.
9184 - testset updated for new query answer requirements.
9187 - created 1.1.0 release tag in svn.
9188 - trunk moved to 1.1.1
9189 - fixup unittest-neg for locking.
9192 - added fedora init and specfile to contrib (by Paul Wouters).
9193 - added configure check for ldns 1.4.0 (using its compat funcs).
9194 - neater comments in worker.h.
9195 - removed doc/plan and updated doc/TODO.
9196 - silenced EHOSTDOWN (verbosity 2 or higher to see it).
9197 - review comments from Jelte, Matthijs. Neater code.
9200 - add unbound-control manpage to makedist replace list.
9203 - unit test for negative cache, stress tests the refcounting.
9205 in the negative cache rbtree (upcoming 1.1 feature). (Thanks to
9206 Attila Nagy for testing).
9207 - nicer comments in cachedump about failed RR to string conversion.
9209 for extended statistics.
9212 - fixup the getaddrinfo compat code rename.
9215 - added configure check for eee build warning.
9218 - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4.
9219 - detect nonblocking problems in network stack in configure script.
9222 - dname_priv must decompress the name before comparison.
9223 - iana portlist updated.
9226 - fixed possible memory leak in key_entry_key deletion.
9227 Would leak a couple bytes when trust anchors were replaced.
9228 - if query and reply qname overlap, the bytes are skipped not copied.
9230 had outstanding (TCP) replies.
9232 properly.
9233 - fixed file descriptor leak for localzone type deny (for TCP).
9234 - fixed memleak at exit for nsec3 negative cached zones.
9235 - fixed memleak for the keyword 'nodefault' when reading config.
9237 do not get spammed by it.
9239 error while unnecessarily try to listen to a closed fd. Fixed.
9242 - fixed -Wwrite-strings warnings that result in better code.
9245 - fixup build process for Mac OSX linker, use ldns b32 compat funcs.
9246 - generated configure with autoconf-2.61.
9247 - iana portlist updated.
9248 - detect if libssl needs libdl. For static linking with libssl.
9250 from ldns 1.4.0 (need very latest version).
9251 - updated the included ldns tarball.
9252 - proper detection of SHA256 and SHA512 functions (not just sizes).
9255 - a little more debug info for failure on signer names. prints names.
9258 - CFLAGS are picked up by configure from the environment.
9259 - iana portlist updated.
9260 - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too.
9261 - new stub-prime: yesno option. Default is off, so it does not prime.
9262 can be turned on to get same behaviour as previous unbound release.
9263 - made automated test that checks if builtin root hints are uptodate.
9265 implementation. The unwanted-reply-threshold can be set.
9266 - fixup so fptr_whitelist test in alloc.c works.
9269 - fix update-anchors.sh, so it does not report different RR order
9270 as an update. Sorts the keys in the file. Updated copyright.
9271 - fixup testbound on windows, the command control pipe doesn't exist.
9272 - skip 08hostlib test on windows, no fork() available.
9273 - made unbound-remote work on windows.
9276 - quench a log message that is debug only.
9277 - iana portlist updated.
9278 - do not query bogus nameservers. It is like nameservers that have
9279 the NS or A or AAAA record bogus are listed as donotquery.
9281 attempt to get more options to be fetched.
9282 - changed bogus-ttl default value from 900 to 60 seconds.
9284 actual attacks at this time. And thus repeated validation helps
9285 the operators get the problem fixed sooner. It makes validation
9286 failures go away sooner (60 seconds after the zone is fixed).
9290 and if the TTL is big enough that solves validation for the zone.
9291 - fixup unbound-control compilation on windows.
9294 - port Leopard/G5: fixup type conversion size_t/uint32.
9295 please ranlib, stop file without symbols warning.
9296 - harden referral path now also validates the root after priming.
9298 and attemps to validate the entries.
9301 - Fixup negative TTL values appearing (reported by Attila Nagy).
9304 - better documentation for 0x20; remove fallback TODO, it is done.
9306 as well as very careful NS caching (only when doing NS query).
9307 A, AAAA use the delegation from the NS-query.
9310 - fwd_three.tpkg test was flaky. If the three requests hit the
9311 wrong threads by chance (or bad OS) then the test would fail.
9312 Made less flaky by increasing number of retries.
9313 - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs.
9314 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014).
9315 Which includes the ldns_dname_absolute fix.
9317 listening when full. Thus, removed timeout problem.
9318 It may be serviced by three threads, or maybe by one.
9319 Mostly only useful for lock-check testing now.
9324 correct answer.
9325 - iana port list update.
9326 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013).
9330 two tests that are supposed to fail to validate.
9333 - negative cache caps max iterations of NSEC3 done.
9334 - NSEC3 negative cache for qtype DS works.
9337 - NSEC negative cache for DS.
9340 - jostle-timeout option, so you can config for slow links.
9341 - 0x20 fallback code. Tries 3xnumber of nameserver addresses
9342 queries that must all be the same. Sent to random nameservers.
9343 - documented choices for DoS, EDNS, 0x20.
9346 - fixup unlink of pidfile.
9347 - fixup SHA256 algorithm collation code.
9348 - contrib/update-anchor.sh does not overwrite anchors if not needed.
9349 exits 0 when a restart is needed, other values if not.
9350 so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart
9351 can restart unbound exactly when needed.
9354 - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1.
9355 - tests for sha256 support and downgrade resistance.
9357 using the drafted protocol numbers.
9358 - when using stub on localhost (127.0.0.1@10053) unbound works.
9359 Like when running NSD to host a local zone, on the same machine.
9360 The noprime feature. manpages more explanation. Added a test for it.
9361 - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com"
9365 detected, eventually.
9366 - multiple query timeout rtt backoff does not backoff too much.
9369 - tests for remote-control.
9370 - small memory leak in exception during remote control fixed.
9371 - fixup for lock checking but not unchecking in remote control.
9372 - iana portlist updated.
9375 - Msg cache is loaded. A cache load enables cache responses.
9376 - unbound-control flush [name], flush_type and flush_zone.
9379 - dump_cache and load_cache statements in unbound-control.
9380 RRsets are dumped and loaded correctly.
9381 Msg cache is dumped.
9384 - locking on the localdata structure.
9385 - add and remove local zone and data with unbound-control.
9386 - ldns trunk snapshot updated, make tests work again.
9389 - fixup error in time calculation.
9390 - munin plugin improvements.
9391 - nicer abbreviations for high query types values (ixfr, axfr, any...)
9392 - documented the statistics output in unbound-control man page.
9393 - extended statistics prints out histogram, over unbound-control.
9396 - locking for threadsafe bogus rrset counter.
9397 - ldns trunk no longer exports b32 functions, provide compat.
9398 - ldns tarball updated.
9399 - testcode/ldns-testpkts.c const fixups.
9400 - fixed rcode stat printout.
9401 - munin plugin in contrib.
9402 - stats always printout uptime, because stats plugins need it.
9405 - extended-statistics: yesno config option.
9406 - unwanted replies spoof nearmiss detector.
9407 - iana portlist updated.
9410 - working start, stop, reload commands for unbound-control.
9411 - test for unbound-control working; better exit value for control.
9412 - verbosity control via unbound-control.
9413 - unbound-control stats.
9416 - removed browser control mentions. Proto speccy.
9420 the socket options to the accepted socket.
9421 - fix TCP timeouts.
9422 - SSL protected connection between server and unbound-control.
9425 - remove memleak in privacy addresses on reloads and quits.
9426 - remote control work.
9429 - smallapp/unbound-control-setup.sh script to set up certificates.
9432 - scrubber scrubs away private addresses.
9433 - test for private addresses. man page entry.
9434 - code refactored for name and address tree lookups.
9438 private-domain.
9439 - dnstree for reuse of routines that help with domain, addr lookups.
9440 - private-address and private-domain config option read, stored.
9443 - DoS protection features. Queries are jostled out to make room.
9444 - testbound can pass time, increasing the internal timer.
9446 is removed too.
9449 - disallow nonrecursive queries for cache snooping by default.
9450 You can allow is using access-control: <subnet> allow_snoop.
9451 The defaults do allow access no authoritative data without RD bit.
9452 - two tests for it and fixups of tests for nonrec refused.
9455 - version 1.1 number in trunk.
9456 - harden-referral-path option for query for NS records.
9457 Default turns off expensive, experimental option.
9461 again. (from bugfix#199).
9463 and these are only visible by using the -d commandline flag.
9466 - daemon(3) is causing problems for people. Reverting the patch.
9467 bug#200, and 199 and 203 contain sideline discussion on it.
9468 - bug#199 fixed: pidfile can be outside chroot. openlog is done before
9469 chroot and drop permissions.
9471 neg-cache-size.
9472 - bug#203 fixed: dlv has been implemented.
9475 - test for insecure zone when DLV is in use, also does negative cache.
9476 - test for trustanchor when DLV is in use (the anchor works).
9477 - test for DLV used for a zone below a trustanchor.
9478 - added scrub filter for overreaching NSEC records and unit test.
9480 - use of setresuid or setreuid when available.
9481 - use daemon(3) if available.
9484 - realclean patch from Robert Edmonds.
9487 - nicer debuglogging of DLV.
9488 - test with secure delegation inside the DLV repository.
9491 - negative cache code linked into validator, for DLV use.
9492 negative cache works for DLV.
9493 - iana portlist update.
9494 - dlv-anchor option for unit tests.
9495 - fixup NSEC_AT_APEX classification for short typemaps.
9496 - ldns-testns has subdomain checks, for unit tests.
9499 - negative cache code, reviewed.
9503 the verbosity of the statements. Better logfile message
9504 classification.
9505 - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd.
9509 enclosers from NSEC responses.
9510 - DLV works, straight to the dlv repository, so not for production.
9511 - Iana port update.
9514 - synthesize DLV messages from the rrset cache, like done for DS.
9518 options.
9519 - bug #204: variable name ameliorated in log.c.
9520 - bug #206: in iana_update, no egrep, but awk use.
9521 - ldns snapshot r2699 taken (includes DLV type).
9522 - DLV work, config file element, trust anchor read in.
9525 - finished adjusting testset to provide qtype NS answers.
9528 - Fixup rrset security updates overwriting 2181 trust status.
9530 nonvalidated data, and 2181 rules prevent cache overwrites to them.
9531 - Fix assertion fail on bogus key handling.
9532 - dnssec lameness detection works on first query at trust apex.
9533 - NS queries get proper cache and dnssec lameness treatment.
9534 - fixup compilation without pthreads on linux.
9537 - NS queries are done after every referral.
9538 validator is used on those NS records (if anchors enabled).
9541 - Scrubber more strict. CNAME chains, DNAMEs from cache, other
9542 irrelevant rrsets removed.
9543 - 1.0.2 released from 1.0 support branch.
9544 - fixup update-anchor.sh to work both in BSD shell and bash.
9547 - fixup DS test so apex nodata works again.
9550 - iana port update.
9551 - TODO update.
9552 - fix bug 201: null ptr deref on cleanup while udp pkts wait for port.
9553 - added explanatory text for outgoing-port-permit in manpage.
9556 - fixup bug qtype DS for unsigned zone and signed parent validation.
9559 - added original copyright statement of OpenBSD arc4random code.
9560 - created tube signaling solution on windows, as a pipe replacement.
9561 this makes background asynchronous resolution work on windows.
9562 - removed very insecure socketpair compat code. It also did not
9563 work with event_waiting. Solved by pipe replacement.
9564 - unbound -h prints openssl version number as well.
9567 - moved pipe actions to util/tube.c. easier porting and shared code.
9568 - check _raw() commpoint callbacks with fptr_wlist.
9569 - iana port update.
9572 - #198: nicer entropy warning message. manpage OS hints.
9575 - #198: fixup man page to suggest chroot entropy fix.
9578 - branch for 1.0 support.
9579 - trunk work on tube.c.
9582 - fix bug #196, compile outside source tree.
9583 - fix bug #195, add --with-username=user configure option.
9585 fds than the builtin minievent can handle.
9588 - made svn tag 1.0.1, trunk now 1.0.2
9589 - sha256 checksums enabled in makedist.sh
9593 IPv6 example prefix to AS112 default blocklist.
9594 - fixup lookup of DS records by client with trustanchor for same.
9595 - libunbound ub_resolve, fix handling of error condition during setup.
9596 - lowered log_hex blocksize to fit through BSD syslog linesize.
9597 - no useless initialisation if getpwnam not available.
9598 - iana, ldns snapshot updated.
9601 - Matthijs fixed memory leaks in root hints file reading.
9604 - fixup streamtcp bounds setting for udp mode, in the test framework.
9605 - contrib item for updating trust anchors.
9608 - fixup fwd_ancil test typos.
9609 - Fix for newegg lameness : ok for qtype=A, but lame for others.
9610 - fixup unit test for infra cache, test lame merging.
9612 handling.
9615 - removed testcode/checklocks from production code compilation path.
9617 on windows.
9618 - fwd_ancil test fails if platform support is lacking.
9621 - fixup minitpkg to cleanup on windows with its file locking troubles.
9622 - minitpkg shows skipped tests in report.
9624 ipv6 connectivity).
9626 not been fully handled yet. when interest in the event(s) resumes,
9627 they are sent again. When WOULDBLOCK is returned events are cleared.
9628 - skip tests that need signals when testing on mingw.
9632 do not work in ascii-mode on windows. The b does nothing on unix.
9633 unittest and testbound tests work on windows (xp too).
9634 - ioctlsocket prints nicer error message.
9635 - fixed up some TCP porting for winsock.
9636 - lack of IPv6 gives a warning, no fatal error.
9637 - use WSAGetLastError() on windows instead of errno for some errors.
9641 fds for waiting on than unixes.
9642 - winsock_event minievent handler for windows. (you could also
9643 attempt to link with libevent/libev ports for windows).
9644 - neater crypto check and gdi32 detection.
9645 - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista.
9648 - on windows, use windows threads, mutex and thread-local-storage(Tls).
9649 - detect if openssl needs gdi32.
9650 - if no threading, THREADS_DISABLED is defined for use in the code.
9651 - sets USE_WINSOCK if using ws2_32 on windows.
9652 - wsa_strerror() function for more readable errors.
9653 - WSA Startup and Cleanup called in unbound.exe.
9657 random, srandom (used inside the tests).
9658 - signed or unsigned FD_SET is cast.
9661 - fixup warnings compiling on eeepc xandros linux.
9666 and lameness.
9667 * check if no AA bit for non-forwarder, and thus lame zone.
9668 In response to error report by Richard Doty for mail.opusnet.com.
9669 - fixup unput warning from lexer on freeBSD.
9670 - bug#183. pidfile, rundir, and chroot configure options. Also the
9671 example.conf and manual pages get the configured defaults.
9679 - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug.
9680 Reported by Robert Edmonds.
9681 - iana port updated.
9684 - updated libtool files with newer version.
9685 - iana portlist updated.
9688 - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the
9689 trailing dot is not used during comparison.
9694 bash shell).
9695 - bug 180: fixed buffer overflow in unbound-checkconf use of strncat.
9697 config file parts).
9700 --disable-static configure flag caused problems. (Patch from
9702 - bug 179: same fix as 177.
9704 unbound. Fixed so that configure parameters are passed to the
9705 subdir configure script.
9706 fixed that ./libtool is used always, you can still override
9707 manually with ./configure libtool=mylibtool or set $libtool in
9708 the environment.
9709 - update of the ldns tarball to current ldns svn version (fix 181).
9710 - bug 184: -r option for unbound-host, read resolv.conf for
9711 forwarder. (Note that forwarder must support DNSSEC for validation
9712 to succeed).
9715 - mingw32 porting.
9716 - test for sys/wait.h
9717 - WSAEWOULDBLOCK test after nonblocking TCP connect.
9718 - write_iov_buffer removed: unused and no struct iov on windows.
9719 - signed/unsigned warning fixup mini_event.
9720 - use ioctlsocket to set nonblocking I/O if fnctl is unavailable.
9722 - detect pwd.h.
9723 - detect getpwnam, getrlimit, setsid, sbrk, chroot.
9724 - default config has no chroot if chroot() unavailable.
9725 - if no kill() then no pidfile is read or written.
9726 - gmtime_r is replaced by nonthreadsafe alternative if unavail.
9727 used in rrsig time validation errors.
9730 - contrib unbound.spec from Patrick Vande Walle.
9732 in system log.
9733 - do not generate lex input and lex unput functions.
9734 - mingw port. replacement functions labelled _unbound.
9735 - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed.
9738 - fedora 9, check in6_pktinfo define in configure.
9739 - CREDITS fixup of history.
9740 - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative.
9743 - fixup for MacOSX hosts file reading (reported by John Dickinson).
9744 - created 1.0.0 svn tag.
9745 - trunk version 1.0.1.
9748 - accepted patch from Ondrej Sury for library version libtool option.
9749 - configure --disable-rpath fixes up libtool for rpath trouble.
9750 Adapted from debian package patch file.
9753 - Added root ipv6 addresses to builtin root hints.
9754 - TODO modified for post 1.0 plans.
9755 - trunk version set to 1.0.0.
9756 - no unnecessary linking with librt (only when libevent/libev used).
9759 - fixup no-ip4 problem with error callback in outside network.
9762 - DESTDIR is honored by the Makefile for rpms.
9763 - contrib files unbound.spec and unbound.init, builds working RPM
9764 on FC7 Linux, a chrooted caching resolver, and libunbound.
9765 - iana ports update.
9768 - chroot checks improved. working directory relative to chroot.
9769 checks if config file path is inside chroot. Documentation on it.
9770 - nicer example.conf text.
9771 - created 0.11 tag.
9774 - parseunbound.pl contrib update from Kai Storbeck for threads.
9778 - ignore SIGPIPE.
9779 - unit test for SIGPIPE ignore.
9782 - FEATURES document.
9784 and chroot was used.
9787 - requirements doc, updated clean query returns.
9788 - parseunbound.pl update from Kai Storbeck.
9789 - sunos4 porting changes.
9792 - fixup default rc.d pidfile location to /usr/local/etc.
9793 - iana ports updated.
9794 - copyright updated in ldns-testpkts to keep same as in ldns.
9796 chroot dir.
9797 - documented 'gcc: unrecognized -KPIC option' errors on Solaris.
9798 - example.conf values changed to /usr/local/etc/unbound
9799 - DSA test work.
9800 - DSA signatures: unbound is compatible with both encodings found.
9801 It will detect and convert when necessary.
9804 - got update for parseunbound.pl statistics script from Kai Storbeck.
9805 - tpkg tests for udp wait list.
9806 - documented 0x20 status.
9807 - fixup chroot and checkconf, it is much smarter now.
9808 - fixup DSA EVP signature decoding. Solution that Jelte found copied.
9809 - and check first sig byte for the encoding type.
9812 - random port selection out of the configged ports.
9813 - fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
9814 - removed base_port.
9815 - created 256-port ephemeral space for the OS, 59802 available.
9816 - fixup consistency of port_if out array during heavy use.
9819 - --with-libevent works with latest libevent 1.4.99-trunk.
9820 - added log file statistics perl script to contrib.
9821 - automatic iana ports update from makefile. 60058 available.
9826 libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
9827 - unused commpoints not listed in epoll list.
9828 - statistics-cumulative option so that the values are not reset.
9830 it excludes <1024 and iana assigned numbers.
9831 config statements to modify the available port numbers.
9834 - unbound tries to set the ulimit fds when started as server.
9835 if that does not work, it will scale back its requirements.
9838 - documented /dev/random symlink from chrootdir as FAQ entry.
9841 - implemented AD bit signaling. If a query sets AD bit (but not DO)
9842 then the AD bit is set in the reply if the answer validated.
9843 Without including DNSSEC signatures. Useful if you have a trusted
9844 path from the client to the resolver. Follows dnssec-updates draft.
9848 section must be present in the reply (by the scrubber). And it must
9849 be equal to the question sent, at least lowercase folded.
9851 to store such messages. However blocking by the scrubber makes
9852 sure nothing gets into the RRset cache. Also, this looks like a
9854 done (which is useful in a spoofing situation).
9855 - RTT banding. Band size 400 msec, this makes band around zero (fast)
9856 include unknown servers. This makes unbound explore unknown servers.
9859 - -C config feature for harvest program.
9860 - harvest handles CNAMEs too.
9863 - patch from Hugo Koji Kobayashi for iterator logs spelling.
9867 of a cname trust chain is lower; not full answer_AA.
9868 - test for this fix.
9869 - default config file location is /usr/local/etc/unbound.
9870 Thus prefix is used to determine the location. This is also the
9871 chroot and pidfile default location.
9874 - Create 0.10 svn tag.
9875 - 0.11 version in trunk.
9876 - indentation nicer.
9879 - documentation update.
9880 - fixup port to Solaris of perf test tool.
9881 - updated ldns-tarball with decl-after-statement fixes.
9884 - fixed memory leaks in libunbound (during cancellation and wait).
9885 - libunbound returns the answer packet in full.
9886 - snprintf compat update.
9887 - harvest performs lookup.
9888 - ldns-tarball update with fix for ldns_dname_label.
9889 - installs to sbin by default.
9890 - install all manual pages (unbound-host and libunbound too).
9893 - option to use caps for id randomness.
9898 - delay utility delays TCP as well. If the server that is forwarded
9899 to has a TCP error, the delay utility closes the connection.
9900 - delay does REUSE_ADDR, and can handle a server that closes its end.
9901 - answers use casing from query.
9904 - delay utility works. Gets decent thoughput too (>20000).
9908 and query ID) in the reply list, avoid re-encoding the answer.
9910 profile reports.
9911 - default is now minievent - not libevent. As its faster and
9912 not needed for regular installs, only for very large port ranges.
9914 nocache-recursion check.
9915 - less hashing during msg parse, 4% for recursion.
9916 - small speed fix for dname_count_size_labels, +1 or +2% recursion.
9919 +70 to +80 for cache hits, and +96% for version.bind.
9921 www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
9922 www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
9923 So, unbound can be about equal qps to NSD in cache hits.
9924 And about 3.4x faster than BIND in cache performance.
9925 - delay utility for testing.
9928 - speedup of root-delegation message encoding by 15%.
9929 - minor speedup of compress tree_lookup, maybe 1%.
9931 profiler output, maybe a couple percent when it matters.
9934 - setup speec_cache for need-ldns-testns in dotests.
9936 on that account.
9937 - fptr whitelist checks are not disabled in optimize mode.
9938 - do-daemonize config file option.
9939 - minievent time share initializes time at start.
9940 - updated testdata for nsec3 new algorithm numbers (6, 7).
9941 - small performance test of packet encoding (root delegation).
9944 - applied patch to unbound-host man page from Jan-Piet Mens.
9946 to default 'no').
9947 - time is only gotten once and the value is shared across unbound.
9948 - unittest cleans up crypto, so that it has no memory leaks.
9950 +3% speed for cache responses and +9% for recursions.
9951 - ldns tarball update with new NSEC3 sign code numbers.
9952 - perform several reads per UDP operation. This improves performance
9953 in DoS conditions, and costs very little in normal conditions.
9954 improves cache response +50%, and recursions +10%.
9955 - modified asynclook test. because the callback from async is not
9958 released for a callback and a new cancel() for that callback.
9960 lock window. I'd rather have the small possibility of a callback
9962 callbacks. Could be possible to only outlaw process(), wait(),
9963 cancel() from callbacks, by adding another lock, but I'd rather not.
9966 - patch to unbound-host from Jan-Piet Mens.
9967 - unbound host prints errors if fails to configure context.
9970 or can be sent a little while later (i.e. processing time may
9971 take long, but throughput has to be high).
9973 after a CNAME).
9974 - streamlined code for RD flag setting.
9975 - profiled code and changed dname compares to be faster.
9976 The speedup is about +3% to +8% (depending on the test).
9977 - minievent tests for eintr and eagain.
9980 - added FreeBSD rc.d script to contrib.
9982 and chroot: defaults in config file.
9983 - added cache speed test, for cache size OK and cache too small.
9987 defaults).
9988 - perf test program works.
9991 - 0.9 released.
9992 - 1.0 development. Printout ldns version on unbound -h.
9993 - start of perf tool.
9994 - bugfix to read empty lines from /etc/hosts.
9998 is not present.
10001 - changed library to use ub_ instead of ub_val_ as prefix.
10002 - statistics output text nice.
10003 - etc/hosts handling.
10004 - library function to put logging to a stream.
10005 - set any option interface.
10008 - test program for multiple queries over a TCP channel.
10009 - tpkg test for stream tcp queries.
10010 - unbound replies to multiple TCP queries on a TCP channel.
10012 when validating a nonrec query.
10016 required.
10019 - moved up all current level 2 to be level 3. And 3 to 4.
10021 for operators.
10022 - verbosity level 2. Describes recursion and validation.
10023 - cleaner configure script and fixes for libevent solaris.
10024 - signedness for log output memory sizes in high verbosity.
10027 - clearer explanation of threading configure options.
10029 to do the extended test).
10030 - changed name of ub_val_result_free to ub_val_resolve_free.
10032 libunbound/unbound.c -> libunbound.c and worker to libworker.
10033 - fallback without EDNS if result is NOTIMPL as well as on FORMERR.
10036 - statistics-interval: seconds option added.
10039 - fixup Makefile strip command and libunbound docs typo.
10044 block, and services both pipes and queries.
10047 - check trailing / on chrootdir in checkconf.
10048 - check if root hints and anchor files are in chrootdir.
10049 - no route to host tcp error is verbosity level 2.
10050 - removed unused send_reply_iov. and its configure check.
10051 - added prints of 'remote address is 1.2.3.4 port 53' to errors
10052 from netevent; the basic socket errors.
10056 local_zone answers.
10057 - fixup uninit warning from random.c; also seems to fix sporadic
10058 sigFPE coming out of openssl.
10059 - made openssl entropy warning more silent for library use. Needs
10060 verbosity 1 now.
10061 - fixup forgotten locks for rbtree_searches on ctx->query tree.
10063 a super-rnd can be passed at init to chain init random states.
10064 - test also does lock checks if available.
10065 - protect config access in libworker_setup().
10066 - libevent doesn't like comm_base_exit outside of runloop.
10067 - close fds after removing commpoints only (for epoll, kqueue).
10070 - added tpkg for asynclook and library use.
10071 - allows localhost to be queried when as a library.
10073 really fast answers that beat the cancel).
10074 - please doxygen, put doxygen comment in one place.
10075 - asynclook -b blocking mode and test.
10076 - refactor asynclook, nicer code.
10078 a mutex around the rand init.
10079 - fix pass async_id=NULL to _async resolve().
10080 - rewrote _wait() routine, so that it is threadsafe.
10081 - cancelation is threadsafe.
10082 - asynclook extended test in tpkg.
10084 locks, so does not service the query pipe on the bg side.
10085 Now those locks are only held for fg_threads and for bg_as_a_thread.
10088 - tested the cancel() function.
10089 - asynclook -c (cancel) feature.
10090 - fix fail to allocate context actions.
10091 - make pipe nonblocking at start.
10092 - update plane for retry mode with caution to limit bandwidth.
10093 - fix Makefile for concurrent make of unbound-host.
10094 - renamed ub_val_ctx_wait/poll/process/fd to ub_val*.
10095 - new calls to set forwarding added to header and docs.
10098 - removed debug prints from if-auto, verb-algo enables some.
10102 thread that does process() ).
10105 - library code for async in libunbound/unbound.c.
10106 - fix link testbound.
10107 - fixup exit bug in mini_event.
10108 - background worker query enter and result functions.
10110 hostaddresses (A records) at the same time.
10113 - libworker work, netevent raw commpoints, write_msg, serialize.
10116 - touch up of manpage for libunbound.
10117 - support for IP_RECVDSTADDR (for *BSD ip4).
10119 ip6 and once ip4, uses socket options.
10120 - goodbye ip4to6 mapping.
10121 - update ldns-testpkts with latest version from ldns-trunk.
10122 - updated makedist for relative ldns pathnames.
10123 - library API with more information inside the result structure.
10124 - work on background resolves.
10127 - fixup configure in case -lldns is installed.
10128 - fixup a couple of doxygen warnings, about enum variables.
10130 PKT_INFO structure as well.
10131 - manual page with library API, all on one page 'man libunbound'.
10132 - rewrite of PKTINFO structure, it also captures IP4 PKTINFO.
10135 - incoming queries to the server with TC bit on are replied FORMERR.
10137 queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying
10138 to use ifnum=-1 to mean 'no interface, use kernel route'.
10141 - interface-automatic feature. experimental. Nice for anycast.
10142 - tpkg test for ip6 ancillary data.
10143 - removed debug prints.
10145 compatibility. The feature probably will not work on OpenBSD.
10146 - makedist fixup for ldns-src in build-dir.
10149 - in no debug sets NDEBUG to remove asserts.
10151 for assertions and for compiler warnings.
10152 - ldns.tgz updated with ldns-trunk (where buffer.h is updated).
10153 - fix lint, unit test in optimize mode.
10154 - default access control allows ::ffff:127.0.0.1 v6mapped localhost.
10157 - man page, warning removed.
10158 - added text describing the use of stub zones for private zones.
10160 interface lines.
10161 - memory sizes can be given with 'k', 'Kb', or M or G appended.
10164 - typo in example.conf.
10166 by linking with .lo instead of .o files in the ldns package.
10167 - nicer do-ip6: yes/no documentation.
10168 - nicer linking of libevent .o files.
10169 - man pages render correctly on solaris.
10173 give entropy, and the rng needs to be seeded.
10176 - print median and quartiles with extensive logging.
10179 - document misconfiguration in private network.
10182 - fixup typo in requirements.
10184 the access control list, as refused will stop retries.
10187 - unbound-host has a -d option to show what happens. This can help
10188 with debugging (why do I get this answer).
10189 - fixup CNAME handling, on nodata, sets and display canonname.
10190 - dot removed from CNAME display.
10191 - respect -v for NXDOMAINs.
10192 - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes).
10193 - size_t to int for portability of the header file.
10194 - fixup bogus handling.
10195 - dependencies and lint for unbound-host.
10199 receives data.
10200 - unbound-host prints rdata using ldns.
10202 information when you give -v.
10205 - locking in context_new() inside the function.
10206 - setup of libworker.
10209 - minor Makefile fixup.
10211 preparing for code-reuse.
10212 - move context into own header file.
10213 - context query structure.
10214 - removed unused variable pwd from checkconf.
10215 - removed unused assignment from outside netw.
10216 - check timeval length of string.
10217 - fixup error in val_utils getsigner.
10218 - fixup same (*var) error in netblocktostr.
10219 - fixup memleak on parse error in localzone.
10220 - fixup memleak on packet parse error.
10221 - put ; after union in parser.y.
10222 - small hardening in iter_operate against iq==NULL.
10223 - hardening, if error reply with rcode=0 (noerror) send servfail.
10224 - fixup same (*var) error in find_rrset in msgparse, was harmless.
10225 - check return value of evtimer_add().
10227 entries one at a time. Instead they are removed and unlocked.
10228 - fptr_wlist for markdelfunc.
10229 - removed is_locked param from lruhash delkeyfunc.
10230 - moved bin_unlock during bin_split purely to please.
10233 - changed checkconf/ to smallapp/ to make room for more support tools.
10234 (such as unbound-host).
10235 - install dirs created with -m 755 because they need to be accessible.
10236 - library extensive featurelist added to TODO.
10237 - please doxygen, lint.
10238 - library test application, with basic functionality.
10239 - fix for building in a subdirectory.
10240 - link lib fix for Leopard.
10243 - makefile that creates libunbound.la, basic file or libunbound.a
10244 when creating static executables (no libtool).
10245 - more API setup.
10248 - 0.9 public API start.
10252 has been chosen for authoritative features.
10254 to specify TXT records in local data.
10255 - fixup small memory problem in implicit transparent zone creation.
10256 - test for implicit zone creation and multiple RR RRsets local data.
10257 - local-zone nodefault test.
10258 - show testbound testlist on commit.
10260 the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial
10261 domain exists).
10262 - nicer verbosity: 0 and 1 levels.
10264 requiring message from the cache.
10268 and NS record is needed to be a referral.
10269 - duplicate checking when adding NSECs for a CNAME, and test.
10270 - created svn tag 0.8, after completing testbed tests.
10273 - per suggestion in rfc2308, replaced default max-ttl value with 1 day.
10276 a call to malloc when a message is parsed.
10277 - update of memstats tool to print number of allocation calls.
10279 of the allocations as well. region_alloc stat is removed.
10282 - noted EDNS in-the-middle dropping trouble as a TODO.
10283 At this point theoretical, no user trouble has been reported.
10284 - added all default AS112 zones.
10285 - answers from local zone content.
10287 * nodata answer (exist, but not that type).
10288 * nxdomain answer (domain does not exist).
10289 * empty-nonterminal answer.
10291 or additional section processing, NS put in auth.
10293 of important defaults (localhost, as112, reverses).
10294 Also checks deny and refuse settings.
10295 - fixup implicit zone generation and AA bit for NXDOMAIN on localdata.
10298 - local zone internal data setup.
10301 - 0.8 - str2list config support for double string config options.
10302 - local-zone and local-data options, config storage and documentation.
10305 - do not downcase NSEC and RRSIG for verification. Follows
10306 draft-ietf-dnsext-dnssec-bis-updates-06.txt.
10307 - fixup leaking unbound daemons at end of tests.
10308 - README file updated.
10309 - nice libevent not found error.
10310 - README talks about gnu make.
10311 - 0.8: unit test for addr_mask and fixups for it.
10312 and unit test for addr_in_common().
10313 - 0.8: access-control config file element.
10314 and unit test rpl replay file.
10315 - 0.8: fixup address reporting from netevent.
10318 - privilege separation is not needed in unbound at this time.
10319 TODO item marked as such.
10320 - created beta-0.7 branch for support.
10321 - tagged 0.7 for beta release.
10322 - moved trunk to 0.8 for 0.8(auth features) development.
10323 - 0.8: access control list setup.
10326 - review fixups from Jelte.
10329 - testbed script does not recreate configure, since its in svn now.
10331 /etc/unbound/unbound.conf.
10332 - tag 0.6.
10335 - remove debug print.
10336 - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists.
10340 arrives later on.
10341 - bugreports to unbound-bugs@nlnetlabs.nl
10342 - fixup testbound so it exits cleanly.
10343 - cleanup the caches on a reload, so that rrsetID numbers won't clash.
10346 - took ldns snapshot in repo.
10347 - default config file is /etc/unbound/unbound.conf.
10348 If it doesn't exist, it is installed with the doc/example.conf file.
10349 The file is not deleted on uninstall.
10350 - default listening is not all, but localhost interfaces.
10353 - Fixup chroot and drop user privileges.
10354 - new L root ip address in default hints.
10358 dealloc during deinit.
10359 - Fixup of chroot call. Happens after privileges are dropped, so
10360 that checking the passwd entry still works.
10361 - minor touch up of clear() hashtable function.
10362 - VERB_DETAIL prints out what chdir, username, chroot is being done.
10363 - when id numbers run out, caches are cleared, as in design notes.
10364 Tested with a mock setup with very few bits in id, it worked.
10365 - harden-dnssec-stripped: yes is now default. It insists on dnssec
10366 data for trust anchors. Included tests for the feature.
10369 - cache-max-ttl config option.
10370 - building outside sourcedir works again.
10374 The operator can override them to be less secure ("") if necessary.
10376 sort per reference key pointer, not on referencepointer itself.
10377 - pidfile: "/etc/unbound/unbound.pid" is now the default.
10378 - tests changed to reflect the updated default.
10379 - created hashtable clear() function that respects locks.
10383 smaller than uncompressed names. A packet from comrite.com was seen
10384 to be compressed to a larger size. Added it as unit test.
10385 - quieter logging at low verbosity level for common tcp messages.
10386 - no greedy TTL update.
10389 - fixup (grand-)parent problem for dnssec-lameness detection.
10391 since the detection needs that.
10392 - no longer trust in query section in reply during dnssec lame detect.
10394 non-preferred. If no other servers exist or answer, the dnssec lame
10395 server is used; the fastest dnssec lame server is chosen.
10397 insecure mode from unbound works.
10398 - Fixup max queries per thread, any more are dropped.
10401 - added donotquerylocalhost config option. Can be turned off for
10402 out test cases.
10403 - ISO C compat changes.
10404 - detect RA-no-AA lameness, as LAME.
10405 - DNSSEC-lameness detection, as LAME.
10406 See notes in requirements.txt for choices made.
10407 - tests for lameness detection.
10408 - added all to make test target; need unbound for fwd tests.
10409 - testbound does not pollute /etc/unbound.
10413 to use. ./configure, config.guess, config.sub, ltmain.sh,
10414 and config.h.in.
10415 - added yacc/lex generated files, util/configlexer.c,
10416 util/configparser.c util/configparser.h, to svn.
10417 - without lex no attempt to use it.
10418 - unsecure response validation collated into one block.
10419 - remove warning about const cast of cfgfile name.
10420 - outgoing-interfaces can be different from service interfaces.
10423 make arguments from the unbound make invocation.
10424 - nicer error when libevent problem causes instant exit on signal.
10425 - read root hints from a root hint file (like BIND does).
10428 - addresses are logged with errors.
10430 since the callback may create new pending items.
10431 - tests updated because retries are now in iterator module.
10433 and ldns by makedist.sh.
10435 no ldns is installed on the system.
10436 make download_ldns refreshes the tarball with ldns svn trunk.
10437 - ldns-src.tar.gz is used if no ldns is found on the system, and
10438 statically linked into unbound.
10439 - start of regional allocator code.
10440 - regional uses less memory and variables, simplified code.
10441 - remove of region-allocator.
10443 up to a maximum.
10444 - make unit test cleanly free memory.
10447 - fixup another cycle detect and ns-addr timeout resolution bug.
10449 when resolving a mandatory-glue nameserver-address for that zone.
10451 the TLD server for this name. And this resolves a lot of cases where
10452 the other nameserver names lead to cycles or are not available.
10454 for thread safety. The random generator is initialised with
10455 entropy from the system.
10457 in the log message.
10458 - removed some debug prints, only verb_algo (4) enables them.
10460 where no scripted answer was available.
10461 - mark insecure RRs as insecure.
10462 - fixup removal of nonsecure items from the additional.
10464 90% of roundtrip times, 512 msec has 99% of roundtrip times.)
10465 - server selection failover to next server after timeout (376 msec).
10468 - no malloc in log_hex.
10469 - assertions around system calls.
10470 - protect against gethostname without ending zero.
10471 - ntop output is null terminated by unbound.
10473 - various snprintf use sizeof(stringbuf) instead of fixed constant.
10475 weird negative input and particular interpretation of integer math.
10476 - dname_pkt_copy checks length of result, to protect result buffers.
10477 prints an error, this should not happen. Bad strings should have
10478 been rejected earlier in the program.
10479 - remove a size_t underflow from msgreply size func.
10482 - nicer warning.
10483 - fix IP6 TCP, wrong definition check. With test package.
10485 the code was there but was called by value instead of by reference.
10486 And test for the case, uses xxd and nc.
10487 - more portable ip6 check for sockaddr types.
10491 several dynamic lib dirs.
10494 - fixup tests for no AD bit in non-DO queries.
10495 - test that makes sure AD bit is not set on non-DO query.
10498 - removed logfile open early. It did not have the proper permissions;
10499 it was opened as root instead of the user. And we cannot change user
10500 id yet, since chroot and bind ports need to be done.
10501 - callback checks for event callbacks done from mini_event. Because
10502 of deletions cannot do this from netevent. This means when using
10503 libevent the protection does not work on event-callbacks.
10504 - fixup too small reply (did not zero counts).
10505 - fixup reply no longer AD bit when query without DO bit.
10508 - function pointer whitelist.
10511 - overwrite sensitive random seed value after use.
10512 - switch to logfile very soon if not -d (console attached).
10513 - error messages do not reveal the trustanchor contents.
10514 - start work on function pointer whitelists.
10518 chain of trust.
10519 - mesh checks if modules are looping, and stops them.
10520 - refetch with CNAMEd nameserver address regression test added.
10522 number with parse errors.
10523 - unit test for multiple ENT case.
10524 - fix for cname out of validated unsec zone.
10525 - fixup nasty id=0 reuse. Also added assertions to detect its
10526 return (the assertion catches in the existing test cases).
10529 - skip F77, CXX, objC tests in configure step.
10530 - fixup crash in refetch glue after a CNAME.
10531 and protection against similar failures (with error print).
10535 interface: statements.
10538 - SIGHUP will reopen the log file.
10539 - Option to log to syslog.
10540 - please lint, fixup tests (that went to syslog on open, oops).
10541 - config check program.
10544 - tests for NSEC3. Fixup bitmap checks for NSEC3.
10546 check that original data did not exist.
10547 - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure
10548 delegation, for abuse of child zone apex nsec3.
10549 - create 0.5 release tag.
10552 - do not make test programs by default.
10553 - But 'make test' will perform all of the tests.
10555 is found.
10556 - signit can generate NSEC3 hashes, for generating tests.
10557 - multiple nsec3 parameters in message test.
10558 - too high nsec3 iterations becomes insecure test.
10561 - fixup empty_DS_name allocated in wrong region (port DEC Alpha).
10562 - fixup testcode lock safety (port FreeBSD).
10563 - removes subscript has type char warnings (port Solaris 9).
10564 - fixup of field with format type to int (port MacOS/X intel).
10565 - added test for infinite loop case in nonRD answer validation.
10566 It was a more general problem, but hard to reproduce. When an
10569 proof is possible - the signature has been stripped off.
10572 - fixup and test for NSEC wildcard with empty nonterminals.
10573 - makedist.sh fixup for svn info.
10574 - acl features request in plan.
10575 - improved DS empty nonterminal handling.
10576 - compat with ANS nxdomain for empty nonterminals. Attempts the nodata
10577 proof anyway, which succeeds in ANS failure case.
10578 - striplab protection in case it becomes -1.
10579 - plans for static and blacklist config.
10582 - comments about non-packed usage.
10583 - plan for overload support in 0.6.
10585 and for failed prime when missing glue.
10587 cache. Also the safety belt is used if priming fails to complete.
10588 - fixup NSEC rdata not to be lowercased, bind compat.
10591 - wildcard nsec3 testcases, and fixup to get correct wildcard name.
10592 - validator prints subtype classification for debug.
10595 - NSEC3 hash cache unit test.
10596 - validator nsec3 nameerror test.
10599 - nsec3 nodata proof, nods proof, wildcard proof.
10600 - nsec3 support for cname chain ending in noerror or nodata.
10601 - validator calls nsec3 proof routines if no NSECs prove anything.
10603 the wrong qname into the cache. When prepending the cnames, the
10604 qname has to be reset to the original qname.
10607 - nsec3 find matching and covering, ce proof, prove namerror msg.
10610 - fixup of manual page warnings, like for NSD bugreport.
10611 - nsec3 work, config, max iterations, filter, and hash cache.
10614 - fixup to find libevent on mac port install.
10615 - fixup size_t vs unsigned portability in validator/sigcrypt.
10616 - please compiler on different platforms, for unreachable code.
10617 - val_nsec3 file.
10618 - pthread_rwlock type is optional, in case of old pthread libs.
10621 - cname, name error validator tests.
10622 - logging of qtype ANY works.
10624 in other sections, unless DO bit is on).
10625 - testbound can replay a TCP query (set MATCH TCP in the QUERY).
10626 - DS and noDS referral validation test.
10628 securely deny existence of child trust anchors, if validated.
10629 - not all *.name NSECs are present because a wildcard was matched,
10630 and *.name NSECs can prove nodata for empty nonterminals.
10633 for a nodata proof.
10634 - configure option for memory allocation debugging.
10635 - port configure option for memory allocation to solaris10.
10639 callbacks for the same query from the same server.
10640 - testbound removes config file from /tmp on failed exit.
10641 - fixup for referral cleanup of the additional section.
10642 - tests for cname, referral validation.
10643 - neater testbound tpkg output.
10644 - DNAMEs no longer match their apex when synthesized from the cache.
10645 - find correct signer name for DNAME responses.
10646 - wildcarded DNAME test and fixup code to detect.
10647 - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs.
10648 So that wildcarded CNAMEs get their NSEC with them to the answer.
10651 CNAME'd messages.
10655 validator. CNAME to a NXDOMAIN response was collated into a response
10656 with both a CNAME and the NXDOMAIN rcode. Added a test that the
10657 rcode is changed to NOERROR (because of the CNAME).
10658 - timeout on tcp does not lead to spurious leakage detect.
10660 not show lame cache growth as a leakage growth.
10662 number of entries.
10663 - tool too summarize allocations per code line.
10666 - can read bind trusted-keys { ... }; files, in a compatibility mode.
10667 - iterator should not detach target queries that it still could need.
10669 current_query num check.
10670 - validator nodata, positive, referral tests.
10671 - dname print can print '*' wildcard.
10674 - fixup override date config option.
10675 - config options to control memory usage.
10676 - caught bad free of un-alloced data in worker_send error case.
10677 - memory accounting for key cache (trust anchors and temporary cache).
10678 - memory accounting fixup for outside network tcp pending waits.
10679 - memory accounting fixup for outside network tcp callbacks.
10680 - memory accounting for iterator fixed storage.
10681 - key cache size and slabs config options.
10682 - lib crypto cleanups at exit.
10685 - test tool to sign rrsets for testing validator with.
10686 - added RSA and DSA test keys, public and private pairs, 512 bits.
10687 - default configuration is with validation enabled.
10688 Only a trust-anchor needs to be configured for DNSSEC to work.
10689 - do not convert to DER for DSA signature verification.
10691 positive response.
10695 instead performs a malloc to do the backup.
10697 and stores the rrsets in the cache. Further referral (nonRD queries)
10698 replies are made from the rrset cache directly. Unless unchecked
10699 rrsets are encountered, there are then validated.
10700 - enforce that signing is done by a parent domain (or same domain).
10701 - adjust TTL downwards if rrset TTL bigger than signature allows.
10703 not give servfail (bogus is changed into indeterminate).
10704 - optimization of rrset verification. rr canonical sorting is reused,
10705 for the same rrset. canonical rrset image in buffer is reused for
10706 the same signature.
10708 canonicalization routine will fail if it does not fit in buffer.
10709 - faster verification for large sigsets.
10711 algorithm for validation. Key prime failures are reported as
10712 verb_ops level.
10715 - do not garble the edns if a cache answer fails.
10716 - answer norecursive from cache if possible.
10718 referrals.
10719 - do not store referral in msg cache for nonRD queries.
10721 verification.
10722 - mark rrsets indeterminate and insecure if they are found to be so.
10723 and store this in the cache.
10726 - message is bogus if unsecure authority rrsets are present.
10727 - val-clean-additional option, so you can turn it off.
10729 routine. This makes the proof routines prettier.
10731 nodata work.
10733 the rrset is from the additional section. Signatures may have
10734 fallen off the packet, and cause validation failure.
10735 - more verbose signature date errors (with the date attached).
10736 - increased default infrastructure cache size. It is important for
10738 size). To 10000 entries (for 2M entries, 4M cache size).
10741 - CNAME handling - move needs_validation to before val_new().
10742 val_new() setups the chase-reply to be an edited copy of the msg.
10743 new classification, and find signer can find for it.
10745 cname.
10746 - refuse to follow wildcarded DNAMEs when validating.
10747 But you can query for qtype ANY, or qtype DNAME and validate that.
10750 - bogus TTL.
10751 - review - use val_error().
10754 - ANY response validation.
10755 - store security status in cache.
10757 validated, return the query to client, or send servfail to client.
10758 Sets AD bit on validated replies.
10759 - do not examine security status on an error reply in mesh_done.
10760 - construct DS, DNSKEY messages from rrset cache.
10761 - manual page entry for override-date.
10764 - validate and positive validation, positive wildcard NSEC validation.
10765 - nodata validation, nxdomain validation.
10768 - process DNSKEY response in FINDKEY state.
10771 - work on DS2KE routine.
10772 - val_nsec.c for validator NSEC proofs.
10773 - unit test for NSEC bitmap reading.
10774 - dname iswild and canonical_compare with unit tests.
10777 - DS sig unit test.
10778 - latest release libevent 1.3c and 1.3d have threading fixed.
10779 - key entry fixup data pointer and ttl absolute.
10781 trust-anchor.
10782 - fixup canonical compare byfield routine, fix bug and also neater.
10784 ANY and NS.
10786 removes the NS section duplicate. dig NS gives sometimes the NS
10787 in the answer section, as referral.
10788 - validator FINDKEY state.
10791 - crypto calls to verify signatures.
10792 - unit test for rrsig verification.
10795 - default outgoing ports changed to avoid port 2049 by default.
10796 This port is widely blocked by firewalls.
10797 - count infra lameness cache in memory size.
10799 - outbound entries are allocated in the query region they are for.
10800 - extensive debugging for memory allocations.
10801 - --enable-lock-checks can be used to enable lock checking.
10802 - protect undefs in config.h from autoheaders ministrations.
10803 - print all received udp packets. log hex will print on multiple
10804 lines if needed.
10805 - fixed error in parser with backwards rrsig references.
10807 its task.
10811 mess up the dependencies.
10812 - canonical compare routine updated.
10813 - canonical hinfo compare.
10814 - printout list of the queries that the mesh is working on.
10817 - malloc and free overrides that track total allocation and frees.
10818 for memory debugging.
10819 - work on canonical sort.
10823 - dname signature label count and unit test.
10824 - added debug heap size print to memory printout.
10825 - typo fixup in worker.c
10826 - -R needed on solaris.
10827 - validator override option for date check testing.
10830 - ldns _raw routines created (in ldns trunk).
10832 - val_utils uses sigcrypt to perform signature cryptography.
10836 - security status type.
10837 - security status is copied when rdata is equal for rrsets.
10839 that refer to NSEC, NSEC3, DNAME rrsets that have changed.
10841 - val_sigcrypt file for validator signature checks.
10844 - key cache for validator.
10845 - moved isroot and dellabel to own dname routines, with unit test.
10848 - replanning.
10849 - scrubber check section of lame NS set.
10851 DS and DNSKEY entries.
10852 - unit test trust anchor storage.
10853 - trust anchors converted to packed rrsets.
10854 - key entry definition.
10857 - configure change for latest libevent trunk version (needs -lrt).
10858 - query_done and walk_supers are moved out of module interface.
10859 - fixup delegation point duplicates.
10861 so that the classification is lame.
10863 with calling of next module and return.
10864 - validator work.
10868 - module work for module to module interconnections.
10869 - config of modules.
10870 - detect cycle takes flags.
10874 - release 0.4 tag.
10878 cancelled out by sequential thread-ids in the random number seed.
10882 it would hit that timeout and fail the test. Changed so that unbound
10883 is kept waiting for 2 seconds instead.
10886 - removed useless -C debug option. It did not work.
10887 - text edit of documentation.
10888 - added doc/CREDITS file, referred to by the manpages.
10889 - updated planning.
10892 - cycle detection, for query state dependencies. Will attempt to
10893 circumvent the cycle, but if no other targets available fails.
10894 - unit test for AXFR, IXFR response.
10895 - test for cycle detection.
10898 - testbound read ADDRESS and check it.
10899 - test for version.bind and friends.
10900 - test for iterator chaining through several referrals.
10901 - test and fixup for refetch for glue. Refetch fails if glue
10902 is still not provided.
10905 - Example section in config manual.
10906 - Addr stored for range and moment in replay.
10909 - Check CNAME chain before returning cache entry with CNAMEs.
10910 - Option harden-glue, default is on. It will discard out of zone
10911 data. If disabled, performance is faster, but spoofing attempts
10912 become a possibility. Note that still normalize scrubbing is done,
10914 and not returned to the client.
10915 - if glue times out, refetch by asking parent of delegation again.
10916 Much like asking for DS at the parent side.
10917 - TODO items from forgery-resilience draft.
10918 and on memory handling improvements.
10919 - renamed module_event_timeout to module_event_noreply.
10921 a network packet (not on cache replies).
10924 - shuffle NS selection when getting nameserver target addresses.
10926 freebsd scheduler selects correct process to run.
10927 - added identity and version config options and replies.
10928 - store cname messages complete answers.
10931 - do not query addresses, 127.0.0.1, and ::1 by default.
10934 - forward zone options in config file.
10935 - forward per zone in iterator. takes precedence over stubs.
10936 - fixup commithooks.
10938 new forward zones.
10939 - fix parser to handle absent server: clause.
10941 applied during the test (which removes the poison, by the way).
10942 - feature, addresses can be specified with @portnumber, like nsd.conf.
10943 - test config files changed over to new forwarder syntax.
10946 - delete of mesh does a postorder traverse of the tree.
10947 - found and fixed a memory leak. For TTL=0 messages, that would
10948 not be cached, instead the msg-replyinfo structure was leaked.
10950 unresponsive. This is defined as a host with the maximum rto value.
10951 This means that unbound tried the host for retries up to 120 secs.
10952 The rto value will time out after host-ttl seconds from the cache.
10953 This keeps such unresolvable queries from taking up resources.
10954 - utility for keeping histogram.
10957 - mesh is called by worker, and iterator uses it.
10958 This removes the hierarchical code.
10959 QueryTargets state and Finished state are merged for iterator.
10960 - forwarder mode no longer sets AA bit on first reply.
10961 - rcode in walk_supers is not needed.
10964 - more mesh work.
10965 - error encode routine for ease.
10968 - removed unused _node iterator value from rbtree_t. Takes up space.
10970 set, so that a priming(stub) subquery error can be handled.
10971 - iterator stores if it is priming or not.
10972 - log_query_info() neater logging.
10973 - changed iterator so that it does not alter module_qstate.qinfo
10974 but keeps a chase query info. Also query_flags are not altered,
10975 the iterator uses chase_flags.
10976 - fixup crash in case no ports for the family exist.
10979 - Fixup secondary buffer in case of error callback.
10980 - cleanup slumber list of runnable states.
10981 - module_subreq_depth fails to work in slumber list.
10982 - fixup query release for cached results to sub targets.
10983 - neater error for tcp connection failure, shows addr in verbose.
10984 - rbtree_init so that it can be used with preallocated memory.
10987 - new -C option to enable coredumps after forking away.
10988 - doc update.
10989 - fixup CNAME generation by scrubber, and memory allocation of it.
10990 - fixup deletion of serviced queries when all callbacks delete too.
10991 - set num target queries to 0 when you move them to slumber list.
10992 - typo in check caused subquery errors to be ignored, fixed.
10993 - make lint happy about rlim_t.
10994 - freeup of modules after freeup of module-states.
10995 - duplicate replies work, this uses secondary udp buffer in outnet.
10998 - nicer layout in stats.c, review 0.3 change.
10999 - spelling improvement, review 0.3 change.
11001 servers will stand out from the rest.
11002 - target-fetch-policy: "3 2 1 0 0" config setting.
11003 - fixup queries answered without RD bit (for root prime results).
11004 - refuse AXFR and IXFR requests.
11005 - fixup RD flag in error reply from iterator. fixup RA flag from
11006 worker error reply.
11007 - fixup encoding of very short edns buffer sizes, now sets TC bit.
11008 - config options harden-short-bufsize and harden-large-queries.
11011 - same, move subqueries to slumber list when first has resolved.
11012 - fixup last fix for duplicate callbacks.
11013 - another offbyone in targetcounter. Also in Java prototype by the way.
11017 multiple times, this will succeed. Only one callback will happen;
11019 will not matter).
11021 the subqueries (for other targets). These are put on the slumber
11022 list.
11024 stopped, with an error, and it is still waiting for other ones.
11025 - if a query loops, halt entire query (easy way to clean up properly).
11029 policy of 0 did nothing.
11033 ldns and libevent are linked statically. Default is off.
11034 - make install and make uninstall. Works with static-exe and without.
11035 installation of unbound binary and manual pages.
11036 - alignment problem fix on solaris 64.
11037 - fixup address in case of TCP error.
11040 - num target queries was set to 0 at a bad time. Default it to 0 and
11041 increase as target queries are done.
11042 - synthesize CNAME and DNAME responses from the cache.
11043 - Updated doxygen config for doxygen 1.5.
11044 - aclocal newer version.
11045 - doxygen 1.5 fixes for comments (for the strict check on docs).
11050 a TCP fallback has occured.
11053 'unknown type' in the answer section).
11055 in the signature list over the rrsig type.
11059 for outbound list of serviced queries for iterator module.
11060 - nicer printout of outgoing port selection.
11061 - fixup cname target readout.
11062 - nicer debug output.
11063 - fixup rrset counts when prepending CNAMEs to the answer.
11064 - fixup rrset TTL for prepended CNAMEs.
11066 run next.
11067 - subreq insertion code fixup for slumber list.
11068 - VERB_DETAIL, verbosity: 2 level gives short but readable output.
11069 VERB_ALGO, verbosity: 3 gives extensive output.
11070 - fixup RA bit in cached replies.
11071 - fixup CNAME responses from the cache no longer partial response.
11072 - error in network send handled without leakage.
11074 if ip6 is not connected, skips to next server.
11077 - iterator state finished.
11078 - subrequests without parent store in cache and stop.
11079 - worker slumber list for ongoing promiscuous queries.
11080 - subrequest error handling.
11081 - priming failure returns SERVFAIL.
11082 - priming gives LAME result, returns SERVFAIL.
11083 - debug routine to print dns_msg as handled by iterator.
11084 - memleak in config file stubs fixup.
11086 in dname validation for NS targets.
11087 - sets entry.key for new special allocs.
11088 - lognametypeclass can display unknown types and classes.
11091 - random selection of equally preferred nameserver targets.
11092 - reply info copy routine. Reuses existing code.
11093 - cache lameness in response handling.
11095 been deleted by that routine.
11096 - Prime response state.
11097 - Process target response state.
11098 - some memcmp changed to dname_compare for case preservation.
11101 - normalize incoming messages. Like unbound-java, with CNAME chain
11102 checked, DNAME checked, CNAME's synthesized, glue checked.
11103 - sanitize incoming messages.
11104 - split msgreply encode functions into own file msgencode.c.
11105 - msg_parse to queryinfo/replyinfo conversion more versatile.
11106 - process_response, classify response, delegpt_from_message.
11109 - querytargets state.
11110 - dname_subdomain_c() routine.
11111 - server selection, based on RTT. ip6 is filtered out if not available,
11112 and lameness is checked too.
11113 - delegation point copy routine.
11116 - removed FLAG_CD from message and rrset caches. This was useful for
11118 rrset enabled) cache.
11119 - iterator response typing.
11120 - iterator cname handle.
11121 - iterator prime start.
11122 - subquery work.
11123 - processInitRequest and processInitRequest2.
11124 - cache synthesizes referral messages, with DS and NSEC.
11125 - processInitRequest3.
11126 - if a request creates multiple subrequests these are all activated.
11129 - routines to lock and unlock array of rrsets moved to cache/rrset.
11130 - lookup message from msg cache (and copy to region).
11131 - fixed cast error in dns msg lookup.
11132 - message with duplicate rrset does not increase its TTLs twice.
11133 - 'qnamesize' changed to 'qname_len' for similar naming scheme.
11136 - Acknowledge use of unbound-java code in iterator. Nicer readme.
11137 - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and
11138 rrset cache from module environment.
11140 members. They are still kept in network format for fast msg encode.
11141 - dns cache find_delegation routine.
11142 - iterator main functions setup.
11143 - dns cache lookup setup.
11146 - small changes to prepare for subqueries.
11147 - iterator forwarder feature separated out.
11149 testing can proceed locally.
11150 - replay tests now have config option to enable forwarding mode.
11154 and for setting timeout for UDP. Pending_udp takes milliseconds.
11155 - cleaner iterator sockaddr conversion of forwarder address.
11156 - iterator/iter_utils and iter_delegpt setup.
11157 - root hints.
11161 outbound entry to the module.
11162 - testbound support for new serviced queries.
11163 - test for retry to TCP cannot use testbound any longer.
11164 - testns test for EDNS fallback, test for TCP fallback already exists.
11165 - fixes for no-locking compile.
11167 timeout callback. Fix for fwd_three tests, performed nonexit query.
11170 - small comment on hash table locking.
11172 and udp retries and rtt timing.
11175 - lruhash_touch() would cause locking order problems. Fixup in
11176 lock-verify in case locking cycle is found.
11177 - services/cache/rrset.c for rrset cache code.
11178 - special rrset_cache LRU updating function that uses the rrset id.
11179 - no dependencies calculation when make clean is called.
11180 - config settings for infra cache.
11181 - daemon code slightly cleaner, only creates caches once.
11184 - host cache code.
11185 - unit test for host cache.
11188 - Port to OS/X and Dec Alpha. Printf format and alignment fixes.
11189 - extensive lock debug report on join timeout.
11190 - proper RTT calculation, in utility code.
11191 - setup of services/cache/infra, host cache.
11194 - iterator/iterator.c module.
11195 - fixup to pass reply_info in testcode and in netevent.
11198 - created release-0.3 svn tag.
11199 - util/module.h
11200 - fixed compression - no longer compresses root name.
11203 - outside network cleans up waiting tcp queries on exit.
11204 - fallback to TCP.
11205 - testbound replay with retry in TCP mode.
11206 - tpkg test for retry in TCP mode, against ldns-testns server.
11207 - daemon checks max number of open files and complains if not enough.
11208 - test where data expires in the cache.
11209 - compiletests: fixed empty body ifstatements in alloc.c, in case
11210 locks are disabled.
11214 tcp queries.
11215 - outgoing-num-tcp config option.
11216 - outgoing network keeps waiting list of queries waiting for buffer.
11217 - netevent supports outgoing tcp commpoints, nonblocking connects.
11220 - EDNS read from query, used to make reply smaller.
11221 - advertised edns value constants.
11222 - EDNS BADVERS response, if asked for too high edns version.
11224 has successfully been parsed.
11227 - msgreply sizefunc is more accurate.
11228 - config settings for rrset cache size and slabs.
11230 alloc cache to store released keys.
11231 - alloc cache special_release() locks if necessary.
11232 - rrset trustworthiness type added.
11233 - thread keeps a scratchpad region for handling messages.
11234 - writev used in netevent to write tcp length and data after another.
11235 This saves a roundtrip on tcp replies.
11236 - test for one rrset updated in the cache.
11238 trustworthy enough.
11239 - test for TTL refreshed in rrset.
11242 - fill refs. Use new parse and encode to answer queries.
11243 - stores rrsets in cache.
11244 - uses new msgreply format in cache.
11247 - dname unit tests in own file and spread out neatly in functions.
11248 - more dname unit tests.
11250 not fit, and will leave out (whole)rrsets from additional if needed.
11253 - decompress query section, extremely lenient acceptance.
11254 But only for answers from other servers, not for plain queries.
11255 - compression and decompression test cases.
11256 - some stats added.
11257 - example.conf interface: line is changed from 127.0.0.1 which leads
11259 to a documentation and test address.
11262 - removed iov usage, it is not good for dns message encoding.
11263 - owner name compression more optimal.
11264 - rrsig owner name compression.
11265 - rdata domain name compression.
11268 - floating point exception fix in lock-verify.
11270 - fixup lint in dname owner domain name compression code.
11271 - define for offset range that can be compressed to.
11274 - prettier code; parse_rrset->type kept in host byte order.
11275 - datatype used for hashvalue of converted rrsig structure.
11276 - unit test compares edns section data too.
11279 - ttl per RR, for RRSIG rrsets and others.
11280 - dname_print debug function.
11281 - if type is not known, size calc will skip DNAME decompression.
11282 - RRSIG parsing and storing and putting in messages.
11283 - dnssec enabled unit tests (from nlnetlabs.nl and se queries).
11284 - EDNS extraction routine.
11287 - code comes through all of the unit tests now.
11288 - disabled warning about spurious extra data.
11289 - documented the RRSIG parse plan in msgparse.h.
11290 - rrsig reading and outputting.
11293 - fix unit test to actually to tests.
11294 - fix write iov helper, and fakevent code.
11295 - extra builtin testcase (small packet).
11296 - ttl converted to network format in packets.
11298 - rdatalen off by 2 error fixup.
11299 - uses less iov space for header.
11302 - review of msgparse code.
11303 - smaller test cases.
11306 - copy and decompress dnames.
11307 - store calculated hash value too.
11308 - routine to create message out of stored information.
11309 - util/data/msgparse.c for message parsing code.
11310 - unit test, and first fixes because of test.
11311 * forgot rrset_count addition.
11312 * did & of ptr on stack for memory position calculation.
11313 * dname_pkt_copy forgot to read next label length.
11315 * double frees fixed in error conditions.
11316 * types with less than full rdata allowed by parser.
11317 Some dynamic update packets seem to use it.
11321 memory size to allocate for rrs.
11322 - code to handle ID creation.
11325 - parse routines. Code that parses rrsets, rrs.
11328 - dname compare routine that preserves case, with unit tests.
11332 start of sectionparse.
11335 - Improved alignment of reply_info packet, nice for 32 and 64 bit.
11337 due to RRset updates.
11338 - import of region-allocator code from nsd.
11339 - set alloc special type to ub_packed_rrset_key.
11340 Uses lruhash entry overflow chain next pointer in alloc cache.
11341 - doxygen documentation for region-allocator.
11342 - setup for parse scratch data.
11345 - discussed packed rrset with Jelte.
11348 - moved to version 0.3.
11349 - added util/data/dname.c
11350 - layout of memory for rrsets.
11353 - detect sign of msghdr.msg_iovlen so that the cast to that type
11354 in netevent (which is there to please lint) can be correct.
11355 The type on several OSes ranges from int, int32, uint32, size_t.
11356 Detects unsigned or signed using math trick.
11357 - constants for DNS flags.
11358 - compilation without locks fixup.
11359 - removed include of unportable header from lookup3.c.
11360 - more portable use of struct msghdr.
11361 - casts for printf warning portability.
11362 - tweaks to tests to port them to the testbed.
11363 - 0.2 tag created.
11366 - check sizes of udp received messages, not too short.
11367 - review changes. Some memmoves can be memcpys: 4byte aligned.
11368 set id correctly on cached answers.
11369 - review changes msgreply.c, memleak on error condition. AA flag
11370 clear on cached reply. Lowercase queries on hashing.
11371 unit test on lowercasing. Test AA bit not set on cached reply.
11372 Note that no TTLs are managed.
11375 - writev or sendmsg used when answering from cache.
11376 This avoids a copy of the data.
11377 - do not do useless byteswap on query id. Store reply flags in uint16
11378 for easier access (and no repeated byteswapping).
11379 - reviewed code.
11380 - configure detects and config.h includes sys/uio.h for writev decl.
11383 - new config option: num-queries-per-thread.
11385 using one thread (from the query service list).
11388 - added test for cache and not cached answers, in testbound replays.
11390 replay file to unbound.
11391 - created test that checks if items drop out of the cache.
11392 - added word 'partitioned hash table' to documentation on slab hash.
11393 A slab hash is a partitioned hash table.
11394 - worker can handle multiple queries at a time.
11397 - config settings for slab hash message cache.
11398 - test for cached answer.
11399 - Fixup deleting fake answer from testbound list.
11402 - review of yesterday's commits.
11403 - covered up memory leak of the entry locks.
11404 - answers from the cache correctly. Copies flags correctly.
11405 - sanity check for incoming query replies.
11406 - slabbed hash table. Much nicer contention, need dual cpu to see.
11409 - AIX configure check.
11411 in files it has not yet read in.
11412 - threaded hash table test.
11413 - unit test runs lock-verify afterwards and checks result.
11414 - need writelock to update data on hash_insert.
11415 - message cache code, msgreply code.
11418 - unit test of hash table, fixup locking problem in table_grow().
11419 - fixup accounting of sizes for removing items from hashtable.
11420 - unit test for hash table, single threaded test of integrity.
11421 - lock-verify reports errors nicely. More quiet in operation.
11424 - lock-verifier, checks consistent order of locking.
11427 - hash table insert (and subroutines) and lookup implemented.
11428 - hash table remove.
11429 - unit tests for hash internal bin, lru functions.
11432 - lock_unprotect in checklocks.
11433 - util/storage/lruhash.h for LRU hash table structure.
11436 - configure.ac moved to 0.2.
11437 - query_info and replymsg util/data structure.
11440 - added rwlock writelock checking.
11442 to not change protected memory areas.
11443 - log_hex function to dump hex strings to the logfile.
11444 - checklocks zeroes its destroyed lock after checking memory areas.
11445 - unit test for alloc.
11446 - identifier for union in checklocks to please older compilers.
11447 - created 0.1 tag.
11450 - Reviewed checklock code.
11455 contention measurement.
11458 - Testbed works with threading (different machines, different options).
11459 - alloc work, does the special type.
11462 - do not compile fork funcs unless needed. Otherwise will give
11463 type errors as their typedefs have not been enabled.
11464 - log shows thread numbers much more nicely (and portably).
11466 unbound will exit if given a signal.
11467 Reloads will not work, and exit is not graceful.
11468 - start of alloc framework layout.
11472 changes to code (close after event_del).
11473 - set ipc pipes nonblocking.
11476 - ub_thread_join portable definition.
11477 - forking is used if no threading is available.
11478 Tested, it works, since pipes work across processes as well.
11479 Thread_join is replaced with waitpid.
11481 so that they do not result in problems.
11482 - Also randomize the outgoing port range for tests.
11483 - If query list is full, will stop selecting listening ports for read.
11484 This makes all threads service incoming requests, instead of one.
11485 No memory is leaking during reloads, service of queries, etc.
11486 - test that uses ldns-testns -f to test threading. Have to answer
11487 three queries at the same time.
11488 - with verbose=0 operates quietly.
11491 - ub_random code used to select ID and port.
11492 - log code prints thread id.
11494 correctly.
11495 - don't open pipes for #0, doesn't need it.
11496 - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload).
11499 - Can do reloads on sigHUP. Everything is stopped, and freed,
11500 except the listening ports. Then the config file is reread.
11501 And everything is started again (and listening ports if needed).
11502 - Ports for queries are shared.
11503 - config file added interface:, chroot: and username:.
11504 - config file: directory, logfile, pidfile. And they work too.
11505 - will daemonize by default now. Use -d to stay in the foreground.
11506 - got BSD random[256 state] code, made it threadsafe. util/random.
11509 - Have a config file. Removed commandline options, moved to config.
11510 - tests use config file.
11513 - put -c option in man page.
11514 - minievent fd array capped by FD_SETSIZE.
11517 - Added locks code and pthread spinlock detection.
11518 - can use no locks, or solaris native thread library.
11519 - added yacc and lex configure, and config file parsing code.
11520 also makedist.sh, and manpage.
11521 - put include errno.h in config.h
11524 - Created 0.0 svn tag.
11525 - added acx_pthread.m4 autoconf check for pthreads from
11526 the autoconf archive. It is GPL-with-autoconf-exception Licensed.
11527 You can specify --with-pthreads, or --without-pthreads to configure.
11530 - Updated testbed script, works better by using make on remote end.
11531 - removed check decls, we can compile without them.
11532 - makefile supports LIBOBJ replacements.
11533 - docs checks ignore compat code.
11534 - added util/mini-event.c and .h, a select based alternative used with
11535 ./configure --with-libevent=no
11536 It is limited to 1024 file descriptors, and has less features.
11537 - will not create ip6 sockets if ip6 not on the machine.
11540 - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64,
11541 Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc.
11542 - malloc rndstate, so that it is aligned for access.
11543 - fixed rbtree cleanup with postorder traverse.
11544 - fixed pending messages are deleted when handled.
11546 adds more verbosity.
11549 - Included configure.ac changes from ldns.
11550 - detect (some) headers before the standards check.
11551 - do not use isblank to test c99, since its not available on solaris9.
11552 - review of testcode.
11553 * entries in a RANGE are no longer reversed.
11554 * print name of file with replay entry parse errors.
11555 - port to OSX: cast to int for some prints of sizet.
11556 - Makefile copies ldnstestpkts.c before doing dependencies on it.
11559 - work on fake events, first fwd replay works.
11560 - events can do timeouts and errors on queries to servers.
11561 - test package that runs replay scenarios.
11564 - work on fake events.
11567 - replay file reading.
11570 and main structure of event replay routines.
11573 - added tcp test.
11574 - replay storage.
11575 - testcode/fake_event work.
11578 - return answer with the same ID as query was sent with.
11579 - created udp forwarder test. I've done some effort to make it perform
11580 quickly. After servers are created, no big sleep statements but
11581 it checks the logfiles to see if servers have come up. Takes 0.14s.
11582 - set addrlen value when calling recvfrom.
11583 - comparison of addrs more portable.
11584 - LIBEVENT option for testbed to set libevent directory.
11585 - work on tcp input.
11588 - reviewed code and improved in places.
11591 - Picked up stdc99 and other define tests from ldns. Improved
11592 POSIX define test to include getaddrinfo.
11593 - defined constants for netevent callback error code.
11594 - unit test for strisip6.
11598 address families.
11599 - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets.
11600 - listens on both ip4 and ip6 ports to provide correct return address.
11601 - worker fwder address filled correctly.
11602 - fixup timer code.
11603 - forwards udp queries and sends answer.
11606 - outside network more UDP work.
11607 - moved * closer to type.
11608 - comm_timer object and events.
11611 - Added makedist.sh script to make release tarball.
11612 - Removed listen callback layer, did not add anything.
11613 - Added UDP recv to netevent, worker callback for udp.
11614 - netevent communication reply storage structure.
11615 - minimal query header sanity checking for worker.
11616 - copied over rbtree implementation from NSD (BSD licensed too).
11617 - outgoing network query service work.
11620 - links in example/ldns-testpkts.c and .h for premade packet support.
11621 - added callback argument to listen_dnsport and daemon/worker.
11624 - unbound.8 a short manpage.
11627 - fixed memleak.
11628 - make lint works on BSD and Linux (openssl defines).
11629 - make tags works.
11630 - testbound program start.
11633 - fixed lint so it may work on BSD.
11634 - put license into header of every file.
11635 - created verbosity flag.
11636 - fixed libevent configure flag.
11637 - detects event_base_free() in new libevent 1.2 version.
11638 - getopt in daemon. fatal_exit() and verbose() logging funcs.
11639 - created log_assert, that throws assertions to the logfile.
11640 - listen_dnsport service. Binds ports.
11643 - cleaned up configure.ac.
11646 - added libevent to configure to link with.
11647 - util/netevent setup work.
11648 - configure searches for libevent.
11650 have been found).
11651 - doxygen works with ATTR_UNUSED().
11652 - util/netevent implementation.
11655 - Designed header file for network communication.
11658 - added readme.svn and readme.tests.
11661 - Testbed script (run on multiple platforms the test set).
11662 Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5.
11663 - added unit test tpkg.
11666 - committed first set of files into subversion repository.
11667 svn co svn+ssh://unbound.net/svn/unbound
11668 You need a ssh login. There is no https access yet.
11669 - Added LICENSE, the BSD license.
11670 - Added doc/README with compile help.
11671 - main program stub and quiet makefile.
11672 - minimal logging service (to stderr).
11673 - added postcommit hook that serves emails.
11674 - added first test 00-lint. postcommit also checks if build succeeds.
11675 - 01-doc: doxygen doc target added for html docs. And stringent test
11676 on documented files, functions and parameters.
11679 - Created Makefile.in and configure.ac.