projects / apple / network_cmds.git / blame
| Commit | Line | Data |
|---|---|---|
| 89c4ed63 A |
1 | 8 December 2014: Wouter |
| 2 | - Fix CVE-2014-8602: denial of service by making resolver chase | |
| 3 | endless series of delegations. | |
| 4 | ||
| 5 | 1 December 2014: Wouter | |
| 6 | - Fix bug#632: unbound fails to build on AArch64, protects | |
| 7 | getentropy compat code from calling sysctl if it is has been removed. | |
| 8 | ||
| 9 | 29 November 2014: Wouter | |
| 10 | - Add include to getentropy_linux.c, hopefully fixing debian build. | |
| 11 | ||
| 12 | 28 November 2014: Wouter | |
| 13 | - Fix makefile for build from noexec source tree. | |
| 14 | ||
| 15 | 26 November 2014: Wouter | |
| 16 | - Fix libunbound undefined symbol errors for main. | |
| 17 | Referencing main does not seem to be possible for libunbound. | |
| 18 | ||
| 19 | 24 November 2014: Wouter | |
| 20 | - Fix log at high verbosity and memory allocation failure. | |
| 21 | - iana portlist update. | |
| 22 | ||
| 23 | 21 November 2014: Wouter | |
| 24 | - Fix crash on multiple thread random usage on systems without | |
| 25 | arc4random. | |
| 26 | ||
| 27 | 20 November 2014: Wouter | |
| 28 | - fix compat/getentropy_win.c check if CryptGenRandom works and no | |
| 29 | immediate exit on windows. | |
| 30 | ||
| 31 | 19 November 2014: Wouter | |
| 32 | - Fix cdflag dns64 processing. | |
| 33 | ||
| 34 | 18 November 2014: Wouter | |
| 35 | - Fix that CD flag disables DNS64 processing, returning the DNSSEC | |
| 36 | signed AAAA denial. | |
| 37 | - iana portlist update. | |
| 38 | ||
| 39 | 17 November 2014: Wouter | |
| 40 | - Fix #627: SSL_CTX_load_verify_locations return code not properly | |
| 41 | checked. | |
| 42 | ||
| 43 | 14 November 2014: Wouter | |
| 44 | - parser with bison 2.7 | |
| 45 | ||
| 46 | 13 November 2014: Wouter | |
| 47 | - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, | |
| 48 | added to contrib/aaaa-filter-iterator.patch. | |
| 49 | ||
| 50 | 12 November 2014: Wouter | |
| 51 | - trunk has 1.5.1 in development. | |
| 52 | - Patch from Robert Edmonds to build pyunbound python module | |
| 53 | differently. No versioninfo, with -shared and without $(LIBS). | |
| 54 | - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page. | |
| 55 | - Removed 'increased limit open files' log message that is written | |
| 56 | to console. It is only written on verbosity 4 and higher. | |
| 57 | This keeps system bootup console cleaner. | |
| 58 | - Patch from James Raftery, always print stats for rcodes 0..5. | |
| 59 | ||
| 60 | 11 November 2014: Wouter | |
| 61 | - iana portlist update. | |
| 62 | - Fix bug where forward or stub addresses with same address but | |
| 63 | different port number were not tried. | |
| 64 | - version number in svn trunk is 1.5.0 | |
| 65 | - tag 1.5.0rc1 | |
| 66 | - review fix from Ralph. | |
| 67 | ||
| 68 | 7 November 2014: Wouter | |
| 69 | - dnstap fixes by Robert Edmonds: | |
| 70 | dnstap/dnstap.m4: cosmetic fixes | |
| 71 | dnstap/: Remove compiled protoc-c output files | |
| 72 | dnstap/dnstap.m4: Error out if required libraries are not found | |
| 73 | dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of | |
| 74 | protobuf-c 1.0.0 | |
| 75 | dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0) | |
| 76 | ||
| 77 | 4 November 2014: Wouter | |
| 78 | - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically | |
| 79 | tracked trust anchor to libunbound. | |
| 80 | - Redefine internal minievent symbols to unique symbols that helps | |
| 81 | linking on platforms where the linker leaks names across modules. | |
| 82 | ||
| 83 | 27 October 2014: Wouter | |
| 84 | - Disabled use of SSLv3 in remote-control and ssl-upstream. | |
| 85 | - iana portlist update. | |
| 86 | ||
| 87 | 16 October 2014: Wouter | |
| 88 | - Documented dns64 configuration in unbound.conf man page. | |
| 89 | ||
| 90 | 13 October 2014: Wouter | |
| 91 | - Fix #617: in ldns in unbound, lowercase WKS services. | |
| 92 | - Fix ctype invocation casts. | |
| 93 | ||
| 94 | 10 October 2014: Wouter | |
| 95 | - Fix unbound-checkconf check for module config with dns64 module. | |
| 96 | - Fix unbound capsforid fallback, it ignores TTLs in comparison. | |
| 97 | ||
| 98 | 6 October 2014: Wouter | |
| 99 | - Fix #614: man page variable substitution bug. | |
| 100 | 6 October 2014: Willem | |
| 101 | - Whitespaces after $ORIGIN are not part of the origin dname (ldns). | |
| 102 | - $TTL's value starts at position 5 (ldns). | |
| 103 | ||
| 104 | 1 October 2014: Wouter | |
| 105 | - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire). | |
| 106 | ||
| 107 | 29 September 2014: Wouter | |
| 108 | - Fix #612: create service with service.conf in present directory and | |
| 109 | auto load it. | |
| 110 | - Fix for mingw compile openssl ranlib. | |
| 111 | ||
| 112 | 25 September 2014: Wouter | |
| 113 | - updated configure and aclocal with newer autoconf 1.13. | |
| 114 | ||
| 115 | 22 September 2014: Wouter | |
| 116 | - Fix swig and python examples for Python 3.x. | |
| 117 | - Fix for mingw compile with openssl-1.0.1i. | |
| 118 | ||
| 119 | 19 September 2014: Wouter | |
| 120 | - improve python configuration detection to build on Fedora 22. | |
| 121 | ||
| 122 | 18 September 2014: Wouter | |
| 123 | - patches to also build with Python 3.x (from Pavel Simerda). | |
| 124 | ||
| 125 | 16 September 2014: Wouter | |
| 126 | - Fix tcp timer waiting list removal code. | |
| 127 | - iana portlist update. | |
| 128 | - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue | |
| 129 | is longer and more tcp connections can be handled. | |
| 130 | ||
| 131 | 15 September 2014: Wouter | |
| 132 | - Fix unit test for CDS typecode. | |
| 133 | ||
| 134 | 5 September 2014: Wouter | |
| 135 | - type CDS and CDNSKEY types in sldns. | |
| 136 | ||
| 137 | 25 August 2014: Wouter | |
| 138 | - Fixup checklock code for log lock and its mutual initialization | |
| 139 | dependency. | |
| 140 | - iana portlist update. | |
| 141 | - Removed necessity for pkg-config from the dnstap.m4, new are | |
| 142 | the --with-libfstrm and --with-protobuf-c configure options. | |
| 143 | ||
| 144 | 19 August 2014: Wouter | |
| 145 | - Update unbound manpage with more explanation (from Florian Obser). | |
| 146 | ||
| 147 | 18 August 2014: Wouter | |
| 148 | - Fix #603: unbound-checkconf -o <option> should skip verification | |
| 149 | checks. | |
| 150 | - iana portlist update. | |
| 151 | - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings. | |
| 152 | ||
| 153 | 5 August 2014: Wouter | |
| 154 | - dnstap support, with a patch from Farsight Security, written by | |
| 155 | Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c. | |
| 156 | It is BSD licensed (see dnstap/dnstap.c). | |
| 157 | Building with --enable-dnstap needs pkg-config with this patch. | |
| 158 | - Noted dnstap in doc/README and doc/CREDITS. | |
| 159 | - Changes to the dnstap patch. | |
| 160 | - lint fixes. | |
| 161 | - dnstap/dnstap_config.h should not have been added to the repo, | |
| 162 | because is it generated. | |
| 163 | ||
| 164 | 1 August 2014: Wouter | |
| 165 | - Patch add msg, rrset, infra and key cache sizes to stats command | |
| 166 | from Maciej Soltysiak. | |
| 167 | - iana portlist update. | |
| 168 | ||
| 169 | 31 July 2014: Wouter | |
| 170 | - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault. | |
| 171 | Initial commit of the patch from the FreeBSD base (with its fixes). | |
| 172 | This adds a module (for module-config in unbound.conf) dns64 that | |
| 173 | performs DNS64 processing, see README.DNS64. | |
| 174 | - Changes from DNS64: | |
| 175 | strcpy changed to memmove. | |
| 176 | arraybound check fixed from prefix_net/8/4 to prefix_net/8+4. | |
| 177 | allocation of result consistently in the correct region. | |
| 178 | time_t is now used for ttl in unbound (since the patch's version). | |
| 179 | - testdata/dns64_lookup.rpl for unit test for dns64 functionality. | |
| 180 | ||
| 181 | 29 July 2014: Wouter | |
| 182 | - Patch from Dag-Erling Smorgrav that implements feature, unbound -dd | |
| 183 | does not fork in the background and also logs to stderr. | |
| 184 | ||
| 185 | 21 July 2014: Wouter | |
| 186 | - Fix endian.h include for OpenBSD. | |
| 187 | ||
| 188 | 16 July 2014: Wouter | |
| 189 | - And Fix#596: Bail out of unbound-control dump_infra when ssl | |
| 190 | write fails. | |
| 191 | ||
| 192 | 15 July 2014: Wouter | |
| 193 | - Fix #596: Bail out of unbound-control list_local_zones when ssl | |
| 194 | write fails. | |
| 195 | - iana portlist update. | |
| 196 | ||
| 197 | 13 July 2014: Wouter | |
| 198 | - Configure tests if main can be linked to from getentropy compat. | |
| 199 | ||
| 200 | 12 July 2014: Wouter | |
| 201 | - Fix getentropy compat code, function refs were not portable. | |
| 202 | - Fix to check openssl version number only for OpenSSL. | |
| 203 | - LibreSSL provides compat items, check for that in configure. | |
| 204 | - Fix bug in fix for log locks that caused deadlock in signal handler. | |
| 205 | - update compat/getentropy and arc4random to the most recent ones from OpenBSD. | |
| 206 | ||
| 207 | 11 July 2014: Matthijs | |
| 208 | - fake-rfc2553 patch (thanks Benjamin Baier). | |
| 209 | ||
| 210 | 11 July 2014: Wouter | |
| 211 | - arc4random in compat/ and getentropy, explicit_bzero, chacha for | |
| 212 | dependencies, from OpenBSD. arc4_lock and sha512 in compat. | |
| 213 | This makes arc4random available on all platforms, except when | |
| 214 | compiled with LIBNSS (it uses libNSS crypto random). | |
| 215 | - fix strptime implicit declaration error on OpenBSD. | |
| 216 | - arc4random, getentropy and explicit_bzero compat for Windows. | |
| 217 | ||
| 218 | 4 July 2014: Wouter | |
| 219 | - Fix #593: segfault or crash upon rotating logfile. | |
| 220 | ||
| 221 | 3 July 2014: Wouter | |
| 222 | - DLV tests added. | |
| 223 | - signit tool fixup for compile with libldns library. | |
| 224 | - iana portlist updated. | |
| 225 | ||
| 226 | 27 June 2014: Wouter | |
| 227 | - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X. | |
| 228 | ||
| 229 | 26 June 2014: Wouter | |
| 230 | - unbound-control status reports if so-reuseport was successful. | |
| 231 | - iana portlist updated. | |
| 232 | ||
| 233 | 24 June 2014: Wouter | |
| 234 | - Fix caps-for-id fallback, and added fallback attempt when servers | |
| 235 | drop 0x20 perturbed queries. | |
| 236 | - Fixup testsetup for VM tests (run testcode/run_vm.sh). | |
| 237 | ||
| 238 | 17 June 2014: Wouter | |
| 239 | - iana portlist updated. | |
| 240 | ||
| 241 | 3 June 2014: Wouter | |
| 242 | - Add AAAA for B root server to default root hints. | |
| 243 | ||
| 244 | 2 June 2014: Wouter | |
| 245 | - Remove unused define from iterator.h | |
| 246 | ||
| 247 | 30 May 2014: Wouter | |
| 248 | - Fixup sldns_enum_edns_option typedef definition. | |
| 249 | ||
| 250 | 28 May 2014: Wouter | |
| 251 | - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue | |
| 252 | fixes from FreeBSD's copy of Unbound, he notes: | |
| 253 | Generate unbound-control-setup.sh at build time so it respects | |
| 254 | prefix and sysconfdir from the configure script. Also fix the | |
| 255 | umask to match the comment, and the comment to match the umask. | |
| 256 | Add const and static where needed. Use unions instead of | |
| 257 | playing pointer poker. Move declarations that are needed in | |
| 258 | multiple source files into a shared header. Move sldns_bgetc() | |
| 259 | from parse.c to buffer.c where it belongs. Introduce a new | |
| 260 | header file, worker.h, which declares the callbacks that | |
| 261 | all workers must define. Remove those declarations from | |
| 262 | libworker.h. Include the correct headers in the correct places. | |
| 263 | Fix a few dummy callbacks that don't match their prototype. | |
| 264 | Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. | |
| 265 | Remove a useless printf which breaks reproducible builds. | |
| 266 | Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're | |
| 267 | no longer used. Add unbound-control-setup.sh to the list of | |
| 268 | generated files. The prototype for libworker_event_done_cb() | |
| 269 | needs to be moved from libunbound/libworker.h to | |
| 270 | libunbound/worker.h. | |
| 271 | - Fixup out-of-directory compile with unbound-control-setup.sh.in. | |
| 272 | - make depend. | |
| 273 | ||
| 274 | 23 May 2014: Wouter | |
| 275 | - unbound-host -D enabled dnssec and reads root trust anchor from | |
| 276 | the default root key file that was compiled in. | |
| 277 | ||
| 278 | 20 May 2014: Wouter | |
| 279 | - Feature, unblock-lan-zones: yesno that you can use to make unbound | |
| 280 | perform 10.0.0.0/8 and other reverse lookups normally, for use if | |
| 281 | unbound is running service for localhost on localhost. | |
| 282 | ||
| 283 | 16 May 2014: Wouter | |
| 284 | - Updated create_unbound_ad_servers and unbound_cache scripts from | |
| 285 | Yuri Voinov in the source/contrib directory. Added | |
| 286 | warmup.cmd (and .sh): warm up the DNS cache with your MRU domains. | |
| 287 | ||
| 288 | 9 May 2014: Wouter | |
| 289 | - Implement draft-ietf-dnsop-rfc6598-rfc6303-01. | |
| 290 | - iana portlist updated. | |
| 291 | ||
| 292 | 8 May 2014: Wouter | |
| 293 | - Contrib windows scripts from Yuri Voinov added to src/contrib: | |
| 294 | create_unbound_ad_servers.cmd: enters anti-ad server lists. | |
| 295 | unbound_cache.cmd: saves and loads the cache. | |
| 296 | - Added unbound-control-setup.cmd from Yuri Voinov to the windows | |
| 297 | unbound distribution set. It requires openssl installed in %PATH%. | |
| 298 | ||
| 299 | 6 May 2014: Wouter | |
| 300 | - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier. | |
| 301 | ||
| 302 | 5 May 2014: Wouter | |
| 303 | - More #567: remove : from output of stub and forward lists, this is | |
| 304 | easier to parse. | |
| 305 | ||
| 306 | 29 April 2014: Wouter | |
| 307 | - iana portlist updated. | |
| 308 | - Add unbound-control flush_negative that flushed nxdomains, nodata, | |
| 309 | and errors from the cache. For dnssec-trigger and NetworkManager, | |
| 310 | fixes cases where network changes have localdata that was already | |
| 311 | negatively cached from the previous network. | |
| 312 | ||
| 313 | 23 April 2014: Wouter | |
| 314 | - Patch from Jeremie Courreges-Anglas to use arc4random_uniform | |
| 315 | if available on the OS, it gets entropy from the OS. | |
| 316 | ||
| 317 | 15 April 2014: Wouter | |
| 318 | - Fix compile with libevent2 on FreeBSD. | |
| 319 | ||
| 320 | 11 April 2014: Wouter | |
| 321 | - Fix #502: explain that do-ip6 disable does not stop AAAA lookups, | |
| 322 | but it stops the use of the ipv6 transport layer for DNS traffic. | |
| 323 | - iana portlist updated. | |
| 324 | ||
| 325 | 10 April 2014: Wouter | |
| 326 | - iana portlist updated. | |
| 327 | - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation | |
| 328 | option for DNS fragmentation defense. | |
| 329 | - Document that dump_requestlist only prints queries from thread 0. | |
| 330 | - unbound-control stats prints num.query.tcpout with number of TCP | |
| 331 | outgoing queries made in the previous statistics interval. | |
| 332 | - Fix #567: unbound lists if forward zone is secure or insecure with | |
| 333 | +i annotation in output of list_forwards, also for list_stubs | |
| 334 | (for NetworkManager integration.) | |
| 335 | - Fix #554: use unsigned long to print 64bit statistics counters on | |
| 336 | 64bit systems. | |
| 337 | - Fix #558: failed prefetch lookup does not remove cached response | |
| 338 | but delays next prefetch (in lieu of caching a SERVFAIL). | |
| 339 | - Fix #545: improved logging, the ip address of the error is printed | |
| 340 | on the same log-line as the error. | |
| 341 | ||
| 342 | 8 April 2014: Wouter | |
| 343 | - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control | |
| 344 | in testbound scripts. | |
| 345 | - iana portlist updated. | |
| 346 | ||
| 347 | 7 April 2014: Wouter | |
| 348 | - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root | |
| 349 | hints (patch from Anand Buddhdev). | |
| 350 | - Fix #572: Fix unit test failure for systems with different | |
| 351 | /etc/services. | |
| 352 | ||
| 353 | 28 March 2014: Wouter | |
| 354 | - Fix #569: do_tcp is do-tcp in unbound.conf man page. | |
| 355 | ||
| 356 | 25 March 2014: Wouter | |
| 357 | - Patch from Stuart Henderson to build unbound-host man from .1.in. | |
| 358 | ||
| 359 | 24 March 2014: Wouter | |
| 360 | - Fix print filename of encompassing config file on read failure. | |
| 361 | ||
| 362 | 12 March 2014: Wouter | |
| 363 | - tag 1.4.22 | |
| 364 | - trunk has 1.4.23 in development. | |
| 365 | ||
| 366 | 10 March 2014: Wouter | |
| 367 | - Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes | |
| 368 | because of spelling. Patch from Chris Coates. | |
| 369 | ||
| 370 | 27 February 2014: Wouter | |
| 371 | - tag 1.4.22rc1 | |
| 372 | ||
| 373 | 21 February 2014: Wouter | |
| 374 | - iana portlist updated. | |
| 375 | ||
| 376 | 20 February 2014: Matthijs | |
| 377 | - Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is | |
| 378 | received. This is okay according 4035, but not after revising | |
| 379 | existence in 4592. NSEC empty non-terminals exist and thus the | |
| 380 | RCODE should have been NOERROR. If this occurs, and the RRsets | |
| 381 | are secure, we set the RCODE to NOERROR and the security status | |
| 382 | of the reponse is also considered secure. | |
| 383 | ||
| 384 | 14 February 2014: Wouter | |
| 385 | - Works on Minix (3.2.1). | |
| 386 | ||
| 387 | 11 February 2014: Wouter | |
| 388 | - Fix parse of #553(NSD) string in sldns, quotes without spaces. | |
| 389 | ||
| 390 | 7 February 2014: Wouter | |
| 391 | - iana portlist updated. | |
| 392 | - add body to ifstatement if locks disabled. | |
| 393 | - add TXT string"string" test case to unit test. | |
| 394 | - Fix #551: License change "Regents" to "Copyright holder", matching | |
| 395 | the BSD license on opensource.org. | |
| 396 | ||
| 397 | 6 February 2014: Wouter | |
| 398 | - sldns has type HIP. | |
| 399 | - code documentation on the module interface. | |
| 400 | ||
| 401 | 5 February 2014: Wouter | |
| 402 | - Fix sldns parse tests on osx. | |
| 403 | ||
| 404 | 3 February 2014: Wouter | |
| 405 | - Detect libevent2 install automatically by configure. | |
| 406 | - Fixup link with lib/event2 subdir. | |
| 407 | - Fix parse in sldns of quoted parenthesized text strings. | |
| 408 | ||
| 409 | 31 January 2014: Wouter | |
| 410 | - unit test for ldns wire to str and back with zones, root, nlnetlabs | |
| 411 | and types.sidnlabs. | |
| 412 | - Fix for hex to string in unknown, atma and nsap. | |
| 413 | - fixup nss compile (no ldns in it). | |
| 414 | - fixup warning in unitldns | |
| 415 | - fixup WKS and rdata type service to print unsigned because strings | |
| 416 | are not portable; they cannot be read (for sure) on other computers. | |
| 417 | - fixup type EUI48 and EUI64, type APL and type IPSECKEY in string | |
| 418 | parse sldns. | |
| 419 | ||
| 420 | 30 January 2014: Wouter | |
| 421 | - delay-close does not act if there are udp-wait queries, so that | |
| 422 | it does not make a socketdrain DoS easier. | |
| 423 | ||
| 424 | 28 January 2014: Wouter | |
| 425 | - iana portlist updated. | |
| 426 | - iana portlist test updated so it does not touch the source | |
| 427 | if there are no changes. | |
| 428 | - delay-close: msec option that delays closing ports for which | |
| 429 | the UDP reply has timed out. Keeps the port open, only accepts | |
| 430 | the correct reply. This correct reply is not used, but the port | |
| 431 | is open so that no port-denied ICMPs are generated. | |
| 432 | ||
| 433 | 27 January 2014: Wouter | |
| 434 | - reuseport is attempted, then fallback to without on failure. | |
| 435 | ||
| 436 | 24 January 2014: Wouter | |
| 437 | - Change unbound-event.h to use void* buffer, length idiom. | |
| 438 | - iana portlist updated. | |
| 439 | - unbound-event.h is installed if you configure --enable-event-api. | |
| 440 | - speed up unbound (reports say it could be up to 10%), by reducing | |
| 441 | lock contention on localzones.lock. It is changed to an rwlock. | |
| 442 | - so-reuseport: yesno option to distribute queries evenly over | |
| 443 | threads on Linux (Thanks Robert Edmonds). | |
| 444 | - made lint clean. | |
| 445 | ||
| 446 | 21 January 2014: Wouter | |
| 447 | - Fix #547: no trustanchor written if filesystem full, fclose checked. | |
| 448 | ||
| 449 | 17 January 2014: Wouter | |
| 450 | - Fix isprint() portability in sldns, uses unsigned int. | |
| 451 | - iana portlist updated. | |
| 452 | ||
| 453 | 16 January 2014: Wouter | |
| 454 | - fix #544: Fixed +i causes segfault when running with module conf | |
| 455 | "iterator". | |
| 456 | - Windows port, adjust %lld to %I64d, and warning in win_event.c. | |
| 457 | ||
| 458 | 14 January 2014: Wouter | |
| 459 | - iana portlist updated. | |
| 460 | ||
| 461 | 5 Dec 2013: Wouter | |
| 462 | - Fix bug in cachedump that uses sldns. | |
| 463 | - update pythonmod for ldns_ to sldns_ name change. | |
| 464 | ||
| 465 | 3 Dec 2013: Wouter | |
| 466 | - Fix sldns to use sldns_ prefix for all ldns_ variables. | |
| 467 | - Fix windows compile to compile with sldns. | |
| 468 | ||
| 469 | 30 Nov 2013: Wouter | |
| 470 | - Fix sldns to make globals use sldns_ prefix. This fixes | |
| 471 | linking with libldns that uses global variables ldns_ . | |
| 472 | ||
| 473 | 13 Nov 2013: Wouter | |
| 474 | - Fix bug#537: compile python plugin without ldns library. | |
| 475 | ||
| 476 | 12 Nov 2013: Wouter | |
| 477 | - Fix bug#536: acl_deny_non_local and refuse_non_local added. | |
| 478 | ||
| 479 | 5 Nov 2013: Wouter | |
| 480 | - Patch from Neel Goyal to fix async id assignment if callback | |
| 481 | is called by libunbound in the mesh attach. | |
| 482 | - Accept ip-address: as an alternative for interface: for | |
| 483 | consistency with nsd.conf syntax. | |
| 484 | ||
| 485 | 4 Nov 2013: Wouter | |
| 486 | - Patch from Neel Goyal to fix callback in libunbound. | |
| 487 | ||
| 488 | 3 Nov 2013: Wouter | |
| 489 | - if configured --with-libunbound-only fix make install. | |
| 490 | ||
| 491 | 31 Oct 2013: Wouter | |
| 492 | - Fix #531: Set SO_REUSEADDR so that the wildcard interface and a | |
| 493 | more specific interface port 53 can be used at the same time, and | |
| 494 | one of the daemons is unbound. | |
| 495 | - iana portlist update. | |
| 496 | - separate ldns into core ldns inside ldns/ subdirectory. No more | |
| 497 | --with-ldns is needed and unbound does not rely on libldns. | |
| 498 | - portability fixes for new USE_SLDNS ldns subdir codebase. | |
| 499 | ||
| 500 | 22 Oct 2013: Wouter | |
| 501 | - Patch from Neel Goyal: Add an API call to set an event base on an | |
| 502 | existing ub_ctx. This basically just destroys the current worker and | |
| 503 | sets the event base to the current. And fix a deadlock in | |
| 504 | ub_resolve_event – the cfglock is held when libworker_create is | |
| 505 | called. This ends up trying to acquire the lock again in | |
| 506 | context_obtain_alloc in the call chain. | |
| 507 | - Fix #528: if very high logging (4 or more) segfault on allow_snoop. | |
| 508 | ||
| 509 | 26 Sep 2013: Wouter | |
| 510 | - unbound-event.h is installed if configured --with-libevent. It | |
| 511 | contains low-level library calls, that use libevent's event_base | |
| 512 | and an ldns_buffer for the wire return packet to perform async | |
| 513 | resolution in the client's eventloop. | |
| 514 | ||
| 515 | 19 Sep 2013: Wouter | |
| 516 | - 1.4.21 tag created. | |
| 517 | - trunk has 1.4.22 number inside it. | |
| 518 | - iana portlist updated. | |
| 519 | - acx_nlnetlabs.m4 to 26; improve FLTO help text. | |
| 520 | ||
| 521 | 16 Sep 2013: Wouter | |
| 522 | - Fix#524: max-udp-size not effective to non-EDNS0 queries, from | |
| 523 | Daisuke HIGASHI. | |
| 524 | ||
| 525 | 10 Sep 2013: Wouter | |
| 526 | - MIN_TTL and MAX_TTL also in time_t. | |
| 527 | - tag 1.4.21rc1 made again. | |
| 528 | ||
| 529 | 26 Aug 2013: Wouter | |
| 530 | - More fixes for bug#519: for the threaded case test if the bg | |
| 531 | thread has been killed, on ub_ctx_delete, to avoid hangs. | |
| 532 | ||
| 533 | 22 Aug 2013: Wouter | |
| 534 | - more fixes that I overlooked. | |
| 535 | - review fixes from Willem. | |
| 536 | ||
| 537 | 21 Aug 2013: Wouter | |
| 538 | - Fix#520: Errors found by static analysis from Tomas Hozza(redhat). | |
| 539 | ||
| 540 | 20 Aug 2013: Wouter | |
| 541 | - Fix for 2038, with time_t instead of uint32_t. | |
| 542 | ||
| 543 | 19 Aug 2013: Wouter | |
| 544 | - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound). | |
| 545 | ||
| 546 | 14 Aug 2013: Wouter | |
| 547 | - Fix uninit variable in fix#516. | |
| 548 | ||
| 549 | 8 Aug 2013: Wouter | |
| 550 | - Fix#516 dnssec lameness detection for answers that are improper. | |
| 551 | ||
| 552 | 30 Jun 2013: Wouter | |
| 553 | - tag 1.4.21rc1 | |
| 554 | ||
| 555 | 29 Jun 2013: Wouter | |
| 556 | - Fix#512 memleak in testcode for testbound (if it fails). | |
| 557 | - Fix#512 NSS returned arrays out of setup function to be statics. | |
| 558 | ||
| 559 | 26 Jun 2013: Wouter | |
| 560 | - max include of 100.000 files (depth and globbed at one time). | |
| 561 | This is to preserve system memory in bug cases, or endless cases. | |
| 562 | - iana portlist updated. | |
| 563 | ||
| 564 | 19 Jun 2013: Wouter | |
| 565 | - streamtcp man page, contributed by Tomas Hozza. | |
| 566 | - iana portlist updated. | |
| 567 | - libunbound documentation on how to avoid openssl race conditions. | |
| 568 | ||
| 569 | 25 Jun 2013: Wouter | |
| 570 | - Squelch sendto-permission denied errors when the network is | |
| 571 | not connected, to avoid spamming syslog. | |
| 572 | - configure --disable-flto option (from Robert Edmonds). | |
| 573 | ||
| 574 | 18 Jun 2013: Wouter | |
| 575 | - Fix for const string literals in C++ for libunbound, from Karel | |
| 576 | Slany. | |
| 577 | - iana portlist updated. | |
| 578 | ||
| 579 | 17 Jun 2013: Wouter | |
| 580 | - Fixup manpage syntax. | |
| 581 | ||
| 582 | 14 Jun 2013: Wouter | |
| 583 | - get_option and set_option support for log-time-ascii, python-script | |
| 584 | val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect | |
| 585 | immediately. The others are mostly useful for libunbound users. | |
| 586 | ||
| 587 | 13 Jun 2013: Wouter | |
| 588 | - get_option, set_option, unbound-checkconf -o and libunbound | |
| 589 | getoption and setoption support cache-min-ttl and cache-max-ttl. | |
| 590 | ||
| 591 | 10 Jun 2013: Wouter | |
| 592 | - Fix#501: forward-first does not recurse, when forward name is ".". | |
| 593 | - iana portlist update. | |
| 594 | - Max include depth is unlimited. | |
| 595 | ||
| 596 | 27 May 2013: Wouter | |
| 597 | - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply | |
| 598 | patch to it to not fail when -Werror is also specified, from the | |
| 599 | autoconf-archives. | |
| 600 | - iana portlist update. | |
| 601 | ||
| 602 | 21 May 2013: Wouter | |
| 603 | - Explain bogus and secure flags in libunbound more. | |
| 604 | ||
| 605 | 16 May 2013: Wouter | |
| 606 | - Fix#499 use-after-free in out-of-memory handling code (thanks Jake | |
| 607 | Montgomery). | |
| 608 | - Fix#500 use on non-initialised values on socket bind failures. | |
| 609 | ||
| 610 | 15 May 2013: Wouter | |
| 611 | - Fix round-robin doesn't work with some Windows clients (from Ilya | |
| 612 | Bakulin). | |
| 613 | ||
| 614 | 3 May 2013: Wouter | |
| 615 | - update acx_nlnetlabs.m4 to v23, sleep w32 fix. | |
| 616 | ||
| 617 | 26 April 2013: Wouter | |
| 618 | - add unbound-control insecure_add and insecure_remove for the | |
| 619 | administration of negative trust anchors. | |
| 620 | ||
| 621 | 25 April 2013: Wouter | |
| 622 | - Implement max-udp-size config option, default 4096 (thanks | |
| 623 | Daisuke Higashi). | |
| 624 | - Robust checks on dname validity from rdata for dname compare. | |
| 625 | - updated iana portlist. | |
| 626 | ||
| 627 | 19 April 2013: Wouter | |
| 628 | - Fixup snprintf return value usage, fixed libunbound_get_option. | |
| 629 | ||
| 630 | 18 April 2013: Wouter | |
| 631 | - fix bug #491: pick program name (0th argument) as syslog identity. | |
| 632 | - own implementation of compat/snprintf.c. | |
| 633 | ||
| 634 | 15 April 2013: Wouter | |
| 635 | - Fix so that for a configuration line of include: "*.conf" it is not | |
| 636 | an error if there are no files matching the glob pattern. | |
| 637 | - unbound-anchor review: BIO_write can return 0 successfully if it | |
| 638 | has successfully appended a zero length string. | |
| 639 | ||
| 640 | 11 April 2013: Wouter | |
| 641 | - Fix queries leaking up for stubs and forwards, if the configured | |
| 642 | nameservers all fail to answer. | |
| 643 | ||
| 644 | 10 April 2013: Wouter | |
| 645 | - code improve for minimal responses, small speed increase. | |
| 646 | ||
| 647 | 9 April 2013: Wouter | |
| 648 | - updated iana portlist. | |
| 649 | - Fix crash in previous private address fixup of 22 March. | |
| 650 | ||
| 651 | 28 March 2013: Wouter | |
| 652 | - Make reverse zones easier by documenting the nodefault statements | |
| 653 | commented-out in the example config file. | |
| 654 | ||
| 655 | 26 March 2013: Wouter | |
| 656 | - more fixes to lookup3.c endianness detection. | |
| 657 | ||
| 658 | 25 March 2013: Wouter | |
| 659 | - #492: Fix endianness detection, revert to older lookup3.c detection | |
| 660 | and put new detect lines after previous tests, to avoid regressions | |
| 661 | but allow new detections to succeed. | |
| 662 | And add detection for machine/endian.h to it. | |
| 663 | ||
| 664 | 22 March 2013: Wouter | |
| 665 | - Fix resolve of names that use a mix of public and private addresses. | |
| 666 | - iana portlist update. | |
| 667 | - Fix makedist for new svn for -d option. | |
| 668 | - unbound.h header file has UNBOUND_VERSION_MAJOR define. | |
| 669 | - Fix windows RSRC version for long version numbers. | |
| 670 | ||
| 671 | 21 March 2013: Wouter | |
| 672 | - release 1.4.20 | |
| 673 | - trunk has 1.4.21 | |
| 674 | - committed libunbound version 4:1:2 for binary API updated in 1.4.20 | |
| 675 | - install copy of unbound-control.8 man page for unbound-control-setup | |
| 676 | ||
| 677 | 14 March 2013: Wouter | |
| 678 | - iana portlist update. | |
| 679 | - tag 1.4.20rc1 | |
| 680 | ||
| 681 | 12 March 2013: Wouter | |
| 682 | - Fixup makedist.sh for windows compile. | |
| 683 | ||
| 684 | 11 March 2013: Wouter | |
| 685 | - iana portlist update. | |
| 686 | - testcode/ldns-testpkts.c check for makedist is informational. | |
| 687 | ||
| 688 | 15 February 2013: Wouter | |
| 689 | - fix defines in lookup3 for bigendian bsd alpha | |
| 690 | ||
| 691 | 11 February 2013: Wouter | |
| 692 | - Fixup openssl_thread init code to only run if compiled with SSL. | |
| 693 | ||
| 694 | 7 February 2013: Wouter | |
| 695 | - detect endianness in lookup3 on BSD. | |
| 696 | - add libunbound.ttl at end of result structure, version bump for | |
| 697 | libunbound and binary backwards compatible, but 1.4.19 is not | |
| 698 | forward compatible with 1.4.20. | |
| 699 | - update iana port list. | |
| 700 | ||
| 701 | 30 January 2013: Wouter | |
| 702 | - includes and have_ssl fixes for nss. | |
| 703 | ||
| 704 | 29 January 2013: Wouter | |
| 705 | - printout name of zone with duplicate fwd and hint errors. | |
| 706 | ||
| 707 | 28 January 2013: Wouter | |
| 708 | - updated fwd_zero for newer nc. Updated common.sh for newer netstat. | |
| 709 | ||
| 710 | 17 January 2013: Wouter | |
| 711 | - unbound-anchors checks the emailAddress of the signer of the | |
| 712 | root.xml file, default is dnssec@iana.org. It also checks that | |
| 713 | the signer has the correct key usage for a digital signature. | |
| 714 | - update iana port list. | |
| 715 | ||
| 716 | 3 January 2013: Wouter | |
| 717 | - Test that unbound-control checks client credentials. | |
| 718 | - Test that unbound can handle a CNAME at an intermediate node in | |
| 719 | the chain of trust (where it seeks a DS record). | |
| 720 | - Check the commonName of the signer of the root.xml file in | |
| 721 | unbound-anchor, default is dnssec@iana.org. | |
| 722 | ||
| 723 | 2 January 2013: Wouter | |
| 724 | - Fix openssl lock free on exit (reported by Robert Fleischman). | |
| 725 | - iana portlist updated. | |
| 726 | - Tested that unbound implements the RFC5155 Technical Errata id 3441. | |
| 727 | Unbound already implements insecure classification of an empty | |
| 728 | nonterminal in NSEC3 optout zone. | |
| 729 | ||
| 730 | 20 December 2012: Wouter | |
| 731 | - Fix unbound-anchor xml parse of entity declarations for safety. | |
| 732 | ||
| 733 | 19 December 2012: Wouter | |
| 734 | - iana portlist updated. | |
| 735 | ||
| 736 | 18 December 2012: Wouter | |
| 737 | - iana portlist updated. | |
| 738 | ||
| 739 | 14 December 2012: Wouter | |
| 740 | - Change of D.ROOT-SERVERS.NET A address in default root hints. | |
| 741 | ||
| 742 | 12 December 2012: Wouter | |
| 743 | - 1.4.19 release. | |
| 744 | - trunk has 1.4.20 under development. | |
| 745 | ||
| 746 | 5 December 2012: Wouter | |
| 747 | - note support for AAAA RR type RFC. | |
| 748 | ||
| 749 | 4 December 2012: Wouter | |
| 750 | - 1.4.19rc1 tag. | |
| 751 | ||
| 752 | 30 November 2012: Wouter | |
| 753 | - bug 481: fix python example0. | |
| 754 | - iana portlist updated. | |
| 755 | ||
| 756 | 27 November 2012: Wouter | |
| 757 | - iana portlist updated. | |
| 758 | ||
| 759 | 9 November 2012: Wouter | |
| 760 | - Fix unbound-control forward disables configured stubs below it. | |
| 761 | ||
| 762 | 7 November 2012: Wouter | |
| 763 | - Fixup ldns-testpkts, identical to ldns/examples. | |
| 764 | - iana portlist updated. | |
| 765 | ||
| 766 | 30 October 2012: Wouter | |
| 767 | - Fix bug #477: unbound-anchor segfaults if EDNS is blocked. | |
| 768 | ||
| 769 | 29 October 2012: Matthijs | |
| 770 | - Fix validation for responses with both CNAME and wildcard | |
| 771 | expanded CNAME records in answer section. | |
| 772 | ||
| 773 | 8 October 2012: Wouter | |
| 774 | - update ldns-testpkts.c to ldns 1.6.14 version. | |
| 775 | - fix build of pythonmod in objdir, for unbound.py. | |
| 776 | - make clean and makerealclean remove generated python and docs. | |
| 777 | ||
| 778 | 5 October 2012: Wouter | |
| 779 | - fix build of pythonmod in objdir (thanks Jakob Schlyter). | |
| 780 | ||
| 781 | 3 October 2012: Wouter | |
| 782 | - fix text in unbound-anchor man page. | |
| 783 | ||
| 784 | 1 October 2012: Wouter | |
| 785 | - ignore trusted-keys globs that have no files (from Paul Wouters). | |
| 786 | ||
| 787 | 27 September 2012: Wouter | |
| 788 | - include: directive in config file accepts wildcards. Patch from | |
| 789 | Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*" | |
| 790 | - unbound-control -q option is quiet, patch from Mariano Absatz. | |
| 791 | - iana portlist updated. | |
| 792 | - updated contrib/unbound.spec, patch from Valentin Bud. | |
| 793 | ||
| 794 | 21 September 2012: Wouter | |
| 795 | - chdir to / after chroot call (suggested by Camiel Dobbelaar). | |
| 796 | ||
| 797 | 17 September 2012: Wouter | |
| 798 | - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation | |
| 799 | otherwise it is treated as insecure. The RSAMD5 algorithm is | |
| 800 | deprecated (RFC6725). The MD5 hash is considered weak for some | |
| 801 | purposes, if you want to sign your zone, then RSASHA256 is an | |
| 802 | uncontested hash. | |
| 803 | ||
| 804 | 30 August 2012: Wouter | |
| 805 | - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled. | |
| 806 | - iana portlist updated. | |
| 807 | ||
| 808 | 29 August 2012: Wouter | |
| 809 | - Nicer comments outgoing-port-avoid, thanks Stu (bug #465). | |
| 810 | ||
| 811 | 22 August 2012: Wouter | |
| 812 | - Fallback to 1472 and 1232, one fragment size without headers. | |
| 813 | ||
| 814 | 21 August 2012: Wouter | |
| 815 | - Fix timeouts so that when a server has been offline for a while | |
| 816 | and is probed to see it works, it becomes fully available for | |
| 817 | server selection again. | |
| 818 | ||
| 819 | 17 August 2012: Wouter | |
| 820 | - Add documentation to libunbound for default nonuse of resolv.conf. | |
| 821 | ||
| 822 | 2 August 2012: Wouter | |
| 823 | - trunk has 1.4.19 under development (fixes from 1 aug and 31 july | |
| 824 | are for 1.4.19). | |
| 825 | - iana portlist updated. | |
| 826 | ||
| 827 | 1 August 2012: Wouter | |
| 828 | - Fix openssl race condition, initializes openssl locks, reported | |
| 829 | by Einar Lonn and Patrik Wallstrom. | |
| 830 | ||
| 831 | 31 July 2012: Wouter | |
| 832 | - Improved forward-first and stub-first documentation. | |
| 833 | - Fix that enables modules to register twice for the same | |
| 834 | serviced_query, without race conditions or administration issues. | |
| 835 | This should not happen with the current codebase, but it is robust. | |
| 836 | - Fix forward-first option where it sets the RD flag wrongly. | |
| 837 | - added manpage links for libunbound calls (Thanks Paul Wouters). | |
| 838 | ||
| 839 | 30 July 2012: Wouter | |
| 840 | - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012). | |
| 841 | ||
| 842 | 27 July 2012: Wouter | |
| 843 | - unbound-host works with libNSS | |
| 844 | - fix bogus nodata cname chain not reported as bogus by validator, | |
| 845 | (Thanks Peter van Dijk). | |
| 846 | ||
| 847 | 26 July 2012: Wouter | |
| 848 | - iana portlist updated. | |
| 849 | - tag 1.4.18rc1. | |
| 850 | ||
| 851 | 25 July 2012: Wouter | |
| 852 | - review fix for libnss, check hash prefix allocation size. | |
| 853 | ||
| 854 | 23 July 2012: Wouter | |
| 855 | - fix missing break for GOST DS hash function. | |
| 856 | - implemented forward_first for the root. | |
| 857 | ||
| 858 | 20 July 2012: Wouter | |
| 859 | - Fix bug#452 and another assertion failure in mesh.c, makes | |
| 860 | assertions in mesh.c resist duplicates. Fixes DS NS search to | |
| 861 | not generate duplicate sub queries. | |
| 862 | ||
| 863 | 19 July 2012: Willem | |
| 864 | - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac, | |
| 865 | if CFLAGS is specified at configure time then '-g -O2' is not | |
| 866 | appended to CFLAGS, so that the user can override them. | |
| 867 | ||
| 868 | 18 July 2012: Willem | |
| 869 | - Fix libunbound report of errors when in background mode. | |
| 870 | ||
| 871 | 11 July 2012: Willem | |
| 872 | - updated iana ports list. | |
| 873 | ||
| 874 | 9 July 2012: Willem | |
| 875 | - Add flush_bogus option for unbound-control | |
| 876 | ||
| 877 | 6 July 2012: Wouter | |
| 878 | - Fix validation of qtype DS queries that result in no data for | |
| 879 | non-optout NSEC3 zones. | |
| 880 | ||
| 881 | 4 July 2012: Wouter | |
| 882 | - compile libunbound with libnss on Suse, passes regression tests. | |
| 883 | ||
| 884 | 3 July 2012: Wouter | |
| 885 | - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes. | |
| 886 | ||
| 887 | 2 July 2012: Wouter | |
| 888 | - updated iana ports list. | |
| 889 | ||
| 890 | 29 June 2012: Wouter | |
| 891 | - patch for unbound_munin_ script to handle arbitrary thread count by | |
| 892 | Sven Ulland. | |
| 893 | ||
| 894 | 28 June 2012: Wouter | |
| 895 | - detect if openssl has FIPS_mode. | |
| 896 | - code review: return value of cache_store can be ignored for better | |
| 897 | performance in out of memory conditions. | |
| 898 | - fix edns-buffer-size and msg-buffer-size manpage documentation. | |
| 899 | - updated iana ports list. | |
| 900 | ||
| 901 | 25 June 2012: Wouter | |
| 902 | - disable RSAMD5 if in FIPS mode (for openssl and for libnss). | |
| 903 | ||
| 904 | 22 June 2012: Wouter | |
| 905 | - implement DS records, NSEC3 and ECDSA for compile with libnss. | |
| 906 | ||
| 907 | 21 June 2012: Wouter | |
| 908 | - fix error handling of alloc failure during rrsig verification. | |
| 909 | - nss check for verification failure. | |
| 910 | - nss crypto works for RSA and DSA. | |
| 911 | ||
| 912 | 20 June 2012: Wouter | |
| 913 | - work on --with-nss build option (for now, --with-libunbound-only). | |
| 914 | ||
| 915 | 19 June 2012: Wouter | |
| 916 | - --with-libunbound-only build option, only builds the library and | |
| 917 | not the daemon and other tools. | |
| 918 | ||
| 919 | 18 June 2012: Wouter | |
| 920 | - code review. | |
| 921 | ||
| 922 | 15 June 2012: Wouter | |
| 923 | - implement log-time-ascii on windows. | |
| 924 | - The key-cache bad key ttl is now 60 seconds. | |
| 925 | - updated iana ports list. | |
| 926 | - code review. | |
| 927 | ||
| 928 | 11 June 2012: Wouter | |
| 929 | - bug #452: fix crash on assert in mesh_state_attachment. | |
| 930 | ||
| 931 | 30 May 2012: Wouter | |
| 932 | - silence warning from swig-generated code (md set but not used in | |
| 933 | swig initmodule, due to ifdefs in swig-generated code). | |
| 934 | ||
| 935 | 27 May 2012: Wouter | |
| 936 | - Fix debian-bugs-658021: Please enable hardened build flags. | |
| 937 | ||
| 938 | 25 May 2012: Wouter | |
| 939 | - updated iana ports list. | |
| 940 | ||
| 941 | 24 May 2012: Wouter | |
| 942 | - tag for 1.4.17 release. | |
| 943 | - trunk is 1.4.18 in development. | |
| 944 | ||
| 945 | 18 May 2012: Wouter | |
| 946 | - Review comments, removed duplicate memset to zero in delegpt. | |
| 947 | ||
| 948 | 16 May 2012: Wouter | |
| 949 | - Updated doc/FEATURES with RFCs that are implemented but not listed. | |
| 950 | - Protect if statements in val_anchor for compile without locks. | |
| 951 | - tag for 1.4.17rc1. | |
| 952 | ||
| 953 | 15 May 2012: Wouter | |
| 954 | - fix configure ECDSA support in ldns detection for windows compile. | |
| 955 | - fix possible uninitialised variable in windows pipe implementation. | |
| 956 | ||
| 957 | 9 May 2012: Wouter | |
| 958 | - Fix alignment problem in util/random on sparc64/freebsd. | |
| 959 | ||
| 960 | 8 May 2012: Wouter | |
| 961 | - Fix for accept spinning reported by OpenBSD. | |
| 962 | - iana portlist updated. | |
| 963 | ||
| 964 | 2 May 2012: Wouter | |
| 965 | - Fix validation of nodata for DS query in NSEC zones, reported by | |
| 966 | Ondrej Mikle. | |
| 967 | ||
| 968 | 13 April 2012: Wouter | |
| 969 | - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older | |
| 970 | openssl. | |
| 971 | ||
| 972 | 10 April 2012: Wouter | |
| 973 | - Applied patch from Daisuke HIGASHI for rrset-roundrobin and | |
| 974 | minimal-responses features. | |
| 975 | - iana portlist updated. | |
| 976 | ||
| 977 | 5 April 2012: Wouter | |
| 978 | - fix bug #443: --with-chroot-dir not honoured by configure. | |
| 979 | - fix bug #444: setusercontext was called too late (thanks Bjorn | |
| 980 | Ketelaars). | |
| 981 | ||
| 982 | 27 March 2012: Wouter | |
| 983 | - fix bug #442: Fix that Makefile depends on pythonmod headers | |
| 984 | even using --without-pythonmodule. | |
| 985 | ||
| 986 | 22 March 2012: Wouter | |
| 987 | - contrib/validation-reporter follows rotated log file (patch from | |
| 988 | Augie Schwer). | |
| 989 | ||
| 990 | 21 March 2012: Wouter | |
| 991 | - new approach to NS fetches for DS lookup that works with | |
| 992 | cornercases, and is more robust and considers forwarders. | |
| 993 | ||
| 994 | 19 March 2012: Wouter | |
| 995 | - iana portlist updated. | |
| 996 | - fix to locate nameservers for DS lookup with NS fetches. | |
| 997 | ||
| 998 | 16 March 2012: Wouter | |
| 999 | - Patch for access to full DNS packet data in unbound python module | |
| 1000 | from Ondrej Mikle. | |
| 1001 | ||
| 1002 | 9 March 2012: Wouter | |
| 1003 | - Applied line-buffer patch from Augie Schwer to validation.reporter.sh. | |
| 1004 | ||
| 1005 | 2 March 2012: Wouter | |
| 1006 | - flush_infra cleans timeouted servers from the cache too. | |
| 1007 | - removed warning from --enable-ecdsa. | |
| 1008 | ||
| 1009 | 1 March 2012: Wouter | |
| 1010 | - forward-first option. Tries without forward if a query fails. | |
| 1011 | Also stub-first option that is similar. | |
| 1012 | ||
| 1013 | 28 February 2012: Wouter | |
| 1014 | - Fix from code review, if EINPROGRESS not defined chain if statement | |
| 1015 | differently. | |
| 1016 | ||
| 1017 | 27 February 2012: Wouter | |
| 1018 | - Fix bug#434: on windows check registry for config file location | |
| 1019 | for unbound-control.exe, and unbound-checkconf.exe. | |
| 1020 | ||
| 1021 | 23 February 2012: Wouter | |
| 1022 | - Fix to squelch 'network unreachable' errors from tcp connect in | |
| 1023 | logs, high verbosity will show them. | |
| 1024 | ||
| 1025 | 16 February 2012: Wouter | |
| 1026 | - iter_hints is now thread-owned in module env, and thus threadsafe. | |
| 1027 | - Fix prefetch and sticky NS, now the prefetch works. It picks | |
| 1028 | nameservers that 'would be valid in the future', and if this makes | |
| 1029 | the NS timeout, it updates that NS by asking delegation from the | |
| 1030 | parent again. If child NS has longer TTL, that TTL does not get | |
| 1031 | refreshed from the lookup to the child nameserver. | |
| 1032 | ||
| 1033 | 15 February 2012: Wouter | |
| 1034 | - Fix forward-zone memory, uses malloc and frees original root dp. | |
| 1035 | - iter hints (stubs) uses malloc inside for more dynamicity. | |
| 1036 | - unbound-control forward_add, forward_remove, stub_add, stub_remove | |
| 1037 | can modify stubs and forwards for running unbound (on mobile computer) | |
| 1038 | they can also add and remove domain-insecure for the zone. | |
| 1039 | ||
| 1040 | 14 February 2012: Wouter | |
| 1041 | - Fix sticky NS (ghost domain problem) if prefetch is yes. | |
| 1042 | - iter forwards uses malloc inside for more dynamicity. | |
| 1043 | ||
| 1044 | 13 February 2012: Wouter | |
| 1045 | - RT#2955. Fix for cygwin compilation. | |
| 1046 | - iana portlist updated. | |
| 1047 | ||
| 1048 | 10 February 2012: Wouter | |
| 1049 | - Slightly smaller critical region in one case in infra cache. | |
| 1050 | - Fix timeouts to keep track of query type, A, AAAA and other, if | |
| 1051 | another has caused timeout blacklist, different type can still probe. | |
| 1052 | - unit test fix for nomem_cnametopos.rpl race condition. | |
| 1053 | ||
| 1054 | 9 February 2012: Wouter | |
| 1055 | - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h. | |
| 1056 | ||
| 1057 | 8 February 2012: Wouter | |
| 1058 | - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This | |
| 1059 | implementation is experimental at this time and not recommended | |
| 1060 | for use on the public internet (the protocol numbers have not | |
| 1061 | been assigned). Needs recent ldns with --enable-ecdsa. | |
| 1062 | - fix memory leak in errorcase for DSA signatures. | |
| 1063 | - iana portlist updated. | |
| 1064 | - workaround for openssl 0.9.8 ecdsa sha2 and evp problem. | |
| 1065 | ||
| 1066 | 3 February 2012: Wouter | |
| 1067 | - fix for windows, rename() is not posix compliant on windows. | |
| 1068 | ||
| 1069 | 2 February 2012: Wouter | |
| 1070 | - 1.4.16 release tag. | |
| 1071 | - svn trunk is 1.4.17 in development. | |
| 1072 | - iana portlist updated. | |
| 1073 | ||
| 1074 | 1 February 2012: Wouter | |
| 1075 | - Fix validation failures (like: validation failure xx: no NSEC3 | |
| 1076 | closest encloser from yy for DS zz. while building chain of trust, | |
| 1077 | because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata | |
| 1078 | for an NSEC3. Now it does not change rdata, and fixes TTL. | |
| 1079 | ||
| 1080 | 30 January 2012: Wouter | |
| 1081 | - Fix version-number in libtool to be version-info so it produces | |
| 1082 | libunbound.so.2 like it should. | |
| 1083 | ||
| 1084 | 26 January 2012: Wouter | |
| 1085 | - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release. | |
| 1086 | - trunk 1.4.16; includes changes memset testcode, #424 openindiana, | |
| 1087 | and keyfile write fixup. | |
| 1088 | - applied patch to support outgoing-interface with ub_ctx_set_option. | |
| 1089 | ||
| 1090 | 23 January 2012: Wouter | |
| 1091 | - Fix memset in test code. | |
| 1092 | ||
| 1093 | 20 January 2012: Wouter | |
| 1094 | - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2. | |
| 1095 | ||
| 1096 | 19 January 2012: Wouter | |
| 1097 | - Fix to write key files completely to a temporary file, and if that | |
| 1098 | succeeds, replace the real key file. So failures leave a useful file. | |
| 1099 | ||
| 1100 | 18 January 2012: Wouter | |
| 1101 | - tag 1.4.15rc1 created | |
| 1102 | - updated libunbound/ubsyms.def and remade tag 1.4.15rc1. | |
| 1103 | ||
| 1104 | 17 January 2012: Wouter | |
| 1105 | - Fix bug where canonical_compare of RRSIG did not downcase the | |
| 1106 | signer-name. This is mostly harmless because RRSIGs do not have | |
| 1107 | to be sorted in canonical order, usually. | |
| 1108 | ||
| 1109 | 12 January 2012: Wouter | |
| 1110 | - bug#428: add ub_version() call to libunbound. API version increase, | |
| 1111 | with (binary) backwards compatibility for the previous version. | |
| 1112 | ||
| 1113 | 10 January 2012: Wouter | |
| 1114 | - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL | |
| 1115 | that would be permissible by the RFCs but it is not the TTL in the | |
| 1116 | cache. | |
| 1117 | - iana portlist updated. | |
| 1118 | - uninitialised variable in reprobe for rtt blocked domains fixed. | |
| 1119 | - lintfix and new flex output. | |
| 1120 | ||
| 1121 | 2 January 2012: Wouter | |
| 1122 | - Fix to randomize hash function, based on 28c3 congress, reported | |
| 1123 | by Peter van Dijk. | |
| 1124 | ||
| 1125 | 24 December 2011: Wouter | |
| 1126 | - Fix for memory leak (about 20 bytes when a tcp or udp send operation | |
| 1127 | towards authority servers failed, takes about 50.000 such failures to | |
| 1128 | leak one Mb, such failures are also usually logged), reported by | |
| 1129 | Robert Fleischmann. | |
| 1130 | - iana portlist updated. | |
| 1131 | ||
| 1132 | 19 December 2011: Wouter | |
| 1133 | - Fix for VU#209659 CVE-2011-4528: Unbound denial of service | |
| 1134 | vulnerabilities from nonstandard redirection and denial of existence | |
| 1135 | http://www.unbound.net/downloads/CVE-2011-4528.txt | |
| 1136 | - robust checks for next-closer NSEC3s. | |
| 1137 | - tag 1.4.14 created. | |
| 1138 | - trunk has 1.4.15 in development. | |
| 1139 | ||
| 1140 | 15 December 2011: Wouter | |
| 1141 | - remove uninit warning from cachedump code. | |
| 1142 | - Fix parse error on negative SOA RRSIGs if badly ordered in the packet. | |
| 1143 | ||
| 1144 | 13 December 2011: Wouter | |
| 1145 | - iana portlist updated. | |
| 1146 | - svn tag 1.4.14rc1 | |
| 1147 | - fix infra cache comparison. | |
| 1148 | - Fix to constrain signer_name to be a parent of the lookupname. | |
| 1149 | ||
| 1150 | 5 December 2011: Wouter | |
| 1151 | - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc. | |
| 1152 | - Fix warnings with gcc 4.6 in compat/inet_ntop.c. | |
| 1153 | - Fix warning unused in compat/strptime.c. | |
| 1154 | - Fix malloc detection and double defintion. | |
| 1155 | ||
| 1156 | 2 December 2011: Wouter | |
| 1157 | - configure generated with autoconf 2.68. | |
| 1158 | ||
| 1159 | 30 November 2011: Wouter | |
| 1160 | - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes | |
| 1161 | SERVFAILs. Also fixed for UDP (but less likely). | |
| 1162 | ||
| 1163 | 28 November 2011: Wouter | |
| 1164 | - Fix quartile time estimate, it was too low, (thanks Jan Komissar). | |
| 1165 | - iana ports updated. | |
| 1166 | ||
| 1167 | 11 November 2011: Wouter | |
| 1168 | - Makefile compat with SunOS make, BSD make and GNU make. | |
| 1169 | - iana ports updated. | |
| 1170 | ||
| 1171 | 10 November 2011: Wouter | |
| 1172 | - Makefile changed for BSD make compatibility. | |
| 1173 | ||
| 1174 | 9 November 2011: Wouter | |
| 1175 | - added unit test for SSL service and SSL-upstream. | |
| 1176 | ||
| 1177 | 8 November 2011: Wouter | |
| 1178 | - can configure ssl service to one port number, and not on others. | |
| 1179 | - fixup windows compile with ssl support. | |
| 1180 | - Fix double free in unbound-host, reported by Steve Grubb. | |
| 1181 | - iana portlist updated. | |
| 1182 | ||
| 1183 | 1 November 2011: Wouter | |
| 1184 | - dns over ssl support as a client, ssl-upstream yes turns it on. | |
| 1185 | It performs an SSL transaction for every DNS query (250 msec). | |
| 1186 | - documentation for new options: ssl-upstream, ssl-service-key and | |
| 1187 | ssl-service.pem. | |
| 1188 | - iana portlist updated. | |
| 1189 | - fix -flto detection on Lion for llvm-gcc. | |
| 1190 | ||
| 1191 | 31 October 2011: Wouter | |
| 1192 | - dns over ssl support, ssl-service-pem and ssl-service-key files | |
| 1193 | can be given and then TCP queries are serviced wrapped in SSL. | |
| 1194 | ||
| 1195 | 27 October 2011: Wouter | |
| 1196 | - lame-ttl and lame-size options no longer exist, it is integrated | |
| 1197 | with the host info. They are ignored (with verbose warning) if | |
| 1198 | encountered to keep the config file backwards compatible. | |
| 1199 | - fix iana-update for changing gzip compression of results. | |
| 1200 | - fix export-all-symbols on OSX. | |
| 1201 | ||
| 1202 | 26 October 2011: Wouter | |
| 1203 | - iana portlist updated. | |
| 1204 | - Infra cache stores information about ping and lameness per IP, zone. | |
| 1205 | This fixes bug #416. | |
| 1206 | - fix iana_update target for gzipped file on iana site. | |
| 1207 | ||
| 1208 | 24 October 2011: Wouter | |
| 1209 | - Fix resolve of partners.extranet.microsoft.com with a fix for the | |
| 1210 | server selection for choosing out of a (particular) list of bad | |
| 1211 | choices. (bug#415) | |
| 1212 | - Fix make_new_space function so that the incoming query is not | |
| 1213 | overwritten if a jostled out query causes a waiting query to be | |
| 1214 | resumed that then fails and sends an error message. (Thanks to | |
| 1215 | Matthew Lee). | |
| 1216 | ||
| 1217 | 21 October 2011: Wouter | |
| 1218 | - fix --enable-allsymbols, fptr wlist is disabled on windows with this | |
| 1219 | option enabled because of memory layout exe vs dll. | |
| 1220 | ||
| 1221 | 19 October 2011: Wouter | |
| 1222 | - fix unbound-anchor for broken strptime on OSX lion, detected | |
| 1223 | in configure. | |
| 1224 | - Detect if GOST really works, openssl1.0 on OSX fails. | |
| 1225 | - Implement ipv6%interface notation for scope_id usage. | |
| 1226 | ||
| 1227 | 17 October 2011: Wouter | |
| 1228 | - better documentation for inform_super (Thanks Yang Zhe). | |
| 1229 | ||
| 1230 | 14 October 2011: Wouter | |
| 1231 | - Fix for out-of-memory condition in libunbound (thanks | |
| 1232 | Robert Fleischman). | |
| 1233 | ||
| 1234 | 13 October 2011: Wouter | |
| 1235 | - Fix --enable-allsymbols, it depended on link specifics of the | |
| 1236 | target platform, or fptr_wlist assertion failures could occur. | |
| 1237 | ||
| 1238 | 12 October 2011: Wouter | |
| 1239 | - updated contrib/unbound_munin_ to family=auto so that it works with | |
| 1240 | munin-node-configure automatically (if installed as | |
| 1241 | /usr/local/share/munin/plugins/unbound_munin_ ). | |
| 1242 | ||
| 1243 | 27 September 2011: Wouter | |
| 1244 | - unbound.exe -w windows option for start and stop service. | |
| 1245 | ||
| 1246 | 23 September 2011: Wouter | |
| 1247 | - TCP-upstream calculates tcp-ping so server selection works if there | |
| 1248 | are alternatives. | |
| 1249 | ||
| 1250 | 20 September 2011: Wouter | |
| 1251 | - Fix classification of NS set in answer section, where there is a | |
| 1252 | parent-child server, and the answer has the AA flag for dir.slb.com. | |
| 1253 | Thanks to Amanda Constant from Secure64. | |
| 1254 | ||
| 1255 | 16 September 2011: Wouter | |
| 1256 | - fix bug #408: accept patch from Steve Snyder that comments out | |
| 1257 | unused functions in lookup3.c. | |
| 1258 | - iana portlist updated. | |
| 1259 | - fix EDNS1480 change memleak and TCP fallback. | |
| 1260 | - fix various compiler warnings (reported by Paul Wouters). | |
| 1261 | - max sent count. EDNS1480 only for rtt < 5000. No promiscuous | |
| 1262 | fetch if sentcount > 3, stop query if sentcount > 16. Count is | |
| 1263 | reset when referral or CNAME happens. This makes unbound better | |
| 1264 | at managing large NS sets, they are explored when there is continued | |
| 1265 | interest (in the form of queries). | |
| 1266 | ||
| 1267 | 15 September 2011: Wouter | |
| 1268 | - release 1.4.13. | |
| 1269 | - trunk contains 1.4.14 in development. | |
| 1270 | - Unbound probes at EDNS1480 if there an EDNS0 timeout. | |
| 1271 | ||
| 1272 | 12 September 2011: Wouter | |
| 1273 | - Reverted dns EDNS backoff fix, it did not help and needs | |
| 1274 | fragmentation fixes instead. | |
| 1275 | - tag 1.4.13rc2 | |
| 1276 | ||
| 1277 | 7 September 2011: Wouter | |
| 1278 | - Fix operation in ipv6 only (do-ip4: no) mode. | |
| 1279 | ||
| 1280 | 6 September 2011: Wouter | |
| 1281 | - fedora specfile updated. | |
| 1282 | ||
| 1283 | 5 September 2011: Wouter | |
| 1284 | - tag 1.4.13rc1 | |
| 1285 | ||
| 1286 | 2 September 2011: Wouter | |
| 1287 | - iana portlist updated. | |
| 1288 | ||
| 1289 | 26 August 2011: Wouter | |
| 1290 | - Fix num-threads 0 does not segfault, reported by Simon Deziel. | |
| 1291 | - Fix validation failures due to EDNS backoff retries, the retry | |
| 1292 | for fetch of data has want_dnssec because the iter_indicate_dnssec | |
| 1293 | function returns true when validation failure retry happens, and | |
| 1294 | then the serviced query code does not fallback to noEDNS, even if | |
| 1295 | the cache says it has this. This helps for DLV deployment when | |
| 1296 | the DNSSEC status is not known for sure before the lookup concludes. | |
| 1297 | ||
| 1298 | 24 August 2011: Wouter | |
| 1299 | - Applied patch from Karel Slany that fixes a memory leak in the | |
| 1300 | unbound python module, in string conversions. | |
| 1301 | ||
| 1302 | 22 August 2011: Wouter | |
| 1303 | - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy | |
| 1304 | Zhang and Luo Ce). Unbound responds with the RR types that are | |
| 1305 | available at the name for qtype ANY and validates those RR types. | |
| 1306 | It does not test for completeness (i.e. with NSEC or NSEC3 query), | |
| 1307 | and it does not follow the CNAME or DNAME to another name (with | |
| 1308 | even more data for the already large response). | |
| 1309 | - Fix that internally, CNAMEs with NXDOMAIN have that as rcode. | |
| 1310 | - Documented the options that work with control set_option command. | |
| 1311 | - tcp-upstream yes/no option (works with set_option) for tunnels. | |
| 1312 | ||
| 1313 | 18 August 2011: Wouter | |
| 1314 | - fix autoconf call in makedist crosscompile to RC or snapshot. | |
| 1315 | ||
| 1316 | 17 August 2011: Wouter | |
| 1317 | - Fix validation of . DS query. | |
| 1318 | - new xml format at IANA, new awk for iana_update. | |
| 1319 | - iana portlist updated. | |
| 1320 | ||
| 1321 | 10 August 2011: Wouter | |
| 1322 | - Fix python site-packages path to /usr/lib64. | |
| 1323 | - updated patch from Tom. | |
| 1324 | - fix memory and fd leak after out-of-memory condition. | |
| 1325 | ||
| 1326 | 9 August 2011: Wouter | |
| 1327 | - patch from Tom Hendrikx fixes load of python modules. | |
| 1328 | ||
| 1329 | 8 August 2011: Wouter | |
| 1330 | - make clean had ldns-src reference, removed. | |
| 1331 | ||
| 1332 | 1 August 2011: Wouter | |
| 1333 | - Fix autoconf 2.68 warnings | |
| 1334 | ||
| 1335 | 14 July 2011: Wouter | |
| 1336 | - Unbound implements RFC6303 (since version 1.4.7). | |
| 1337 | - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the | |
| 1338 | meantime, those are for 1.4.13). | |
| 1339 | - iana portlist updated. | |
| 1340 | ||
| 1341 | 13 July 2011: Wouter | |
| 1342 | - Quick fix for contrib/unbound.spec example, no ldns-builtin any more. | |
| 1343 | ||
| 1344 | 11 July 2011: Wouter | |
| 1345 | - Fix wildcard expansion no-data reply under an optout NSEC3 zone is | |
| 1346 | validated as insecure, reported by Jia Li (lijia@cnnic.cn). | |
| 1347 | ||
| 1348 | 4 July 2011: Wouter | |
| 1349 | - 1.4.12rc1 tag created. | |
| 1350 | ||
| 1351 | 1 July 2011: Wouter | |
| 1352 | - version number in example config file. | |
| 1353 | - fix that --enable-static-exe does not complain about it unknown. | |
| 1354 | ||
| 1355 | 30 June 2011: Wouter | |
| 1356 | - tag relase 1.4.11, trunk is 1.4.12 development. | |
| 1357 | - iana portlist updated. | |
| 1358 | - fix bug#395: id bits of other query may leak out under conditions | |
| 1359 | - fix replyaddr count wrong after jostled queries, which leads to | |
| 1360 | eventual starvation where the daemon has no replyaddrs left to use. | |
| 1361 | - fix comment about rndc port, that referred to the old port number. | |
| 1362 | - fix that the listening socket is not closed when too many remote | |
| 1363 | control connections are made at the same time. | |
| 1364 | - removed ldns-src tarball inside the unbound tarball. | |
| 1365 | ||
| 1366 | 23 June 2011: Wouter | |
| 1367 | - Changed -flto check to support clang compiler. | |
| 1368 | - tag 1.4.11rc3 created. | |
| 1369 | ||
| 1370 | 17 June 2011: Wouter | |
| 1371 | - tag 1.4.11rc1 created. | |
| 1372 | - remove warning about signed/unsigned from flex (other flex version). | |
| 1373 | - updated aclocal.m4 and libtool to match. | |
| 1374 | - tag 1.4.11rc2 created. | |
| 1375 | ||
| 1376 | 16 June 2011: Wouter | |
| 1377 | - log-queries: yesno option, default is no, prints querylog. | |
| 1378 | - version is 1.4.11. | |
| 1379 | ||
| 1380 | 14 June 2011: Wouter | |
| 1381 | - Use -flto compiler flag for link time optimization, if supported. | |
| 1382 | - iana portlist updated. | |
| 1383 | ||
| 1384 | 12 June 2011: Wouter | |
| 1385 | - IPv6 service address for d.root-servers.net (2001:500:2D::D). | |
| 1386 | ||
| 1387 | 10 June 2011: Wouter | |
| 1388 | - unbound-control has version number in the header, | |
| 1389 | UBCT[version]_space_ is the header sent by the client now. | |
| 1390 | - Unbound control port number is registered with IANA: | |
| 1391 | ub-dns-control 8953/tcp unbound dns nameserver control | |
| 1392 | This is the new default for the control-port config setting. | |
| 1393 | - statistics-interval prints the number of jostled queries to log. | |
| 1394 | ||
| 1395 | 30 May 2011: Wouter | |
| 1396 | - Fix Makefile for U in environment, since wrong U is more common than | |
| 1397 | deansification necessity. | |
| 1398 | - iana portlist updated. | |
| 1399 | - updated ldns tarball to 1.6.10rc2 snapshot of today. | |
| 1400 | ||
| 1401 | 25 May 2011: Wouter | |
| 1402 | - Fix assertion failure when unbound generates an empty error reply | |
| 1403 | in response to a query, CVE-2011-1922 VU#531342. | |
| 1404 | - This fix is in tag 1.4.10. | |
| 1405 | - defense in depth against the above bug, an error is printed to log | |
| 1406 | instead of an assertion failure. | |
| 1407 | ||
| 1408 | 10 May 2011: Wouter | |
| 1409 | - bug#386: --enable-allsymbols option links all binaries to libunbound | |
| 1410 | and reduces install size significantly. | |
| 1411 | - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers. | |
| 1412 | - iana portlist updated. | |
| 1413 | - Fix TTL of SOA so negative TTL is separately cached from normal TTL. | |
| 1414 | ||
| 1415 | 14 April 2011: Wouter | |
| 1416 | - configure created with newer autoconf 2.66. | |
| 1417 | ||
| 1418 | 12 April 2011: Wouter | |
| 1419 | - bug#378: Fix that configure checks for ldns_get_random presence. | |
| 1420 | ||
| 1421 | 8 April 2011: Wouter | |
| 1422 | - iana portlist updated. | |
| 1423 | - queries with CD flag set cause DNSSEC validation, but the answer is | |
| 1424 | not withheld if it is bogus. Thus, unbound will retry if it is bad | |
| 1425 | and curb the TTL if it is bad, thus protecting the cache for use by | |
| 1426 | downstream validators. | |
| 1427 | - val-override-date: -1 ignores dates entirely, for NTP usage. | |
| 1428 | ||
| 1429 | 29 March 2011: Wouter | |
| 1430 | - harden-below-nxdomain: changed so that it activates when the | |
| 1431 | cached nxdomain is dnssec secure. This avoids backwards | |
| 1432 | incompatibility because those old servers do not have dnssec. | |
| 1433 | ||
| 1434 | 24 March 2011: Wouter | |
| 1435 | - iana portlist updated. | |
| 1436 | - release 1.4.9. | |
| 1437 | - trunk is 1.5.0 | |
| 1438 | ||
| 1439 | 17 March 2011: Wouter | |
| 1440 | - bug#370: new unbound.spec for CentOS 5.x from Harold Jones. | |
| 1441 | Applied but did not do the --disable-gost. | |
| 1442 | ||
| 1443 | 10 March 2011: Wouter | |
| 1444 | - tag 1.4.9 release candidate 1 created. | |
| 1445 | ||
| 1446 | 3 March 2011: Wouter | |
| 1447 | - updated ldns to today. | |
| 1448 | ||
| 1449 | 1 March 2011: Wouter | |
| 1450 | - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout. | |
| 1451 | - give config parse error for multiple names on a stub or forward zone. | |
| 1452 | - updated ldns tarball to 1.6.9(todays snapshot). | |
| 1453 | ||
| 1454 | 24 February 2011: Wouter | |
| 1455 | - bug #361: Fix, time.elapsed variable not reset with stats_noreset. | |
| 1456 | ||
| 1457 | 23 February 2011: Wouter | |
| 1458 | - iana portlist updated. | |
| 1459 | - common.sh to version 3. | |
| 1460 | ||
| 1461 | 18 February 2011: Wouter | |
| 1462 | - common.sh in testdata updated to version 2. | |
| 1463 | ||
| 1464 | 15 February 2011: Wouter | |
| 1465 | - Added explicit note on unbound-anchor usage: | |
| 1466 | Please note usage of unbound-anchor root anchor is at your own risk | |
| 1467 | and under the terms of our LICENSE (see that file in the source). | |
| 1468 | ||
| 1469 | 11 February 2011: Wouter | |
| 1470 | - iana portlist updated. | |
| 1471 | - tpkg updated with common.sh for common functionality. | |
| 1472 | ||
| 1473 | 7 February 2011: Wouter | |
| 1474 | - Added regression test for addition of a .net DS to the root, and | |
| 1475 | cache effects with different TTL for glue and DNSKEY. | |
| 1476 | - iana portlist updated. | |
| 1477 | ||
| 1478 | 28 January 2011: Wouter | |
| 1479 | - Fix remove private address does not throw away entire response. | |
| 1480 | ||
| 1481 | 24 January 2011: Wouter | |
| 1482 | - release 1.4.8 | |
| 1483 | ||
| 1484 | 19 January 2011: Wouter | |
| 1485 | - fix bug#349: no -L/usr for ldns. | |
| 1486 | ||
| 1487 | 18 January 2011: Wouter | |
| 1488 | - ldns 1.6.8 tarball included. | |
| 1489 | - release 1.4.8rc1. | |
| 1490 | ||
| 1491 | 17 January 2011: Wouter | |
| 1492 | - add get and set option for harden-below-nxdomain feature. | |
| 1493 | - iana portlist updated. | |
| 1494 | ||
| 1495 | 14 January 2011: Wouter | |
| 1496 | - Fix so a changed NS RRset does not get moved name stuck on old | |
| 1497 | server, for type NS the TTL is not increased. | |
| 1498 | ||
| 1499 | 13 January 2011: Wouter | |
| 1500 | - Fix prefetch so it does not get stuck on old server for moved names. | |
| 1501 | ||
| 1502 | 12 January 2011: Wouter | |
| 1503 | - iana portlist updated. | |
| 1504 | ||
| 1505 | 11 January 2011: Wouter | |
| 1506 | - Fix insecure CNAME sequence marked as secure, reported by Bert | |
| 1507 | Hubert. | |
| 1508 | ||
| 1509 | 10 January 2011: Wouter | |
| 1510 | - faster lruhash get_mem routine. | |
| 1511 | ||
| 1512 | 4 January 2011: Wouter | |
| 1513 | - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root. | |
| 1514 | - iana portlist updated. | |
| 1515 | ||
| 1516 | 23 December 2010: Wouter | |
| 1517 | - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept. | |
| 1518 | ||
| 1519 | 21 December 2010: Wouter | |
| 1520 | - algorithm compromise protection using the algorithms signalled in | |
| 1521 | the DS record. Also, trust anchors, DLV, and RFC5011 receive this, | |
| 1522 | and thus, if you have multiple algorithms in your trust-anchor-file | |
| 1523 | then it will now behave different than before. Also, 5011 rollover | |
| 1524 | for algorithms needs to be double-signature until the old algorithm | |
| 1525 | is revoked. | |
| 1526 | It is not an option, because I see no use to turn the security off. | |
| 1527 | - iana portlist updated. | |
| 1528 | ||
| 1529 | 17 December 2010: Wouter | |
| 1530 | - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them). | |
| 1531 | - fix validation in this case: CNAME to nodata for co-hosted opt-in | |
| 1532 | NSEC3 insecure delegation, was bogus, fixed to be insecure. | |
| 1533 | ||
| 1534 | 16 December 2010: Wouter | |
| 1535 | - Fix our 'BDS' license (typo reported by Xavier Belanger). | |
| 1536 | ||
| 1537 | 10 December 2010: Wouter | |
| 1538 | - iana portlist updated. | |
| 1539 | - review changes for unbound-anchor. | |
| 1540 | ||
| 1541 | 2 December 2010: Wouter | |
| 1542 | - feature typetransparent localzone, does not block other RR types. | |
| 1543 | ||
| 1544 | 1 December 2010: Wouter | |
| 1545 | - Fix bug#338: print address when socket creation fails. | |
| 1546 | ||
| 1547 | 30 November 2010: Wouter | |
| 1548 | - Fix storage of EDNS failures in the infra cache. | |
| 1549 | - iana portlist updated. | |
| 1550 | ||
| 1551 | 18 November 2010: Wouter | |
| 1552 | - harden-below-nxdomain option, default off (because very old | |
| 1553 | software may be incompatible). We could enable it by default in | |
| 1554 | the future. | |
| 1555 | ||
| 1556 | 17 November 2010: Wouter | |
| 1557 | - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN. | |
| 1558 | - make test output nicer. | |
| 1559 | ||
| 1560 | 15 November 2010: Wouter | |
| 1561 | - silence 'tcp connect: broken pipe' and 'net down' at low verbosity. | |
| 1562 | - iana portlist updated. | |
| 1563 | - so-sndbuf option for very busy servers, a bit like so-rcvbuf. | |
| 1564 | ||
| 1565 | 9 November 2010: Wouter | |
| 1566 | - unbound-anchor compiles with openssl 0.9.7. | |
| 1567 | ||
| 1568 | 8 November 2010: Wouter | |
| 1569 | - release tag 1.4.7. | |
| 1570 | - trunk is version 1.4.8. | |
| 1571 | - Be lenient and accept imgw.pl malformed packet (like BIND). | |
| 1572 | ||
| 1573 | 5 November 2010: Wouter | |
| 1574 | - do not synthesize a CNAME message from cache for qtype DS. | |
| 1575 | ||
| 1576 | 4 November 2010: Wouter | |
| 1577 | - Use central entropy to seed threads. | |
| 1578 | ||
| 1579 | 3 November 2010: Wouter | |
| 1580 | - Change the rtt used to probe EDNS-timeout hosts to 1000 msec. | |
| 1581 | ||
| 1582 | 2 November 2010: Wouter | |
| 1583 | - tag 1.4.7rc1. | |
| 1584 | - code review. | |
| 1585 | ||
| 1586 | 1 November 2010: Wouter | |
| 1587 | - GOST code enabled by default (RFC 5933). | |
| 1588 | ||
| 1589 | 27 October 2010: Wouter | |
| 1590 | - Fix uninit value in dump_infra print. | |
| 1591 | - Fix validation failure for parent and child on same server with an | |
| 1592 | insecure childzone and a CNAME from parent to child. | |
| 1593 | - Configure detects libev-4.00. | |
| 1594 | ||
| 1595 | 26 October 2010: Wouter | |
| 1596 | - dump_infra and flush_infra commands for unbound-control. | |
| 1597 | - no timeout backoff if meanwhile a query succeeded. | |
| 1598 | - Change of timeout code. No more lost and backoff in blockage. | |
| 1599 | At 12sec timeout (and at least 2x lost before) one probe per IP | |
| 1600 | is allowed only. At 120sec, the IP is blocked. After 15min, a | |
| 1601 | 120sec entry has a single retry packet. | |
| 1602 | ||
| 1603 | 25 October 2010: Wouter | |
| 1604 | - Configure errors if ldns is not found. | |
| 1605 | ||
| 1606 | 22 October 2010: Wouter | |
| 1607 | - Windows 7 fix for the installer. | |
| 1608 | ||
| 1609 | 21 October 2010: Wouter | |
| 1610 | - Fix bug where fallback_tcp causes wrong roundtrip and edns | |
| 1611 | observation to be noted in cache. Fix bug where EDNSprobe halted | |
| 1612 | exponential backoff if EDNS status unknown. | |
| 1613 | - new unresponsive host method, exponentially increasing block backoff. | |
| 1614 | - iana portlist updated. | |
| 1615 | ||
| 1616 | 20 October 2010: Wouter | |
| 1617 | - interface automatic works for some people with ip6 disabled. | |
| 1618 | Therefore the error check is removed, so they can use the option. | |
| 1619 | ||
| 1620 | 19 October 2010: Wouter | |
| 1621 | - Fix for request list growth, if a server has long timeout but the | |
| 1622 | lost counter is low, then its effective rtt is the one without | |
| 1623 | exponential backoff applied. Because the backoff is not working. | |
| 1624 | The lost counter can then increase and the server is blacklisted, | |
| 1625 | or the lost counter does not increase and the server is working | |
| 1626 | for some queries. | |
| 1627 | ||
| 1628 | 18 October 2010: Wouter | |
| 1629 | - iana portlist updated. | |
| 1630 | ||
| 1631 | 13 October 2010: Wouter | |
| 1632 | - Fix TCP so it uses a random outgoing-interface. | |
| 1633 | - unbound-anchor handles ADDPEND keystate. | |
| 1634 | ||
| 1635 | 11 October 2010: Wouter | |
| 1636 | - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where | |
| 1637 | the zone has a secure delegation hosted on the same server did not | |
| 1638 | verify as secure (it was insecure by mistake). | |
| 1639 | - iana portlist updated. | |
| 1640 | - ldns tarball updated (for reading cachedumps with bad RR data). | |
| 1641 | ||
| 1642 | 1 October 2010: Wouter | |
| 1643 | - test for unbound-anchor. fix for reading certs. | |
| 1644 | - Fix alloc_reg_release for longer uptime in out of memory conditions. | |
| 1645 | ||
| 1646 | 28 September 2010: Wouter | |
| 1647 | - unbound-anchor working, it creates or updates a root.key file. | |
| 1648 | Use it before you start the validator (e.g. at system boot time). | |
| 1649 | ||
| 1650 | 27 September 2010: Wouter | |
| 1651 | - iana portlist updated. | |
| 1652 | ||
| 1653 | 24 September 2010: Wouter | |
| 1654 | - bug#329: in example.conf show correct ipv4 link-local 169.254/16. | |
| 1655 | ||
| 1656 | 23 September 2010: Wouter | |
| 1657 | - unbound-anchor app, unbound requires libexpat (xml parser library). | |
| 1658 | ||
| 1659 | 22 September 2010: Wouter | |
| 1660 | - compliance with draft-ietf-dnsop-default-local-zones-14, removed | |
| 1661 | reverse ipv6 orchid prefix from builtin list. | |
| 1662 | - iana portlist updated. | |
| 1663 | ||
| 1664 | 17 September 2010: Wouter | |
| 1665 | - DLV has downgrade protection again, because the RFC says so. | |
| 1666 | - iana portlist updated. | |
| 1667 | ||
| 1668 | 16 September 2010: Wouter | |
| 1669 | - Algorithm rollover operational reality intrudes, for trust-anchor, | |
| 1670 | 5011-store, and DLV-anchor if one key matches it's good enough. | |
| 1671 | - iana portlist updated. | |
| 1672 | - Fix reported validation error in out of memory condition. | |
| 1673 | ||
| 1674 | 15 September 2010: Wouter | |
| 1675 | - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout. | |
| 1676 | ||
| 1677 | 14 September 2010: Wouter | |
| 1678 | - increased mesh-max-activation from 1000 to 3000 for crazy domains | |
| 1679 | like _tcp.slb.com with 262 servers. | |
| 1680 | - iana portlist updated. | |
| 1681 | ||
| 1682 | 13 September 2010: Wouter | |
| 1683 | - bug#327: Fix for cannot access stub zones until the root is primed. | |
| 1684 | ||
| 1685 | 9 September 2010: Wouter | |
| 1686 | - unresponsive servers are not completely blacklisted (because of | |
| 1687 | firewalls), but also not probed all the time (because of the request | |
| 1688 | list size it generates). The probe rate is 1%. | |
| 1689 | - iana portlist updated. | |
| 1690 | ||
| 1691 | 20 August 2010: Wouter | |
| 1692 | - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled. | |
| 1693 | iterator get_mem includes priv_get_mem. delegpt nodup removed. | |
| 1694 | listen_pushback, query_info_allocqname, write_socket, send_packet, | |
| 1695 | comm_point_set_cb_arg and listen_resume removed. | |
| 1696 | ||
| 1697 | 19 August 2010: Wouter | |
| 1698 | - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20. | |
| 1699 | Delegpt structures checked for duplicates always. | |
| 1700 | No more nameserver lookups generated when depth is full anyway. | |
| 1701 | - example.conf notes how to do DNSSEC validation and track the root. | |
| 1702 | - iana portlist updated. | |
| 1703 | ||
| 1704 | 18 August 2010: Wouter | |
| 1705 | - Fix bug#322: configure does not respect CFLAGS on Solaris. | |
| 1706 | Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line | |
| 1707 | if use sun-cc, but some systems need different flags. | |
| 1708 | ||
| 1709 | 16 August 2010: Wouter | |
| 1710 | - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP | |
| 1711 | changes, uses m4_bpatsubst now. | |
| 1712 | - make test (or make check) should be more portable and run the unit | |
| 1713 | test and testbound scripts. (make longtest has special requirements). | |
| 1714 | ||
| 1715 | 13 August 2010: Wouter | |
| 1716 | - More pleasant remote control command parsing. | |
| 1717 | - documentation added for return values reported by doxygen 1.7.1. | |
| 1718 | - iana portlist updated. | |
| 1719 | ||
| 1720 | 9 August 2010: Wouter | |
| 1721 | - Fix name of rrset printed that failed validation. | |
| 1722 | ||
| 1723 | 5 August 2010: Wouter | |
| 1724 | - Return NXDOMAIN after chain of CNAMEs ends at name-not-found. | |
| 1725 | ||
| 1726 | 4 August 2010: Wouter | |
| 1727 | - Fix validation in case a trust anchor enters into a zone with | |
| 1728 | unsupported algorithms. | |
| 1729 | ||
| 1730 | 3 August 2010: Wouter | |
| 1731 | - updated ldns tarball with bugfixes. | |
| 1732 | - release tag 1.4.6. | |
| 1733 | - trunk becomes 1.4.7 develop. | |
| 1734 | - iana portlist updated. | |
| 1735 | ||
| 1736 | 22 July 2010: Wouter | |
| 1737 | - more error details on failed remote control connection. | |
| 1738 | ||
| 1739 | 15 July 2010: Wouter | |
| 1740 | - rlimit adjustments for select and ulimit can happen at the same time. | |
| 1741 | ||
| 1742 | 14 July 2010: Wouter | |
| 1743 | - Donation text added to README. | |
| 1744 | - Fix integer underflow in prefetch ttl creation from cache. This | |
| 1745 | fixes a potential negative prefetch ttl. | |
| 1746 | ||
| 1747 | 12 July 2010: Wouter | |
| 1748 | - Changed the defaults for num-queries-per-thread/outgoing-range. | |
| 1749 | For builtin-select: 512/960, for libevent 1024/4096 and for | |
| 1750 | windows 24/48 (because of win api). This makes the ratio this way | |
| 1751 | to improve resilience under heavy load. For high performance, use | |
| 1752 | libevent and possibly higher numbers. | |
| 1753 | ||
| 1754 | 10 July 2010: Wouter | |
| 1755 | - GOST enabled if SSL is recent and ldns has GOST enabled too. | |
| 1756 | - ldns tarball updated. | |
| 1757 | ||
| 1758 | 9 July 2010: Wouter | |
| 1759 | - iana portlist updated. | |
| 1760 | - Fix validation of qtype DNSKEY when a key-cache entry exists but | |
| 1761 | no rr-cache entry is used (it expired or prefetch), it then goes | |
| 1762 | back up to the DS or trust-anchor to validate the DNSKEY. | |
| 1763 | ||
| 1764 | 7 July 2010: Wouter | |
| 1765 | - Neat function prototypes, unshadowed local declarations. | |
| 1766 | ||
| 1767 | 6 July 2010: Wouter | |
| 1768 | - failure to chown the pidfile is not fatal any more. | |
| 1769 | - testbound uses UTC timezone. | |
| 1770 | - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add | |
| 1771 | /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake. | |
| 1772 | ||
| 1773 | 5 July 2010: Wouter | |
| 1774 | - log if a server is skipped because it is on the donotquery list, | |
| 1775 | at verbosity 4, to enable diagnosis why no queries to 127.0.0.1. | |
| 1776 | - added feature to print configure date, target and options with -h. | |
| 1777 | - added feature to print event backend system details with -h. | |
| 1778 | - wdiff is not actually required by make test, updated requirements. | |
| 1779 | ||
| 1780 | 1 July 2010: Wouter | |
| 1781 | - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex | |
| 1782 | must be signed with all algorithms from the DS rrset at the parent. | |
| 1783 | This is now checked and becomes bogus if not. | |
| 1784 | ||
| 1785 | 28 June 2010: Wouter | |
| 1786 | - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps | |
| 1787 | in overload situations to be about 5 qps for the class of shortly | |
| 1788 | serviced queries. | |
| 1789 | The capacity of the resolver is then about (numqueriesperthread / 2) | |
| 1790 | / (average time for such long queries) qps for long queries. | |
| 1791 | And about (numqueriesperthread / 2)/(jostletimeout in whole seconds) | |
| 1792 | qps for short queries, per thread. | |
| 1793 | - Fix the max number of reply-address count to be applied for duplicate | |
| 1794 | queries, and not for new query list entries. This raises the memory | |
| 1795 | usage to a max of (16+1)*numqueriesperthread reply addresses. | |
| 1796 | ||
| 1797 | 25 June 2010: Wouter | |
| 1798 | - Fix handling of corner case reply from lame server, follows rfc2308. | |
| 1799 | It could lead to a nodata reply getting into the cache if the search | |
| 1800 | for a non-lame server turned up other misconfigured servers. | |
| 1801 | - unbound.h has extern "C" statement for easier include in c++. | |
| 1802 | ||
| 1803 | 23 June 2010: Wouter | |
| 1804 | - iana portlist updated. | |
| 1805 | - makedist upgraded cross compile openssl option, like this: | |
| 1806 | ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost | |
| 1807 | ||
| 1808 | 22 June 2010: Wouter | |
| 1809 | - Unbound reports libev or libevent correctly in logs in verbose mode. | |
| 1810 | - Fix to unload gost dynamic library module for leak testing. | |
| 1811 | ||
| 1812 | 18 June 2010: Wouter | |
| 1813 | - iana portlist updated. | |
| 1814 | ||
| 1815 | 17 June 2010: Wouter | |
| 1816 | - Add AAAA to root hints for I.ROOT-SERVERS.NET. | |
| 1817 | ||
| 1818 | 16 June 2010: Wouter | |
| 1819 | - Fix assertion failure reported by Kai Storbeck from XS4ALL, the | |
| 1820 | assertion was wrong. | |
| 1821 | - updated ldns tarball. | |
| 1822 | ||
| 1823 | 15 June 2010: Wouter | |
| 1824 | - tag 1.4.5 created. | |
| 1825 | - trunk contains 1.4.6 in development. | |
| 1826 | - Fix TCPreply on systems with no writev, if just 1 byte could be sent. | |
| 1827 | - Fix to use one pointer less for iterator query state store_parent_NS. | |
| 1828 | - makedist crosscompile to windows uses builtin ldns not host ldns. | |
| 1829 | - Max referral count from 30 to 130, because 128 one character domains | |
| 1830 | is valid DNS. | |
| 1831 | - added documentation for the histogram printout to syslog. | |
| 1832 | ||
| 1833 | 11 June 2010: Wouter | |
| 1834 | - When retry to parent the retrycount is not wiped, so failed | |
| 1835 | nameservers are not tried again. | |
| 1836 | - iana portlist updated. | |
| 1837 | ||
| 1838 | 10 June 2010: Wouter | |
| 1839 | - Fix bug where a long loop could be entered, now cycle detection | |
| 1840 | has a loop-counter and maximum search amount. | |
| 1841 | ||
| 1842 | 4 June 2010: Wouter | |
| 1843 | - iana portlist updated. | |
| 1844 | - 1.4.5rc1 tag created. | |
| 1845 | ||
| 1846 | 3 June 2010: Wouter | |
| 1847 | - ldns tarball updated, 1.6.5. | |
| 1848 | - review comments, split dependency cycle tracking for parentside | |
| 1849 | last resort lookups for A and AAAA so there are more lookup options. | |
| 1850 | ||
| 1851 | 2 June 2010: Wouter | |
| 1852 | - Fix compile warning if compiled without threads. | |
| 1853 | - updated ldns-tarball with current ldns svn (pre 1.6.5). | |
| 1854 | - GOST disabled-by-default, the algorithm number is allocated but the | |
| 1855 | RFC is still has to pass AUTH48 at the IETF. | |
| 1856 | ||
| 1857 | 1 June 2010: Wouter | |
| 1858 | - Ignore Z flag in incoming messages too. | |
| 1859 | - Fix storage of negative parent glue if that last resort fails. | |
| 1860 | - libtoolize 2.2.6b, autoconf 2.65 applied to configure. | |
| 1861 | - new splint flags for newer splint install. | |
| 1862 | ||
| 1863 | 31 May 2010: Wouter | |
| 1864 | - Fix AD flag handling, it could in some cases mistakenly copy the AD | |
| 1865 | flag from upstream servers. | |
| 1866 | - alloc_special_obtain out of memory is not a fatal error any more, | |
| 1867 | enabling unbound to continue longer in out of memory conditions. | |
| 1868 | - parentside names are dispreferred but not said to be dnssec-lame. | |
| 1869 | - parentside check for cached newname glue. | |
| 1870 | - fix parentside and querytargets modulestate, for dump_requestlist. | |
| 1871 | - unbound-control-setup makes keys -rw-r--- so not all users permitted. | |
| 1872 | - fix parentside from cache to be marked dispreferred for bad names. | |
| 1873 | ||
| 1874 | 28 May 2010: Wouter | |
| 1875 | - iana portlist updated. | |
| 1876 | - parent-child disagreement approach altered. Older fixes are | |
| 1877 | removed in place of a more exhaustive search for misconfigured data | |
| 1878 | available via the parent of a delegation. | |
| 1879 | This is designed to be throttled by cache entries, with TTL from the | |
| 1880 | parent if possible. Additionally the loop-counter is used. | |
| 1881 | It also tests for NS RRset differences between parent and child. | |
| 1882 | The fetch of misconfigured data should be more reliable and thorough. | |
| 1883 | It should work reliably even with no or only partial data in cache. | |
| 1884 | Data received from the child (as always) is deemed more | |
| 1885 | authoritative than information received from the delegation parent. | |
| 1886 | The search for misconfigured data is not performed normally. | |
| 1887 | ||
| 1888 | 26 May 2010: Wouter | |
| 1889 | - Contribution from Migiel de Vos (Surfnet): nagios patch for | |
| 1890 | unbound-host, in contrib/ (in the source tarball). Makes | |
| 1891 | unbound-host suitable for monitoring dnssec(-chain) status. | |
| 1892 | ||
| 1893 | 21 May 2010: Wouter | |
| 1894 | - EDNS timeout code will not fire if EDNS status already known. | |
| 1895 | - EDNS failure not stored if EDNS status known to work. | |
| 1896 | ||
| 1897 | 19 May 2010: Wouter | |
| 1898 | - Fix resolution for domains like safesvc.com.cn. If the iterator | |
| 1899 | can not recurse further and it finds the delegation in a state | |
| 1900 | where it would otherwise have rejected it outhand if so received | |
| 1901 | from a cache lookup, then it can try to ask higherup (with loop | |
| 1902 | protection). | |
| 1903 | - Fix comments in iter_utils:dp_is_useless. | |
| 1904 | ||
| 1905 | 18 May 2010: Wouter | |
| 1906 | - Fix various compiler warnings from the clang llvm compiler. | |
| 1907 | - iana portlist updated. | |
| 1908 | ||
| 1909 | 6 May 2010: Wouter | |
| 1910 | - Fix bug#308: spelling error in variable name in parser and lexer. | |
| 1911 | ||
| 1912 | 4 May 2010: Wouter | |
| 1913 | - Fix dnssec-missing detection that was turned off by server selection. | |
| 1914 | - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default | |
| 1915 | reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa, | |
| 1916 | 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa. | |
| 1917 | ||
| 1918 | 29 April 2010: Wouter | |
| 1919 | - Fix for dnssec lameness detection to use the key cache. | |
| 1920 | - infra cache entries that are expired are wiped clean. Previously | |
| 1921 | it was possible to not expire host data (if accessed often). | |
| 1922 | ||
| 1923 | 28 April 2010: Wouter | |
| 1924 | - ldns tarball updated and GOST support is detected and then enabled. | |
| 1925 | - iana portlist updated. | |
| 1926 | - Fix detection of gost support in ldns (reported by Chris Smith). | |
| 1927 | ||
| 1928 | 27 April 2010: Wouter | |
| 1929 | - unbound-control get_option domain-insecure shows config file items. | |
| 1930 | - fix retry sequence if prime hints are recursion-lame. | |
| 1931 | - autotrust anchor file can be initialized with a ZSK key as well. | |
| 1932 | - harden-referral-path does not result in failures due to max-depth. | |
| 1933 | You can increase the max-depth by adding numbers (' 0') after the | |
| 1934 | target-fetch-policy, this increases the depth to which is checked. | |
| 1935 | ||
| 1936 | 26 April 2010: Wouter | |
| 1937 | - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use | |
| 1938 | CPPFLAGS during configure process. | |
| 1939 | - if libev is installed on the base system (not libevent), detect | |
| 1940 | it from the event.h header file and link with -lev. | |
| 1941 | - configlexer.lex gets config.h, and configyyrename.h added by make, | |
| 1942 | no more double include. | |
| 1943 | - More strict scrubber (Thanks to George Barwood for the idea): | |
| 1944 | NS set must be pertinent to the query (qname subdomain nsname). | |
| 1945 | - Fix bug#307: In 0x20 backoff fix fallback so the number of | |
| 1946 | outstanding queries does not become -1 and block the request. | |
| 1947 | Fixed handling of recursion-lame in combination with 0x20 fallback. | |
| 1948 | Fix so RRsets are compared canonicalized and sorted if the immediate | |
| 1949 | comparison fails, this makes it work around round-robin sites. | |
| 1950 | ||
| 1951 | 23 April 2010: Wouter | |
| 1952 | - Squelch log message: sendto failed permission denied for | |
| 1953 | 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2). | |
| 1954 | - Fix to fetch data as last resort more tenaciously. When cycle | |
| 1955 | targets cause the server selection to believe there are more options | |
| 1956 | when they really are not there, the server selection is reinitiated. | |
| 1957 | - Fix fetch from blacklisted dnssec lame servers as last resort. The | |
| 1958 | server's IP address is then given in validator errors as well. | |
| 1959 | - Fix local-zone type redirect that did not use the query name for | |
| 1960 | the answer rrset. | |
| 1961 | ||
| 1962 | 22 April 2010: Wouter | |
| 1963 | - tag 1.4.4. | |
| 1964 | - trunk contains 1.4.5 in development. | |
| 1965 | - Fix validation failure for qtype ANY caused by a RRSIG parse failure. | |
| 1966 | The validator error message was 'no signatures from ...'. | |
| 1967 | ||
| 1968 | 16 April 2010: Wouter | |
| 1969 | - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN. | |
| 1970 | - tag 1.4.4rc1. | |
| 1971 | ||
| 1972 | 15 April 2010: Wouter | |
| 1973 | - ECC-GOST algorithm number 12 that is assigned by IANA. New test | |
| 1974 | example key and signatures for GOST. GOST requires openssl-1.0.0. | |
| 1975 | GOST is still disabled by default. | |
| 1976 | ||
| 1977 | 9 April 2010: Wouter | |
| 1978 | - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or | |
| 1979 | get into an endless loop, if 0x20 was enabled, and buffers are small | |
| 1980 | or particular broken packets are received. | |
| 1981 | - Fix chain of trust with CNAME at an intermediate step, for the DS | |
| 1982 | processing proof. | |
| 1983 | ||
| 1984 | 8 April 2010: Wouter | |
| 1985 | - Fix validation of queries with wildcard names (*.example). | |
| 1986 | ||
| 1987 | 6 April 2010: Wouter | |
| 1988 | - Fix EDNS probe for .de DNSSEC testbed failure, where the infra | |
| 1989 | cache timeout coincided with a server update, the current EDNS | |
| 1990 | backoff is less sensitive, and does not cache the backoff unless | |
| 1991 | the backoff actually works and the domain is not expecting DNSSEC. | |
| 1992 | - GOST support with correct algorithm numbers. | |
| 1993 | ||
| 1994 | 1 April 2010: Wouter | |
| 1995 | - iana portlist updated. | |
| 1996 | ||
| 1997 | 24 March 2010: Wouter | |
| 1998 | - unbound control flushed items are not counted when flushed again. | |
| 1999 | ||
| 2000 | 23 March 2010: Wouter | |
| 2001 | - iana portlist updated. | |
| 2002 | ||
| 2003 | 22 March 2010: Wouter | |
| 2004 | - unbound-host disables use-syslog from config file so that the | |
| 2005 | config file for the main server can be used more easily. | |
| 2006 | - fix bug#301: unbound-checkconf could not parse interface | |
| 2007 | '0.0.0.0@5353', even though unbound itself worked fine. | |
| 2008 | ||
| 2009 | 19 March 2010: Wouter | |
| 2010 | - fix fwd_ancil test to pass if the socket options are not supported. | |
| 2011 | ||
| 2012 | 18 March 2010: Wouter | |
| 2013 | - Fixed random numbers for port, interface and server selection. | |
| 2014 | Removed very small bias. | |
| 2015 | - Refer to the listing in unbound-control man page in the extended | |
| 2016 | statistics entry in the unbound.conf man page. | |
| 2017 | ||
| 2018 | 16 March 2010: Wouter | |
| 2019 | - Fix interface-automatic for OpenBSD: msg.controllen was too small, | |
| 2020 | also assertions on ancillary data buffer. | |
| 2021 | - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO. | |
| 2022 | - for NSEC3 check if signatures are cached. | |
| 2023 | ||
| 2024 | 15 March 2010: Wouter | |
| 2025 | - unit test for util/regional.c. | |
| 2026 | ||
| 2027 | 12 March 2010: Wouter | |
| 2028 | - Reordered configure checks so fork and -lnsl -lsocket checks are | |
| 2029 | earlier, and thus later checks benefit from and do not hinder them. | |
| 2030 | - iana portlist updated. | |
| 2031 | - ldns tarball updated. | |
| 2032 | - Fix python use when multithreaded. | |
| 2033 | - Fix solaris python compile. | |
| 2034 | - Include less in config.h and include per code file for ldns, ssl. | |
| 2035 | ||
| 2036 | 11 March 2010: Wouter | |
| 2037 | - another memory allocation option: --enable-alloc-nonregional. | |
| 2038 | exposes the regional allocations to other memory purifiers. | |
| 2039 | - fix for memory alignment in struct sock_list allocation. | |
| 2040 | - Fix for MacPorts ldns without ssl default, unbound checks if ldns | |
| 2041 | has dnssec functionality and uses the builtin if not. | |
| 2042 | - Fix daemonize on Solaris 10, it did not detach from terminal. | |
| 2043 | - tag 1.4.3 created. | |
| 2044 | - trunk is 1.4.4 in development. | |
| 2045 | - spelling fix in validation error involving cnames. | |
| 2046 | ||
| 2047 | 10 March 2010: Wouter | |
| 2048 | - --enable-alloc-lite works with test set. | |
| 2049 | - portability in the testset: printf format conversions, prototypes. | |
| 2050 | ||
| 2051 | 9 March 2010: Wouter | |
| 2052 | - tag 1.4.2 created. | |
| 2053 | - trunk is 1.4.3 in development. | |
| 2054 | - --enable-alloc-lite debug option. | |
| 2055 | ||
| 2056 | 8 March 2010: Wouter | |
| 2057 | - iana portlist updated. | |
| 2058 | ||
| 2059 | 4 March 2010: Wouter | |
| 2060 | - Fix crash in control channel code. | |
| 2061 | ||
| 2062 | 3 March 2010: Wouter | |
| 2063 | - better casts in pipe code, brackets placed wrongly. | |
| 2064 | - iana portlist updated. | |
| 2065 | ||
| 2066 | 1 March 2010: Wouter | |
| 2067 | - make install depends on make all. | |
| 2068 | - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs. | |
| 2069 | - --enable-checking: enables assertions but does not look nonproduction. | |
| 2070 | - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with | |
| 2071 | nxdomain and nodata distinguished. | |
| 2072 | - ldns tarball updated. | |
| 2073 | - --disable-rpath fixed for libtool not found errors. | |
| 2074 | - new fedora specfile from Fedora13 in contrib from Paul Wouters. | |
| 2075 | ||
| 2076 | 26 February 2010: Wouter | |
| 2077 | - Fixup prototype for lexer cleanup in daemon code. | |
| 2078 | - unbound-control list_stubs, list_forwards, list_local_zones and | |
| 2079 | list_local_data. | |
| 2080 | ||
| 2081 | 24 February 2010: Wouter | |
| 2082 | - Fix scrubber bug that potentially let NS records through. Reported | |
| 2083 | by Amanda Constant. | |
| 2084 | - Also delete potential poison references from additional. | |
| 2085 | - Fix: no classification of a forwarder as lame, throw away instead. | |
| 2086 | ||
| 2087 | 23 February 2010: Wouter | |
| 2088 | - libunbound ub_ctx_get_option() added. | |
| 2089 | - unbound-control set_option and get_option commands. | |
| 2090 | - iana portlist updated. | |
| 2091 | ||
| 2092 | 18 February 2010: Wouter | |
| 2093 | - A little more strict DS scrubbing. | |
| 2094 | - No more blacklisting of unresponsive servers, a 2 minute timeout | |
| 2095 | is backed off to. | |
| 2096 | - RD flag not enabled for dnssec-blacklisted tries, unless necessary. | |
| 2097 | - pickup ldns compile fix, libdl for libcrypto. | |
| 2098 | - log 'tcp connect: connection timed out' only in high verbosity. | |
| 2099 | - unbound-control log_reopen command. | |
| 2100 | - moved get_option code from unbound-checkconf to util/config_file.c | |
| 2101 | ||
| 2102 | 17 February 2010: Wouter | |
| 2103 | - Disregard DNSKEY from authority section for chain of trust. | |
| 2104 | DS records that are irrelevant to a referral scrubbed. Anti-poison. | |
| 2105 | - iana portlist updated. | |
| 2106 | ||
| 2107 | 16 February 2010: Wouter | |
| 2108 | - Check for 'no space left on device' (or other errors) when | |
| 2109 | writing updated autotrust anchors and print errno to log. | |
| 2110 | ||
| 2111 | 15 February 2010: Wouter | |
| 2112 | - Fixed the requery protection, the TTL was 0, it is now 900 seconds, | |
| 2113 | hardcoded. We made the choice to send out more conservatively, | |
| 2114 | protecting against an aggregate effect more than protecting a | |
| 2115 | single user (from their own folly, perhaps in case of misconfig). | |
| 2116 | ||
| 2117 | 12 February 2010: Wouter | |
| 2118 | - Re-query pattern changed on validation failure. To protect troubled | |
| 2119 | authority servers, unbound caches a failure for the DNSKEY or DS | |
| 2120 | records for the entire zone, and only retries that 900 seconds later. | |
| 2121 | This implies that only a handful of packets are sent extra to the | |
| 2122 | authority if the zone fails. | |
| 2123 | ||
| 2124 | 11 February 2010: Wouter | |
| 2125 | - ldns tarball update for long label length syntax error fix. | |
| 2126 | - iana portlist updated. | |
| 2127 | ||
| 2128 | 9 February 2010: Wouter | |
| 2129 | - Fixup in compat snprintf routine, %f 1.02 and %g support. | |
| 2130 | - include math.h for testbound test compile portability. | |
| 2131 | ||
| 2132 | 2 February 2010: Wouter | |
| 2133 | - Updated url of IANA itar, interim trust anchor repository, in script. | |
| 2134 | ||
| 2135 | 1 February 2010: Wouter | |
| 2136 | - iana portlist updated. | |
| 2137 | - configure test for memcmp portability. | |
| 2138 | ||
| 2139 | 27 January 2010: Wouter | |
| 2140 | - removed warning on format string in validator error log statement. | |
| 2141 | - iana portlist updated. | |
| 2142 | ||
| 2143 | 22 January 2010: Wouter | |
| 2144 | - libtool finish the install of unbound python dynamic library. | |
| 2145 | ||
| 2146 | 21 January 2010: Wouter | |
| 2147 | - acx_nlnetlabs.m4 synchronised with nsd's version. | |
| 2148 | ||
| 2149 | 20 January 2010: Wouter | |
| 2150 | - Fixup lookup trouble for parent-child domains on the first query. | |
| 2151 | ||
| 2152 | 14 January 2010: Wouter | |
| 2153 | - Fixup ldns detection to also check for header files. | |
| 2154 | ||
| 2155 | 13 January 2010: Wouter | |
| 2156 | - prefetch-key option that performs DNSKEY queries earlier in the | |
| 2157 | validation process, and that could halve the latency on DNSSEC | |
| 2158 | queries. It takes some extra processing (CPU, a cache is needed). | |
| 2159 | ||
| 2160 | 12 January 2010: Wouter | |
| 2161 | - Fix unbound-checkconf for auto-trust-anchor-file present checks. | |
| 2162 | ||
| 2163 | 8 January 2010: Wouter | |
| 2164 | - Fix for parent-child disagreement code which could have trouble | |
| 2165 | when (a) ipv6 was disabled and (b) the TTL for parent and child | |
| 2166 | were different. There were two bugs, the parent-side information | |
| 2167 | is fixed to no longer block lookup of child side information and | |
| 2168 | the iterator is fixed to no longer attempt to get ipv6 when it is | |
| 2169 | not enabled and then give up in failure. | |
| 2170 | - test and fixes to make prefetch actually store the answer in the | |
| 2171 | cache. Considers some rrsets 'already expired' but does not allow | |
| 2172 | overwriting of rrsets considered more secure. | |
| 2173 | ||
| 2174 | 7 January 2010: Wouter | |
| 2175 | - Fixup python documentation (thanks Leo Vandewoestijne). | |
| 2176 | - Work on cache prefetch feature. | |
| 2177 | - Stats for prefetch, in log print stats, unbound-control stats | |
| 2178 | and in unbound_munin plugin. | |
| 2179 | ||
| 2180 | 6 January 2010: Wouter | |
| 2181 | - iana portlist updated. | |
| 2182 | - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length. | |
| 2183 | - verbose output includes parent-side-address notion for lameness. | |
| 2184 | - documented val-log-level: 2 setting in example.conf and man page. | |
| 2185 | - change unbound-control-setup from 1024(sha1) to 1536(sha256). | |
| 2186 | ||
| 2187 | 1 January 2010: Wouter | |
| 2188 | - iana portlist updated. | |
| 2189 | ||
| 2190 | 22 December 2009: Wouter | |
| 2191 | - configure with newer libtool 2.2.6b. | |
| 2192 | ||
| 2193 | 17 December 2009: Wouter | |
| 2194 | - review comments. | |
| 2195 | - tag 1.4.1. | |
| 2196 | - trunk to version 1.4.2. | |
| 2197 | ||
| 2198 | 15 December 2009: Wouter | |
| 2199 | - Answer to qclass=ANY queries, with class IN contents. | |
| 2200 | Test that validation also works. | |
| 2201 | - updated ldns snapshot tarball with latest fixes (parsing records). | |
| 2202 | ||
| 2203 | 11 December 2009: Wouter | |
| 2204 | - on IPv4 UDP turn off DF flag. | |
| 2205 | ||
| 2206 | 10 December 2009: Wouter | |
| 2207 | - requirements.txt updated with design choice explanations. | |
| 2208 | - Reading fixes: fix to set unlame when child confirms parent glue, | |
| 2209 | and fix to avoid duplicate addresses in delegation point. | |
| 2210 | - verify_rrsig routine checks expiration last. | |
| 2211 | ||
| 2212 | 9 December 2009: Wouter | |
| 2213 | - Fix Bug#287(reopened): update of ldns tarball with fix for parse | |
| 2214 | errors generated for domain names like '.example.com'. | |
| 2215 | - Fix SOA excluded from negative DS responses. Reported by Hauke | |
| 2216 | Lampe. The negative cache did not include proper SOA records for | |
| 2217 | negative qtype DS responses which makes BIND barf on it, such | |
| 2218 | responses are now only used internally. | |
| 2219 | - Fix negative cache lookup of closestencloser check of DS type bit. | |
| 2220 | ||
| 2221 | 8 December 2009: Wouter | |
| 2222 | - Fix for lookup of parent-child disagreement domains, where the | |
| 2223 | parent-side glue works but it does not provide proper NS, A or AAAA | |
| 2224 | for itself, fixing domains such as motorcaravanners.eu. | |
| 2225 | - Feature: you can specify a port number in the interface: line, so | |
| 2226 | you can bind the same interface multiple times at different ports. | |
| 2227 | ||
| 2228 | 7 December 2009: Wouter | |
| 2229 | - Bug#287: Fix segfault when unbound-control remove nonexistent local | |
| 2230 | data. Added check to tests. | |
| 2231 | ||
| 2232 | 1 December 2009: Wouter | |
| 2233 | - Fix crash with module-config "iterator". | |
| 2234 | - Added unit test that has "iterator" module-config. | |
| 2235 | ||
| 2236 | 30 November 2009: Wouter | |
| 2237 | - bug#284: fix parse of # without end-of-line at end-of-file. | |
| 2238 | ||
| 2239 | 26 November 2009: Wouter | |
| 2240 | - updated ldns with release candidate for version 1.6.3. | |
| 2241 | - tag for 1.4.0 release. | |
| 2242 | - 1.4.1 version in trunk. | |
| 2243 | - Fixup major libtool version to 2 because of why_bogus change. | |
| 2244 | It was 1:5:0 but should have been 2:0:0. | |
| 2245 | ||
| 2246 | 23 November 2009: Wouter | |
| 2247 | - Patch from David Hubbard for libunbound manual page. | |
| 2248 | - Fixup endless spinning in unbound-control stats reported by | |
| 2249 | Attila Nagy. Probably caused by clock reversal. | |
| 2250 | ||
| 2251 | 20 November 2009: Wouter | |
| 2252 | - contrib/split-itar.sh contributed by Tom Hendrikx. | |
| 2253 | ||
| 2254 | 19 November 2009: Wouter | |
| 2255 | - better argument help for unbound-control. | |
| 2256 | - iana portlist updated. | |
| 2257 | ||
| 2258 | 17 November 2009: Wouter | |
| 2259 | - noted multiple entries for multiple domain names in example.conf. | |
| 2260 | - iana portlist updated. | |
| 2261 | ||
| 2262 | 16 November 2009: Wouter | |
| 2263 | - Fixed signer detection of CNAME responses without signatures. | |
| 2264 | - Fix#282 libunbound memleak on error condition by Eric Sesterhenn. | |
| 2265 | - Tests for CNAMEs to deeper trust anchors, secure and bogus. | |
| 2266 | - svn tag 1.4.0rc1 made. | |
| 2267 | ||
| 2268 | 13 November 2009: Wouter | |
| 2269 | - Fixed validation failure for CNAME to optout NSEC3 nodata answer. | |
| 2270 | - unbound-host does not fail on type ANY. | |
| 2271 | - Fixed wireparse failure to put RRSIGs together with data in some | |
| 2272 | long ANY mix cases, which fixes validation failures. | |
| 2273 | ||
| 2274 | 12 November 2009: Wouter | |
| 2275 | - iana portlist updated. | |
| 2276 | - fix manpage errors reported by debian lintian. | |
| 2277 | - review comments. | |
| 2278 | - fixup very long vallog2 level error strings. | |
| 2279 | ||
| 2280 | 11 November 2009: Wouter | |
| 2281 | - ldns tarball updated (to 1.6.2). | |
| 2282 | - review comments. | |
| 2283 | ||
| 2284 | 10 November 2009: Wouter | |
| 2285 | - Thanks to Surfnet found bug in new dnssec-retry code that failed | |
| 2286 | to combine well when combined with DLV and a particular failure. | |
| 2287 | - Fixed unbound-control -h output about argument optionality. | |
| 2288 | - review comments. | |
| 2289 | ||
| 2290 | 5 November 2009: Wouter | |
| 2291 | - lint fixes and portability tests. | |
| 2292 | - better error text for multiple domain keys in one autotrust file. | |
| 2293 | ||
| 2294 | 2 November 2009: Wouter | |
| 2295 | - Fix bug where autotrust does not work when started with a DS. | |
| 2296 | - Updated GOST unit tests for unofficial algorithm number 249 | |
| 2297 | and DNSKEY-format changes in draft version -01. | |
| 2298 | ||
| 2299 | 29 October 2009: Wouter | |
| 2300 | - iana portlist updated. | |
| 2301 | - edns-buffer-size option, default 4096. | |
| 2302 | - fixed do-udp: no. | |
| 2303 | ||
| 2304 | 28 October 2009: Wouter | |
| 2305 | - removed abort on prealloc failure, error still printed but softfail. | |
| 2306 | - iana portlist updated. | |
| 2307 | - RFC 5702: RSASHA256 and RSASHA512 support enabled by default. | |
| 2308 | - ldns tarball updated (which also enables rsasha256 support). | |
| 2309 | ||
| 2310 | 27 October 2009: Wouter | |
| 2311 | - iana portlist updated. | |
| 2312 | ||
| 2313 | 8 October 2009: Wouter | |
| 2314 | - please doxygen | |
| 2315 | - add val-log-level print to corner case (nameserver.epost.bg). | |
| 2316 | - more detail to errors from insecure delegation checks. | |
| 2317 | - Fix double time subtraction in negative cache reported by | |
| 2318 | Amanda Constant and Hugh Mahon. | |
| 2319 | - Made new validator error string available from libunbound for | |
| 2320 | applications. It is in result->why_bogus, a zero-terminated string. | |
| 2321 | unbound-host prints it by default if a result is bogus. | |
| 2322 | Also the errinf is public in module_qstate (for other modules). | |
| 2323 | ||
| 2324 | 7 October 2009: Wouter | |
| 2325 | - retry for validation failure in DS and prime results. Less mem use. | |
| 2326 | unit test. Provisioning in other tests for requeries. | |
| 2327 | - retry for validation failure in DNSKEY in middle of chain of trust. | |
| 2328 | unit test. | |
| 2329 | - retry for empty non terminals in chain of trust and unit test. | |
| 2330 | - Fixed security bug where the signatures for NSEC3 records were not | |
| 2331 | checked when checking for absence of DS records. This could have | |
| 2332 | enabled the substitution of an insecure delegation. | |
| 2333 | - moved version number to 1.4.0 because of 1.3.4 release with only | |
| 2334 | the NSEC3 patch from the entry above. | |
| 2335 | - val-log-level: 2 shows extended error information for validation | |
| 2336 | failures, but still one (longish) line per failure. For example: | |
| 2337 | validation failure <example.com. DNSKEY IN>: signature expired from | |
| 2338 | 192.0.2.4 for trust anchor example.com. while building chain of trust | |
| 2339 | validation failure <www.example.com. A IN>: no signatures from | |
| 2340 | 192.0.2.6 for key example.com. while building chain of trust | |
| 2341 | ||
| 2342 | 6 October 2009: Wouter | |
| 2343 | - Test set updated to provide additional ns lookup result. | |
| 2344 | The retry would attempt to fetch the data from other nameservers | |
| 2345 | for bogus data, and this needed to be provisioned in the tests. | |
| 2346 | ||
| 2347 | 5 October 2009: Wouter | |
| 2348 | - first validation failure retry code. Retries for data failures. | |
| 2349 | And unit test. | |
| 2350 | ||
| 2351 | 2 October 2009: Wouter | |
| 2352 | - improve 5011 modularization. | |
| 2353 | - fix unbound-host so -d can be given before -C. | |
| 2354 | - iana portlist updated. | |
| 2355 | ||
| 2356 | 28 September 2009: Wouter | |
| 2357 | - autotrust-anchor-file can read multiline input and $ORIGIN. | |
| 2358 | - prevent integer overflow in holddown calculation. review fixes. | |
| 2359 | - fixed race condition in trust point revocation. review fix. | |
| 2360 | - review fixes to comments, removed unused code. | |
| 2361 | ||
| 2362 | 25 September 2009: Wouter | |
| 2363 | - so-rcvbuf: 4m option added. Set this on large busy servers to not | |
| 2364 | drop the occasional packet in spikes due to full socket buffers. | |
| 2365 | netstat -su keeps a counter of UDP dropped due to full buffers. | |
| 2366 | - review of validator/autotrust.c, small fixes and comments. | |
| 2367 | ||
| 2368 | 23 September 2009: Wouter | |
| 2369 | - 5011 query failed counts verification failures, not lookup failures. | |
| 2370 | - 5011 probe failure handling fixup. | |
| 2371 | - test unbound reading of original autotrust data. | |
| 2372 | The metadata per-key, such as key state (PENDING, MISSING, VALID) is | |
| 2373 | picked up, otherwise performs initial probe like usual. | |
| 2374 | ||
| 2375 | 22 September 2009: Wouter | |
| 2376 | - autotrust test with algorithm rollover, new ordering of checks | |
| 2377 | assists in orderly rollover. | |
| 2378 | - autotrust test with algorithm rollover to unknown algorithm. | |
| 2379 | checks if new keys are supported before adding them. | |
| 2380 | - autotrust test with trust point revocation, becomes unsigned. | |
| 2381 | - fix DNSSEC-missing-signature detection for minimal responses | |
| 2382 | for qtype DNSKEY (assumes DNSKEY occurs at zone apex). | |
| 2383 | ||
| 2384 | 18 September 2009: Wouter | |
| 2385 | - autotrust tests, fix trustpoint timer deletion code. | |
| 2386 | fix count of valid anchors during missing remove. | |
| 2387 | - autotrust: pick up REVOKE even if not signed with known other keys. | |
| 2388 | ||
| 2389 | 17 September 2009: Wouter | |
| 2390 | - fix compile of unbound-host when --enable-alloc-checks. | |
| 2391 | - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis. | |
| 2392 | - Manual page fixes reported by Tony Finch. | |
| 2393 | ||
| 2394 | 16 September 2009: Wouter | |
| 2395 | - Fix memory leak reported by Tao Ma. | |
| 2396 | - Fix memstats test tool for log-time-ascii log format. | |
| 2397 | ||
| 2398 | 15 September 2009: Wouter | |
| 2399 | - iana portlist updated. | |
| 2400 | ||
| 2401 | 10 September 2009: Wouter | |
| 2402 | - increased MAXSYSLOGLEN so .bg key can be printed in debug output. | |
| 2403 | - use linebuffering for log-file: output, this can be significantly | |
| 2404 | faster than the previous fflush method and enable some class of | |
| 2405 | resolvers to use high verbosity (for short periods). | |
| 2406 | Not on windows, because line buffering does not work there. | |
| 2407 | ||
| 2408 | 9 September 2009: Wouter | |
| 2409 | - Fix bug where DNSSEC-bogus messages were marked with too high TTL. | |
| 2410 | The RRsets would still expire at the normal time, but this would | |
| 2411 | keep messages bogus in the cache for too long. | |
| 2412 | - regression test for that bug. | |
| 2413 | - documented that load_cache is meant for debugging. | |
| 2414 | ||
| 2415 | 8 September 2009: Wouter | |
| 2416 | - fixup printing errors when load_cache, they were printed to the | |
| 2417 | SSL connection which broke, now to the log. | |
| 2418 | - new ldns - with fixed parse of large SOA values. | |
| 2419 | ||
| 2420 | 7 September 2009: Wouter | |
| 2421 | - autotrust testbound scenarios. | |
| 2422 | - autotrust fix that failure count is written to file. | |
| 2423 | - autotrust fix that keys may become valid after add holddown time | |
| 2424 | alone, before the probe returns. | |
| 2425 | ||
| 2426 | 4 September 2009: Wouter | |
| 2427 | - Changes to make unbound work with libevent-2.0.3 alpha. (in | |
| 2428 | configure detection due to new ssl dependency in libevent) | |
| 2429 | - do not call sphinx for documentation when python is disabled. | |
| 2430 | - remove EV_PERSIST from libevent timeout code to make the code | |
| 2431 | compatible with the libevent-2.0. Works with older libevent too. | |
| 2432 | - fix memory leak in python code. | |
| 2433 | ||
| 2434 | 3 September 2009: Wouter | |
| 2435 | - Got a patch from Luca Bruno for libunbound support on windows to | |
| 2436 | pick up the system resolvconf nameservers and hosts there. | |
| 2437 | - included ldns updated (enum warning fixed). | |
| 2438 | - makefile fix for parallel makes. | |
| 2439 | - Patch from Zdenek Vasicek and Attila Nagy for using the source IP | |
| 2440 | from python scripts. See pythonmod/examples/resip.py. | |
| 2441 | - doxygen comment fixes. | |
| 2442 | ||
| 2443 | 2 September 2009: Wouter | |
| 2444 | - TRAFFIC keyword for testbound. Simplifies test generation. | |
| 2445 | ${range lower val upper} to check probe timeout values. | |
| 2446 | - test with 5011-prepublish rollover and revocation. | |
| 2447 | - fix revocation of RR for autotrust, stray exclamation mark. | |
| 2448 | ||
| 2449 | 1 September 2009: Wouter | |
| 2450 | - testbound variable arithmetic. | |
| 2451 | - autotrust probe time is randomised. | |
| 2452 | - autotrust: the probe is active and does not fetch from cache. | |
| 2453 | ||
| 2454 | 31 August 2009: Wouter | |
| 2455 | - testbound variable processing. | |
| 2456 | ||
| 2457 | 28 August 2009: Wouter | |
| 2458 | - fixup unbound-control lookup to print forward and stub servers. | |
| 2459 | ||
| 2460 | 27 August 2009: Wouter | |
| 2461 | - autotrust: mesh answer callback is empty. | |
| 2462 | ||
| 2463 | 26 August 2009: Wouter | |
| 2464 | - autotrust probing. | |
| 2465 | - iana portlist updated. | |
| 2466 | ||
| 2467 | 25 August 2009: Wouter | |
| 2468 | - fixup memleak in trust anchor unsupported algorithm check. | |
| 2469 | - iana portlist updated. | |
| 2470 | - autotrust options: add-holddown, del-holddown, keep-missing. | |
| 2471 | - autotrust store revoked status of trust points. | |
| 2472 | - ctime_r compat definition. | |
| 2473 | - detect yylex_destroy() in configure. | |
| 2474 | - detect SSL_get_compression_methods declaration in configure. | |
| 2475 | - fixup DS lookup at anchor point with unsigned parent. | |
| 2476 | - fixup DLV lookup for DS queries to unsigned domains. | |
| 2477 | ||
| 2478 | 24 August 2009: Wouter | |
| 2479 | - cleaner memory allocation on exit. autotrust test routines. | |
| 2480 | - free all memory on program exit, fix for ssl and flex. | |
| 2481 | ||
| 2482 | 21 August 2009: Wouter | |
| 2483 | - autotrust: debug routines. Read,write and conversions work. | |
| 2484 | ||
| 2485 | 20 August 2009: Wouter | |
| 2486 | - autotrust: save and read trustpoint variables. | |
| 2487 | ||
| 2488 | 19 August 2009: Wouter | |
| 2489 | - autotrust: state table updates. | |
| 2490 | - iana portlist updated. | |
| 2491 | ||
| 2492 | 17 August 2009: Wouter | |
| 2493 | - autotrust: process events. | |
| 2494 | ||
| 2495 | 17 August 2009: Wouter | |
| 2496 | - Fix so that servers are only blacklisted if they fail to reply | |
| 2497 | to 16 queries in a row and the timeout gets above 2 minutes. | |
| 2498 | - autotrust work, split up DS verification of DNSKEYs. | |
| 2499 | ||
| 2500 | 14 August 2009: Wouter | |
| 2501 | - unbound-control lookup prints out infra cache information, like RTT. | |
| 2502 | - Fix bug in DLV lookup reported by Amanda from Secure64. | |
| 2503 | It could sometimes wrongly classify a domain as unsigned, which | |
| 2504 | does not give the AD bit on replies. | |
| 2505 | ||
| 2506 | 13 August 2009: Wouter | |
| 2507 | - autotrust read anchor files. locked trust anchors. | |
| 2508 | ||
| 2509 | 12 August 2009: Wouter | |
| 2510 | - autotrust import work. | |
| 2511 | ||
| 2512 | 11 August 2009: Wouter | |
| 2513 | - Check for openssl compatible with gost if enabled. | |
| 2514 | - updated unit test for GOST=211 code. | |
| 2515 | Nicer naming of test files. | |
| 2516 | - iana portlist updated. | |
| 2517 | ||
| 2518 | 7 August 2009: Wouter | |
| 2519 | - call OPENSSL_config() in unbound and unit test so that the | |
| 2520 | operator can use openssl.cnf for configuration options. | |
| 2521 | - removed small memory leak from config file reader. | |
| 2522 | ||
| 2523 | 6 August 2009: Wouter | |
| 2524 | - configure --enable-gost for GOST support, experimental | |
| 2525 | implementation of draft-dolmatov-dnsext-dnssec-gost-01. | |
| 2526 | - iana portlist updated. | |
| 2527 | - ldns tarball updated (with GOST support). | |
| 2528 | ||
| 2529 | 5 August 2009: Wouter | |
| 2530 | - trunk moved to 1.3.4. | |
| 2531 | ||
| 2532 | 4 August 2009: Wouter | |
| 2533 | - Added test that the examples from draft rsasha256-14 verify. | |
| 2534 | - iana portlist updated. | |
| 2535 | - tagged 1.3.3 | |
| 2536 | ||
| 2537 | 3 August 2009: Wouter | |
| 2538 | - nicer warning when algorithm not supported, tells you to upgrade. | |
| 2539 | - iana portlist updated. | |
| 2540 | ||
| 2541 | 27 July 2009: Wouter | |
| 2542 | - Updated unbound-cacti contribution from Dmitriy Demidov, with | |
| 2543 | the queue statistics displayed in its own graph. | |
| 2544 | - iana portlist updated. | |
| 2545 | ||
| 2546 | 22 July 2009: Wouter | |
| 2547 | - Fix bug found by Michael Tokarev where unbound would try to | |
| 2548 | prime the root servers even though forwarders are configured for | |
| 2549 | the root. | |
| 2550 | - tagged 1.3.3rc1 | |
| 2551 | ||
| 2552 | 21 July 2009: Wouter | |
| 2553 | - Fix server selection, so that it waits for open target queries when | |
| 2554 | faced with lameness. | |
| 2555 | ||
| 2556 | 20 July 2009: Wouter | |
| 2557 | - Ignore transient sendto errors, no route to host, and host, net down. | |
| 2558 | - contrib/update-anchor.sh has -r option for root-hints. | |
| 2559 | - feature val-log-level: 1 prints validation failures so you can | |
| 2560 | keep track of them during dnssec deployment. | |
| 2561 | ||
| 2562 | 16 July 2009: Wouter | |
| 2563 | - fix replacement malloc code. Used in crosscompile. | |
| 2564 | - makedist -w creates crosscompiled setup.exe on fedora11. | |
| 2565 | ||
| 2566 | 15 July 2009: Wouter | |
| 2567 | - dependencies for compat items, for crosscompile. | |
| 2568 | - mingw32 crosscompile changes, dependencies and zipfile creation. | |
| 2569 | and with System.dll from the windows NSIS you can make setup.exe. | |
| 2570 | - package libgcc_s_sjlj exception handler for NSISdl.dll. | |
| 2571 | ||
| 2572 | 14 July 2009: Wouter | |
| 2573 | - updated ldns tarball for solaris x64 compile assistance. | |
| 2574 | - no need to define RAND_MAX from config.h. | |
| 2575 | - iana portlist updated. | |
| 2576 | - configure changes and ldns update for mingw32 crosscompile. | |
| 2577 | ||
| 2578 | 13 July 2009: Wouter | |
| 2579 | - Fix for crash at start on windows. | |
| 2580 | - tag for release 1.3.2. | |
| 2581 | - trunk has version 1.3.3. | |
| 2582 | - Fix for ID bits on windows to use all 16. RAND_MAX was not | |
| 2583 | defined like you'd expect on mingw. Reported by Mees de Roo. | |
| 2584 | ||
| 2585 | 9 July 2009: Wouter | |
| 2586 | - tag for release 1.3.1. | |
| 2587 | - trunk has version 1.3.2. | |
| 2588 | ||
| 2589 | 7 July 2009: Wouter | |
| 2590 | - iana portlist updated. | |
| 2591 | ||
| 2592 | 6 July 2009: Wouter | |
| 2593 | - prettier error handling in SSL setup. | |
| 2594 | - makedist.sh uname fix (same as ldns). | |
| 2595 | - updated fedora spec file. | |
| 2596 | ||
| 2597 | 3 July 2009: Wouter | |
| 2598 | - fixup linking when ldnsdir is "". | |
| 2599 | ||
| 2600 | 30 June 2009: Wouter | |
| 2601 | - more lenient truncation checks. | |
| 2602 | ||
| 2603 | 29 June 2009: Wouter | |
| 2604 | - ldns trunk r2959 imported as tarball, because of solaris cc compile | |
| 2605 | support for c99. r2960 for better configure. | |
| 2606 | - better wrongly_truncated check. | |
| 2607 | - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to | |
| 2608 | avoid dropped packets at routers. | |
| 2609 | ||
| 2610 | 26 June 2009: Wouter | |
| 2611 | - Fix EDNS fallback when EDNS works for short answers but long answers | |
| 2612 | are dropped. | |
| 2613 | ||
| 2614 | 22 June 2009: Wouter | |
| 2615 | - fixup iter priv strict aliasing while preserving size of sockaddr. | |
| 2616 | - iana portlist updated. (one less port allocated, one more fraction | |
| 2617 | of a bit for security!) | |
| 2618 | - updated fedora specfile in contrib from Paul Wouters. | |
| 2619 | ||
| 2620 | 19 June 2009: Wouter | |
| 2621 | - Fixup strict aliasing warning in iter priv code. | |
| 2622 | and config_file code. | |
| 2623 | - iana portlist updated. | |
| 2624 | - harden-referral-path: handle cases where NS is in answer section. | |
| 2625 | ||
| 2626 | 18 June 2009: Wouter | |
| 2627 | - Fix of message parse bug where (specifically) an NSEC and RRSIG | |
| 2628 | in the wrong order would be parsed, but put wrongly into internal | |
| 2629 | structures so that later validation would fail. | |
| 2630 | - Extreme lenience for wrongly truncated replies where a positive | |
| 2631 | reply has an NS in the authority but no signatures. They are | |
| 2632 | turned into minimal responses with only the (secure) answer. | |
| 2633 | - autoconf 2.63 for configure. | |
| 2634 | - python warnings suppress. Keep python API away from header files. | |
| 2635 | ||
| 2636 | 17 June 2009: Wouter | |
| 2637 | - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was | |
| 2638 | used for the python code in unbound. (http://www.nic.cz/vip/ in cz). | |
| 2639 | ||
| 2640 | 16 June 2009: Wouter | |
| 2641 | - Fixup opportunistic target query generation to it does not | |
| 2642 | generate queries that are known to fail. | |
| 2643 | - Touchup on munin total memory report. | |
| 2644 | - messages picked out of the cache by the iterator are checked | |
| 2645 | if their cname chain is still correct and if validation status | |
| 2646 | has to be reexamined. | |
| 2647 | ||
| 2648 | 15 June 2009: Wouter | |
| 2649 | - iana portlist updated. | |
| 2650 | ||
| 2651 | 14 June 2009: Wouter | |
| 2652 | - Fixed bug where cached responses would lose their security | |
| 2653 | status on second validation, which especially impacted dlv | |
| 2654 | lookups. Reported by Hauke Lampe. | |
| 2655 | ||
| 2656 | 13 June 2009: Wouter | |
| 2657 | - bug #254. removed random whitespace from example.conf. | |
| 2658 | ||
| 2659 | 12 June 2009: Wouter | |
| 2660 | - Fixup potential wrong NSEC picked out of the cache. | |
| 2661 | - If unfulfilled callbacks are deleted they are called with an error. | |
| 2662 | - fptr wlist checks for mesh callbacks. | |
| 2663 | - fwd above stub in configuration works. | |
| 2664 | ||
| 2665 | 11 June 2009: Wouter | |
| 2666 | - Fix queries for type DS when forward or stub zones are there. | |
| 2667 | They are performed to higherup domains, and thus treated as if | |
| 2668 | going to higher zones when looking up the right forward or stub | |
| 2669 | server. This makes a stub pointing to a local server that has | |
| 2670 | a local view of example.com signed with the same keys as are | |
| 2671 | publicly used work. Reported by Johan Ihren. | |
| 2672 | - Added build-unbound-localzone-from-hosts.pl to contrib, from | |
| 2673 | Dennis DeDonatis. It converts /etc/hosts into config statements. | |
| 2674 | - same thing fixed for forward-zone and DS, chain of trust from | |
| 2675 | public internet into the forward-zone works now. Added unit test. | |
| 2676 | ||
| 2677 | 9 June 2009: Wouter | |
| 2678 | - openssl key files are opened apache-style, when user is root and | |
| 2679 | before chrooting. This makes permissions on remote-control key | |
| 2680 | files easier to set up. Fixes bug #251. | |
| 2681 | - flush_type and flush_name remove msg cache entries. | |
| 2682 | - codereview - dp copy bogus setting fix. | |
| 2683 | ||
| 2684 | 8 June 2009: Wouter | |
| 2685 | - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause | |
| 2686 | inadvertant behaviour. | |
| 2687 | - 1.3.0 tarball for release created. | |
| 2688 | - 1.3.1 development in svn trunk. | |
| 2689 | - iana portlist updated. | |
| 2690 | - fix lint from complaining on ldns/sha.h. | |
| 2691 | - help compiler figure out aliasing in priv_rrset_bad() routine. | |
| 2692 | - fail to configure with python if swig is not found. | |
| 2693 | - unbound_munin_ in contrib uses ps to show rss if sbrk does not work. | |
| 2694 | ||
| 2695 | 3 June 2009: Wouter | |
| 2696 | - fixup bad free() when wrongly encoded DSA signature is seen. | |
| 2697 | Reported by Paul Wouters. | |
| 2698 | - review comments from Matthijs. | |
| 2699 | ||
| 2700 | 2 June 2009: Wouter | |
| 2701 | - --enable-sha2 option. The draft rsasha256 changed its algorithm | |
| 2702 | numbers too often. Therefore it is more prudent to disable the | |
| 2703 | RSASHA256 and RSASHA512 support by default. | |
| 2704 | - ldns trunk included as new tarball. | |
| 2705 | - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point. | |
| 2706 | ||
| 2707 | 29 May 2009: Wouter | |
| 2708 | - fixup doc bug in README reported by Matthew Dempsky. | |
| 2709 | ||
| 2710 | 28 May 2009: Wouter | |
| 2711 | - update iana port list | |
| 2712 | - update ldns lib tarball | |
| 2713 | ||
| 2714 | 27 May 2009: Wouter | |
| 2715 | - detect lack of IPv6 support on XP (with a different error code). | |
| 2716 | - Fixup a crash-on-exit which was triggered by a very long queue. | |
| 2717 | Unbound would try to re-use ports that came free, but this is | |
| 2718 | of course not really possible because everything is deleted. | |
| 2719 | Most easily triggered on XP (not Vista), maybe because of the | |
| 2720 | network stack encouraging large messages backlogs. | |
| 2721 | - change in debug statements. | |
| 2722 | - Fixed bug that could cause a crash if root prime failed when there | |
| 2723 | were message backlogs. | |
| 2724 | ||
| 2725 | 26 May 2009: Wouter | |
| 2726 | - Thanks again to Brett Carr, found an assertion that was not true. | |
| 2727 | Assertion checked if recursion parent query still existed. | |
| 2728 | ||
| 2729 | 29 April 2009: Wouter | |
| 2730 | - Thanks to Brett Carr, caught windows resource leak, use | |
| 2731 | closesocket() and not close() on sockets or else the network stack | |
| 2732 | starts to leak handles. | |
| 2733 | - Removed usage of windows Mutex because windows cannot handle enough | |
| 2734 | mutexes open. Provide own mutex implementation using primitives. | |
| 2735 | ||
| 2736 | 28 April 2009: Wouter | |
| 2737 | - created svn tag for 1.3.0. | |
| 2738 | ||
| 2739 | 27 April 2009: Wouter | |
| 2740 | - optimised cname from cache. | |
| 2741 | - ifdef windows functions in testbound. | |
| 2742 | ||
| 2743 | 23 April 2009: Wouter | |
| 2744 | - fix for threadsafety in solaris thr_key_create() in tests. | |
| 2745 | - iana portlist updated. | |
| 2746 | - fix pylib test for Darwin. | |
| 2747 | - fix pymod test for Darwin and a python threading bug in pymod init. | |
| 2748 | - check python >= 2.4 in configure. | |
| 2749 | - -ldl check for libcrypto 1.0.0beta. | |
| 2750 | ||
| 2751 | 21 April 2009: Wouter | |
| 2752 | - fix for build outside sourcedir. | |
| 2753 | - fix for configure script swig detection. | |
| 2754 | ||
| 2755 | 17 April 2009: Wouter | |
| 2756 | - Fix reentrant in minievent handler for unix. Could have resulted | |
| 2757 | in spurious event callbacks. | |
| 2758 | - timers do not take up a fd slot for winsock handler. | |
| 2759 | - faster fix for winsock reentrant check. | |
| 2760 | - fix rsasha512 unit test for new (interim) algorithm number. | |
| 2761 | - fix test:ldns doesn't like DOS line endings in keyfiles on unix. | |
| 2762 | - fix compile warning on ubuntu (configlexer fwrite return value). | |
| 2763 | - move python include directives into CPPFLAGS instead of CFLAGS. | |
| 2764 | ||
| 2765 | 16 April 2009: Wouter | |
| 2766 | - winsock event handler exit very quickly on signal, even if | |
| 2767 | under heavy load. | |
| 2768 | - iana portlist updated. | |
| 2769 | - fixup windows winsock handler reentrant problem. | |
| 2770 | ||
| 2771 | 14 April 2009: Wouter | |
| 2772 | - bug #245: fix munin plugin, perform cleanup of stale lockfiles. | |
| 2773 | - makedist.sh; better help text. | |
| 2774 | - cache-min-ttl option and tests. | |
| 2775 | - mingw detect error condition on TCP sockets (NOTCONN). | |
| 2776 | ||
| 2777 | 9 April 2009: Wouter | |
| 2778 | - Fix for removal of RSASHA256_NSEC3 protonumber from ldns. | |
| 2779 | - ldns tarball updated. | |
| 2780 | - iana portlist update. | |
| 2781 | - detect GOST support in openssl-1.0.0-beta1, and fix compile problem | |
| 2782 | because that openssl defines the name STRING for itself. | |
| 2783 | ||
| 2784 | 6 April 2009: Wouter | |
| 2785 | - windows compile fix. | |
| 2786 | - Detect FreeBSD jail without ipv6 addresses assigned. | |
| 2787 | - python libunbound wrapper unit test. | |
| 2788 | - installs the following files. Default is to not build them. | |
| 2789 | from configure --with-pythonmodule: | |
| 2790 | /usr/lib/python2.x/site-packages/unboundmodule.py | |
| 2791 | from configure --with-pyunbound: | |
| 2792 | /usr/lib/python2.x/site-packages/unbound.py | |
| 2793 | /usr/lib/python2.x/site-packages/_unbound.so* | |
| 2794 | The example python scripts (pythonmod/examples and | |
| 2795 | libunbound/python/examples) are not installed. | |
| 2796 | - python invalidate routine respects packed rrset ids and locks. | |
| 2797 | - clock skew checks in unbound, config statements. | |
| 2798 | - nxdomain ttl considerations in requirements.txt | |
| 2799 | ||
| 2800 | 3 April 2009: Wouter | |
| 2801 | - Fixed a bug that caused messages to be stored in the cache too | |
| 2802 | long. Hard to trigger, but NXDOMAINs for nameservers or CNAME | |
| 2803 | targets have been more vulnerable to the TTL miscalculation bug. | |
| 2804 | - documentation test fixed for python addition. | |
| 2805 | ||
| 2806 | 2 April 2009: Wouter | |
| 2807 | - pyunbound (libunbound python plugin) compiles using libtool. | |
| 2808 | - documentation for pythonmod and pyunbound is generated in doc/html. | |
| 2809 | - iana portlist updated. | |
| 2810 | - fixed bug in unbound-control flush_zone where it would not flush | |
| 2811 | every message in the target domain. This especially impacted | |
| 2812 | NXDOMAIN messages which could remain in the cache regardless. | |
| 2813 | - python module test package. | |
| 2814 | ||
| 2815 | 1 April 2009: Wouter | |
| 2816 | - suppress errors when trying to contact authority servers that gave | |
| 2817 | ipv6 AAAA records for their nameservers with ipv4 mapped contents. | |
| 2818 | Still tries to do so, could work when deployed in intranet. | |
| 2819 | Higher verbosity shows the error. | |
| 2820 | - new libunbound calls documented. | |
| 2821 | - pyunbound in libunbound/python. Removed compile warnings. | |
| 2822 | Makefile to make it. | |
| 2823 | ||
| 2824 | 30 March 2009: Wouter | |
| 2825 | - Fixup LDFLAGS from libevent sourcedir compile configure restore. | |
| 2826 | - Fixup so no non-absolute rpaths are added. | |
| 2827 | - Fixup validation of RRSIG queries, they are let through. | |
| 2828 | - read /dev/random before chroot | |
| 2829 | - checkconf fix no python checks when no python module enabled. | |
| 2830 | - fix configure, pthread first, so other libs do not change outcome. | |
| 2831 | ||
| 2832 | 27 March 2009: Wouter | |
| 2833 | - nicer -h output. report linked libraries and modules. | |
| 2834 | - prints modules in intuitive order (config file friendly). | |
| 2835 | - python compiles easily on BSD. | |
| 2836 | ||
| 2837 | 26 March 2009: Wouter | |
| 2838 | - ignore swig varargs warnings with gcc. | |
| 2839 | - remove duplicate example.conf text from python example configs. | |
| 2840 | - outofdir compile fix for python. | |
| 2841 | - pyunbound works. | |
| 2842 | - print modules compiled in on -h. manpage. | |
| 2843 | ||
| 2844 | 25 March 2009: Wouter | |
| 2845 | - initial import of the python contribution from Zdenek Vasicek and | |
| 2846 | Marek Vavrusa. | |
| 2847 | - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0. | |
| 2848 | ||
| 2849 | 24 March 2009: Wouter | |
| 2850 | - more neat configure.ac. Removed duplicate config.h includes. | |
| 2851 | - neater config.h.in. | |
| 2852 | - iana portlist updated. | |
| 2853 | - fix util/configlexer.c and solaris -std=c99 flag. | |
| 2854 | - fix postcommit aclocal errors. | |
| 2855 | - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R. | |
| 2856 | - swap order of host detect and libtool generation. | |
| 2857 | ||
| 2858 | 23 March 2009: Wouter | |
| 2859 | - added launchd plist example file for MacOSX to contrib. | |
| 2860 | - deprecation test for daemon(3). | |
| 2861 | - moved common configure actions to m4 include, prettier Makefile. | |
| 2862 | ||
| 2863 | 20 March 2009: Wouter | |
| 2864 | - bug #239: module-config entries order is important. Documented. | |
| 2865 | - build fix for test asynclook. | |
| 2866 | ||
| 2867 | 19 March 2009: Wouter | |
| 2868 | - winrc/README.txt dos-format text file. | |
| 2869 | - iana portlist updated. | |
| 2870 | - use _beginthreadex() when available (performs stack alignment). | |
| 2871 | - defaults for windows baked into configure.ac (used if on mingw). | |
| 2872 | ||
| 2873 | 18 March 2009: Wouter | |
| 2874 | - Added tests, unknown algorithms become insecure. fallback works. | |
| 2875 | - Fix for and test for unknown algorithms in a trust anchor | |
| 2876 | definition. Trust anchors with no supported algos are ignored. | |
| 2877 | This means a (higher)DS or DLV entry for them could succeed, and | |
| 2878 | otherwise they are treated as insecure. | |
| 2879 | - domain-insecure: "example.com" statement added. Sets domain | |
| 2880 | insecure regardless of chain of trust DSs or DLVs. The inverse | |
| 2881 | of a trust-anchor. | |
| 2882 | ||
| 2883 | 17 March 2009: Wouter | |
| 2884 | - unit test for unsupported algorithm in anchor warning. | |
| 2885 | - fixed so queries do not fail on opportunistic target queries. | |
| 2886 | ||
| 2887 | 16 March 2009: Wouter | |
| 2888 | - fixup diff error printout in contrib/update-itar.sh. | |
| 2889 | - added contrib/unbound_cacti for statistics support in cacti, | |
| 2890 | contributed by Dmitriy Demidov. | |
| 2891 | ||
| 2892 | 13 March 2009: Wouter | |
| 2893 | - doxygen and lex/yacc on linux. | |
| 2894 | - strip update-anchor on makedist -w. | |
| 2895 | - fix testbound on windows. | |
| 2896 | - default log to syslog for windows. | |
| 2897 | - uninstaller can stop unbound - changed text on it to reflect that. | |
| 2898 | - remove debugging from windows 'cron' actions. | |
| 2899 | ||
| 2900 | 12 March 2009: Wouter | |
| 2901 | - log to App.logs on windows prints executable identity. | |
| 2902 | - fixup tests. | |
| 2903 | - munin plugin fix benign locking error printout. | |
| 2904 | - anchor-update for windows, called every 24 hours; unbound reloads. | |
| 2905 | ||
| 2906 | 11 March 2009: Wouter | |
| 2907 | - winsock event handler resets WSAevents after signalled. | |
| 2908 | - winsock event handler tests if signals are really signalled. | |
| 2909 | - install and service with log to file works on XP and Vista on | |
| 2910 | default install location. | |
| 2911 | - on windows logging to the Application logbook works (as a service). | |
| 2912 | - fix RUN_DIR on windows compile setting in makedist. | |
| 2913 | - windows registry has Software\Unbound\ConfigFile element. | |
| 2914 | If does not exist, the default is used. The -c switch overrides it. | |
| 2915 | - fix makedist version cleanup function. | |
| 2916 | ||
| 2917 | 10 March 2009: Wouter | |
| 2918 | - makedist -w strips out old rc.. and snapshot info from version. | |
| 2919 | - setup.exe starts and stops unbound after install, before uninstall. | |
| 2920 | - unbound-checkconf recognizes absolute pathnames on windows (C:...). | |
| 2921 | ||
| 2922 | 9 March 2009: Wouter | |
| 2923 | - Nullsoft NSIS installer creation script. | |
| 2924 | ||
| 2925 | 5 March 2009: Wouter | |
| 2926 | - fixup memory leak introduced on 18feb in mesh reentrant fix. | |
| 2927 | ||
| 2928 | 3 March 2009: Wouter | |
| 2929 | - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8). | |
| 2930 | - service works on xp/vista, no config necessary (using defaults). | |
| 2931 | - windows registry settings. | |
| 2932 | ||
| 2933 | 2 March 2009: Wouter | |
| 2934 | - fixup --export-symbols to be -export-symbls for libtool. | |
| 2935 | This should fix extraneous symbols exported from libunbound. | |
| 2936 | Thanks to Ondrej Sury and Robert Edmonds for finding it. | |
| 2937 | - iana portlist updated. | |
| 2938 | - document FAQ entry on stub/forward zones and default blocking. | |
| 2939 | - fix asynclook test app for libunbound not exporting symbols. | |
| 2940 | - service install and remove utils that work with vista UAC. | |
| 2941 | ||
| 2942 | 27 February 2009: Wouter | |
| 2943 | - Fixup lexer, to not give warnings about fwrite. Appeared in | |
| 2944 | new lexer features. | |
| 2945 | - makedistro functionality for mingw. Has RC support. | |
| 2946 | - support spaces and backslashes in configured defaults paths. | |
| 2947 | - register, deregister in service control manager. | |
| 2948 | ||
| 2949 | 25 February 2009: Wouter | |
| 2950 | - windres usage for application resources. | |
| 2951 | ||
| 2952 | 24 February 2009: Wouter | |
| 2953 | - isc moved their dlv key download location. | |
| 2954 | - fixup warning on vista/mingw. | |
| 2955 | - makedist -w for window zip distribution first version. | |
| 2956 | ||
| 2957 | 20 February 2009: Wouter | |
| 2958 | - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped. | |
| 2959 | Nicer script layout. Added url to site in -h output. | |
| 2960 | ||
| 2961 | 19 February 2009: Wouter | |
| 2962 | - unbound-checkconf and unbound print warnings when trust anchors | |
| 2963 | have unsupported algorithms. | |
| 2964 | - added contrib/update-itar.sh This script is similar to | |
| 2965 | update-anchor.sh, and updates from the IANA ITAR repository. | |
| 2966 | You can provide your own PGP key and trust repo, or can use the | |
| 2967 | builtin. The program uses wget and gpg to work. | |
| 2968 | - iana portlist updated. | |
| 2969 | - update-itar.sh: using ftp:// urls because https godaddy certificate | |
| 2970 | is not available everywhere and then gives fatal errors. The | |
| 2971 | security is provided by pgp signature. | |
| 2972 | ||
| 2973 | 18 February 2009: Wouter | |
| 2974 | - more cycle detection. Also for target queries. | |
| 2975 | - fixup bug where during deletion of the mesh queries the callbacks | |
| 2976 | that were reentrant caused assertion failures. Keep the mesh in | |
| 2977 | a reentrant safe state. Affects libunbound, reload of server, | |
| 2978 | on quit and flush_requestlist. | |
| 2979 | - iana portlist updated. | |
| 2980 | ||
| 2981 | 13 February 2009: Wouter | |
| 2982 | - forwarder information now per-thread duplicated. | |
| 2983 | This keeps it read only for speed, with no locking necessary. | |
| 2984 | - forward command for unbound control to change forwarders to use | |
| 2985 | on the fly. | |
| 2986 | - document that unbound-host reads no config file by default. | |
| 2987 | - updated iana portlist. | |
| 2988 | ||
| 2989 | 12 February 2009: Wouter | |
| 2990 | - call setusercontext if available (on BSD). | |
| 2991 | - small refactor of stats clearing. | |
| 2992 | - #227: flush_stats feature for unbound-control. | |
| 2993 | - stats_noreset feature for unbound-control. | |
| 2994 | - flush_requestlist feature for unbound-control. | |
| 2995 | - libunbound version upped API (was changed 5 feb). | |
| 2996 | - unbound-control status shows if root forwarding is in use. | |
| 2997 | - slightly nicer memory management in iter-fwd code. | |
| 2998 | ||
| 2999 | 10 February 2009: Wouter | |
| 3000 | - keys with rfc5011 REVOKE flag are skipped and not considered when | |
| 3001 | validating data. | |
| 3002 | - iana portlist updated | |
| 3003 | - #226: dump_requestlist feature for unbound-control. | |
| 3004 | ||
| 3005 | 6 February 2009: Wouter | |
| 3006 | - contrib contains specfile for fedora 1.2.1 (from Paul Wouters). | |
| 3007 | - iana portlist updated. | |
| 3008 | - fixup EOL in include directive (reported by Paul Wouters). | |
| 3009 | You can no longer specify newlines in the names of included files. | |
| 3010 | - config parser changed. Gives some syntax errors closer to where they | |
| 3011 | occurred. Does not enforce a space after keyword anymore. | |
| 3012 | Does not allow literal newlines inside quoted strings anymore. | |
| 3013 | - verbosity level 5 logs customer IP for new requestlist entries. | |
| 3014 | - test fix, lexer and cancel test. | |
| 3015 | - new option log-time-ascii: yes if you enable it prints timestamps | |
| 3016 | in the log file as Feb 06 13:45:26 (like syslog does). | |
| 3017 | - detect event_base_new in libevent-1.4.1 and later and use it. | |
| 3018 | - #231 unbound-checkconf -o option prints that value from config file. | |
| 3019 | Useful for scripting in management scripts and the like. | |
| 3020 | ||
| 3021 | 5 February 2009: Wouter | |
| 3022 | - ldns 1.5.0 rc as tarball included. | |
| 3023 | - 1.3.0 development continues: | |
| 3024 | change in libunbound API: ub_cancel can return an error, that | |
| 3025 | the async_id did not exist, or that it was already delivered. | |
| 3026 | The result could have been delivered just before the cancel | |
| 3027 | routine managed to acquire the lock, so a caller may get the | |
| 3028 | result at the same time they call cancel. For this case, | |
| 3029 | ub_cancel tries to return an error code. | |
| 3030 | Fixes race condition in ub_cancel() libunbound function. | |
| 3031 | - MacOSX Leopard cleaner text output from configure. | |
| 3032 | - initgroups(3) is called to drop secondary group permissions, if | |
| 3033 | applicable. | |
| 3034 | - configure option --with-ldns-builtin forces the use of the | |
| 3035 | inluded ldns package with the unbound source. The -I include | |
| 3036 | is put before the others, so it avoids bad include files from | |
| 3037 | an older ldns install. | |
| 3038 | - daemon(3) posix call is used when available. | |
| 3039 | - testbound test for older fix added. | |
| 3040 | ||
| 3041 | 4 February 2009: Wouter | |
| 3042 | - tag for release 1.2.1. | |
| 3043 | - trunk setup for 1.3.0 development. | |
| 3044 | ||
| 3045 | 3 February 2009: Wouter | |
| 3046 | - noted feature requests in doc/TODO. | |
| 3047 | - printout more detailed errors on ssl certificate loading failures. | |
| 3048 | - updated IANA portlist. | |
| 3049 | ||
| 3050 | 16 January 2009: Wouter | |
| 3051 | - more quiet about ipv6 network failures, i.e. when ipv6 is not | |
| 3052 | available (network unreachable). Debug still printed on high | |
| 3053 | verbosity. | |
| 3054 | - unbound-host -4 and -6 options. Stops annoying ipv6 errors when | |
| 3055 | debugging with unbound-host -4 -d ... | |
| 3056 | - more cycle detection for NS-check, addr-check, root-prime and | |
| 3057 | stub-prime queries in the iterator. Avoids possible deadlock | |
| 3058 | when priming fails. | |
| 3059 | ||
| 3060 | 15 January 2009: Wouter | |
| 3061 | - bug #229: fixup configure checks for compilation with Solaris | |
| 3062 | Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc | |
| 3063 | - fixup suncc warnings. | |
| 3064 | - fix bug where unbound could crash using libevent 1.3 and older. | |
| 3065 | - update testset for recent retry change. | |
| 3066 | ||
| 3067 | 14 January 2009: Wouter | |
| 3068 | - 1.2.1 feature: negative caching for failed queries. | |
| 3069 | Queries that failed are cached for 5 seconds (NORR_TTL). | |
| 3070 | If the failure is local, like out of memory, it is not cached. | |
| 3071 | - the TTL comparison for the cache used different comparisons, | |
| 3072 | causing many cache responses that used the iterator and validator | |
| 3073 | state machines unnecessarily. | |
| 3074 | - retry from 4 to 5 so that EDNS drop retry is part of the first | |
| 3075 | query resolve attempt, and cached error does not stop EDNS fallback. | |
| 3076 | - remove debug prints that protect against bad referrals. | |
| 3077 | - honor QUIET=no on make commandline (or QUIET=yes ). | |
| 3078 | ||
| 3079 | 13 January 2009: Wouter | |
| 3080 | - fixed bug in lameness marking, removed printouts. | |
| 3081 | - find NS rrset more cleanly for qtype NS. | |
| 3082 | - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for | |
| 3083 | reporting and logs. | |
| 3084 | - 1.2.1 feature: stops resolving AAAAs promiscuously when they | |
| 3085 | are in the negative cache. | |
| 3086 | ||
| 3087 | 12 January 2009: Wouter | |
| 3088 | - fixed bug in infrastructure lameness cache, did not lowercase | |
| 3089 | name of zone to hash when setting lame. | |
| 3090 | - lameness debugging printouts. | |
| 3091 | ||
| 3092 | 9 January 2009: Wouter | |
| 3093 | - created svn tag for 1.2.0 release. | |
| 3094 | - svn trunk contains 1.2.1 version number. | |
| 3095 | - iana portlist updated for todays list. | |
| 3096 | - removed debug print. | |
| 3097 | ||
| 3098 | 8 January 2009: Wouter | |
| 3099 | - new version of ldns-trunk (today) included as tarball, fixed | |
| 3100 | bug #224, building with -j race condition. | |
| 3101 | - remove possible race condition in the test for race conditions. | |
| 3102 | ||
| 3103 | 7 January 2009: Wouter | |
| 3104 | - version 1.2.0 in preparation. | |
| 3105 | - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file | |
| 3106 | statements. (Adapted from patch by Paul Wouters). | |
| 3107 | - typo fix and iana portlist updated. | |
| 3108 | - porting testsuite; unused var warning, and type fixup. | |
| 3109 | ||
| 3110 | 6 January 2009: Wouter | |
| 3111 | - fixup packet-of-death when compiled with --enable-debug. | |
| 3112 | A malformed packet could cause an internal assertion failure. | |
| 3113 | - added test for HINFO canonicalisation behaviour. | |
| 3114 | - fixup reported problem with transparent local-zone data where | |
| 3115 | queries with different type could get nxdomain. Now queries | |
| 3116 | with a different name get resolved normally, with different type | |
| 3117 | get a correct NOERROR/NODATA answer. | |
| 3118 | - HINFO no longer downcased for validation, making unbound compatible | |
| 3119 | with bind and ldns. | |
| 3120 | - fix reading included config files when chrooted. | |
| 3121 | Give full path names for include files. | |
| 3122 | Relative path names work if the start dir equals the working dir. | |
| 3123 | - fix libunbound message transport when no packet buffer is available. | |
| 3124 | ||
| 3125 | 5 January 2009: Wouter | |
| 3126 | - fixup getaddrinfo failure handling for remote control port. | |
| 3127 | - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints. | |
| 3128 | - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/ | |
| 3129 | - comm_timer_set performs base_set operation after event_add. | |
| 3130 | ||
| 3131 | 18 December 2008: Wouter | |
| 3132 | - fixed bug reported by Duane Wessels: error in DLV lookup, would make | |
| 3133 | some zones that had correct DLV keys as insecure. | |
| 3134 | - follows -rc makedist from ldns changes (no _rc). | |
| 3135 | - ldns tarball updated with 1.4.1rc for DLV unit test. | |
| 3136 | - verbose prints about recursion lame detection and server selection. | |
| 3137 | - fixup BSD port for infra host storage. It hashed wrongly. | |
| 3138 | - fixup makedist snapshot name generation. | |
| 3139 | - do not reopen syslog to avoid dev/log dependency. | |
| 3140 | ||
| 3141 | 17 December 2008: Wouter | |
| 3142 | - follows ldns makedist.sh. -rc option. autom4te dir removed. | |
| 3143 | - unbound-control status command. | |
| 3144 | - extended statistics has a number of ipv6 queries counter. | |
| 3145 | contrib/unbound_munin_ was updated to draw ipv6 in the hits graph. | |
| 3146 | ||
| 3147 | 16 December 2008: Wouter | |
| 3148 | - follow makedist improvements from ldns, for maintainers prereleases. | |
| 3149 | - snapshot version uses _ not - to help rpm distinguish the | |
| 3150 | version number. | |
| 3151 | ||
| 3152 | 11 December 2008: Wouter | |
| 3153 | - better fix for bug #219: use LOG_NDELAY with openlog() call. | |
| 3154 | Thanks to Tamas Tevesz. | |
| 3155 | ||
| 3156 | 9 December 2008: Wouter | |
| 3157 | - bug #221 fixed: unbound checkconf checks if key files exist if | |
| 3158 | remote control is enabled. Also fixed NULL printf when not chrooted. | |
| 3159 | - iana portlist updated. | |
| 3160 | ||
| 3161 | 3 December 2008: Wouter | |
| 3162 | - Fix problem reported by Jaco Engelbrecht where unbound-control stats | |
| 3163 | freezes up unbound if this was compiled without threading, and | |
| 3164 | was using multiple processes. | |
| 3165 | - iana portlist updated. | |
| 3166 | - test for remote control with interprocess communication. | |
| 3167 | - created command distribution mechanism so that remote control | |
| 3168 | commands other than 'stats' work on all processes in a nonthreaded | |
| 3169 | compiled version. dump/load cache work, on the first process. | |
| 3170 | - fixup remote control local_data addition memory corruption bug. | |
| 3171 | ||
| 3172 | 1 December 2008: Wouter | |
| 3173 | - SElinux policy files in contrib/selinux for the unbound daemon, | |
| 3174 | by Paul Wouters and Adam Tkac. | |
| 3175 | ||
| 3176 | 25 November 2008: Wouter | |
| 3177 | - configure complains when --without-ssl is given (bug #220). | |
| 3178 | - skip unsupported feature tests on vista/mingw. | |
| 3179 | - fixup testcode/streamtcp to work on vista/mingw. | |
| 3180 | - root-hints test checks version of dig required. | |
| 3181 | - blacklisted servers are polled at a low rate (1%) to see if they | |
| 3182 | come back up. But not if there is some other working server. | |
| 3183 | ||
| 3184 | 24 November 2008: Wouter | |
| 3185 | - document that the user of the server daemon needs read privileges | |
| 3186 | on the keys and certificates generated by unbound-control-setup. | |
| 3187 | This is different per system or distribution, usually, running the | |
| 3188 | script under the same username as the server uses suffices. | |
| 3189 | i.e. sudo -u unbound unbound-control-setup | |
| 3190 | - testset port to vista/mingw. | |
| 3191 | - tcp_sigpipe to freebsd port. | |
| 3192 | ||
| 3193 | 21 November 2008: Wouter | |
| 3194 | - fixed tcp accept, errors were printed when they should not. | |
| 3195 | - unbound-control-setup.sh removes read/write permissions other | |
| 3196 | from the keys it creates (as suggested by Dmitriy Demidov). | |
| 3197 | ||
| 3198 | 20 November 2008: Wouter | |
| 3199 | - fixup fatal error due to faulty error checking after tcp accept. | |
| 3200 | - add check in rlimit to avoid integer underflow. | |
| 3201 | - rlimit check with new formula; better estimate for number interfaces | |
| 3202 | - nicer comments in rlimit check. | |
| 3203 | - tag 1.1.1 created in svn. | |
| 3204 | - trunk label is 1.1.2 | |
| 3205 | ||
| 3206 | 19 November 2008: Wouter | |
| 3207 | - bug #219: fixed so that syslog which delays opening until the first | |
| 3208 | log line is written, gets a log line while not chroot'ed yet. | |
| 3209 | ||
| 3210 | 18 November 2008: Wouter | |
| 3211 | - iana portlist updated. | |
| 3212 | - removed cast in unit test debug print that was not 64bit safe. | |
| 3213 | - trunk back to 1.1.0; copied to tags 1.1.0 release. | |
| 3214 | - trunk to has version number 1.1.1 again. | |
| 3215 | - in 1.1.1; make clean nicer. grammar in manpage. | |
| 3216 | ||
| 3217 | 17 November 2008: Wouter | |
| 3218 | - theoretical fix for problems reported on mailing list. | |
| 3219 | If a delegation point has no A but only AAAA and do-ip6 is no, | |
| 3220 | resolution would fail. Fixed to ask for the A and AAAA records. | |
| 3221 | It has to ask for both always, so that it can fail quietly, from | |
| 3222 | TLD perspective, when a zone is only reachable on one transport. | |
| 3223 | - test for above, only AAAA and doip6 is no. Fix causes A record | |
| 3224 | for nameserver to be fetched. | |
| 3225 | - fixup address duplication on cache fillup for delegation points. | |
| 3226 | - testset updated for new query answer requirements. | |
| 3227 | ||
| 3228 | 14 November 2008: Wouter | |
| 3229 | - created 1.1.0 release tag in svn. | |
| 3230 | - trunk moved to 1.1.1 | |
| 3231 | - fixup unittest-neg for locking. | |
| 3232 | ||
| 3233 | 13 November 2008: Wouter | |
| 3234 | - added fedora init and specfile to contrib (by Paul Wouters). | |
| 3235 | - added configure check for ldns 1.4.0 (using its compat funcs). | |
| 3236 | - neater comments in worker.h. | |
| 3237 | - removed doc/plan and updated doc/TODO. | |
| 3238 | - silenced EHOSTDOWN (verbosity 2 or higher to see it). | |
| 3239 | - review comments from Jelte, Matthijs. Neater code. | |
| 3240 | ||
| 3241 | 12 November 2008: Wouter | |
| 3242 | - add unbound-control manpage to makedist replace list. | |
| 3243 | ||
| 3244 | 11 November 2008: Wouter | |
| 3245 | - unit test for negative cache, stress tests the refcounting. | |
| 3246 | - fix for refcounting error that could cause fptr_wlist fatal exit | |
| 3247 | in the negative cache rbtree (upcoming 1.1 feature). (Thanks to | |
| 3248 | Attila Nagy for testing). | |
| 3249 | - nicer comments in cachedump about failed RR to string conversion. | |
| 3250 | - fix 32bit wrap around when printing large (4G and more) mem usage | |
| 3251 | for extended statistics. | |
| 3252 | ||
| 3253 | 10 November 2008: Wouter | |
| 3254 | - fixup the getaddrinfo compat code rename. | |
| 3255 | ||
| 3256 | 8 November 2008: Wouter | |
| 3257 | - added configure check for eee build warning. | |
| 3258 | ||
| 3259 | 7 November 2008: Wouter | |
| 3260 | - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4. | |
| 3261 | - detect nonblocking problems in network stack in configure script. | |
| 3262 | ||
| 3263 | 6 November 2008: Wouter | |
| 3264 | - dname_priv must decompress the name before comparison. | |
| 3265 | - iana portlist updated. | |
| 3266 | ||
| 3267 | 5 November 2008: Wouter | |
| 3268 | - fixed possible memory leak in key_entry_key deletion. | |
| 3269 | Would leak a couple bytes when trust anchors were replaced. | |
| 3270 | - if query and reply qname overlap, the bytes are skipped not copied. | |
| 3271 | - fixed file descriptor leak when messages were jostled out that | |
| 3272 | had outstanding (TCP) replies. | |
| 3273 | - DNAMEs used from cache have their synthesized CNAMEs initialized | |
| 3274 | properly. | |
| 3275 | - fixed file descriptor leak for localzone type deny (for TCP). | |
| 3276 | - fixed memleak at exit for nsec3 negative cached zones. | |
| 3277 | - fixed memleak for the keyword 'nodefault' when reading config. | |
| 3278 | - made verbosity of 'edns incapable peer' warning higher, so you | |
| 3279 | do not get spammed by it. | |
| 3280 | - caught elusive Bad file descriptor error bug, that would print the | |
| 3281 | error while unnecessarily try to listen to a closed fd. Fixed. | |
| 3282 | ||
| 3283 | 4 November 2008: Wouter | |
| 3284 | - fixed -Wwrite-strings warnings that result in better code. | |
| 3285 | ||
| 3286 | 3 November 2008: Wouter | |
| 3287 | - fixup build process for Mac OSX linker, use ldns b32 compat funcs. | |
| 3288 | - generated configure with autoconf-2.61. | |
| 3289 | - iana portlist updated. | |
| 3290 | - detect if libssl needs libdl. For static linking with libssl. | |
| 3291 | - changed to use new algorithm identifiers for sha256/sha512 | |
| 3292 | from ldns 1.4.0 (need very latest version). | |
| 3293 | - updated the included ldns tarball. | |
| 3294 | - proper detection of SHA256 and SHA512 functions (not just sizes). | |
| 3295 | ||
| 3296 | 23 October 2008: Wouter | |
| 3297 | - a little more debug info for failure on signer names. prints names. | |
| 3298 | ||
| 3299 | 22 October 2008: Wouter | |
| 3300 | - CFLAGS are picked up by configure from the environment. | |
| 3301 | - iana portlist updated. | |
| 3302 | - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too. | |
| 3303 | - new stub-prime: yesno option. Default is off, so it does not prime. | |
| 3304 | can be turned on to get same behaviour as previous unbound release. | |
| 3305 | - made automated test that checks if builtin root hints are uptodate. | |
| 3306 | - finished draft-wijngaards-dnsext-resolver-side-mitigation | |
| 3307 | implementation. The unwanted-reply-threshold can be set. | |
| 3308 | - fixup so fptr_whitelist test in alloc.c works. | |
| 3309 | ||
| 3310 | 21 October 2008: Wouter | |
| 3311 | - fix update-anchors.sh, so it does not report different RR order | |
| 3312 | as an update. Sorts the keys in the file. Updated copyright. | |
| 3313 | - fixup testbound on windows, the command control pipe doesn't exist. | |
| 3314 | - skip 08hostlib test on windows, no fork() available. | |
| 3315 | - made unbound-remote work on windows. | |
| 3316 | ||
| 3317 | 20 October 2008: Wouter | |
| 3318 | - quench a log message that is debug only. | |
| 3319 | - iana portlist updated. | |
| 3320 | - do not query bogus nameservers. It is like nameservers that have | |
| 3321 | the NS or A or AAAA record bogus are listed as donotquery. | |
| 3322 | - if server selection is faced with only bad choices, it will | |
| 3323 | attempt to get more options to be fetched. | |
| 3324 | - changed bogus-ttl default value from 900 to 60 seconds. | |
| 3325 | In anticipation that operator caused failures are more likely than | |
| 3326 | actual attacks at this time. And thus repeated validation helps | |
| 3327 | the operators get the problem fixed sooner. It makes validation | |
| 3328 | failures go away sooner (60 seconds after the zone is fixed). | |
| 3329 | Also it is likely to try different nameserver targets every minute, | |
| 3330 | so that if a zone is bad on one server but not another, it is | |
| 3331 | likely to pick up the 'correct' one after a couple minutes, | |
| 3332 | and if the TTL is big enough that solves validation for the zone. | |
| 3333 | - fixup unbound-control compilation on windows. | |
| 3334 | ||
| 3335 | 17 October 2008: Wouter | |
| 3336 | - port Leopard/G5: fixup type conversion size_t/uint32. | |
| 3337 | please ranlib, stop file without symbols warning. | |
| 3338 | - harden referral path now also validates the root after priming. | |
| 3339 | It looks up the root NS authoritatively as well as the root servers | |
| 3340 | and attemps to validate the entries. | |
| 3341 | ||
| 3342 | 16 October 2008: Wouter | |
| 3343 | - Fixup negative TTL values appearing (reported by Attila Nagy). | |
| 3344 | ||
| 3345 | 15 October 2008: Wouter | |
| 3346 | - better documentation for 0x20; remove fallback TODO, it is done. | |
| 3347 | - harden-referral-path feature includes A, AAAA queries for glue, | |
| 3348 | as well as very careful NS caching (only when doing NS query). | |
| 3349 | A, AAAA use the delegation from the NS-query. | |
| 3350 | ||
| 3351 | 14 October 2008: Wouter | |
| 3352 | - fwd_three.tpkg test was flaky. If the three requests hit the | |
| 3353 | wrong threads by chance (or bad OS) then the test would fail. | |
| 3354 | Made less flaky by increasing number of retries. | |
| 3355 | - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs. | |
| 3356 | - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014). | |
| 3357 | Which includes the ldns_dname_absolute fix. | |
| 3358 | - fwd_three test remains flaky now that unbound does not stop | |
| 3359 | listening when full. Thus, removed timeout problem. | |
| 3360 | It may be serviced by three threads, or maybe by one. | |
| 3361 | Mostly only useful for lock-check testing now. | |
| 3362 | ||
| 3363 | 13 October 2008: Wouter | |
| 3364 | - fixed recursion servers deployed as authoritative detection, so | |
| 3365 | that as a last resort, a +RD query is sent there to get the | |
| 3366 | correct answer. | |
| 3367 | - iana port list update. | |
| 3368 | - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013). | |
| 3369 | ||
| 3370 | 10 October 2008: Wouter | |
| 3371 | - fixup tests - the negative cache contained the correct NSEC3s for | |
| 3372 | two tests that are supposed to fail to validate. | |
| 3373 | ||
| 3374 | 9 October 2008: Wouter | |
| 3375 | - negative cache caps max iterations of NSEC3 done. | |
| 3376 | - NSEC3 negative cache for qtype DS works. | |
| 3377 | ||
| 3378 | 8 October 2008: Wouter | |
| 3379 | - NSEC negative cache for DS. | |
| 3380 | ||
| 3381 | 6 October 2008: Wouter | |
| 3382 | - jostle-timeout option, so you can config for slow links. | |
| 3383 | - 0x20 fallback code. Tries 3xnumber of nameserver addresses | |
| 3384 | queries that must all be the same. Sent to random nameservers. | |
| 3385 | - documented choices for DoS, EDNS, 0x20. | |
| 3386 | ||
| 3387 | 2 October 2008: Wouter | |
| 3388 | - fixup unlink of pidfile. | |
| 3389 | - fixup SHA256 algorithm collation code. | |
| 3390 | - contrib/update-anchor.sh does not overwrite anchors if not needed. | |
| 3391 | exits 0 when a restart is needed, other values if not. | |
| 3392 | so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart | |
| 3393 | can restart unbound exactly when needed. | |
| 3394 | ||
| 3395 | 30 September 2008: Wouter | |
| 3396 | - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1. | |
| 3397 | - tests for sha256 support and downgrade resistance. | |
| 3398 | - RSASHA256 and RSASHA512 support (using the draft in dnsext), | |
| 3399 | using the drafted protocol numbers. | |
| 3400 | - when using stub on localhost (127.0.0.1@10053) unbound works. | |
| 3401 | Like when running NSD to host a local zone, on the same machine. | |
| 3402 | The noprime feature. manpages more explanation. Added a test for it. | |
| 3403 | - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com" | |
| 3404 | ||
| 3405 | 29 September 2008: Wouter | |
| 3406 | - EDNS lameness detection, if EDNS packets are dropped this is | |
| 3407 | detected, eventually. | |
| 3408 | - multiple query timeout rtt backoff does not backoff too much. | |
| 3409 | ||
| 3410 | 26 September 2008: Wouter | |
| 3411 | - tests for remote-control. | |
| 3412 | - small memory leak in exception during remote control fixed. | |
| 3413 | - fixup for lock checking but not unchecking in remote control. | |
| 3414 | - iana portlist updated. | |
| 3415 | ||
| 3416 | 23 September 2008: Wouter | |
| 3417 | - Msg cache is loaded. A cache load enables cache responses. | |
| 3418 | - unbound-control flush [name], flush_type and flush_zone. | |
| 3419 | ||
| 3420 | 22 September 2008: Wouter | |
| 3421 | - dump_cache and load_cache statements in unbound-control. | |
| 3422 | RRsets are dumped and loaded correctly. | |
| 3423 | Msg cache is dumped. | |
| 3424 | ||
| 3425 | 19 September 2008: Wouter | |
| 3426 | - locking on the localdata structure. | |
| 3427 | - add and remove local zone and data with unbound-control. | |
| 3428 | - ldns trunk snapshot updated, make tests work again. | |
| 3429 | ||
| 3430 | 18 September 2008: Wouter | |
| 3431 | - fixup error in time calculation. | |
| 3432 | - munin plugin improvements. | |
| 3433 | - nicer abbreviations for high query types values (ixfr, axfr, any...) | |
| 3434 | - documented the statistics output in unbound-control man page. | |
| 3435 | - extended statistics prints out histogram, over unbound-control. | |
| 3436 | ||
| 3437 | 17 September 2008: Wouter | |
| 3438 | - locking for threadsafe bogus rrset counter. | |
| 3439 | - ldns trunk no longer exports b32 functions, provide compat. | |
| 3440 | - ldns tarball updated. | |
| 3441 | - testcode/ldns-testpkts.c const fixups. | |
| 3442 | - fixed rcode stat printout. | |
| 3443 | - munin plugin in contrib. | |
| 3444 | - stats always printout uptime, because stats plugins need it. | |
| 3445 | ||
| 3446 | 16 September 2008: Wouter | |
| 3447 | - extended-statistics: yesno config option. | |
| 3448 | - unwanted replies spoof nearmiss detector. | |
| 3449 | - iana portlist updated. | |
| 3450 | ||
| 3451 | 15 September 2008: Wouter | |
| 3452 | - working start, stop, reload commands for unbound-control. | |
| 3453 | - test for unbound-control working; better exit value for control. | |
| 3454 | - verbosity control via unbound-control. | |
| 3455 | - unbound-control stats. | |
| 3456 | ||
| 3457 | 12 September 2008: Wouter | |
| 3458 | - removed browser control mentions. Proto speccy. | |
| 3459 | ||
| 3460 | 11 September 2008: Wouter | |
| 3461 | - set nonblocking on new TCP streams, because linux does not inherit | |
| 3462 | the socket options to the accepted socket. | |
| 3463 | - fix TCP timeouts. | |
| 3464 | - SSL protected connection between server and unbound-control. | |
| 3465 | ||
| 3466 | 10 September 2008: Wouter | |
| 3467 | - remove memleak in privacy addresses on reloads and quits. | |
| 3468 | - remote control work. | |
| 3469 | ||
| 3470 | 9 September 2008: Wouter | |
| 3471 | - smallapp/unbound-control-setup.sh script to set up certificates. | |
| 3472 | ||
| 3473 | 4 September 2008: Wouter | |
| 3474 | - scrubber scrubs away private addresses. | |
| 3475 | - test for private addresses. man page entry. | |
| 3476 | - code refactored for name and address tree lookups. | |
| 3477 | ||
| 3478 | 3 September 2008: Wouter | |
| 3479 | - options for 'DNS Rebinding' protection: private-address and | |
| 3480 | private-domain. | |
| 3481 | - dnstree for reuse of routines that help with domain, addr lookups. | |
| 3482 | - private-address and private-domain config option read, stored. | |
| 3483 | ||
| 3484 | 2 September 2008: Wouter | |
| 3485 | - DoS protection features. Queries are jostled out to make room. | |
| 3486 | - testbound can pass time, increasing the internal timer. | |
| 3487 | - do not mark unsigned additionals bogus, leave unchecked, which | |
| 3488 | is removed too. | |
| 3489 | ||
| 3490 | 1 September 2008: Wouter | |
| 3491 | - disallow nonrecursive queries for cache snooping by default. | |
| 3492 | You can allow is using access-control: <subnet> allow_snoop. | |
| 3493 | The defaults do allow access no authoritative data without RD bit. | |
| 3494 | - two tests for it and fixups of tests for nonrec refused. | |
| 3495 | ||
| 3496 | 29 August 2008: Wouter | |
| 3497 | - version 1.1 number in trunk. | |
| 3498 | - harden-referral-path option for query for NS records. | |
| 3499 | Default turns off expensive, experimental option. | |
| 3500 | ||
| 3501 | 28 August 2008: Wouter | |
| 3502 | - fixup logfile handling; it is created with correct permissions | |
| 3503 | again. (from bugfix#199). | |
| 3504 | Some errors are not written to logfile (pidfile writing, forking), | |
| 3505 | and these are only visible by using the -d commandline flag. | |
| 3506 | ||
| 3507 | 27 August 2008: Wouter | |
| 3508 | - daemon(3) is causing problems for people. Reverting the patch. | |
| 3509 | bug#200, and 199 and 203 contain sideline discussion on it. | |
| 3510 | - bug#199 fixed: pidfile can be outside chroot. openlog is done before | |
| 3511 | chroot and drop permissions. | |
| 3512 | - config option to set size of aggressive negative cache, | |
| 3513 | neg-cache-size. | |
| 3514 | - bug#203 fixed: dlv has been implemented. | |
| 3515 | ||
| 3516 | 26 August 2008: Wouter | |
| 3517 | - test for insecure zone when DLV is in use, also does negative cache. | |
| 3518 | - test for trustanchor when DLV is in use (the anchor works). | |
| 3519 | - test for DLV used for a zone below a trustanchor. | |
| 3520 | - added scrub filter for overreaching NSEC records and unit test. | |
| 3521 | - iana portlist update | |
| 3522 | - use of setresuid or setreuid when available. | |
| 3523 | - use daemon(3) if available. | |
| 3524 | ||
| 3525 | 25 August 2008: Wouter | |
| 3526 | - realclean patch from Robert Edmonds. | |
| 3527 | ||
| 3528 | 22 August 2008: Wouter | |
| 3529 | - nicer debuglogging of DLV. | |
| 3530 | - test with secure delegation inside the DLV repository. | |
| 3531 | ||
| 3532 | 21 August 2008: Wouter | |
| 3533 | - negative cache code linked into validator, for DLV use. | |
| 3534 | negative cache works for DLV. | |
| 3535 | - iana portlist update. | |
| 3536 | - dlv-anchor option for unit tests. | |
| 3537 | - fixup NSEC_AT_APEX classification for short typemaps. | |
| 3538 | - ldns-testns has subdomain checks, for unit tests. | |
| 3539 | ||
| 3540 | 20 August 2008: Wouter | |
| 3541 | - negative cache code, reviewed. | |
| 3542 | ||
| 3543 | 18 August 2008: Wouter | |
| 3544 | - changes info: in logfile to notice: info: or debug: depending on | |
| 3545 | the verbosity of the statements. Better logfile message | |
| 3546 | classification. | |
| 3547 | - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd. | |
| 3548 | ||
| 3549 | 15 August 2008: Wouter | |
| 3550 | - DLV nsec code fixed for better detection of closest existing | |
| 3551 | enclosers from NSEC responses. | |
| 3552 | - DLV works, straight to the dlv repository, so not for production. | |
| 3553 | - Iana port update. | |
| 3554 | ||
| 3555 | 14 August 2008: Wouter | |
| 3556 | - synthesize DLV messages from the rrset cache, like done for DS. | |
| 3557 | ||
| 3558 | 13 August 2008: Wouter | |
| 3559 | - bug #203: nicer do-auto log message when user sets incompatible | |
| 3560 | options. | |
| 3561 | - bug #204: variable name ameliorated in log.c. | |
| 3562 | - bug #206: in iana_update, no egrep, but awk use. | |
| 3563 | - ldns snapshot r2699 taken (includes DLV type). | |
| 3564 | - DLV work, config file element, trust anchor read in. | |
| 3565 | ||
| 3566 | 12 August 2008: Wouter | |
| 3567 | - finished adjusting testset to provide qtype NS answers. | |
| 3568 | ||
| 3569 | 11 August 2008: Wouter | |
| 3570 | - Fixup rrset security updates overwriting 2181 trust status. | |
| 3571 | This makes validated to be insecure data just as worthless as | |
| 3572 | nonvalidated data, and 2181 rules prevent cache overwrites to them. | |
| 3573 | - Fix assertion fail on bogus key handling. | |
| 3574 | - dnssec lameness detection works on first query at trust apex. | |
| 3575 | - NS queries get proper cache and dnssec lameness treatment. | |
| 3576 | - fixup compilation without pthreads on linux. | |
| 3577 | ||
| 3578 | 8 August 2008: Wouter | |
| 3579 | - NS queries are done after every referral. | |
| 3580 | validator is used on those NS records (if anchors enabled). | |
| 3581 | ||
| 3582 | 7 August 2008: Wouter | |
| 3583 | - Scrubber more strict. CNAME chains, DNAMEs from cache, other | |
| 3584 | irrelevant rrsets removed. | |
| 3585 | - 1.0.2 released from 1.0 support branch. | |
| 3586 | - fixup update-anchor.sh to work both in BSD shell and bash. | |
| 3587 | ||
| 3588 | 5 August 2008: Wouter | |
| 3589 | - fixup DS test so apex nodata works again. | |
| 3590 | ||
| 3591 | 4 August 2008: Wouter | |
| 3592 | - iana port update. | |
| 3593 | - TODO update. | |
| 3594 | - fix bug 201: null ptr deref on cleanup while udp pkts wait for port. | |
| 3595 | - added explanatory text for outgoing-port-permit in manpage. | |
| 3596 | ||
| 3597 | 30 July 2008: Wouter | |
| 3598 | - fixup bug qtype DS for unsigned zone and signed parent validation. | |
| 3599 | ||
| 3600 | 25 July 2008: Wouter | |
| 3601 | - added original copyright statement of OpenBSD arc4random code. | |
| 3602 | - created tube signaling solution on windows, as a pipe replacement. | |
| 3603 | this makes background asynchronous resolution work on windows. | |
| 3604 | - removed very insecure socketpair compat code. It also did not | |
| 3605 | work with event_waiting. Solved by pipe replacement. | |
| 3606 | - unbound -h prints openssl version number as well. | |
| 3607 | ||
| 3608 | 22 July 2008: Wouter | |
| 3609 | - moved pipe actions to util/tube.c. easier porting and shared code. | |
| 3610 | - check _raw() commpoint callbacks with fptr_wlist. | |
| 3611 | - iana port update. | |
| 3612 | ||
| 3613 | 21 July 2008: Wouter | |
| 3614 | - #198: nicer entropy warning message. manpage OS hints. | |
| 3615 | ||
| 3616 | 19 July 2008: Wouter | |
| 3617 | - #198: fixup man page to suggest chroot entropy fix. | |
| 3618 | ||
| 3619 | 18 July 2008: Wouter | |
| 3620 | - branch for 1.0 support. | |
| 3621 | - trunk work on tube.c. | |
| 3622 | ||
| 3623 | 17 July 2008: Wouter | |
| 3624 | - fix bug #196, compile outside source tree. | |
| 3625 | - fix bug #195, add --with-username=user configure option. | |
| 3626 | - print error and exit if started with config that requires more | |
| 3627 | fds than the builtin minievent can handle. | |
| 3628 | ||
| 3629 | 16 July 2008: Wouter | |
| 3630 | - made svn tag 1.0.1, trunk now 1.0.2 | |
| 3631 | - sha256 checksums enabled in makedist.sh | |
| 3632 | ||
| 3633 | 15 July 2008: Wouter | |
| 3634 | - Follow draft-ietf-dnsop-default-local-zones-06 added reverse | |
| 3635 | IPv6 example prefix to AS112 default blocklist. | |
| 3636 | - fixup lookup of DS records by client with trustanchor for same. | |
| 3637 | - libunbound ub_resolve, fix handling of error condition during setup. | |
| 3638 | - lowered log_hex blocksize to fit through BSD syslog linesize. | |
| 3639 | - no useless initialisation if getpwnam not available. | |
| 3640 | - iana, ldns snapshot updated. | |
| 3641 | ||
| 3642 | 3 July 2008: Wouter | |
| 3643 | - Matthijs fixed memory leaks in root hints file reading. | |
| 3644 | ||
| 3645 | 26 June 2008: Wouter | |
| 3646 | - fixup streamtcp bounds setting for udp mode, in the test framework. | |
| 3647 | - contrib item for updating trust anchors. | |
| 3648 | ||
| 3649 | 25 June 2008: Wouter | |
| 3650 | - fixup fwd_ancil test typos. | |
| 3651 | - Fix for newegg lameness : ok for qtype=A, but lame for others. | |
| 3652 | - fixup unit test for infra cache, test lame merging. | |
| 3653 | - porting to mingw, bind, listen, getsockopt and setsockopt error | |
| 3654 | handling. | |
| 3655 | ||
| 3656 | 24 June 2008: Wouter | |
| 3657 | - removed testcode/checklocks from production code compilation path. | |
| 3658 | - streamtcp can use UDP mode (connected UDP socket), for testing IPv6 | |
| 3659 | on windows. | |
| 3660 | - fwd_ancil test fails if platform support is lacking. | |
| 3661 | ||
| 3662 | 23 June 2008: Wouter | |
| 3663 | - fixup minitpkg to cleanup on windows with its file locking troubles. | |
| 3664 | - minitpkg shows skipped tests in report. | |
| 3665 | - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not | |
| 3666 | ipv6 connectivity). | |
| 3667 | - winsock event handler keeps track of sticky TCP events, that have | |
| 3668 | not been fully handled yet. when interest in the event(s) resumes, | |
| 3669 | they are sent again. When WOULDBLOCK is returned events are cleared. | |
| 3670 | - skip tests that need signals when testing on mingw. | |
| 3671 | ||
| 3672 | 18 June 2008: Wouter | |
| 3673 | - open testbound replay files in binary mode, because fseek/ftell | |
| 3674 | do not work in ascii-mode on windows. The b does nothing on unix. | |
| 3675 | unittest and testbound tests work on windows (xp too). | |
| 3676 | - ioctlsocket prints nicer error message. | |
| 3677 | - fixed up some TCP porting for winsock. | |
| 3678 | - lack of IPv6 gives a warning, no fatal error. | |
| 3679 | - use WSAGetLastError() on windows instead of errno for some errors. | |
| 3680 | ||
| 3681 | 17 June 2008: Wouter | |
| 3682 | - outgoing num fds 32 by default on windows ; it supports less | |
| 3683 | fds for waiting on than unixes. | |
| 3684 | - winsock_event minievent handler for windows. (you could also | |
| 3685 | attempt to link with libevent/libev ports for windows). | |
| 3686 | - neater crypto check and gdi32 detection. | |
| 3687 | - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista. | |
| 3688 | ||
| 3689 | 16 June 2008: Wouter | |
| 3690 | - on windows, use windows threads, mutex and thread-local-storage(Tls). | |
| 3691 | - detect if openssl needs gdi32. | |
| 3692 | - if no threading, THREADS_DISABLED is defined for use in the code. | |
| 3693 | - sets USE_WINSOCK if using ws2_32 on windows. | |
| 3694 | - wsa_strerror() function for more readable errors. | |
| 3695 | - WSA Startup and Cleanup called in unbound.exe. | |
| 3696 | ||
| 3697 | 13 June 2008: Wouter | |
| 3698 | - port mingw32, more signal ifdefs, detect sleep, usleep, | |
| 3699 | random, srandom (used inside the tests). | |
| 3700 | - signed or unsigned FD_SET is cast. | |
| 3701 | ||
| 3702 | 10 June 2008: Wouter | |
| 3703 | - fixup warnings compiling on eeepc xandros linux. | |
| 3704 | ||
| 3705 | 9 June 2008: Wouter | |
| 3706 | - in iteration response type code | |
| 3707 | * first check for SOA record (negative answer) before NS record | |
| 3708 | and lameness. | |
| 3709 | * check if no AA bit for non-forwarder, and thus lame zone. | |
| 3710 | In response to error report by Richard Doty for mail.opusnet.com. | |
| 3711 | - fixup unput warning from lexer on freeBSD. | |
| 3712 | - bug#183. pidfile, rundir, and chroot configure options. Also the | |
| 3713 | example.conf and manual pages get the configured defaults. | |
| 3714 | You can use: (or accept the defaults to /usr/local/etc/unbound/) | |
| 3715 | --with-conf-file=filename | |
| 3716 | --with-pidfile=filename | |
| 3717 | --with-run-dir=path | |
| 3718 | --with-chroot-dir=path | |
| 3719 | ||
| 3720 | 8 June 2008: Wouter | |
| 3721 | - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug. | |
| 3722 | Reported by Robert Edmonds. | |
| 3723 | - iana port updated. | |
| 3724 | ||
| 3725 | 4 June 2008: Wouter | |
| 3726 | - updated libtool files with newer version. | |
| 3727 | - iana portlist updated. | |
| 3728 | ||
| 3729 | 3 June 2008: Wouter | |
| 3730 | - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the | |
| 3731 | trailing dot is not used during comparison. | |
| 3732 | ||
| 3733 | 2 June 2008: Wouter | |
| 3734 | - Jelte fixed bugs in my absence | |
| 3735 | - bug 178: fixed unportable shell usage in configure (relied on | |
| 3736 | bash shell). | |
| 3737 | - bug 180: fixed buffer overflow in unbound-checkconf use of strncat. | |
| 3738 | - bug 181: fixed buffer overflow in ldns (called by unbound to parse | |
| 3739 | config file parts). | |
| 3740 | - fixes by Wouter | |
| 3741 | - bug 177: fixed compilation failure on opensuse, the | |
| 3742 | --disable-static configure flag caused problems. (Patch from | |
| 3743 | Klaus Singvogel) | |
| 3744 | - bug 179: same fix as 177. | |
| 3745 | - bug 185: --disable-shared not passed along to ldns included with | |
| 3746 | unbound. Fixed so that configure parameters are passed to the | |
| 3747 | subdir configure script. | |
| 3748 | fixed that ./libtool is used always, you can still override | |
| 3749 | manually with ./configure libtool=mylibtool or set $libtool in | |
| 3750 | the environment. | |
| 3751 | - update of the ldns tarball to current ldns svn version (fix 181). | |
| 3752 | - bug 184: -r option for unbound-host, read resolv.conf for | |
| 3753 | forwarder. (Note that forwarder must support DNSSEC for validation | |
| 3754 | to succeed). | |
| 3755 | ||
| 3756 | 23 May 2008: Wouter | |
| 3757 | - mingw32 porting. | |
| 3758 | - test for sys/wait.h | |
| 3759 | - WSAEWOULDBLOCK test after nonblocking TCP connect. | |
| 3760 | - write_iov_buffer removed: unused and no struct iov on windows. | |
| 3761 | - signed/unsigned warning fixup mini_event. | |
| 3762 | - use ioctlsocket to set nonblocking I/O if fnctl is unavailable. | |
| 3763 | - skip signals that are not defined | |
| 3764 | - detect pwd.h. | |
| 3765 | - detect getpwnam, getrlimit, setsid, sbrk, chroot. | |
| 3766 | - default config has no chroot if chroot() unavailable. | |
| 3767 | - if no kill() then no pidfile is read or written. | |
| 3768 | - gmtime_r is replaced by nonthreadsafe alternative if unavail. | |
| 3769 | used in rrsig time validation errors. | |
| 3770 | ||
| 3771 | 22 May 2008: Wouter | |
| 3772 | - contrib unbound.spec from Patrick Vande Walle. | |
| 3773 | - fixup bug#175: call tzset before chroot to have correct timestamps | |
| 3774 | in system log. | |
| 3775 | - do not generate lex input and lex unput functions. | |
| 3776 | - mingw port. replacement functions labelled _unbound. | |
| 3777 | - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed. | |
| 3778 | ||
| 3779 | 19 May 2008: Wouter | |
| 3780 | - fedora 9, check in6_pktinfo define in configure. | |
| 3781 | - CREDITS fixup of history. | |
| 3782 | - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative. | |
| 3783 | ||
| 3784 | 16 May 2008: Wouter | |
| 3785 | - fixup for MacOSX hosts file reading (reported by John Dickinson). | |
| 3786 | - created 1.0.0 svn tag. | |
| 3787 | - trunk version 1.0.1. | |
| 3788 | ||
| 3789 | 14 May 2008: Wouter | |
| 3790 | - accepted patch from Ondrej Sury for library version libtool option. | |
| 3791 | - configure --disable-rpath fixes up libtool for rpath trouble. | |
| 3792 | Adapted from debian package patch file. | |
| 3793 | ||
| 3794 | 13 May 2008: Wouter | |
| 3795 | - Added root ipv6 addresses to builtin root hints. | |
| 3796 | - TODO modified for post 1.0 plans. | |
| 3797 | - trunk version set to 1.0.0. | |
| 3798 | - no unnecessary linking with librt (only when libevent/libev used). | |
| 3799 | ||
| 3800 | 7 May 2008: Wouter | |
| 3801 | - fixup no-ip4 problem with error callback in outside network. | |
| 3802 | ||
| 3803 | 25 April 2008: Wouter | |
| 3804 | - DESTDIR is honored by the Makefile for rpms. | |
| 3805 | - contrib files unbound.spec and unbound.init, builds working RPM | |
| 3806 | on FC7 Linux, a chrooted caching resolver, and libunbound. | |
| 3807 | - iana ports update. | |
| 3808 | ||
| 3809 | 24 April 2008: Wouter | |
| 3810 | - chroot checks improved. working directory relative to chroot. | |
| 3811 | checks if config file path is inside chroot. Documentation on it. | |
| 3812 | - nicer example.conf text. | |
| 3813 | - created 0.11 tag. | |
| 3814 | ||
| 3815 | 23 April 2008: Wouter | |
| 3816 | - parseunbound.pl contrib update from Kai Storbeck for threads. | |
| 3817 | - iana ports update | |
| 3818 | ||
| 3819 | 22 April 2008: Wouter | |
| 3820 | - ignore SIGPIPE. | |
| 3821 | - unit test for SIGPIPE ignore. | |
| 3822 | ||
| 3823 | 21 April 2008: Wouter | |
| 3824 | - FEATURES document. | |
| 3825 | - fixup reread of config file if it was given as a full path | |
| 3826 | and chroot was used. | |
| 3827 | ||
| 3828 | 16 April 2008: Wouter | |
| 3829 | - requirements doc, updated clean query returns. | |
| 3830 | - parseunbound.pl update from Kai Storbeck. | |
| 3831 | - sunos4 porting changes. | |
| 3832 | ||
| 3833 | 15 April 2008: Wouter | |
| 3834 | - fixup default rc.d pidfile location to /usr/local/etc. | |
| 3835 | - iana ports updated. | |
| 3836 | - copyright updated in ldns-testpkts to keep same as in ldns. | |
| 3837 | - fixup checkconf chroot tests a bit more, chdir must be inside | |
| 3838 | chroot dir. | |
| 3839 | - documented 'gcc: unrecognized -KPIC option' errors on Solaris. | |
| 3840 | - example.conf values changed to /usr/local/etc/unbound | |
| 3841 | - DSA test work. | |
| 3842 | - DSA signatures: unbound is compatible with both encodings found. | |
| 3843 | It will detect and convert when necessary. | |
| 3844 | ||
| 3845 | 14 April 2008: Wouter | |
| 3846 | - got update for parseunbound.pl statistics script from Kai Storbeck. | |
| 3847 | - tpkg tests for udp wait list. | |
| 3848 | - documented 0x20 status. | |
| 3849 | - fixup chroot and checkconf, it is much smarter now. | |
| 3850 | - fixup DSA EVP signature decoding. Solution that Jelte found copied. | |
| 3851 | - and check first sig byte for the encoding type. | |
| 3852 | ||
| 3853 | 11 April 2008: Wouter | |
| 3854 | - random port selection out of the configged ports. | |
| 3855 | - fixup threadsafety for libevent-1.4.3+ (event_base_get_method). | |
| 3856 | - removed base_port. | |
| 3857 | - created 256-port ephemeral space for the OS, 59802 available. | |
| 3858 | - fixup consistency of port_if out array during heavy use. | |
| 3859 | ||
| 3860 | 10 April 2008: Wouter | |
| 3861 | - --with-libevent works with latest libevent 1.4.99-trunk. | |
| 3862 | - added log file statistics perl script to contrib. | |
| 3863 | - automatic iana ports update from makefile. 60058 available. | |
| 3864 | ||
| 3865 | 9 April 2008: Wouter | |
| 3866 | - configure can detect libev(from its build directory) when passed | |
| 3867 | --with-libevent=/home/wouter/libev-3.2 | |
| 3868 | libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%). | |
| 3869 | - unused commpoints not listed in epoll list. | |
| 3870 | - statistics-cumulative option so that the values are not reset. | |
| 3871 | - config creates array of available ports, 61841 available, | |
| 3872 | it excludes <1024 and iana assigned numbers. | |
| 3873 | config statements to modify the available port numbers. | |
| 3874 | ||
| 3875 | 8 April 2008: Wouter | |
| 3876 | - unbound tries to set the ulimit fds when started as server. | |
| 3877 | if that does not work, it will scale back its requirements. | |
| 3878 | ||
| 3879 | 27 March 2008: Wouter | |
| 3880 | - documented /dev/random symlink from chrootdir as FAQ entry. | |
| 3881 | ||
| 3882 | 26 March 2008: Wouter | |
| 3883 | - implemented AD bit signaling. If a query sets AD bit (but not DO) | |
| 3884 | then the AD bit is set in the reply if the answer validated. | |
| 3885 | Without including DNSSEC signatures. Useful if you have a trusted | |
| 3886 | path from the client to the resolver. Follows dnssec-updates draft. | |
| 3887 | ||
| 3888 | 25 March 2008: Wouter | |
| 3889 | - implemented check that for NXDOMAIN and NOERROR answers a query | |
| 3890 | section must be present in the reply (by the scrubber). And it must | |
| 3891 | be equal to the question sent, at least lowercase folded. | |
| 3892 | Previously this feature happened because the cache code refused | |
| 3893 | to store such messages. However blocking by the scrubber makes | |
| 3894 | sure nothing gets into the RRset cache. Also, this looks like a | |
| 3895 | timeout (instead of an allocation failure) and this retries are | |
| 3896 | done (which is useful in a spoofing situation). | |
| 3897 | - RTT banding. Band size 400 msec, this makes band around zero (fast) | |
| 3898 | include unknown servers. This makes unbound explore unknown servers. | |
| 3899 | ||
| 3900 | 7 March 2008: Wouter | |
| 3901 | - -C config feature for harvest program. | |
| 3902 | - harvest handles CNAMEs too. | |
| 3903 | ||
| 3904 | 5 March 2008: Wouter | |
| 3905 | - patch from Hugo Koji Kobayashi for iterator logs spelling. | |
| 3906 | ||
| 3907 | 4 March 2008: Wouter | |
| 3908 | - From report by Jinmei Tatuya, rfc2181 trust value for remainder | |
| 3909 | of a cname trust chain is lower; not full answer_AA. | |
| 3910 | - test for this fix. | |
| 3911 | - default config file location is /usr/local/etc/unbound. | |
| 3912 | Thus prefix is used to determine the location. This is also the | |
| 3913 | chroot and pidfile default location. | |
| 3914 | ||
| 3915 | 3 March 2008: Wouter | |
| 3916 | - Create 0.10 svn tag. | |
| 3917 | - 0.11 version in trunk. | |
| 3918 | - indentation nicer. | |
| 3919 | ||
| 3920 | 29 February 2008: Wouter | |
| 3921 | - documentation update. | |
| 3922 | - fixup port to Solaris of perf test tool. | |
| 3923 | - updated ldns-tarball with decl-after-statement fixes. | |
| 3924 | ||
| 3925 | 28 February 2008: Wouter | |
| 3926 | - fixed memory leaks in libunbound (during cancellation and wait). | |
| 3927 | - libunbound returns the answer packet in full. | |
| 3928 | - snprintf compat update. | |
| 3929 | - harvest performs lookup. | |
| 3930 | - ldns-tarball update with fix for ldns_dname_label. | |
| 3931 | - installs to sbin by default. | |
| 3932 | - install all manual pages (unbound-host and libunbound too). | |
| 3933 | ||
| 3934 | 27 February 2008: Wouter | |
| 3935 | - option to use caps for id randomness. | |
| 3936 | - config file option use-caps-for-id: yes | |
| 3937 | - harvest debug tool | |
| 3938 | ||
| 3939 | 26 February 2008: Wouter | |
| 3940 | - delay utility delays TCP as well. If the server that is forwarded | |
| 3941 | to has a TCP error, the delay utility closes the connection. | |
| 3942 | - delay does REUSE_ADDR, and can handle a server that closes its end. | |
| 3943 | - answers use casing from query. | |
| 3944 | ||
| 3945 | 25 February 2008: Wouter | |
| 3946 | - delay utility works. Gets decent thoughput too (>20000). | |
| 3947 | ||
| 3948 | 22 February 2008: Wouter | |
| 3949 | - +2% for recursions, if identical queries (except for destination | |
| 3950 | and query ID) in the reply list, avoid re-encoding the answer. | |
| 3951 | - removed TODO items for optimizations that do not show up in | |
| 3952 | profile reports. | |
| 3953 | - default is now minievent - not libevent. As its faster and | |
| 3954 | not needed for regular installs, only for very large port ranges. | |
| 3955 | - loop check different speedup pkt-dname-reading, 1% faster for | |
| 3956 | nocache-recursion check. | |
| 3957 | - less hashing during msg parse, 4% for recursion. | |
| 3958 | - small speed fix for dname_count_size_labels, +1 or +2% recursion. | |
| 3959 | - some speed results noted: | |
| 3960 | optimization resulted in +40% for recursion (cache miss) and | |
| 3961 | +70 to +80 for cache hits, and +96% for version.bind. | |
| 3962 | zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4 | |
| 3963 | www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3 | |
| 3964 | www with DO bit set : BIND 8269.31 Ub 28735.6 qps. | |
| 3965 | So, unbound can be about equal qps to NSD in cache hits. | |
| 3966 | And about 3.4x faster than BIND in cache performance. | |
| 3967 | - delay utility for testing. | |
| 3968 | ||
| 3969 | 21 February 2008: Wouter | |
| 3970 | - speedup of root-delegation message encoding by 15%. | |
| 3971 | - minor speedup of compress tree_lookup, maybe 1%. | |
| 3972 | - speedup of dname_lab_cmp and memlowercmp - the top functions in | |
| 3973 | profiler output, maybe a couple percent when it matters. | |
| 3974 | ||
| 3975 | 20 February 2008: Wouter | |
| 3976 | - setup speec_cache for need-ldns-testns in dotests. | |
| 3977 | - check number of queued replies on incoming queries to avoid overload | |
| 3978 | on that account. | |
| 3979 | - fptr whitelist checks are not disabled in optimize mode. | |
| 3980 | - do-daemonize config file option. | |
| 3981 | - minievent time share initializes time at start. | |
| 3982 | - updated testdata for nsec3 new algorithm numbers (6, 7). | |
| 3983 | - small performance test of packet encoding (root delegation). | |
| 3984 | ||
| 3985 | 19 February 2008: Wouter | |
| 3986 | - applied patch to unbound-host man page from Jan-Piet Mens. | |
| 3987 | - fix donotquery-localhost: yes default (it erroneously was switched | |
| 3988 | to default 'no'). | |
| 3989 | - time is only gotten once and the value is shared across unbound. | |
| 3990 | - unittest cleans up crypto, so that it has no memory leaks. | |
| 3991 | - mini_event shares the time value with unbound this results in | |
| 3992 | +3% speed for cache responses and +9% for recursions. | |
| 3993 | - ldns tarball update with new NSEC3 sign code numbers. | |
| 3994 | - perform several reads per UDP operation. This improves performance | |
| 3995 | in DoS conditions, and costs very little in normal conditions. | |
| 3996 | improves cache response +50%, and recursions +10%. | |
| 3997 | - modified asynclook test. because the callback from async is not | |
| 3998 | in any sort of lock (and thus can use all library functions freely), | |
| 3999 | this causes a tiny race condition window when the last lock is | |
| 4000 | released for a callback and a new cancel() for that callback. | |
| 4001 | The only way to remove this is by putting callbacks into some | |
| 4002 | lock window. I'd rather have the small possibility of a callback | |
| 4003 | for a cancelled function then no use of library functions in | |
| 4004 | callbacks. Could be possible to only outlaw process(), wait(), | |
| 4005 | cancel() from callbacks, by adding another lock, but I'd rather not. | |
| 4006 | ||
| 4007 | 18 February 2008: Wouter | |
| 4008 | - patch to unbound-host from Jan-Piet Mens. | |
| 4009 | - unbound host prints errors if fails to configure context. | |
| 4010 | - fixup perf to resend faster, so that long waiting requests do | |
| 4011 | not hold up the queue, they become lost packets or SERVFAILs, | |
| 4012 | or can be sent a little while later (i.e. processing time may | |
| 4013 | take long, but throughput has to be high). | |
| 4014 | - fixup iterator operating in no cache conditions (RD flag unset | |
| 4015 | after a CNAME). | |
| 4016 | - streamlined code for RD flag setting. | |
| 4017 | - profiled code and changed dname compares to be faster. | |
| 4018 | The speedup is about +3% to +8% (depending on the test). | |
| 4019 | - minievent tests for eintr and eagain. | |
| 4020 | ||
| 4021 | 15 February 2008: Wouter | |
| 4022 | - added FreeBSD rc.d script to contrib. | |
| 4023 | - --prefix option for configure also changes directory: pidfile: | |
| 4024 | and chroot: defaults in config file. | |
| 4025 | - added cache speed test, for cache size OK and cache too small. | |
| 4026 | ||
| 4027 | 14 February 2008: Wouter | |
| 4028 | - start without a config file (will complain, but start with | |
| 4029 | defaults). | |
| 4030 | - perf test program works. | |
| 4031 | ||
| 4032 | 13 February 2008: Wouter | |
| 4033 | - 0.9 released. | |
| 4034 | - 1.0 development. Printout ldns version on unbound -h. | |
| 4035 | - start of perf tool. | |
| 4036 | - bugfix to read empty lines from /etc/hosts. | |
| 4037 | ||
| 4038 | 12 February 2008: Wouter | |
| 4039 | - fixup problem with configure calling itself if ldns-src tarball | |
| 4040 | is not present. | |
| 4041 | ||
| 4042 | 11 February 2008: Wouter | |
| 4043 | - changed library to use ub_ instead of ub_val_ as prefix. | |
| 4044 | - statistics output text nice. | |
| 4045 | - etc/hosts handling. | |
| 4046 | - library function to put logging to a stream. | |
| 4047 | - set any option interface. | |
| 4048 | ||
| 4049 | 8 February 2008: Wouter | |
| 4050 | - test program for multiple queries over a TCP channel. | |
| 4051 | - tpkg test for stream tcp queries. | |
| 4052 | - unbound replies to multiple TCP queries on a TCP channel. | |
| 4053 | - fixup misclassification of root referral with NS in answer | |
| 4054 | when validating a nonrec query. | |
| 4055 | - tag 0.9 | |
| 4056 | - layout of manpages, spelling fix in header, manpages process by | |
| 4057 | makedist, list asynclook and tcpstream tests as ldns-testns | |
| 4058 | required. | |
| 4059 | ||
| 4060 | 7 February 2008: Wouter | |
| 4061 | - moved up all current level 2 to be level 3. And 3 to 4. | |
| 4062 | to make room for new debug level 2 for detailed information | |
| 4063 | for operators. | |
| 4064 | - verbosity level 2. Describes recursion and validation. | |
| 4065 | - cleaner configure script and fixes for libevent solaris. | |
| 4066 | - signedness for log output memory sizes in high verbosity. | |
| 4067 | ||
| 4068 | 6 February 2008: Wouter | |
| 4069 | - clearer explanation of threading configure options. | |
| 4070 | - fixup asynclook test for nothreading (it creates only one process | |
| 4071 | to do the extended test). | |
| 4072 | - changed name of ub_val_result_free to ub_val_resolve_free. | |
| 4073 | - removes warning message during library linking, renamed | |
| 4074 | libunbound/unbound.c -> libunbound.c and worker to libworker. | |
| 4075 | - fallback without EDNS if result is NOTIMPL as well as on FORMERR. | |
| 4076 | ||
| 4077 | 5 February 2008: Wouter | |
| 4078 | - statistics-interval: seconds option added. | |
| 4079 | - test for statistics option | |
| 4080 | - ignore errors making directories, these can occur in parallel builds | |
| 4081 | - fixup Makefile strip command and libunbound docs typo. | |
| 4082 | ||
| 4083 | 31 January 2008: Wouter | |
| 4084 | - bg thread/process reads and writes the pipe nonblocking all the time | |
| 4085 | so that even if the pipe is buffered or so, the bg thread does not | |
| 4086 | block, and services both pipes and queries. | |
| 4087 | ||
| 4088 | 30 January 2008: Wouter | |
| 4089 | - check trailing / on chrootdir in checkconf. | |
| 4090 | - check if root hints and anchor files are in chrootdir. | |
| 4091 | - no route to host tcp error is verbosity level 2. | |
| 4092 | - removed unused send_reply_iov. and its configure check. | |
| 4093 | - added prints of 'remote address is 1.2.3.4 port 53' to errors | |
| 4094 | from netevent; the basic socket errors. | |
| 4095 | ||
| 4096 | 28 January 2008: Wouter | |
| 4097 | - fixup uninit use of buffer by libunbound (query id, flags) for | |
| 4098 | local_zone answers. | |
| 4099 | - fixup uninit warning from random.c; also seems to fix sporadic | |
| 4100 | sigFPE coming out of openssl. | |
| 4101 | - made openssl entropy warning more silent for library use. Needs | |
| 4102 | verbosity 1 now. | |
| 4103 | - fixup forgotten locks for rbtree_searches on ctx->query tree. | |
| 4104 | - random generator cleanup - RND_STATE_SIZE removed, and instead | |
| 4105 | a super-rnd can be passed at init to chain init random states. | |
| 4106 | - test also does lock checks if available. | |
| 4107 | - protect config access in libworker_setup(). | |
| 4108 | - libevent doesn't like comm_base_exit outside of runloop. | |
| 4109 | - close fds after removing commpoints only (for epoll, kqueue). | |
| 4110 | ||
| 4111 | 25 January 2008: Wouter | |
| 4112 | - added tpkg for asynclook and library use. | |
| 4113 | - allows localhost to be queried when as a library. | |
| 4114 | - fixup race condition between cancel and answer (in case of | |
| 4115 | really fast answers that beat the cancel). | |
| 4116 | - please doxygen, put doxygen comment in one place. | |
| 4117 | - asynclook -b blocking mode and test. | |
| 4118 | - refactor asynclook, nicer code. | |
| 4119 | - fixup race problems from opensll in rand init from library, with | |
| 4120 | a mutex around the rand init. | |
| 4121 | - fix pass async_id=NULL to _async resolve(). | |
| 4122 | - rewrote _wait() routine, so that it is threadsafe. | |
| 4123 | - cancelation is threadsafe. | |
| 4124 | - asynclook extended test in tpkg. | |
| 4125 | - fixed two races where forked bg process waits for (somehow shared?) | |
| 4126 | locks, so does not service the query pipe on the bg side. | |
| 4127 | Now those locks are only held for fg_threads and for bg_as_a_thread. | |
| 4128 | ||
| 4129 | 24 January 2008: Wouter | |
| 4130 | - tested the cancel() function. | |
| 4131 | - asynclook -c (cancel) feature. | |
| 4132 | - fix fail to allocate context actions. | |
| 4133 | - make pipe nonblocking at start. | |
| 4134 | - update plane for retry mode with caution to limit bandwidth. | |
| 4135 | - fix Makefile for concurrent make of unbound-host. | |
| 4136 | - renamed ub_val_ctx_wait/poll/process/fd to ub_val*. | |
| 4137 | - new calls to set forwarding added to header and docs. | |
| 4138 | ||
| 4139 | 23 January 2008: Wouter | |
| 4140 | - removed debug prints from if-auto, verb-algo enables some. | |
| 4141 | - libunbound QUIT setup, remove memory leaks, when using threads | |
| 4142 | will share memory for passing results instead of writing it over | |
| 4143 | the pipe, only writes ID number over the pipe (towards the handler | |
| 4144 | thread that does process() ). | |
| 4145 | ||
| 4146 | 22 January 2008: Wouter | |
| 4147 | - library code for async in libunbound/unbound.c. | |
| 4148 | - fix link testbound. | |
| 4149 | - fixup exit bug in mini_event. | |
| 4150 | - background worker query enter and result functions. | |
| 4151 | - bg query test application asynclook, it looks up multiple | |
| 4152 | hostaddresses (A records) at the same time. | |
| 4153 | ||
| 4154 | 21 January 2008: Wouter | |
| 4155 | - libworker work, netevent raw commpoints, write_msg, serialize. | |
| 4156 | ||
| 4157 | 18 January 2008: Wouter | |
| 4158 | - touch up of manpage for libunbound. | |
| 4159 | - support for IP_RECVDSTADDR (for *BSD ip4). | |
| 4160 | - fix for BSD, do not use ip4to6 mapping, make two sockets, once | |
| 4161 | ip6 and once ip4, uses socket options. | |
| 4162 | - goodbye ip4to6 mapping. | |
| 4163 | - update ldns-testpkts with latest version from ldns-trunk. | |
| 4164 | - updated makedist for relative ldns pathnames. | |
| 4165 | - library API with more information inside the result structure. | |
| 4166 | - work on background resolves. | |
| 4167 | ||
| 4168 | 17 January 2008: Wouter | |
| 4169 | - fixup configure in case -lldns is installed. | |
| 4170 | - fixup a couple of doxygen warnings, about enum variables. | |
| 4171 | - interface-automatic now copies the interface address from the | |
| 4172 | PKT_INFO structure as well. | |
| 4173 | - manual page with library API, all on one page 'man libunbound'. | |
| 4174 | - rewrite of PKTINFO structure, it also captures IP4 PKTINFO. | |
| 4175 | ||
| 4176 | 16 January 2008: Wouter | |
| 4177 | - incoming queries to the server with TC bit on are replied FORMERR. | |
| 4178 | - interface-automatic replied the wrong source address on localhost | |
| 4179 | queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying | |
| 4180 | to use ifnum=-1 to mean 'no interface, use kernel route'. | |
| 4181 | ||
| 4182 | 15 January 2008: Wouter | |
| 4183 | - interface-automatic feature. experimental. Nice for anycast. | |
| 4184 | - tpkg test for ip6 ancillary data. | |
| 4185 | - removed debug prints. | |
| 4186 | - porting experience, define for Solaris, test refined for BSD | |
| 4187 | compatibility. The feature probably will not work on OpenBSD. | |
| 4188 | - makedist fixup for ldns-src in build-dir. | |
| 4189 | ||
| 4190 | 14 January 2008: Wouter | |
| 4191 | - in no debug sets NDEBUG to remove asserts. | |
| 4192 | - configure --enable-debug is needed for dependency generation | |
| 4193 | for assertions and for compiler warnings. | |
| 4194 | - ldns.tgz updated with ldns-trunk (where buffer.h is updated). | |
| 4195 | - fix lint, unit test in optimize mode. | |
| 4196 | - default access control allows ::ffff:127.0.0.1 v6mapped localhost. | |
| 4197 | ||
| 4198 | 11 January 2008: Wouter | |
| 4199 | - man page, warning removed. | |
| 4200 | - added text describing the use of stub zones for private zones. | |
| 4201 | - checkconf tests for bad hostnames (IP address), and for doubled | |
| 4202 | interface lines. | |
| 4203 | - memory sizes can be given with 'k', 'Kb', or M or G appended. | |
| 4204 | ||
| 4205 | 10 January 2008: Wouter | |
| 4206 | - typo in example.conf. | |
| 4207 | - made using ldns-src that is included the package more portable | |
| 4208 | by linking with .lo instead of .o files in the ldns package. | |
| 4209 | - nicer do-ip6: yes/no documentation. | |
| 4210 | - nicer linking of libevent .o files. | |
| 4211 | - man pages render correctly on solaris. | |
| 4212 | ||
| 4213 | 9 January 2008: Wouter | |
| 4214 | - fixup openssl RAND problem, when the system is not configured to | |
| 4215 | give entropy, and the rng needs to be seeded. | |
| 4216 | ||
| 4217 | 8 January 2008: Wouter | |
| 4218 | - print median and quartiles with extensive logging. | |
| 4219 | ||
| 4220 | 4 January 2008: Wouter | |
| 4221 | - document misconfiguration in private network. | |
| 4222 | ||
| 4223 | 2 January 2008: Wouter | |
| 4224 | - fixup typo in requirements. | |
| 4225 | - document that 'refused' is a better choice than 'drop' for | |
| 4226 | the access control list, as refused will stop retries. | |
| 4227 | ||
| 4228 | 7 December 2007: Wouter | |
| 4229 | - unbound-host has a -d option to show what happens. This can help | |
| 4230 | with debugging (why do I get this answer). | |
| 4231 | - fixup CNAME handling, on nodata, sets and display canonname. | |
| 4232 | - dot removed from CNAME display. | |
| 4233 | - respect -v for NXDOMAINs. | |
| 4234 | - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes). | |
| 4235 | - size_t to int for portability of the header file. | |
| 4236 | - fixup bogus handling. | |
| 4237 | - dependencies and lint for unbound-host. | |
| 4238 | ||
| 4239 | 6 December 2007: Wouter | |
| 4240 | - library resolution works in foreground mode, unbound-host app | |
| 4241 | receives data. | |
| 4242 | - unbound-host prints rdata using ldns. | |
| 4243 | - unbound-host accepts trust anchors, and prints validation | |
| 4244 | information when you give -v. | |
| 4245 | ||
| 4246 | 5 December 2007: Wouter | |
| 4247 | - locking in context_new() inside the function. | |
| 4248 | - setup of libworker. | |
| 4249 | ||
| 4250 | 4 December 2007: Wouter | |
| 4251 | - minor Makefile fixup. | |
| 4252 | - moved module-stack code out of daemon/daemon into services/modstack, | |
| 4253 | preparing for code-reuse. | |
| 4254 | - move context into own header file. | |
| 4255 | - context query structure. | |
| 4256 | - removed unused variable pwd from checkconf. | |
| 4257 | - removed unused assignment from outside netw. | |
| 4258 | - check timeval length of string. | |
| 4259 | - fixup error in val_utils getsigner. | |
| 4260 | - fixup same (*var) error in netblocktostr. | |
| 4261 | - fixup memleak on parse error in localzone. | |
| 4262 | - fixup memleak on packet parse error. | |
| 4263 | - put ; after union in parser.y. | |
| 4264 | - small hardening in iter_operate against iq==NULL. | |
| 4265 | - hardening, if error reply with rcode=0 (noerror) send servfail. | |
| 4266 | - fixup same (*var) error in find_rrset in msgparse, was harmless. | |
| 4267 | - check return value of evtimer_add(). | |
| 4268 | - fixup lockorder in lruhash_reclaim(), building up a list of locked | |
| 4269 | entries one at a time. Instead they are removed and unlocked. | |
| 4270 | - fptr_wlist for markdelfunc. | |
| 4271 | - removed is_locked param from lruhash delkeyfunc. | |
| 4272 | - moved bin_unlock during bin_split purely to please. | |
| 4273 | ||
| 4274 | 3 December 2007: Wouter | |
| 4275 | - changed checkconf/ to smallapp/ to make room for more support tools. | |
| 4276 | (such as unbound-host). | |
| 4277 | - install dirs created with -m 755 because they need to be accessible. | |
| 4278 | - library extensive featurelist added to TODO. | |
| 4279 | - please doxygen, lint. | |
| 4280 | - library test application, with basic functionality. | |
| 4281 | - fix for building in a subdirectory. | |
| 4282 | - link lib fix for Leopard. | |
| 4283 | ||
| 4284 | 30 November 2007: Wouter | |
| 4285 | - makefile that creates libunbound.la, basic file or libunbound.a | |
| 4286 | when creating static executables (no libtool). | |
| 4287 | - more API setup. | |
| 4288 | ||
| 4289 | 29 November 2007: Wouter | |
| 4290 | - 0.9 public API start. | |
| 4291 | ||
| 4292 | 28 November 2007: Wouter | |
| 4293 | - Changeup plan for 0.8 - no complication needed, a simple solution | |
| 4294 | has been chosen for authoritative features. | |
| 4295 | - you can use single quotes in the config file, so it is possible | |
| 4296 | to specify TXT records in local data. | |
| 4297 | - fixup small memory problem in implicit transparent zone creation. | |
| 4298 | - test for implicit zone creation and multiple RR RRsets local data. | |
| 4299 | - local-zone nodefault test. | |
| 4300 | - show testbound testlist on commit. | |
| 4301 | - iterator normalizer changes CNAME chains ending in NXDOMAIN where | |
| 4302 | the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial | |
| 4303 | domain exists). | |
| 4304 | - nicer verbosity: 0 and 1 levels. | |
| 4305 | - lower nonRDquery chance of eliciting wrongly typed validation | |
| 4306 | requiring message from the cache. | |
| 4307 | - fix for nonRDquery validation typing; nodata is detected when | |
| 4308 | SOA record in auth section (all validation-requiring nodata messages | |
| 4309 | have a SOA record in authority, so this is OK for the validator), | |
| 4310 | and NS record is needed to be a referral. | |
| 4311 | - duplicate checking when adding NSECs for a CNAME, and test. | |
| 4312 | - created svn tag 0.8, after completing testbed tests. | |
| 4313 | ||
| 4314 | 27 November 2007: Wouter | |
| 4315 | - per suggestion in rfc2308, replaced default max-ttl value with 1 day. | |
| 4316 | - set size of msgparse lookup table to 32, from 1024, so that its size | |
| 4317 | is below the 2048 regional large size threshold, and does not cause | |
| 4318 | a call to malloc when a message is parsed. | |
| 4319 | - update of memstats tool to print number of allocation calls. | |
| 4320 | This is what is taking time (not space) and indicates the avg size | |
| 4321 | of the allocations as well. region_alloc stat is removed. | |
| 4322 | ||
| 4323 | 22 November 2007: Wouter | |
| 4324 | - noted EDNS in-the-middle dropping trouble as a TODO. | |
| 4325 | At this point theoretical, no user trouble has been reported. | |
| 4326 | - added all default AS112 zones. | |
| 4327 | - answers from local zone content. | |
| 4328 | * positive answer, the rrset in question | |
| 4329 | * nodata answer (exist, but not that type). | |
| 4330 | * nxdomain answer (domain does not exist). | |
| 4331 | * empty-nonterminal answer. | |
| 4332 | * But not: wildcard, nsec, referral, rrsig, cname/dname, | |
| 4333 | or additional section processing, NS put in auth. | |
| 4334 | - test for correct working of static and transparent and couple | |
| 4335 | of important defaults (localhost, as112, reverses). | |
| 4336 | Also checks deny and refuse settings. | |
| 4337 | - fixup implicit zone generation and AA bit for NXDOMAIN on localdata. | |
| 4338 | ||
| 4339 | 21 November 2007: Wouter | |
| 4340 | - local zone internal data setup. | |
| 4341 | ||
| 4342 | 20 November 2007: Wouter | |
| 4343 | - 0.8 - str2list config support for double string config options. | |
| 4344 | - local-zone and local-data options, config storage and documentation. | |
| 4345 | ||
| 4346 | 19 November 2007: Wouter | |
| 4347 | - do not downcase NSEC and RRSIG for verification. Follows | |
| 4348 | draft-ietf-dnsext-dnssec-bis-updates-06.txt. | |
| 4349 | - fixup leaking unbound daemons at end of tests. | |
| 4350 | - README file updated. | |
| 4351 | - nice libevent not found error. | |
| 4352 | - README talks about gnu make. | |
| 4353 | - 0.8: unit test for addr_mask and fixups for it. | |
| 4354 | and unit test for addr_in_common(). | |
| 4355 | - 0.8: access-control config file element. | |
| 4356 | and unit test rpl replay file. | |
| 4357 | - 0.8: fixup address reporting from netevent. | |
| 4358 | ||
| 4359 | 16 November 2007: Wouter | |
| 4360 | - privilege separation is not needed in unbound at this time. | |
| 4361 | TODO item marked as such. | |
| 4362 | - created beta-0.7 branch for support. | |
| 4363 | - tagged 0.7 for beta release. | |
| 4364 | - moved trunk to 0.8 for 0.8(auth features) development. | |
| 4365 | - 0.8: access control list setup. | |
| 4366 | ||
| 4367 | 15 November 2007: Wouter | |
| 4368 | - review fixups from Jelte. | |
| 4369 | ||
| 4370 | 14 November 2007: Wouter | |
| 4371 | - testbed script does not recreate configure, since its in svn now. | |
| 4372 | - fixup checkconf test so that it does not test | |
| 4373 | /etc/unbound/unbound.conf. | |
| 4374 | - tag 0.6. | |
| 4375 | ||
| 4376 | 13 November 2007: Wouter | |
| 4377 | - remove debug print. | |
| 4378 | - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists. | |
| 4379 | ||
| 4380 | 12 November 2007: Wouter | |
| 4381 | - fixup signal handling where SIGTERM could be ignored if a SIGHUP | |
| 4382 | arrives later on. | |
| 4383 | - bugreports to unbound-bugs@nlnetlabs.nl | |
| 4384 | - fixup testbound so it exits cleanly. | |
| 4385 | - cleanup the caches on a reload, so that rrsetID numbers won't clash. | |
| 4386 | ||
| 4387 | 9 November 2007: Wouter | |
| 4388 | - took ldns snapshot in repo. | |
| 4389 | - default config file is /etc/unbound/unbound.conf. | |
| 4390 | If it doesn't exist, it is installed with the doc/example.conf file. | |
| 4391 | The file is not deleted on uninstall. | |
| 4392 | - default listening is not all, but localhost interfaces. | |
| 4393 | ||
| 4394 | 8 November 2007: Wouter | |
| 4395 | - Fixup chroot and drop user privileges. | |
| 4396 | - new L root ip address in default hints. | |
| 4397 | ||
| 4398 | 1 November 2007: Wouter | |
| 4399 | - Fixup of crash on reload, due to anchors in env not NULLed after | |
| 4400 | dealloc during deinit. | |
| 4401 | - Fixup of chroot call. Happens after privileges are dropped, so | |
| 4402 | that checking the passwd entry still works. | |
| 4403 | - minor touch up of clear() hashtable function. | |
| 4404 | - VERB_DETAIL prints out what chdir, username, chroot is being done. | |
| 4405 | - when id numbers run out, caches are cleared, as in design notes. | |
| 4406 | Tested with a mock setup with very few bits in id, it worked. | |
| 4407 | - harden-dnssec-stripped: yes is now default. It insists on dnssec | |
| 4408 | data for trust anchors. Included tests for the feature. | |
| 4409 | ||
| 4410 | 31 October 2007: Wouter | |
| 4411 | - cache-max-ttl config option. | |
| 4412 | - building outside sourcedir works again. | |
| 4413 | - defaults more secure: | |
| 4414 | username: "unbound" | |
| 4415 | chroot: "/etc/unbound" | |
| 4416 | The operator can override them to be less secure ("") if necessary. | |
| 4417 | - fix horrible oversight in sorting rrset references in a message, | |
| 4418 | sort per reference key pointer, not on referencepointer itself. | |
| 4419 | - pidfile: "/etc/unbound/unbound.pid" is now the default. | |
| 4420 | - tests changed to reflect the updated default. | |
| 4421 | - created hashtable clear() function that respects locks. | |
| 4422 | ||
| 4423 | 30 October 2007: Wouter | |
| 4424 | - fixup assertion failure that relied on compressed names to be | |
| 4425 | smaller than uncompressed names. A packet from comrite.com was seen | |
| 4426 | to be compressed to a larger size. Added it as unit test. | |
| 4427 | - quieter logging at low verbosity level for common tcp messages. | |
| 4428 | - no greedy TTL update. | |
| 4429 | ||
| 4430 | 23 October 2007: Wouter | |
| 4431 | - fixup (grand-)parent problem for dnssec-lameness detection. | |
| 4432 | - fixup tests to do additional section processing for lame replies, | |
| 4433 | since the detection needs that. | |
| 4434 | - no longer trust in query section in reply during dnssec lame detect. | |
| 4435 | - dnssec lameness does not make the server never ever queried, but | |
| 4436 | non-preferred. If no other servers exist or answer, the dnssec lame | |
| 4437 | server is used; the fastest dnssec lame server is chosen. | |
| 4438 | - added test then when trust anchor cannot be primed (nodata), the | |
| 4439 | insecure mode from unbound works. | |
| 4440 | - Fixup max queries per thread, any more are dropped. | |
| 4441 | ||
| 4442 | 22 October 2007: Wouter | |
| 4443 | - added donotquerylocalhost config option. Can be turned off for | |
| 4444 | out test cases. | |
| 4445 | - ISO C compat changes. | |
| 4446 | - detect RA-no-AA lameness, as LAME. | |
| 4447 | - DNSSEC-lameness detection, as LAME. | |
| 4448 | See notes in requirements.txt for choices made. | |
| 4449 | - tests for lameness detection. | |
| 4450 | - added all to make test target; need unbound for fwd tests. | |
| 4451 | - testbound does not pollute /etc/unbound. | |
| 4452 | ||
| 4453 | 19 October 2007: Wouter | |
| 4454 | - added configure (and its files) to svn, so that the trunk is easier | |
| 4455 | to use. ./configure, config.guess, config.sub, ltmain.sh, | |
| 4456 | and config.h.in. | |
| 4457 | - added yacc/lex generated files, util/configlexer.c, | |
| 4458 | util/configparser.c util/configparser.h, to svn. | |
| 4459 | - without lex no attempt to use it. | |
| 4460 | - unsecure response validation collated into one block. | |
| 4461 | - remove warning about const cast of cfgfile name. | |
| 4462 | - outgoing-interfaces can be different from service interfaces. | |
| 4463 | - ldns-src configure is done during unbound configure and | |
| 4464 | ldns-src make is done during unbound make, and so inherits the | |
| 4465 | make arguments from the unbound make invocation. | |
| 4466 | - nicer error when libevent problem causes instant exit on signal. | |
| 4467 | - read root hints from a root hint file (like BIND does). | |
| 4468 | ||
| 4469 | 18 October 2007: Wouter | |
| 4470 | - addresses are logged with errors. | |
| 4471 | - fixup testcode fake event to remove pending before callback | |
| 4472 | since the callback may create new pending items. | |
| 4473 | - tests updated because retries are now in iterator module. | |
| 4474 | - ldns-testpkts code is checked for differences between unbound | |
| 4475 | and ldns by makedist.sh. | |
| 4476 | - ldns trunk from today added in svn repo for fallback in case | |
| 4477 | no ldns is installed on the system. | |
| 4478 | make download_ldns refreshes the tarball with ldns svn trunk. | |
| 4479 | - ldns-src.tar.gz is used if no ldns is found on the system, and | |
| 4480 | statically linked into unbound. | |
| 4481 | - start of regional allocator code. | |
| 4482 | - regional uses less memory and variables, simplified code. | |
| 4483 | - remove of region-allocator. | |
| 4484 | - alloc cache keeps a cache of recently released regional blocks, | |
| 4485 | up to a maximum. | |
| 4486 | - make unit test cleanly free memory. | |
| 4487 | ||
| 4488 | 17 October 2007: Wouter | |
| 4489 | - fixup another cycle detect and ns-addr timeout resolution bug. | |
| 4490 | This time by refusing delegations from the cache without addresses | |
| 4491 | when resolving a mandatory-glue nameserver-address for that zone. | |
| 4492 | We're going to have to ask a TLD server anyway; might as well be | |
| 4493 | the TLD server for this name. And this resolves a lot of cases where | |
| 4494 | the other nameserver names lead to cycles or are not available. | |
| 4495 | - changed random generator from random(3) clone to arc4random wrapped | |
| 4496 | for thread safety. The random generator is initialised with | |
| 4497 | entropy from the system. | |
| 4498 | - fix crash where failure to prime DNSKEY tried to print null pointer | |
| 4499 | in the log message. | |
| 4500 | - removed some debug prints, only verb_algo (4) enables them. | |
| 4501 | - fixup test; new random generator took new paths; such as one | |
| 4502 | where no scripted answer was available. | |
| 4503 | - mark insecure RRs as insecure. | |
| 4504 | - fixup removal of nonsecure items from the additional. | |
| 4505 | - reduced timeout values to more realistic, 376 msec (262 msec has | |
| 4506 | 90% of roundtrip times, 512 msec has 99% of roundtrip times.) | |
| 4507 | - server selection failover to next server after timeout (376 msec). | |
| 4508 | ||
| 4509 | 16 October 2007: Wouter | |
| 4510 | - no malloc in log_hex. | |
| 4511 | - assertions around system calls. | |
| 4512 | - protect against gethostname without ending zero. | |
| 4513 | - ntop output is null terminated by unbound. | |
| 4514 | - pidfile content null termination | |
| 4515 | - various snprintf use sizeof(stringbuf) instead of fixed constant. | |
| 4516 | - changed loopdetect % 8 with & 0x7 since % can become negative for | |
| 4517 | weird negative input and particular interpretation of integer math. | |
| 4518 | - dname_pkt_copy checks length of result, to protect result buffers. | |
| 4519 | prints an error, this should not happen. Bad strings should have | |
| 4520 | been rejected earlier in the program. | |
| 4521 | - remove a size_t underflow from msgreply size func. | |
| 4522 | ||
| 4523 | 15 October 2007: Wouter | |
| 4524 | - nicer warning. | |
| 4525 | - fix IP6 TCP, wrong definition check. With test package. | |
| 4526 | - fixup the fact that the query section was not compressed to, | |
| 4527 | the code was there but was called by value instead of by reference. | |
| 4528 | And test for the case, uses xxd and nc. | |
| 4529 | - more portable ip6 check for sockaddr types. | |
| 4530 | ||
| 4531 | 8 October 2007: Wouter | |
| 4532 | - --disable-rpath option in configure for 64bit systems with | |
| 4533 | several dynamic lib dirs. | |
| 4534 | ||
| 4535 | 7 October 2007: Wouter | |
| 4536 | - fixup tests for no AD bit in non-DO queries. | |
| 4537 | - test that makes sure AD bit is not set on non-DO query. | |
| 4538 | ||
| 4539 | 6 October 2007: Wouter | |
| 4540 | - removed logfile open early. It did not have the proper permissions; | |
| 4541 | it was opened as root instead of the user. And we cannot change user | |
| 4542 | id yet, since chroot and bind ports need to be done. | |
| 4543 | - callback checks for event callbacks done from mini_event. Because | |
| 4544 | of deletions cannot do this from netevent. This means when using | |
| 4545 | libevent the protection does not work on event-callbacks. | |
| 4546 | - fixup too small reply (did not zero counts). | |
| 4547 | - fixup reply no longer AD bit when query without DO bit. | |
| 4548 | ||
| 4549 | 5 October 2007: Wouter | |
| 4550 | - function pointer whitelist. | |
| 4551 | ||
| 4552 | 4 October 2007: Wouter | |
| 4553 | - overwrite sensitive random seed value after use. | |
| 4554 | - switch to logfile very soon if not -d (console attached). | |
| 4555 | - error messages do not reveal the trustanchor contents. | |
| 4556 | - start work on function pointer whitelists. | |
| 4557 | ||
| 4558 | 3 October 2007: Wouter | |
| 4559 | - fix for multiple empty nonterminals, after multiple DSes in the | |
| 4560 | chain of trust. | |
| 4561 | - mesh checks if modules are looping, and stops them. | |
| 4562 | - refetch with CNAMEd nameserver address regression test added. | |
| 4563 | - fixup line count bug in testcode, so testbound prints correct line | |
| 4564 | number with parse errors. | |
| 4565 | - unit test for multiple ENT case. | |
| 4566 | - fix for cname out of validated unsec zone. | |
| 4567 | - fixup nasty id=0 reuse. Also added assertions to detect its | |
| 4568 | return (the assertion catches in the existing test cases). | |
| 4569 | ||
| 4570 | 1 October 2007: Wouter | |
| 4571 | - skip F77, CXX, objC tests in configure step. | |
| 4572 | - fixup crash in refetch glue after a CNAME. | |
| 4573 | and protection against similar failures (with error print). | |
| 4574 | ||
| 4575 | 28 September 2007: Wouter | |
| 4576 | - test case for unbound-checkconf, fixed so it also checks the | |
| 4577 | interface: statements. | |
| 4578 | ||
| 4579 | 26 September 2007: Wouter | |
| 4580 | - SIGHUP will reopen the log file. | |
| 4581 | - Option to log to syslog. | |
| 4582 | - please lint, fixup tests (that went to syslog on open, oops). | |
| 4583 | - config check program. | |
| 4584 | ||
| 4585 | 25 September 2007: Wouter | |
| 4586 | - tests for NSEC3. Fixup bitmap checks for NSEC3. | |
| 4587 | - positive ANY response needs to check if wildcard expansion, and | |
| 4588 | check that original data did not exist. | |
| 4589 | - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure | |
| 4590 | delegation, for abuse of child zone apex nsec3. | |
| 4591 | - create 0.5 release tag. | |
| 4592 | ||
| 4593 | 24 September 2007: Wouter | |
| 4594 | - do not make test programs by default. | |
| 4595 | - But 'make test' will perform all of the tests. | |
| 4596 | - Advertise builtin select libevent alternative when no libevent | |
| 4597 | is found. | |
| 4598 | - signit can generate NSEC3 hashes, for generating tests. | |
| 4599 | - multiple nsec3 paramaters in message test. | |
| 4600 | - too high nsec3 iterations becomes insecure test. | |
| 4601 | ||
| 4602 | 21 September 2007: Wouter | |
| 4603 | - fixup empty_DS_name allocated in wrong region (port DEC Alpha). | |
| 4604 | - fixup testcode lock safety (port FreeBSD). | |
| 4605 | - removes subscript has type char warnings (port Solaris 9). | |
| 4606 | - fixup of field with format type to int (port MacOS/X intel). | |
| 4607 | - added test for infinite loop case in nonRD answer validation. | |
| 4608 | It was a more general problem, but hard to reproduce. When an | |
| 4609 | unsigned rrset is being validated and the key fetched, the DS | |
| 4610 | sequence is followed, but if the final name has no DS, then no | |
| 4611 | proof is possible - the signature has been stripped off. | |
| 4612 | ||
| 4613 | 20 September 2007: Wouter | |
| 4614 | - fixup and test for NSEC wildcard with empty nonterminals. | |
| 4615 | - makedist.sh fixup for svn info. | |
| 4616 | - acl features request in plan. | |
| 4617 | - improved DS empty nonterminal handling. | |
| 4618 | - compat with ANS nxdomain for empty nonterminals. Attempts the nodata | |
| 4619 | proof anyway, which succeeds in ANS failure case. | |
| 4620 | - striplab protection in case it becomes -1. | |
| 4621 | - plans for static and blacklist config. | |
| 4622 | ||
| 4623 | 19 September 2007: Wouter | |
| 4624 | - comments about non-packed usage. | |
| 4625 | - plan for overload support in 0.6. | |
| 4626 | - added testbound tests for a failed resolution from the logs | |
| 4627 | and for failed prime when missing glue. | |
| 4628 | - fixup so useless delegation points are not returned from the | |
| 4629 | cache. Also the safety belt is used if priming fails to complete. | |
| 4630 | - fixup NSEC rdata not to be lowercased, bind compat. | |
| 4631 | ||
| 4632 | 18 September 2007: Wouter | |
| 4633 | - wildcard nsec3 testcases, and fixup to get correct wildcard name. | |
| 4634 | - validator prints subtype classification for debug. | |
| 4635 | ||
| 4636 | 17 September 2007: Wouter | |
| 4637 | - NSEC3 hash cache unit test. | |
| 4638 | - validator nsec3 nameerror test. | |
| 4639 | ||
| 4640 | 14 September 2007: Wouter | |
| 4641 | - nsec3 nodata proof, nods proof, wildcard proof. | |
| 4642 | - nsec3 support for cname chain ending in noerror or nodata. | |
| 4643 | - validator calls nsec3 proof routines if no NSECs prove anything. | |
| 4644 | - fixup iterator bug where it stored the answer to a cname under | |
| 4645 | the wrong qname into the cache. When prepending the cnames, the | |
| 4646 | qname has to be reset to the original qname. | |
| 4647 | ||
| 4648 | 13 September 2007: Wouter | |
| 4649 | - nsec3 find matching and covering, ce proof, prove namerror msg. | |
| 4650 | ||
| 4651 | 12 September 2007: Wouter | |
| 4652 | - fixup of manual page warnings, like for NSD bugreport. | |
| 4653 | - nsec3 work, config, max iterations, filter, and hash cache. | |
| 4654 | ||
| 4655 | 6 September 2007: Wouter | |
| 4656 | - fixup to find libevent on mac port install. | |
| 4657 | - fixup size_t vs unsigned portability in validator/sigcrypt. | |
| 4658 | - please compiler on different platforms, for unreachable code. | |
| 4659 | - val_nsec3 file. | |
| 4660 | - pthread_rwlock type is optional, in case of old pthread libs. | |
| 4661 | ||
| 4662 | 5 September 2007: Wouter | |
| 4663 | - cname, name error validator tests. | |
| 4664 | - logging of qtype ANY works. | |
| 4665 | - ANY type answers get RRSIG in answer section of replies (but not | |
| 4666 | in other sections, unless DO bit is on). | |
| 4667 | - testbound can replay a TCP query (set MATCH TCP in the QUERY). | |
| 4668 | - DS and noDS referral validation test. | |
| 4669 | - if you configure many trust anchors, parent trust anchors can | |
| 4670 | securely deny existance of child trust anchors, if validated. | |
| 4671 | - not all *.name NSECs are present because a wildcard was matched, | |
| 4672 | and *.name NSECs can prove nodata for empty nonterminals. | |
| 4673 | Also, for wildcard name NSECs, check they are not from the parent | |
| 4674 | zone (for wildcarded zone cuts), and check absence of CNAME bit, | |
| 4675 | for a nodata proof. | |
| 4676 | - configure option for memory allocation debugging. | |
| 4677 | - port configure option for memory allocation to solaris10. | |
| 4678 | ||
| 4679 | 4 September 2007: Wouter | |
| 4680 | - fixup of Leakage warning when serviced queries processed multiple | |
| 4681 | callbacks for the same query from the same server. | |
| 4682 | - testbound removes config file from /tmp on failed exit. | |
| 4683 | - fixup for referral cleanup of the additional section. | |
| 4684 | - tests for cname, referral validation. | |
| 4685 | - neater testbound tpkg output. | |
| 4686 | - DNAMEs no longer match their apex when synthesized from the cache. | |
| 4687 | - find correct signer name for DNAME responses. | |
| 4688 | - wildcarded DNAME test and fixup code to detect. | |
| 4689 | - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs. | |
| 4690 | So that wildcarded CNAMEs get their NSEC with them to the answer. | |
| 4691 | - test for a CNAME to a DNAME to a CNAME to an answer, all from | |
| 4692 | different domains, for key fetching and signature checking of | |
| 4693 | CNAME'd messages. | |
| 4694 | ||
| 4695 | 3 September 2007: Wouter | |
| 4696 | - Fixed error in iterator that would cause assertion failure in | |
| 4697 | validator. CNAME to a NXDOMAIN response was collated into a response | |
| 4698 | with both a CNAME and the NXDOMAIN rcode. Added a test that the | |
| 4699 | rcode is changed to NOERROR (because of the CNAME). | |
| 4700 | - timeout on tcp does not lead to spurious leakage detect. | |
| 4701 | - account memory for name of lame zones, so that memory leakages does | |
| 4702 | not show lame cache growth as a leakage growth. | |
| 4703 | - config setting for lameness cache expressed in bytes, instead of | |
| 4704 | number of entries. | |
| 4705 | - tool too summarize allocations per code line. | |
| 4706 | ||
| 4707 | 31 August 2007: Wouter | |
| 4708 | - can read bind trusted-keys { ... }; files, in a compatibility mode. | |
| 4709 | - iterator should not detach target queries that it still could need. | |
| 4710 | the protection against multiple outstanding queries is moved to a | |
| 4711 | current_query num check. | |
| 4712 | - validator nodata, positive, referral tests. | |
| 4713 | - dname print can print '*' wildcard. | |
| 4714 | ||
| 4715 | 30 August 2007: Wouter | |
| 4716 | - fixup override date config option. | |
| 4717 | - config options to control memory usage. | |
| 4718 | - caught bad free of un-alloced data in worker_send error case. | |
| 4719 | - memory accounting for key cache (trust anchors and temporary cache). | |
| 4720 | - memory accounting fixup for outside network tcp pending waits. | |
| 4721 | - memory accounting fixup for outside network tcp callbacks. | |
| 4722 | - memory accounting for iterator fixed storage. | |
| 4723 | - key cache size and slabs config options. | |
| 4724 | - lib crypto cleanups at exit. | |
| 4725 | ||
| 4726 | 29 August 2007: Wouter | |
| 4727 | - test tool to sign rrsets for testing validator with. | |
| 4728 | - added RSA and DSA test keys, public and private pairs, 512 bits. | |
| 4729 | - default configuration is with validation enabled. | |
| 4730 | Only a trust-anchor needs to be configured for DNSSEC to work. | |
| 4731 | - do not convert to DER for DSA signature verification. | |
| 4732 | - validator replay test file, for a DS to DNSKEY DSA key prime and | |
| 4733 | positive response. | |
| 4734 | ||
| 4735 | 28 August 2007: Wouter | |
| 4736 | - removed double use for udp buffers, that could fail, | |
| 4737 | instead performs a malloc to do the backup. | |
| 4738 | - validator validates referral messages, by validating all the rrsets | |
| 4739 | and stores the rrsets in the cache. Further referral (nonRD queries) | |
| 4740 | replies are made from the rrset cache directly. Unless unchecked | |
| 4741 | rrsets are encountered, there are then validated. | |
| 4742 | - enforce that signing is done by a parent domain (or same domain). | |
| 4743 | - adjust TTL downwards if rrset TTL bigger than signature allows. | |
| 4744 | - permissive mode feature, sets AD bit for secure, but bogus does | |
| 4745 | not give servfail (bogus is changed into indeterminate). | |
| 4746 | - optimization of rrset verification. rr canonical sorting is reused, | |
| 4747 | for the same rrset. canonical rrset image in buffer is reused for | |
| 4748 | the same signature. | |
| 4749 | - if the rrset is too big (64k exactly + large owner name) the | |
| 4750 | canonicalization routine will fail if it does not fit in buffer. | |
| 4751 | - faster verification for large sigsets. | |
| 4752 | - verb_detail mode reports validation failures, but not the entire | |
| 4753 | algorithm for validation. Key prime failures are reported as | |
| 4754 | verb_ops level. | |
| 4755 | ||
| 4756 | 27 August 2007: Wouter | |
| 4757 | - do not garble the edns if a cache answer fails. | |
| 4758 | - answer norecursive from cache if possible. | |
| 4759 | - honor clean_additional setting when returning secure non-recursive | |
| 4760 | referrals. | |
| 4761 | - do not store referral in msg cache for nonRD queries. | |
| 4762 | - store verification status in the rrset cache to speed up future | |
| 4763 | verification. | |
| 4764 | - mark rrsets indeterminate and insecure if they are found to be so. | |
| 4765 | and store this in the cache. | |
| 4766 | ||
| 4767 | 24 August 2007: Wouter | |
| 4768 | - message is bogus if unsecure authority rrsets are present. | |
| 4769 | - val-clean-additional option, so you can turn it off. | |
| 4770 | - move rrset verification out of the specific proof types into one | |
| 4771 | routine. This makes the proof routines prettier. | |
| 4772 | - fixup cname handling in validator, cname-to-positive and cname-to- | |
| 4773 | nodata work. | |
| 4774 | - Do not synthesize DNSKEY and DS responses from the rrset cache if | |
| 4775 | the rrset is from the additional section. Signatures may have | |
| 4776 | fallen off the packet, and cause validation failure. | |
| 4777 | - more verbose signature date errors (with the date attached). | |
| 4778 | - increased default infrastructure cache size. It is important for | |
| 4779 | performance, and 1000 entries are only 212k (or a 400 k total cache | |
| 4780 | size). To 10000 entries (for 2M entries, 4M cache size). | |
| 4781 | ||
| 4782 | 23 August 2007: Wouter | |
| 4783 | - CNAME handling - move needs_validation to before val_new(). | |
| 4784 | val_new() setups the chase-reply to be an edited copy of the msg. | |
| 4785 | new classification, and find signer can find for it. | |
| 4786 | removal of unsigned crap from additional, and query restart for | |
| 4787 | cname. | |
| 4788 | - refuse to follow wildcarded DNAMEs when validating. | |
| 4789 | But you can query for qtype ANY, or qtype DNAME and validate that. | |
| 4790 | ||
| 4791 | 22 August 2007: Wouter | |
| 4792 | - bogus TTL. | |
| 4793 | - review - use val_error(). | |
| 4794 | ||
| 4795 | 21 August 2007: Wouter | |
| 4796 | - ANY response validation. | |
| 4797 | - store security status in cache. | |
| 4798 | - check cache security status and either send the query to be | |
| 4799 | validated, return the query to client, or send servfail to client. | |
| 4800 | Sets AD bit on validated replies. | |
| 4801 | - do not examine security status on an error reply in mesh_done. | |
| 4802 | - construct DS, DNSKEY messages from rrset cache. | |
| 4803 | - manual page entry for override-date. | |
| 4804 | ||
| 4805 | 20 August 2007: Wouter | |
| 4806 | - validate and positive validation, positive wildcard NSEC validation. | |
| 4807 | - nodata validation, nxdomain validation. | |
| 4808 | ||
| 4809 | 18 August 2007: Wouter | |
| 4810 | - process DNSKEY response in FINDKEY state. | |
| 4811 | ||
| 4812 | 17 August 2007: Wouter | |
| 4813 | - work on DS2KE routine. | |
| 4814 | - val_nsec.c for validator NSEC proofs. | |
| 4815 | - unit test for NSEC bitmap reading. | |
| 4816 | - dname iswild and canonical_compare with unit tests. | |
| 4817 | ||
| 4818 | 16 August 2007: Wouter | |
| 4819 | - DS sig unit test. | |
| 4820 | - latest release libevent 1.3c and 1.3d have threading fixed. | |
| 4821 | - key entry fixup data pointer and ttl absolute. | |
| 4822 | - This makes a key-prime succeed in validator, with DS or DNSKEY as | |
| 4823 | trust-anchor. | |
| 4824 | - fixup canonical compare byfield routine, fix bug and also neater. | |
| 4825 | - fixed iterator response type classification for queries of type | |
| 4826 | ANY and NS. | |
| 4827 | dig ANY gives sometimes NS rrset in AN and NS section, and parser | |
| 4828 | removes the NS section duplicate. dig NS gives sometimes the NS | |
| 4829 | in the answer section, as referral. | |
| 4830 | - validator FINDKEY state. | |
| 4831 | ||
| 4832 | 15 August 2007: Wouter | |
| 4833 | - crypto calls to verify signatures. | |
| 4834 | - unit test for rrsig verification. | |
| 4835 | ||
| 4836 | 14 August 2007: Wouter | |
| 4837 | - default outgoing ports changed to avoid port 2049 by default. | |
| 4838 | This port is widely blocked by firewalls. | |
| 4839 | - count infra lameness cache in memory size. | |
| 4840 | - accounting of memory improved | |
| 4841 | - outbound entries are allocated in the query region they are for. | |
| 4842 | - extensive debugging for memory allocations. | |
| 4843 | - --enable-lock-checks can be used to enable lock checking. | |
| 4844 | - protect undefs in config.h from autoheaders ministrations. | |
| 4845 | - print all received udp packets. log hex will print on multiple | |
| 4846 | lines if needed. | |
| 4847 | - fixed error in parser with backwards rrsig references. | |
| 4848 | - mark cycle targets for iterator did not have CD flag so failed | |
| 4849 | its task. | |
| 4850 | ||
| 4851 | 13 August 2007: Wouter | |
| 4852 | - fixup makefile, if lexer is missing give nice error and do not | |
| 4853 | mess up the dependencies. | |
| 4854 | - canonical compare routine updated. | |
| 4855 | - canonical hinfo compare. | |
| 4856 | - printout list of the queries that the mesh is working on. | |
| 4857 | ||
| 4858 | 10 August 2007: Wouter | |
| 4859 | - malloc and free overrides that track total allocation and frees. | |
| 4860 | for memory debugging. | |
| 4861 | - work on canonical sort. | |
| 4862 | ||
| 4863 | 9 August 2007: Wouter | |
| 4864 | - canonicalization, signature checks | |
| 4865 | - dname signature label count and unit test. | |
| 4866 | - added debug heap size print to memory printout. | |
| 4867 | - typo fixup in worker.c | |
| 4868 | - -R needed on solaris. | |
| 4869 | - validator override option for date check testing. | |
| 4870 | ||
| 4871 | 8 August 2007: Wouter | |
| 4872 | - ldns _raw routines created (in ldns trunk). | |
| 4873 | - sigcrypt DS digest routines | |
| 4874 | - val_utils uses sigcrypt to perform signature cryptography. | |
| 4875 | - sigcrypt keyset processing | |
| 4876 | ||
| 4877 | 7 August 2007: Wouter | |
| 4878 | - security status type. | |
| 4879 | - security status is copied when rdata is equal for rrsets. | |
| 4880 | - rrset id is updated to invalidate all the message cache entries | |
| 4881 | that refer to NSEC, NSEC3, DNAME rrsets that have changed. | |
| 4882 | - val_util work | |
| 4883 | - val_sigcrypt file for validator signature checks. | |
| 4884 | ||
| 4885 | 6 August 2007: Wouter | |
| 4886 | - key cache for validator. | |
| 4887 | - moved isroot and dellabel to own dname routines, with unit test. | |
| 4888 | ||
| 4889 | 3 August 2007: Wouter | |
| 4890 | - replanning. | |
| 4891 | - scrubber check section of lame NS set. | |
| 4892 | - trust anchors can be in config file or read from zone file, | |
| 4893 | DS and DNSKEY entries. | |
| 4894 | - unit test trust anchor storage. | |
| 4895 | - trust anchors converted to packed rrsets. | |
| 4896 | - key entry definition. | |
| 4897 | ||
| 4898 | 2 August 2007: Wouter | |
| 4899 | - configure change for latest libevent trunk version (needs -lrt). | |
| 4900 | - query_done and walk_supers are moved out of module interface. | |
| 4901 | - fixup delegation point duplicates. | |
| 4902 | - fixup iterator scrubber; lame NS set is let through the scrubber | |
| 4903 | so that the classification is lame. | |
| 4904 | - validator module exists, and does nothing but pass through, | |
| 4905 | with calling of next module and return. | |
| 4906 | - validator work. | |
| 4907 | ||
| 4908 | 1 August 2007: Wouter | |
| 4909 | - set version to 0.5 | |
| 4910 | - module work for module to module interconnections. | |
| 4911 | - config of modules. | |
| 4912 | - detect cycle takes flags. | |
| 4913 | ||
| 4914 | 31 July 2007: Wouter | |
| 4915 | - updated plan | |
| 4916 | - release 0.4 tag. | |
| 4917 | ||
| 4918 | 30 July 2007: Wouter | |
| 4919 | - changed random state init, so that sequential process IDs are not | |
| 4920 | cancelled out by sequential thread-ids in the random number seed. | |
| 4921 | - the fwd_three test, which sends three queries to unbound, and | |
| 4922 | unbound is kept waiting by ldns-testns for 3 seconds, failed | |
| 4923 | because the retry timeout for default by unbound is 3 seconds too, | |
| 4924 | it would hit that timeout and fail the test. Changed so that unbound | |
| 4925 | is kept waiting for 2 seconds instead. | |
| 4926 | ||
| 4927 | 27 July 2007: Wouter | |
| 4928 | - removed useless -C debug option. It did not work. | |
| 4929 | - text edit of documentation. | |
| 4930 | - added doc/CREDITS file, referred to by the manpages. | |
| 4931 | - updated planning. | |
| 4932 | ||
| 4933 | 26 July 2007: Wouter | |
| 4934 | - cycle detection, for query state dependencies. Will attempt to | |
| 4935 | circumvent the cycle, but if no other targets available fails. | |
| 4936 | - unit test for AXFR, IXFR response. | |
| 4937 | - test for cycle detection. | |
| 4938 | ||
| 4939 | 25 July 2007: Wouter | |
| 4940 | - testbound read ADDRESS and check it. | |
| 4941 | - test for version.bind and friends. | |
| 4942 | - test for iterator chaining through several referrals. | |
| 4943 | - test and fixup for refetch for glue. Refetch fails if glue | |
| 4944 | is still not provided. | |
| 4945 | ||
| 4946 | 24 July 2007: Wouter | |
| 4947 | - Example section in config manual. | |
| 4948 | - Addr stored for range and moment in replay. | |
| 4949 | ||
| 4950 | 20 July 2007: Wouter | |
| 4951 | - Check CNAME chain before returning cache entry with CNAMEs. | |
| 4952 | - Option harden-glue, default is on. It will discard out of zone | |
| 4953 | data. If disabled, performance is faster, but spoofing attempts | |
| 4954 | become a possibility. Note that still normalize scrubbing is done, | |
| 4955 | and that the potentially spoofed data is used for infrastructure | |
| 4956 | and not returned to the client. | |
| 4957 | - if glue times out, refetch by asking parent of delegation again. | |
| 4958 | Much like asking for DS at the parent side. | |
| 4959 | - TODO items from forgery-resilience draft. | |
| 4960 | and on memory handling improvements. | |
| 4961 | - renamed module_event_timeout to module_event_noreply. | |
| 4962 | - memory reporting code; reports on memory usage after handling | |
| 4963 | a network packet (not on cache replies). | |
| 4964 | ||
| 4965 | 19 July 2007: Wouter | |
| 4966 | - shuffle NS selection when getting nameserver target addresses. | |
| 4967 | - fixup of deadlock warnings, yield cpu in checklock code so that | |
| 4968 | freebsd scheduler selects correct process to run. | |
| 4969 | - added identity and version config options and replies. | |
| 4970 | - store cname messages complete answers. | |
| 4971 | ||
| 4972 | 18 July 2007: Wouter | |
| 4973 | - do not query addresses, 127.0.0.1, and ::1 by default. | |
| 4974 | ||
| 4975 | 17 July 2007: Wouter | |
| 4976 | - forward zone options in config file. | |
| 4977 | - forward per zone in iterator. takes precendence over stubs. | |
| 4978 | - fixup commithooks. | |
| 4979 | - removed forward-to and forward-to-port features, subsumed by | |
| 4980 | new forward zones. | |
| 4981 | - fix parser to handle absent server: clause. | |
| 4982 | - change untrusted rrset test to account for scrubber that is now | |
| 4983 | applied during the test (which removes the poison, by the way). | |
| 4984 | - feature, addresses can be specified with @portnumber, like nsd.conf. | |
| 4985 | - test config files changed over to new forwarder syntax. | |
| 4986 | ||
| 4987 | 27 June 2007: Wouter | |
| 4988 | - delete of mesh does a postorder traverse of the tree. | |
| 4989 | - found and fixed a memory leak. For TTL=0 messages, that would | |
| 4990 | not be cached, instead the msg-replyinfo structure was leaked. | |
| 4991 | - changed server selection so it will filter out hosts that are | |
| 4992 | unresponsive. This is defined as a host with the maximum rto value. | |
| 4993 | This means that unbound tried the host for retries up to 120 secs. | |
| 4994 | The rto value will time out after host-ttl seconds from the cache. | |
| 4995 | This keeps such unresolvable queries from taking up resources. | |
| 4996 | - utility for keeping histogram. | |
| 4997 | ||
| 4998 | 26 June 2007: Wouter | |
| 4999 | - mesh is called by worker, and iterator uses it. | |
| 5000 | This removes the hierarchical code. | |
| 5001 | QueryTargets state and Finished state are merged for iterator. | |
| 5002 | - forwarder mode no longer sets AA bit on first reply. | |
| 5003 | - rcode in walk_supers is not needed. | |
| 5004 | ||
| 5005 | 25 June 2007: Wouter | |
| 5006 | - more mesh work. | |
| 5007 | - error encode routine for ease. | |
| 5008 | ||
| 5009 | 22 June 2007: Wouter | |
| 5010 | - removed unused _node iterator value from rbtree_t. Takes up space. | |
| 5011 | - iterator can handle querytargets state without a delegation point | |
| 5012 | set, so that a priming(stub) subquery error can be handled. | |
| 5013 | - iterator stores if it is priming or not. | |
| 5014 | - log_query_info() neater logging. | |
| 5015 | - changed iterator so that it does not alter module_qstate.qinfo | |
| 5016 | but keeps a chase query info. Also query_flags are not altered, | |
| 5017 | the iterator uses chase_flags. | |
| 5018 | - fixup crash in case no ports for the family exist. | |
| 5019 | ||
| 5020 | 21 June 2007: Wouter | |
| 5021 | - Fixup secondary buffer in case of error callback. | |
| 5022 | - cleanup slumber list of runnable states. | |
| 5023 | - module_subreq_depth fails to work in slumber list. | |
| 5024 | - fixup query release for cached results to sub targets. | |
| 5025 | - neater error for tcp connection failure, shows addr in verbose. | |
| 5026 | - rbtree_init so that it can be used with preallocated memory. | |
| 5027 | ||
| 5028 | 20 June 2007: Wouter | |
| 5029 | - new -C option to enable coredumps after forking away. | |
| 5030 | - doc update. | |
| 5031 | - fixup CNAME generation by scrubber, and memory allocation of it. | |
| 5032 | - fixup deletion of serviced queries when all callbacks delete too. | |
| 5033 | - set num target queries to 0 when you move them to slumber list. | |
| 5034 | - typo in check caused subquery errors to be ignored, fixed. | |
| 5035 | - make lint happy about rlim_t. | |
| 5036 | - freeup of modules after freeup of module-states. | |
| 5037 | - duplicate replies work, this uses secondary udp buffer in outnet. | |
| 5038 | ||
| 5039 | 19 June 2007: Wouter | |
| 5040 | - nicer layout in stats.c, review 0.3 change. | |
| 5041 | - spelling improvement, review 0.3 change. | |
| 5042 | - uncapped timeout for server selection, so that very fast or slow | |
| 5043 | servers will stand out from the rest. | |
| 5044 | - target-fetch-policy: "3 2 1 0 0" config setting. | |
| 5045 | - fixup queries answered without RD bit (for root prime results). | |
| 5046 | - refuse AXFR and IXFR requests. | |
| 5047 | - fixup RD flag in error reply from iterator. fixup RA flag from | |
| 5048 | worker error reply. | |
| 5049 | - fixup encoding of very short edns buffer sizes, now sets TC bit. | |
| 5050 | - config options harden-short-bufsize and harden-large-queries. | |
| 5051 | ||
| 5052 | 18 June 2007: Wouter | |
| 5053 | - same, move subqueries to slumber list when first has resolved. | |
| 5054 | - fixup last fix for duplicate callbacks. | |
| 5055 | - another offbyone in targetcounter. Also in Java prototype by the way. | |
| 5056 | ||
| 5057 | 15 June 2007: Wouter | |
| 5058 | - if a query asks to be notified of the same serviced query result | |
| 5059 | multiple times, this will succeed. Only one callback will happen; | |
| 5060 | multiple outbound-list entries result (but the double cleanup of it | |
| 5061 | will not matter). | |
| 5062 | - when iterator moves on due to CNAME or referral, it will remove | |
| 5063 | the subqueries (for other targets). These are put on the slumber | |
| 5064 | list. | |
| 5065 | - state module wait subq is OK with no new subqs, an old one may have | |
| 5066 | stopped, with an error, and it is still waiting for other ones. | |
| 5067 | - if a query loops, halt entire query (easy way to clean up properly). | |
| 5068 | ||
| 5069 | 14 June 2007: Wouter | |
| 5070 | - num query targets was > 0 , not >= 0 compared, so that fetch | |
| 5071 | policy of 0 did nothing. | |
| 5072 | ||
| 5073 | 13 June 2007: Wouter | |
| 5074 | - debug option: configure --enable-static-exe for compile where | |
| 5075 | ldns and libevent are linked statically. Default is off. | |
| 5076 | - make install and make uninstall. Works with static-exe and without. | |
| 5077 | installation of unbound binary and manual pages. | |
| 5078 | - alignement problem fix on solaris 64. | |
| 5079 | - fixup address in case of TCP error. | |
| 5080 | ||
| 5081 | 12 June 2007: Wouter | |
| 5082 | - num target queries was set to 0 at a bad time. Default it to 0 and | |
| 5083 | increase as target queries are done. | |
| 5084 | - synthesize CNAME and DNAME responses from the cache. | |
| 5085 | - Updated doxygen config for doxygen 1.5. | |
| 5086 | - aclocal newer version. | |
| 5087 | - doxygen 1.5 fixes for comments (for the strict check on docs). | |
| 5088 | ||
| 5089 | 11 June 2007: Wouter | |
| 5090 | - replies on TCP queries have the address field set in replyinfo, | |
| 5091 | for serviced queries, because the initiator does not know that | |
| 5092 | a TCP fallback has occured. | |
| 5093 | - omit DNSSEC types from nonDO replies, except if qtype is ANY or | |
| 5094 | if qtype directly queries for the type (and then only show that | |
| 5095 | 'unknown type' in the answer section). | |
| 5096 | - fixed message parsing where rrsigs on their own would be put | |
| 5097 | in the signature list over the rrsig type. | |
| 5098 | ||
| 5099 | 7 June 2007: Wouter | |
| 5100 | - fixup error in double linked list insertion for subqueries and | |
| 5101 | for outbound list of serviced queries for iterator module. | |
| 5102 | - nicer printout of outgoing port selection. | |
| 5103 | - fixup cname target readout. | |
| 5104 | - nicer debug output. | |
| 5105 | - fixup rrset counts when prepending CNAMEs to the answer. | |
| 5106 | - fixup rrset TTL for prepended CNAMEs. | |
| 5107 | - process better check for looping modules, and which submodule to | |
| 5108 | run next. | |
| 5109 | - subreq insertion code fixup for slumber list. | |
| 5110 | - VERB_DETAIL, verbosity: 2 level gives short but readable output. | |
| 5111 | VERB_ALGO, verbosity: 3 gives extensive output. | |
| 5112 | - fixup RA bit in cached replies. | |
| 5113 | - fixup CNAME responses from the cache no longer partial response. | |
| 5114 | - error in network send handled without leakage. | |
| 5115 | - enable ip6 from config, and try ip6 addresses if available, | |
| 5116 | if ip6 is not connected, skips to next server. | |
| 5117 | ||
| 5118 | 5 June 2007: Wouter | |
| 5119 | - iterator state finished. | |
| 5120 | - subrequests without parent store in cache and stop. | |
| 5121 | - worker slumber list for ongoing promiscuous queries. | |
| 5122 | - subrequest error handling. | |
| 5123 | - priming failure returns SERVFAIL. | |
| 5124 | - priming gives LAME result, returns SERVFAIL. | |
| 5125 | - debug routine to print dns_msg as handled by iterator. | |
| 5126 | - memleak in config file stubs fixup. | |
| 5127 | - more small bugs, in scrubber, query compare no ID for lookup, | |
| 5128 | in dname validation for NS targets. | |
| 5129 | - sets entry.key for new special allocs. | |
| 5130 | - lognametypeclass can display unknown types and classes. | |
| 5131 | ||
| 5132 | 4 June 2007: Wouter | |
| 5133 | - random selection of equally preferred nameserver targets. | |
| 5134 | - reply info copy routine. Reuses existing code. | |
| 5135 | - cache lameness in response handling. | |
| 5136 | - do not touch qstate after worker_process_query because it may have | |
| 5137 | been deleted by that routine. | |
| 5138 | - Prime response state. | |
| 5139 | - Process target response state. | |
| 5140 | - some memcmp changed to dname_compare for case preservation. | |
| 5141 | ||
| 5142 | 1 June 2007: Wouter | |
| 5143 | - normalize incoming messages. Like unbound-java, with CNAME chain | |
| 5144 | checked, DNAME checked, CNAME's synthesized, glue checked. | |
| 5145 | - sanitize incoming messages. | |
| 5146 | - split msgreply encode functions into own file msgencode.c. | |
| 5147 | - msg_parse to queryinfo/replyinfo conversion more versatile. | |
| 5148 | - process_response, classify response, delegpt_from_message. | |
| 5149 | ||
| 5150 | 31 May 2007: Wouter | |
| 5151 | - querytargets state. | |
| 5152 | - dname_subdomain_c() routine. | |
| 5153 | - server selection, based on RTT. ip6 is filtered out if not available, | |
| 5154 | and lameness is checked too. | |
| 5155 | - delegation point copy routine. | |
| 5156 | ||
| 5157 | 30 May 2007: Wouter | |
| 5158 | - removed FLAG_CD from message and rrset caches. This was useful for | |
| 5159 | an agnostic forwarder, but not for a sophisticated (trust value per | |
| 5160 | rrset enabled) cache. | |
| 5161 | - iterator reponse typing. | |
| 5162 | - iterator cname handle. | |
| 5163 | - iterator prime start. | |
| 5164 | - subquery work. | |
| 5165 | - processInitRequest and processInitRequest2. | |
| 5166 | - cache synthesizes referral messages, with DS and NSEC. | |
| 5167 | - processInitRequest3. | |
| 5168 | - if a request creates multiple subrequests these are all activated. | |
| 5169 | ||
| 5170 | 29 May 2007: Wouter | |
| 5171 | - routines to lock and unlock array of rrsets moved to cache/rrset. | |
| 5172 | - lookup message from msg cache (and copy to region). | |
| 5173 | - fixed cast error in dns msg lookup. | |
| 5174 | - message with duplicate rrset does not increase its TTLs twice. | |
| 5175 | - 'qnamesize' changed to 'qname_len' for similar naming scheme. | |
| 5176 | ||
| 5177 | 25 May 2007: Wouter | |
| 5178 | - Acknowledge use of unbound-java code in iterator. Nicer readme. | |
| 5179 | - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and | |
| 5180 | rrset cache from module environment. | |
| 5181 | - packed rrset key has type and class as easily accessable struct | |
| 5182 | members. They are still kept in network format for fast msg encode. | |
| 5183 | - dns cache find_delegation routine. | |
| 5184 | - iterator main functions setup. | |
| 5185 | - dns cache lookup setup. | |
| 5186 | ||
| 5187 | 24 May 2007: Wouter | |
| 5188 | - small changes to prepare for subqueries. | |
| 5189 | - iterator forwarder feature separated out. | |
| 5190 | - iterator hints stub code, config file stub code, so that first | |
| 5191 | testing can proceed locally. | |
| 5192 | - replay tests now have config option to enable forwarding mode. | |
| 5193 | ||
| 5194 | 23 May 2007: Wouter | |
| 5195 | - outside network does precise timers for roundtrip estimates for rtt | |
| 5196 | and for setting timeout for UDP. Pending_udp takes milliseconds. | |
| 5197 | - cleaner iterator sockaddr conversion of forwarder address. | |
| 5198 | - iterator/iter_utils and iter_delegpt setup. | |
| 5199 | - root hints. | |
| 5200 | ||
| 5201 | 22 May 2007: Wouter | |
| 5202 | - outbound query list for modules and support to callback with the | |
| 5203 | outbound entry to the module. | |
| 5204 | - testbound support for new serviced queries. | |
| 5205 | - test for retry to TCP cannot use testbound any longer. | |
| 5206 | - testns test for EDNS fallback, test for TCP fallback already exists. | |
| 5207 | - fixes for no-locking compile. | |
| 5208 | - mini_event timer precision and fix for change in timeouts during | |
| 5209 | timeout callback. Fix for fwd_three tests, performed nonexit query. | |
| 5210 | ||
| 5211 | 21 May 2007: Wouter | |
| 5212 | - small comment on hash table locking. | |
| 5213 | - outside network serviced queries, contain edns and tcp fallback, | |
| 5214 | and udp retries and rtt timing. | |
| 5215 | ||
| 5216 | 16 May 2007: Wouter | |
| 5217 | - lruhash_touch() would cause locking order problems. Fixup in | |
| 5218 | lock-verify in case locking cycle is found. | |
| 5219 | - services/cache/rrset.c for rrset cache code. | |
| 5220 | - special rrset_cache LRU updating function that uses the rrset id. | |
| 5221 | - no dependencies calculation when make clean is called. | |
| 5222 | - config settings for infra cache. | |
| 5223 | - daemon code slightly cleaner, only creates caches once. | |
| 5224 | ||
| 5225 | 15 May 2007: Wouter | |
| 5226 | - host cache code. | |
| 5227 | - unit test for host cache. | |
| 5228 | ||
| 5229 | 14 May 2007: Wouter | |
| 5230 | - Port to OS/X and Dec Alpha. Printf format and alignment fixes. | |
| 5231 | - extensive lock debug report on join timeout. | |
| 5232 | - proper RTT calculation, in utility code. | |
| 5233 | - setup of services/cache/infra, host cache. | |
| 5234 | ||
| 5235 | 11 May 2007: Wouter | |
| 5236 | - iterator/iterator.c module. | |
| 5237 | - fixup to pass reply_info in testcode and in netevent. | |
| 5238 | ||
| 5239 | 10 May 2007: Wouter | |
| 5240 | - created release-0.3 svn tag. | |
| 5241 | - util/module.h | |
| 5242 | - fixed compression - no longer compresses root name. | |
| 5243 | ||
| 5244 | 9 May 2007: Wouter | |
| 5245 | - outside network cleans up waiting tcp queries on exit. | |
| 5246 | - fallback to TCP. | |
| 5247 | - testbound replay with retry in TCP mode. | |
| 5248 | - tpkg test for retry in TCP mode, against ldns-testns server. | |
| 5249 | - daemon checks max number of open files and complains if not enough. | |
| 5250 | - test where data expires in the cache. | |
| 5251 | - compiletests: fixed empty body ifstatements in alloc.c, in case | |
| 5252 | locks are disabled. | |
| 5253 | ||
| 5254 | 8 May 2007: Wouter | |
| 5255 | - outgoing network keeps list of available tcp buffers for outgoing | |
| 5256 | tcp queries. | |
| 5257 | - outgoing-num-tcp config option. | |
| 5258 | - outgoing network keeps waiting list of queries waiting for buffer. | |
| 5259 | - netevent supports outgoing tcp commpoints, nonblocking connects. | |
| 5260 | ||
| 5261 | 7 May 2007: Wouter | |
| 5262 | - EDNS read from query, used to make reply smaller. | |
| 5263 | - advertised edns value constants. | |
| 5264 | - EDNS BADVERS response, if asked for too high edns version. | |
| 5265 | - EDNS extended error reponses once the EDNS record from the query | |
| 5266 | has successfully been parsed. | |
| 5267 | ||
| 5268 | 4 May 2007: Wouter | |
| 5269 | - msgreply sizefunc is more accurate. | |
| 5270 | - config settings for rrset cache size and slabs. | |
| 5271 | - hashtable insert takes argument so that a thread can use its own | |
| 5272 | alloc cache to store released keys. | |
| 5273 | - alloc cache special_release() locks if necessary. | |
| 5274 | - rrset trustworthiness type added. | |
| 5275 | - thread keeps a scratchpad region for handling messages. | |
| 5276 | - writev used in netevent to write tcp length and data after another. | |
| 5277 | This saves a roundtrip on tcp replies. | |
| 5278 | - test for one rrset updated in the cache. | |
| 5279 | - test for one rrset which is not updated, as it is not deemed | |
| 5280 | trustworthy enough. | |
| 5281 | - test for TTL refreshed in rrset. | |
| 5282 | ||
| 5283 | 3 May 2007: Wouter | |
| 5284 | - fill refs. Use new parse and encode to answer queries. | |
| 5285 | - stores rrsets in cache. | |
| 5286 | - uses new msgreply format in cache. | |
| 5287 | ||
| 5288 | 2 May 2007: Wouter | |
| 5289 | - dname unit tests in own file and spread out neatly in functions. | |
| 5290 | - more dname unit tests. | |
| 5291 | - message encoding creates truncated TC flagged messages if they do | |
| 5292 | not fit, and will leave out (whole)rrsets from additional if needed. | |
| 5293 | ||
| 5294 | 1 May 2007: Wouter | |
| 5295 | - decompress query section, extremely lenient acceptance. | |
| 5296 | But only for answers from other servers, not for plain queries. | |
| 5297 | - compression and decompression test cases. | |
| 5298 | - some stats added. | |
| 5299 | - example.conf interface: line is changed from 127.0.0.1 which leads | |
| 5300 | to problems if used (restricting communication to the localhost), | |
| 5301 | to a documentation and test address. | |
| 5302 | ||
| 5303 | 27 April 2007: Wouter | |
| 5304 | - removed iov usage, it is not good for dns message encoding. | |
| 5305 | - owner name compression more optimal. | |
| 5306 | - rrsig owner name compression. | |
| 5307 | - rdata domain name compression. | |
| 5308 | ||
| 5309 | 26 April 2007: Wouter | |
| 5310 | - floating point exception fix in lock-verify. | |
| 5311 | - lint uses make dependency | |
| 5312 | - fixup lint in dname owner domain name compression code. | |
| 5313 | - define for offset range that can be compressed to. | |
| 5314 | ||
| 5315 | 25 April 2007: Wouter | |
| 5316 | - prettier code; parse_rrset->type kept in host byte order. | |
| 5317 | - datatype used for hashvalue of converted rrsig structure. | |
| 5318 | - unit test compares edns section data too. | |
| 5319 | ||
| 5320 | 24 April 2007: Wouter | |
| 5321 | - ttl per RR, for RRSIG rrsets and others. | |
| 5322 | - dname_print debug function. | |
| 5323 | - if type is not known, size calc will skip DNAME decompression. | |
| 5324 | - RRSIG parsing and storing and putting in messages. | |
| 5325 | - dnssec enabled unit tests (from nlnetlabs.nl and se queries). | |
| 5326 | - EDNS extraction routine. | |
| 5327 | ||
| 5328 | 20 April 2007: Wouter | |
| 5329 | - code comes through all of the unit tests now. | |
| 5330 | - disabled warning about spurious extra data. | |
| 5331 | - documented the RRSIG parse plan in msgparse.h. | |
| 5332 | - rrsig reading and outputting. | |
| 5333 | ||
| 5334 | 19 April 2007: Wouter | |
| 5335 | - fix unit test to actually to tests. | |
| 5336 | - fix write iov helper, and fakevent code. | |
| 5337 | - extra builtin testcase (small packet). | |
| 5338 | - ttl converted to network format in packets. | |
| 5339 | - flags converted correctly | |
| 5340 | - rdatalen off by 2 error fixup. | |
| 5341 | - uses less iov space for header. | |
| 5342 | ||
| 5343 | 18 April 2007: Wouter | |
| 5344 | - review of msgparse code. | |
| 5345 | - smaller test cases. | |
| 5346 | ||
| 5347 | 17 April 2007: Wouter | |
| 5348 | - copy and decompress dnames. | |
| 5349 | - store calculated hash value too. | |
| 5350 | - routine to create message out of stored information. | |
| 5351 | - util/data/msgparse.c for message parsing code. | |
| 5352 | - unit test, and first fixes because of test. | |
| 5353 | * forgot rrset_count addition. | |
| 5354 | * did & of ptr on stack for memory position calculation. | |
| 5355 | * dname_pkt_copy forgot to read next label length. | |
| 5356 | - test from file and fixes | |
| 5357 | * double frees fixed in error conditions. | |
| 5358 | * types with less than full rdata allowed by parser. | |
| 5359 | Some dynamic update packets seem to use it. | |
| 5360 | ||
| 5361 | 16 April 2007: Wouter | |
| 5362 | - following a small change in LDNS, parsing code calculates the | |
| 5363 | memory size to allocate for rrs. | |
| 5364 | - code to handle ID creation. | |
| 5365 | ||
| 5366 | 13 April 2007: Wouter | |
| 5367 | - parse routines. Code that parses rrsets, rrs. | |
| 5368 | ||
| 5369 | 12 April 2007: Wouter | |
| 5370 | - dname compare routine that preserves case, with unit tests. | |
| 5371 | ||
| 5372 | 11 April 2007: Wouter | |
| 5373 | - parse work - dname packet parse, msgparse, querysection parse, | |
| 5374 | start of sectionparse. | |
| 5375 | ||
| 5376 | 10 April 2007: Wouter | |
| 5377 | - Improved alignment of reply_info packet, nice for 32 and 64 bit. | |
| 5378 | - Put RRset counts in reply_info, because the number of RRs can change | |
| 5379 | due to RRset updates. | |
| 5380 | - import of region-allocator code from nsd. | |
| 5381 | - set alloc special type to ub_packed_rrset_key. | |
| 5382 | Uses lruhash entry overflow chain next pointer in alloc cache. | |
| 5383 | - doxygen documentation for region-allocator. | |
| 5384 | - setup for parse scratch data. | |
| 5385 | ||
| 5386 | 5 April 2007: Wouter | |
| 5387 | - discussed packed rrset with Jelte. | |
| 5388 | ||
| 5389 | 4 April 2007: Wouter | |
| 5390 | - moved to version 0.3. | |
| 5391 | - added util/data/dname.c | |
| 5392 | - layout of memory for rrsets. | |
| 5393 | ||
| 5394 | 3 April 2007: Wouter | |
| 5395 | - detect sign of msghdr.msg_iovlen so that the cast to that type | |
| 5396 | in netevent (which is there to please lint) can be correct. | |
| 5397 | The type on several OSes ranges from int, int32, uint32, size_t. | |
| 5398 | Detects unsigned or signed using math trick. | |
| 5399 | - constants for DNS flags. | |
| 5400 | - compilation without locks fixup. | |
| 5401 | - removed include of unportable header from lookup3.c. | |
| 5402 | - more portable use of struct msghdr. | |
| 5403 | - casts for printf warning portability. | |
| 5404 | - tweaks to tests to port them to the testbed. | |
| 5405 | - 0.2 tag created. | |
| 5406 | ||
| 5407 | 2 April 2007: Wouter | |
| 5408 | - check sizes of udp received messages, not too short. | |
| 5409 | - review changes. Some memmoves can be memcpys: 4byte aligned. | |
| 5410 | set id correctly on cached answers. | |
| 5411 | - review changes msgreply.c, memleak on error condition. AA flag | |
| 5412 | clear on cached reply. Lowercase queries on hashing. | |
| 5413 | unit test on lowercasing. Test AA bit not set on cached reply. | |
| 5414 | Note that no TTLs are managed. | |
| 5415 | ||
| 5416 | 29 March 2007: Wouter | |
| 5417 | - writev or sendmsg used when answering from cache. | |
| 5418 | This avoids a copy of the data. | |
| 5419 | - do not do useless byteswap on query id. Store reply flags in uint16 | |
| 5420 | for easier access (and no repeated byteswapping). | |
| 5421 | - reviewed code. | |
| 5422 | - configure detects and config.h includes sys/uio.h for writev decl. | |
| 5423 | ||
| 5424 | 28 March 2007: Wouter | |
| 5425 | - new config option: num-queries-per-thread. | |
| 5426 | - added tpkg test for answering three queries at the same time | |
| 5427 | using one thread (from the query service list). | |
| 5428 | ||
| 5429 | 27 March 2007: Wouter | |
| 5430 | - added test for cache and not cached answers, in testbound replays. | |
| 5431 | - testbound can give config file and commandline options from the | |
| 5432 | replay file to unbound. | |
| 5433 | - created test that checks if items drop out of the cache. | |
| 5434 | - added word 'partitioned hash table' to documentation on slab hash. | |
| 5435 | A slab hash is a partitioned hash table. | |
| 5436 | - worker can handle multiple queries at a time. | |
| 5437 | ||
| 5438 | 26 March 2007: Wouter | |
| 5439 | - config settings for slab hash message cache. | |
| 5440 | - test for cached answer. | |
| 5441 | - Fixup deleting fake answer from testbound list. | |
| 5442 | ||
| 5443 | 23 March 2007: Wouter | |
| 5444 | - review of yesterday's commits. | |
| 5445 | - covered up memory leak of the entry locks. | |
| 5446 | - answers from the cache correctly. Copies flags correctly. | |
| 5447 | - sanity check for incoming query replies. | |
| 5448 | - slabbed hash table. Much nicer contention, need dual cpu to see. | |
| 5449 | ||
| 5450 | 22 March 2007: Wouter | |
| 5451 | - AIX configure check. | |
| 5452 | - lock-verify can handle references to locks that are created | |
| 5453 | in files it has not yet read in. | |
| 5454 | - threaded hash table test. | |
| 5455 | - unit test runs lock-verify afterwards and checks result. | |
| 5456 | - need writelock to update data on hash_insert. | |
| 5457 | - message cache code, msgreply code. | |
| 5458 | ||
| 5459 | 21 March 2007: Wouter | |
| 5460 | - unit test of hash table, fixup locking problem in table_grow(). | |
| 5461 | - fixup accounting of sizes for removing items from hashtable. | |
| 5462 | - unit test for hash table, single threaded test of integrity. | |
| 5463 | - lock-verify reports errors nicely. More quiet in operation. | |
| 5464 | ||
| 5465 | 16 March 2007: Wouter | |
| 5466 | - lock-verifier, checks consistent order of locking. | |
| 5467 | ||
| 5468 | 14 March 2007: Wouter | |
| 5469 | - hash table insert (and subroutines) and lookup implemented. | |
| 5470 | - hash table remove. | |
| 5471 | - unit tests for hash internal bin, lru functions. | |
| 5472 | ||
| 5473 | 13 March 2007: Wouter | |
| 5474 | - lock_unprotect in checklocks. | |
| 5475 | - util/storage/lruhash.h for LRU hash table structure. | |
| 5476 | ||
| 5477 | 12 March 2007: Wouter | |
| 5478 | - configure.ac moved to 0.2. | |
| 5479 | - query_info and replymsg util/data structure. | |
| 5480 | ||
| 5481 | 9 March 2007: Wouter | |
| 5482 | - added rwlock writelock checking. | |
| 5483 | So it will keep track of the writelock, and readlocks are enforced | |
| 5484 | to not change protected memory areas. | |
| 5485 | - log_hex function to dump hex strings to the logfile. | |
| 5486 | - checklocks zeroes its destroyed lock after checking memory areas. | |
| 5487 | - unit test for alloc. | |
| 5488 | - identifier for union in checklocks to please older compilers. | |
| 5489 | - created 0.1 tag. | |
| 5490 | ||
| 5491 | 8 March 2007: Wouter | |
| 5492 | - Reviewed checklock code. | |
| 5493 | ||
| 5494 | 7 March 2007: Wouter | |
| 5495 | - created a wrapper around thread calls that performs some basic | |
| 5496 | checking for data race and deadlock, and basic performance | |
| 5497 | contention measurement. | |
| 5498 | ||
| 5499 | 6 March 2007: Wouter | |
| 5500 | - Testbed works with threading (different machines, different options). | |
| 5501 | - alloc work, does the special type. | |
| 5502 | ||
| 5503 | 2 March 2007: Wouter | |
| 5504 | - do not compile fork funcs unless needed. Otherwise will give | |
| 5505 | type errors as their typedefs have not been enabled. | |
| 5506 | - log shows thread numbers much more nicely (and portably). | |
| 5507 | - even on systems with nonthreadsafe libevent signal handling, | |
| 5508 | unbound will exit if given a signal. | |
| 5509 | Reloads will not work, and exit is not graceful. | |
| 5510 | - start of alloc framework layout. | |
| 5511 | ||
| 5512 | 1 March 2007: Wouter | |
| 5513 | - Signals, libevent and threads work well, with libevent patch and | |
| 5514 | changes to code (close after event_del). | |
| 5515 | - set ipc pipes nonblocking. | |
| 5516 | ||
| 5517 | 27 February 2007: Wouter | |
| 5518 | - ub_thread_join portable definition. | |
| 5519 | - forking is used if no threading is available. | |
| 5520 | Tested, it works, since pipes work across processes as well. | |
| 5521 | Thread_join is replaced with waitpid. | |
| 5522 | - During reloads the daemon will temporarily handle signals, | |
| 5523 | so that they do not result in problems. | |
| 5524 | - Also randomize the outgoing port range for tests. | |
| 5525 | - If query list is full, will stop selecting listening ports for read. | |
| 5526 | This makes all threads service incoming requests, instead of one. | |
| 5527 | No memory is leaking during reloads, service of queries, etc. | |
| 5528 | - test that uses ldns-testns -f to test threading. Have to answer | |
| 5529 | three queries at the same time. | |
| 5530 | - with verbose=0 operates quietly. | |
| 5531 | ||
| 5532 | 26 February 2007: Wouter | |
| 5533 | - ub_random code used to select ID and port. | |
| 5534 | - log code prints thread id. | |
| 5535 | - unbound can thread itself, with reload(HUP) and quit working | |
| 5536 | correctly. | |
| 5537 | - don't open pipes for #0, doesn't need it. | |
| 5538 | - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload). | |
| 5539 | ||
| 5540 | 23 February 2007: Wouter | |
| 5541 | - Can do reloads on sigHUP. Everything is stopped, and freed, | |
| 5542 | except the listening ports. Then the config file is reread. | |
| 5543 | And everything is started again (and listening ports if needed). | |
| 5544 | - Ports for queries are shared. | |
| 5545 | - config file added interface:, chroot: and username:. | |
| 5546 | - config file: directory, logfile, pidfile. And they work too. | |
| 5547 | - will daemonize by default now. Use -d to stay in the foreground. | |
| 5548 | - got BSD random[256 state] code, made it threadsafe. util/random. | |
| 5549 | ||
| 5550 | 22 February 2007: Wouter | |
| 5551 | - Have a config file. Removed commandline options, moved to config. | |
| 5552 | - tests use config file. | |
| 5553 | ||
| 5554 | 21 February 2007: Wouter | |
| 5555 | - put -c option in man page. | |
| 5556 | - minievent fd array capped by FD_SETSIZE. | |
| 5557 | ||
| 5558 | 20 February 2007: Wouter | |
| 5559 | - Added locks code and pthread spinlock detection. | |
| 5560 | - can use no locks, or solaris native thread library. | |
| 5561 | - added yacc and lex configure, and config file parsing code. | |
| 5562 | also makedist.sh, and manpage. | |
| 5563 | - put include errno.h in config.h | |
| 5564 | ||
| 5565 | 19 February 2007: Wouter | |
| 5566 | - Created 0.0 svn tag. | |
| 5567 | - added acx_pthread.m4 autoconf check for pthreads from | |
| 5568 | the autoconf archive. It is GPL-with-autoconf-exception Licensed. | |
| 5569 | You can specify --with-pthreads, or --without-pthreads to configure. | |
| 5570 | ||
| 5571 | 16 February 2007: Wouter | |
| 5572 | - Updated testbed script, works better by using make on remote end. | |
| 5573 | - removed check decls, we can compile without them. | |
| 5574 | - makefile supports LIBOBJ replacements. | |
| 5575 | - docs checks ignore compat code. | |
| 5576 | - added util/mini-event.c and .h, a select based alternative used with | |
| 5577 | ./configure --with-libevent=no | |
| 5578 | It is limited to 1024 file descriptors, and has less features. | |
| 5579 | - will not create ip6 sockets if ip6 not on the machine. | |
| 5580 | ||
| 5581 | 15 February 2007: Wouter | |
| 5582 | - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64, | |
| 5583 | Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc. | |
| 5584 | - malloc rndstate, so that it is aligned for access. | |
| 5585 | - fixed rbtree cleanup with postorder traverse. | |
| 5586 | - fixed pending messages are deleted when handled. | |
| 5587 | - You can control verbosity; default is not verbose, every -v | |
| 5588 | adds more verbosity. | |
| 5589 | ||
| 5590 | 14 February 2007: Wouter | |
| 5591 | - Included configure.ac changes from ldns. | |
| 5592 | - detect (some) headers before the standards check. | |
| 5593 | - do not use isblank to test c99, since its not available on solaris9. | |
| 5594 | - review of testcode. | |
| 5595 | * entries in a RANGE are no longer reversed. | |
| 5596 | * print name of file with replay entry parse errors. | |
| 5597 | - port to OSX: cast to int for some prints of sizet. | |
| 5598 | - Makefile copies ldnstestpkts.c before doing dependencies on it. | |
| 5599 | ||
| 5600 | 13 February 2007: Wouter | |
| 5601 | - work on fake events, first fwd replay works. | |
| 5602 | - events can do timeouts and errors on queries to servers. | |
| 5603 | - test package that runs replay scenarios. | |
| 5604 | ||
| 5605 | 12 February 2007: Wouter | |
| 5606 | - work on fake events. | |
| 5607 | ||
| 5608 | 9 February 2007: Wouter | |
| 5609 | - replay file reading. | |
| 5610 | - fake event setup, it creates fake structures, and teardowns, | |
| 5611 | added signal callbacks to reply to be able to fake those, | |
| 5612 | and main structure of event replay routines. | |
| 5613 | ||
| 5614 | 8 February 2007: Wouter | |
| 5615 | - added tcp test. | |
| 5616 | - replay storage. | |
| 5617 | - testcode/fake_event work. | |
| 5618 | ||
| 5619 | 7 February 2007: Wouter | |
| 5620 | - return answer with the same ID as query was sent with. | |
| 5621 | - created udp forwarder test. I've done some effort to make it perform | |
| 5622 | quickly. After servers are created, no big sleep statements but | |
| 5623 | it checks the logfiles to see if servers have come up. Takes 0.14s. | |
| 5624 | - set addrlen value when calling recvfrom. | |
| 5625 | - comparison of addrs more portable. | |
| 5626 | - LIBEVENT option for testbed to set libevent directory. | |
| 5627 | - work on tcp input. | |
| 5628 | ||
| 5629 | 6 February 2007: Wouter | |
| 5630 | - reviewed code and improved in places. | |
| 5631 | ||
| 5632 | 5 February 2007: Wouter | |
| 5633 | - Picked up stdc99 and other define tests from ldns. Improved | |
| 5634 | POSIX define test to include getaddrinfo. | |
| 5635 | - defined constants for netevent callback error code. | |
| 5636 | - unit test for strisip6. | |
| 5637 | ||
| 5638 | 2 February 2007: Wouter | |
| 5639 | - Created udp4 and udp6 port arrays to provide service for both | |
| 5640 | address families. | |
| 5641 | - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets. | |
| 5642 | - listens on both ip4 and ip6 ports to provide correct return address. | |
| 5643 | - worker fwder address filled correctly. | |
| 5644 | - fixup timer code. | |
| 5645 | - forwards udp queries and sends answer. | |
| 5646 | ||
| 5647 | 1 February 2007: Wouter | |
| 5648 | - outside network more UDP work. | |
| 5649 | - moved * closer to type. | |
| 5650 | - comm_timer object and events. | |
| 5651 | ||
| 5652 | 31 January 2007: Wouter | |
| 5653 | - Added makedist.sh script to make release tarball. | |
| 5654 | - Removed listen callback layer, did not add anything. | |
| 5655 | - Added UDP recv to netevent, worker callback for udp. | |
| 5656 | - netevent communication reply storage structure. | |
| 5657 | - minimal query header sanity checking for worker. | |
| 5658 | - copied over rbtree implementation from NSD (BSD licensed too). | |
| 5659 | - outgoing network query service work. | |
| 5660 | ||
| 5661 | 30 January 2007: Wouter | |
| 5662 | - links in example/ldns-testpkts.c and .h for premade packet support. | |
| 5663 | - added callback argument to listen_dnsport and daemon/worker. | |
| 5664 | ||
| 5665 | 29 January 2007: Wouter | |
| 5666 | - unbound.8 a short manpage. | |
| 5667 | ||
| 5668 | 26 January 2007: Wouter | |
| 5669 | - fixed memleak. | |
| 5670 | - make lint works on BSD and Linux (openssl defines). | |
| 5671 | - make tags works. | |
| 5672 | - testbound program start. | |
| 5673 | ||
| 5674 | 25 January 2007: Wouter | |
| 5675 | - fixed lint so it may work on BSD. | |
| 5676 | - put license into header of every file. | |
| 5677 | - created verbosity flag. | |
| 5678 | - fixed libevent configure flag. | |
| 5679 | - detects event_base_free() in new libevent 1.2 version. | |
| 5680 | - getopt in daemon. fatal_exit() and verbose() logging funcs. | |
| 5681 | - created log_assert, that throws assertions to the logfile. | |
| 5682 | - listen_dnsport service. Binds ports. | |
| 5683 | ||
| 5684 | 24 January 2007: Wouter | |
| 5685 | - cleaned up configure.ac. | |
| 5686 | ||
| 5687 | 23 January 2007: Wouter | |
| 5688 | - added libevent to configure to link with. | |
| 5689 | - util/netevent setup work. | |
| 5690 | - configure searches for libevent. | |
| 5691 | - search for libs at end of configure (when other headers and types | |
| 5692 | have been found). | |
| 5693 | - doxygen works with ATTR_UNUSED(). | |
| 5694 | - util/netevent implementation. | |
| 5695 | ||
| 5696 | 22 January 2007: Wouter | |
| 5697 | - Designed header file for network communication. | |
| 5698 | ||
| 5699 | 16 January 2007: Wouter | |
| 5700 | - added readme.svn and readme.tests. | |
| 5701 | ||
| 5702 | 4 January 2007: Wouter | |
| 5703 | - Testbed script (run on multiple platforms the test set). | |
| 5704 | Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5. | |
| 5705 | - added unit test tpkg. | |
| 5706 | ||
| 5707 | 3 January 2007: Wouter | |
| 5708 | - committed first set of files into subversion repository. | |
| 5709 | svn co svn+ssh://unbound.net/svn/unbound | |
| 5710 | You need a ssh login. There is no https access yet. | |
| 5711 | - Added LICENSE, the BSD license. | |
| 5712 | - Added doc/README with compile help. | |
| 5713 | - main program stub and quiet makefile. | |
| 5714 | - minimal logging service (to stderr). | |
| 5715 | - added postcommit hook that serves emails. | |
| 5716 | - added first test 00-lint. postcommit also checks if build succeeds. | |
| 5717 | - 01-doc: doxygen doc target added for html docs. And stringent test | |
| 5718 | on documented files, functions and parameters. | |
| 5719 | ||
| 5720 | 15 December 2006: Wouter | |
| 5721 | - Created Makefile.in and configure.ac. |