123 March 2015: Wouter 2 - Fix segfault on user not found at startup (from Maciej Soltysiak). 3 42 March 2015: Wouter 5 - iana portlist update. 6 720 February 2015: Wouter 8 - Use the getrandom syscall introduced in Linux 3.17 (from Heiner 9 Kallweit). 10 - Fix #645 Portability to Solaris 10, use AF_LOCAL. 11 - Fix #646 Portability to Solaris, -lrt for getentropy_solaris. 12 - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after 13 reload. 14 1519 February 2015: Wouter 16 - 1.5.2 release tag. 17 - svn trunk contains 1.5.3 under development. 18 1913 February 2015: Wouter 20 - Fix #643: doc/example.conf.in: unnecessary whitespace. 21 2212 February 2015: Wouter 23 - tag 1.5.2rc1 24 2511 February 2015: Wouter 26 - iana portlist update. 27 2810 February 2015: Wouter 29 - Fix scrubber with harden-glue turned off to reject NS (and other 30 not-address) records. 31 329 February 2015: Wouter 33 - Fix validation failure in case upstream forwarder (ISC BIND) does 34 not have the same trust anchors and decides to insert unsigned NS 35 record in authority section. 36 372 February 2015: Wouter 38 - infra-cache-min-rtt patch from Florian Riehm, for expected long 39 uplink roundtrip times. 40 4130 January 2015: Wouter 42 - Fix 0x20 capsforid fallback to omit gratuitous NS and additional 43 section changes. 44 - Portability fix for Solaris ('sun' is not usable for a variable). 45 4629 January 2015: Wouter 47 - Fix pyunbound byte string representation for python3. 48 4926 January 2015: Wouter 50 - Fix unintended use of gcc extension for incomplete enum types, 51 compile with pedantic c99 compliance (from Daniel Dickman). 52 5323 January 2015: Wouter 54 - windows port fixes, no AF_LOCAL, no chown, no chmod(grp). 55 5616 January 2015: Wouter 57 - unit test for local unix connection. Documentation and log_addr 58 does not inspect port for AF_LOCAL. 59 - unbound-checkconf -f prints chroot with pidfile path. 60 6113 January 2015: Wouter 62 - iana portlist update. 63 6412 January 2015: Wouter 65 - Cast sun_len sizeof to socklen_t. 66 - Fix pyunbound ord call, portable for python 2 and 3. 67 687 January 2015: Wouter 69 - Fix warnings in pythonmod changes. 70 716 January 2015: Wouter 72 - iana portlist update. 73 - patch for remote control over local sockets, from Dag-Erling 74 Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and 75 control-use-cert: no. 76 - Fixup that patch and uid lookup (only for daemon). 77 - coded the default of control-use-cert, to yes. 78 795 January 2015: Wouter 80 - getauxval test for ppc64 linux compatibility. 81 - make strip works for unbound-host and unbound-anchor. 82 - patch from Stephane Lapie that adds to the python API, that 83 exposes struct delegpt, and adds the find_delegation function. 84 - print query name when max target count is exceeded. 85 - patch from Stuart Henderson that fixes DESTDIR in 86 unbound-control-setup for installs where config is not in 87 the prefix location. 88 - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing 89 IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne). 90 - Updated contrib warmup.cmd/sh to support two modes - load 91 from pre-defined list of domains or (with filename as argument) 92 load from user-specified list of domains, and updated contrib 93 unbound_cache.sh/cmd to support loading/save/reload cache to/from 94 default path or (with secondary argument) arbitrary path/filename, 95 from Yuri Voinov. 96 - Patch from Philip Paeps to contrib/unbound_munin_ that uses 97 type ABSOLUTE. Allows munin.conf: [idleserver.example.net] 98 unbound_munin_hits.graph_period minute 99 1009 December 2014: Wouter 101 - svn trunk has 1.5.2 in development. 102 - config.guess and config.sub update from libtoolize. 103 - local-zone: example.com inform makes unbound log a message with 104 client IP for queries in that zone. Eg. for finding infected hosts. 105 1068 December 2014: Wouter 107 - Fix CVE-2014-8602: denial of service by making resolver chase 108 endless series of delegations. 109 1101 December 2014: Wouter 111 - Fix bug#632: unbound fails to build on AArch64, protects 112 getentropy compat code from calling sysctl if it is has been removed. 113 11429 November 2014: Wouter 115 - Add include to getentropy_linux.c, hopefully fixing debian build. 116 11728 November 2014: Wouter 118 - Fix makefile for build from noexec source tree. 119 12026 November 2014: Wouter 121 - Fix libunbound undefined symbol errors for main. 122 Referencing main does not seem to be possible for libunbound. 123 12424 November 2014: Wouter 125 - Fix log at high verbosity and memory allocation failure. 126 - iana portlist update. 127 12821 November 2014: Wouter 129 - Fix crash on multiple thread random usage on systems without 130 arc4random. 131 13220 November 2014: Wouter 133 - fix compat/getentropy_win.c check if CryptGenRandom works and no 134 immediate exit on windows. 135 13619 November 2014: Wouter 137 - Fix cdflag dns64 processing. 138 13918 November 2014: Wouter 140 - Fix that CD flag disables DNS64 processing, returning the DNSSEC 141 signed AAAA denial. 142 - iana portlist update. 143 14417 November 2014: Wouter 145 - Fix #627: SSL_CTX_load_verify_locations return code not properly 146 checked. 147 14814 November 2014: Wouter 149 - parser with bison 2.7 150 15113 November 2014: Wouter 152 - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, 153 added to contrib/aaaa-filter-iterator.patch. 154 15512 November 2014: Wouter 156 - trunk has 1.5.1 in development. 157 - Patch from Robert Edmonds to build pyunbound python module 158 differently. No versioninfo, with -shared and without $(LIBS). 159 - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page. 160 - Removed 'increased limit open files' log message that is written 161 to console. It is only written on verbosity 4 and higher. 162 This keeps system bootup console cleaner. 163 - Patch from James Raftery, always print stats for rcodes 0..5. 164 16511 November 2014: Wouter 166 - iana portlist update. 167 - Fix bug where forward or stub addresses with same address but 168 different port number were not tried. 169 - version number in svn trunk is 1.5.0 170 - tag 1.5.0rc1 171 - review fix from Ralph. 172 1737 November 2014: Wouter 174 - dnstap fixes by Robert Edmonds: 175 dnstap/dnstap.m4: cosmetic fixes 176 dnstap/: Remove compiled protoc-c output files 177 dnstap/dnstap.m4: Error out if required libraries are not found 178 dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of 179 protobuf-c 1.0.0 180 dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0) 181 1824 November 2014: Wouter 183 - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically 184 tracked trust anchor to libunbound. 185 - Redefine internal minievent symbols to unique symbols that helps 186 linking on platforms where the linker leaks names across modules. 187 18827 October 2014: Wouter 189 - Disabled use of SSLv3 in remote-control and ssl-upstream. 190 - iana portlist update. 191 19216 October 2014: Wouter 193 - Documented dns64 configuration in unbound.conf man page. 194 19513 October 2014: Wouter 196 - Fix #617: in ldns in unbound, lowercase WKS services. 197 - Fix ctype invocation casts. 198 19910 October 2014: Wouter 200 - Fix unbound-checkconf check for module config with dns64 module. 201 - Fix unbound capsforid fallback, it ignores TTLs in comparison. 202 2036 October 2014: Wouter 204 - Fix #614: man page variable substitution bug. 2056 October 2014: Willem 206 - Whitespaces after $ORIGIN are not part of the origin dname (ldns). 207 - $TTL's value starts at position 5 (ldns). 208 2091 October 2014: Wouter 210 - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire). 211 21229 September 2014: Wouter 213 - Fix #612: create service with service.conf in present directory and 214 auto load it. 215 - Fix for mingw compile openssl ranlib. 216 21725 September 2014: Wouter 218 - updated configure and aclocal with newer autoconf 1.13. 219 22022 September 2014: Wouter 221 - Fix swig and python examples for Python 3.x. 222 - Fix for mingw compile with openssl-1.0.1i. 223 22419 September 2014: Wouter 225 - improve python configuration detection to build on Fedora 22. 226 22718 September 2014: Wouter 228 - patches to also build with Python 3.x (from Pavel Simerda). 229 23016 September 2014: Wouter 231 - Fix tcp timer waiting list removal code. 232 - iana portlist update. 233 - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue 234 is longer and more tcp connections can be handled. 235 23615 September 2014: Wouter 237 - Fix unit test for CDS typecode. 238 2395 September 2014: Wouter 240 - type CDS and CDNSKEY types in sldns. 241 24225 August 2014: Wouter 243 - Fixup checklock code for log lock and its mutual initialization 244 dependency. 245 - iana portlist update. 246 - Removed necessity for pkg-config from the dnstap.m4, new are 247 the --with-libfstrm and --with-protobuf-c configure options. 248 24919 August 2014: Wouter 250 - Update unbound manpage with more explanation (from Florian Obser). 251 25218 August 2014: Wouter 253 - Fix #603: unbound-checkconf -o <option> should skip verification 254 checks. 255 - iana portlist update. 256 - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings. 257 2585 August 2014: Wouter 259 - dnstap support, with a patch from Farsight Security, written by 260 Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c. 261 It is BSD licensed (see dnstap/dnstap.c). 262 Building with --enable-dnstap needs pkg-config with this patch. 263 - Noted dnstap in doc/README and doc/CREDITS. 264 - Changes to the dnstap patch. 265 - lint fixes. 266 - dnstap/dnstap_config.h should not have been added to the repo, 267 because is it generated. 268 2691 August 2014: Wouter 270 - Patch add msg, rrset, infra and key cache sizes to stats command 271 from Maciej Soltysiak. 272 - iana portlist update. 273 27431 July 2014: Wouter 275 - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault. 276 Initial commit of the patch from the FreeBSD base (with its fixes). 277 This adds a module (for module-config in unbound.conf) dns64 that 278 performs DNS64 processing, see README.DNS64. 279 - Changes from DNS64: 280 strcpy changed to memmove. 281 arraybound check fixed from prefix_net/8/4 to prefix_net/8+4. 282 allocation of result consistently in the correct region. 283 time_t is now used for ttl in unbound (since the patch's version). 284 - testdata/dns64_lookup.rpl for unit test for dns64 functionality. 285 28629 July 2014: Wouter 287 - Patch from Dag-Erling Smorgrav that implements feature, unbound -dd 288 does not fork in the background and also logs to stderr. 289 29021 July 2014: Wouter 291 - Fix endian.h include for OpenBSD. 292 29316 July 2014: Wouter 294 - And Fix#596: Bail out of unbound-control dump_infra when ssl 295 write fails. 296 29715 July 2014: Wouter 298 - Fix #596: Bail out of unbound-control list_local_zones when ssl 299 write fails. 300 - iana portlist update. 301 30213 July 2014: Wouter 303 - Configure tests if main can be linked to from getentropy compat. 304 30512 July 2014: Wouter 306 - Fix getentropy compat code, function refs were not portable. 307 - Fix to check openssl version number only for OpenSSL. 308 - LibreSSL provides compat items, check for that in configure. 309 - Fix bug in fix for log locks that caused deadlock in signal handler. 310 - update compat/getentropy and arc4random to the most recent ones from OpenBSD. 311 31211 July 2014: Matthijs 313 - fake-rfc2553 patch (thanks Benjamin Baier). 314 31511 July 2014: Wouter 316 - arc4random in compat/ and getentropy, explicit_bzero, chacha for 317 dependencies, from OpenBSD. arc4_lock and sha512 in compat. 318 This makes arc4random available on all platforms, except when 319 compiled with LIBNSS (it uses libNSS crypto random). 320 - fix strptime implicit declaration error on OpenBSD. 321 - arc4random, getentropy and explicit_bzero compat for Windows. 322 3234 July 2014: Wouter 324 - Fix #593: segfault or crash upon rotating logfile. 325 3263 July 2014: Wouter 327 - DLV tests added. 328 - signit tool fixup for compile with libldns library. 329 - iana portlist updated. 330 33127 June 2014: Wouter 332 - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X. 333 33426 June 2014: Wouter 335 - unbound-control status reports if so-reuseport was successful. 336 - iana portlist updated. 337 33824 June 2014: Wouter 339 - Fix caps-for-id fallback, and added fallback attempt when servers 340 drop 0x20 perturbed queries. 341 - Fixup testsetup for VM tests (run testcode/run_vm.sh). 342 34317 June 2014: Wouter 344 - iana portlist updated. 345 3463 June 2014: Wouter 347 - Add AAAA for B root server to default root hints. 348 3492 June 2014: Wouter 350 - Remove unused define from iterator.h 351 35230 May 2014: Wouter 353 - Fixup sldns_enum_edns_option typedef definition. 354 35528 May 2014: Wouter 356 - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue 357 fixes from FreeBSD's copy of Unbound, he notes: 358 Generate unbound-control-setup.sh at build time so it respects 359 prefix and sysconfdir from the configure script. Also fix the 360 umask to match the comment, and the comment to match the umask. 361 Add const and static where needed. Use unions instead of 362 playing pointer poker. Move declarations that are needed in 363 multiple source files into a shared header. Move sldns_bgetc() 364 from parse.c to buffer.c where it belongs. Introduce a new 365 header file, worker.h, which declares the callbacks that 366 all workers must define. Remove those declarations from 367 libworker.h. Include the correct headers in the correct places. 368 Fix a few dummy callbacks that don't match their prototype. 369 Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. 370 Remove a useless printf which breaks reproducible builds. 371 Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're 372 no longer used. Add unbound-control-setup.sh to the list of 373 generated files. The prototype for libworker_event_done_cb() 374 needs to be moved from libunbound/libworker.h to 375 libunbound/worker.h. 376 - Fixup out-of-directory compile with unbound-control-setup.sh.in. 377 - make depend. 378 37923 May 2014: Wouter 380 - unbound-host -D enabled dnssec and reads root trust anchor from 381 the default root key file that was compiled in. 382 38320 May 2014: Wouter 384 - Feature, unblock-lan-zones: yesno that you can use to make unbound 385 perform 10.0.0.0/8 and other reverse lookups normally, for use if 386 unbound is running service for localhost on localhost. 387 38816 May 2014: Wouter 389 - Updated create_unbound_ad_servers and unbound_cache scripts from 390 Yuri Voinov in the source/contrib directory. Added 391 warmup.cmd (and .sh): warm up the DNS cache with your MRU domains. 392 3939 May 2014: Wouter 394 - Implement draft-ietf-dnsop-rfc6598-rfc6303-01. 395 - iana portlist updated. 396 3978 May 2014: Wouter 398 - Contrib windows scripts from Yuri Voinov added to src/contrib: 399 create_unbound_ad_servers.cmd: enters anti-ad server lists. 400 unbound_cache.cmd: saves and loads the cache. 401 - Added unbound-control-setup.cmd from Yuri Voinov to the windows 402 unbound distribution set. It requires openssl installed in %PATH%. 403 4046 May 2014: Wouter 405 - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier. 406 4075 May 2014: Wouter 408 - More #567: remove : from output of stub and forward lists, this is 409 easier to parse. 410 41129 April 2014: Wouter 412 - iana portlist updated. 413 - Add unbound-control flush_negative that flushed nxdomains, nodata, 414 and errors from the cache. For dnssec-trigger and NetworkManager, 415 fixes cases where network changes have localdata that was already 416 negatively cached from the previous network. 417 41823 April 2014: Wouter 419 - Patch from Jeremie Courreges-Anglas to use arc4random_uniform 420 if available on the OS, it gets entropy from the OS. 421 42215 April 2014: Wouter 423 - Fix compile with libevent2 on FreeBSD. 424 42511 April 2014: Wouter 426 - Fix #502: explain that do-ip6 disable does not stop AAAA lookups, 427 but it stops the use of the ipv6 transport layer for DNS traffic. 428 - iana portlist updated. 429 43010 April 2014: Wouter 431 - iana portlist updated. 432 - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation 433 option for DNS fragmentation defense. 434 - Document that dump_requestlist only prints queries from thread 0. 435 - unbound-control stats prints num.query.tcpout with number of TCP 436 outgoing queries made in the previous statistics interval. 437 - Fix #567: unbound lists if forward zone is secure or insecure with 438 +i annotation in output of list_forwards, also for list_stubs 439 (for NetworkManager integration.) 440 - Fix #554: use unsigned long to print 64bit statistics counters on 441 64bit systems. 442 - Fix #558: failed prefetch lookup does not remove cached response 443 but delays next prefetch (in lieu of caching a SERVFAIL). 444 - Fix #545: improved logging, the ip address of the error is printed 445 on the same log-line as the error. 446 4478 April 2014: Wouter 448 - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control 449 in testbound scripts. 450 - iana portlist updated. 451 4527 April 2014: Wouter 453 - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root 454 hints (patch from Anand Buddhdev). 455 - Fix #572: Fix unit test failure for systems with different 456 /etc/services. 457 45828 March 2014: Wouter 459 - Fix #569: do_tcp is do-tcp in unbound.conf man page. 460 46125 March 2014: Wouter 462 - Patch from Stuart Henderson to build unbound-host man from .1.in. 463 46424 March 2014: Wouter 465 - Fix print filename of encompassing config file on read failure. 466 46712 March 2014: Wouter 468 - tag 1.4.22 469 - trunk has 1.4.23 in development. 470 47110 March 2014: Wouter 472 - Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes 473 because of spelling. Patch from Chris Coates. 474 47527 February 2014: Wouter 476 - tag 1.4.22rc1 477 47821 February 2014: Wouter 479 - iana portlist updated. 480 48120 February 2014: Matthijs 482 - Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is 483 received. This is okay according 4035, but not after revising 484 existence in 4592. NSEC empty non-terminals exist and thus the 485 RCODE should have been NOERROR. If this occurs, and the RRsets 486 are secure, we set the RCODE to NOERROR and the security status 487 of the reponse is also considered secure. 488 48914 February 2014: Wouter 490 - Works on Minix (3.2.1). 491 49211 February 2014: Wouter 493 - Fix parse of #553(NSD) string in sldns, quotes without spaces. 494 4957 February 2014: Wouter 496 - iana portlist updated. 497 - add body to ifstatement if locks disabled. 498 - add TXT string"string" test case to unit test. 499 - Fix #551: License change "Regents" to "Copyright holder", matching 500 the BSD license on opensource.org. 501 5026 February 2014: Wouter 503 - sldns has type HIP. 504 - code documentation on the module interface. 505 5065 February 2014: Wouter 507 - Fix sldns parse tests on osx. 508 5093 February 2014: Wouter 510 - Detect libevent2 install automatically by configure. 511 - Fixup link with lib/event2 subdir. 512 - Fix parse in sldns of quoted parenthesized text strings. 513 51431 January 2014: Wouter 515 - unit test for ldns wire to str and back with zones, root, nlnetlabs 516 and types.sidnlabs. 517 - Fix for hex to string in unknown, atma and nsap. 518 - fixup nss compile (no ldns in it). 519 - fixup warning in unitldns 520 - fixup WKS and rdata type service to print unsigned because strings 521 are not portable; they cannot be read (for sure) on other computers. 522 - fixup type EUI48 and EUI64, type APL and type IPSECKEY in string 523 parse sldns. 524 52530 January 2014: Wouter 526 - delay-close does not act if there are udp-wait queries, so that 527 it does not make a socketdrain DoS easier. 528 52928 January 2014: Wouter 530 - iana portlist updated. 531 - iana portlist test updated so it does not touch the source 532 if there are no changes. 533 - delay-close: msec option that delays closing ports for which 534 the UDP reply has timed out. Keeps the port open, only accepts 535 the correct reply. This correct reply is not used, but the port 536 is open so that no port-denied ICMPs are generated. 537 53827 January 2014: Wouter 539 - reuseport is attempted, then fallback to without on failure. 540 54124 January 2014: Wouter 542 - Change unbound-event.h to use void* buffer, length idiom. 543 - iana portlist updated. 544 - unbound-event.h is installed if you configure --enable-event-api. 545 - speed up unbound (reports say it could be up to 10%), by reducing 546 lock contention on localzones.lock. It is changed to an rwlock. 547 - so-reuseport: yesno option to distribute queries evenly over 548 threads on Linux (Thanks Robert Edmonds). 549 - made lint clean. 550 55121 January 2014: Wouter 552 - Fix #547: no trustanchor written if filesystem full, fclose checked. 553 55417 January 2014: Wouter 555 - Fix isprint() portability in sldns, uses unsigned int. 556 - iana portlist updated. 557 55816 January 2014: Wouter 559 - fix #544: Fixed +i causes segfault when running with module conf 560 "iterator". 561 - Windows port, adjust %lld to %I64d, and warning in win_event.c. 562 56314 January 2014: Wouter 564 - iana portlist updated. 565 5665 Dec 2013: Wouter 567 - Fix bug in cachedump that uses sldns. 568 - update pythonmod for ldns_ to sldns_ name change. 569 5703 Dec 2013: Wouter 571 - Fix sldns to use sldns_ prefix for all ldns_ variables. 572 - Fix windows compile to compile with sldns. 573 57430 Nov 2013: Wouter 575 - Fix sldns to make globals use sldns_ prefix. This fixes 576 linking with libldns that uses global variables ldns_ . 577 57813 Nov 2013: Wouter 579 - Fix bug#537: compile python plugin without ldns library. 580 58112 Nov 2013: Wouter 582 - Fix bug#536: acl_deny_non_local and refuse_non_local added. 583 5845 Nov 2013: Wouter 585 - Patch from Neel Goyal to fix async id assignment if callback 586 is called by libunbound in the mesh attach. 587 - Accept ip-address: as an alternative for interface: for 588 consistency with nsd.conf syntax. 589 5904 Nov 2013: Wouter 591 - Patch from Neel Goyal to fix callback in libunbound. 592 5933 Nov 2013: Wouter 594 - if configured --with-libunbound-only fix make install. 595 59631 Oct 2013: Wouter 597 - Fix #531: Set SO_REUSEADDR so that the wildcard interface and a 598 more specific interface port 53 can be used at the same time, and 599 one of the daemons is unbound. 600 - iana portlist update. 601 - separate ldns into core ldns inside ldns/ subdirectory. No more 602 --with-ldns is needed and unbound does not rely on libldns. 603 - portability fixes for new USE_SLDNS ldns subdir codebase. 604 60522 Oct 2013: Wouter 606 - Patch from Neel Goyal: Add an API call to set an event base on an 607 existing ub_ctx. This basically just destroys the current worker and 608 sets the event base to the current. And fix a deadlock in 609 ub_resolve_event – the cfglock is held when libworker_create is 610 called. This ends up trying to acquire the lock again in 611 context_obtain_alloc in the call chain. 612 - Fix #528: if very high logging (4 or more) segfault on allow_snoop. 613 61426 Sep 2013: Wouter 615 - unbound-event.h is installed if configured --with-libevent. It 616 contains low-level library calls, that use libevent's event_base 617 and an ldns_buffer for the wire return packet to perform async 618 resolution in the client's eventloop. 619 62019 Sep 2013: Wouter 621 - 1.4.21 tag created. 622 - trunk has 1.4.22 number inside it. 623 - iana portlist updated. 624 - acx_nlnetlabs.m4 to 26; improve FLTO help text. 625 62616 Sep 2013: Wouter 627 - Fix#524: max-udp-size not effective to non-EDNS0 queries, from 628 Daisuke HIGASHI. 629 63010 Sep 2013: Wouter 631 - MIN_TTL and MAX_TTL also in time_t. 632 - tag 1.4.21rc1 made again. 633 63426 Aug 2013: Wouter 635 - More fixes for bug#519: for the threaded case test if the bg 636 thread has been killed, on ub_ctx_delete, to avoid hangs. 637 63822 Aug 2013: Wouter 639 - more fixes that I overlooked. 640 - review fixes from Willem. 641 64221 Aug 2013: Wouter 643 - Fix#520: Errors found by static analysis from Tomas Hozza(redhat). 644 64520 Aug 2013: Wouter 646 - Fix for 2038, with time_t instead of uint32_t. 647 64819 Aug 2013: Wouter 649 - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound). 650 65114 Aug 2013: Wouter 652 - Fix uninit variable in fix#516. 653 6548 Aug 2013: Wouter 655 - Fix#516 dnssec lameness detection for answers that are improper. 656 65730 Jun 2013: Wouter 658 - tag 1.4.21rc1 659 66029 Jun 2013: Wouter 661 - Fix#512 memleak in testcode for testbound (if it fails). 662 - Fix#512 NSS returned arrays out of setup function to be statics. 663 66426 Jun 2013: Wouter 665 - max include of 100.000 files (depth and globbed at one time). 666 This is to preserve system memory in bug cases, or endless cases. 667 - iana portlist updated. 668 66919 Jun 2013: Wouter 670 - streamtcp man page, contributed by Tomas Hozza. 671 - iana portlist updated. 672 - libunbound documentation on how to avoid openssl race conditions. 673 67425 Jun 2013: Wouter 675 - Squelch sendto-permission denied errors when the network is 676 not connected, to avoid spamming syslog. 677 - configure --disable-flto option (from Robert Edmonds). 678 67918 Jun 2013: Wouter 680 - Fix for const string literals in C++ for libunbound, from Karel 681 Slany. 682 - iana portlist updated. 683 68417 Jun 2013: Wouter 685 - Fixup manpage syntax. 686 68714 Jun 2013: Wouter 688 - get_option and set_option support for log-time-ascii, python-script 689 val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect 690 immediately. The others are mostly useful for libunbound users. 691 69213 Jun 2013: Wouter 693 - get_option, set_option, unbound-checkconf -o and libunbound 694 getoption and setoption support cache-min-ttl and cache-max-ttl. 695 69610 Jun 2013: Wouter 697 - Fix#501: forward-first does not recurse, when forward name is ".". 698 - iana portlist update. 699 - Max include depth is unlimited. 700 70127 May 2013: Wouter 702 - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply 703 patch to it to not fail when -Werror is also specified, from the 704 autoconf-archives. 705 - iana portlist update. 706 70721 May 2013: Wouter 708 - Explain bogus and secure flags in libunbound more. 709 71016 May 2013: Wouter 711 - Fix#499 use-after-free in out-of-memory handling code (thanks Jake 712 Montgomery). 713 - Fix#500 use on non-initialised values on socket bind failures. 714 71515 May 2013: Wouter 716 - Fix round-robin doesn't work with some Windows clients (from Ilya 717 Bakulin). 718 7193 May 2013: Wouter 720 - update acx_nlnetlabs.m4 to v23, sleep w32 fix. 721 72226 April 2013: Wouter 723 - add unbound-control insecure_add and insecure_remove for the 724 administration of negative trust anchors. 725 72625 April 2013: Wouter 727 - Implement max-udp-size config option, default 4096 (thanks 728 Daisuke Higashi). 729 - Robust checks on dname validity from rdata for dname compare. 730 - updated iana portlist. 731 73219 April 2013: Wouter 733 - Fixup snprintf return value usage, fixed libunbound_get_option. 734 73518 April 2013: Wouter 736 - fix bug #491: pick program name (0th argument) as syslog identity. 737 - own implementation of compat/snprintf.c. 738 73915 April 2013: Wouter 740 - Fix so that for a configuration line of include: "*.conf" it is not 741 an error if there are no files matching the glob pattern. 742 - unbound-anchor review: BIO_write can return 0 successfully if it 743 has successfully appended a zero length string. 744 74511 April 2013: Wouter 746 - Fix queries leaking up for stubs and forwards, if the configured 747 nameservers all fail to answer. 748 74910 April 2013: Wouter 750 - code improve for minimal responses, small speed increase. 751 7529 April 2013: Wouter 753 - updated iana portlist. 754 - Fix crash in previous private address fixup of 22 March. 755 75628 March 2013: Wouter 757 - Make reverse zones easier by documenting the nodefault statements 758 commented-out in the example config file. 759 76026 March 2013: Wouter 761 - more fixes to lookup3.c endianness detection. 762 76325 March 2013: Wouter 764 - #492: Fix endianness detection, revert to older lookup3.c detection 765 and put new detect lines after previous tests, to avoid regressions 766 but allow new detections to succeed. 767 And add detection for machine/endian.h to it. 768 76922 March 2013: Wouter 770 - Fix resolve of names that use a mix of public and private addresses. 771 - iana portlist update. 772 - Fix makedist for new svn for -d option. 773 - unbound.h header file has UNBOUND_VERSION_MAJOR define. 774 - Fix windows RSRC version for long version numbers. 775 77621 March 2013: Wouter 777 - release 1.4.20 778 - trunk has 1.4.21 779 - committed libunbound version 4:1:2 for binary API updated in 1.4.20 780 - install copy of unbound-control.8 man page for unbound-control-setup 781 78214 March 2013: Wouter 783 - iana portlist update. 784 - tag 1.4.20rc1 785 78612 March 2013: Wouter 787 - Fixup makedist.sh for windows compile. 788 78911 March 2013: Wouter 790 - iana portlist update. 791 - testcode/ldns-testpkts.c check for makedist is informational. 792 79315 February 2013: Wouter 794 - fix defines in lookup3 for bigendian bsd alpha 795 79611 February 2013: Wouter 797 - Fixup openssl_thread init code to only run if compiled with SSL. 798 7997 February 2013: Wouter 800 - detect endianness in lookup3 on BSD. 801 - add libunbound.ttl at end of result structure, version bump for 802 libunbound and binary backwards compatible, but 1.4.19 is not 803 forward compatible with 1.4.20. 804 - update iana port list. 805 80630 January 2013: Wouter 807 - includes and have_ssl fixes for nss. 808 80929 January 2013: Wouter 810 - printout name of zone with duplicate fwd and hint errors. 811 81228 January 2013: Wouter 813 - updated fwd_zero for newer nc. Updated common.sh for newer netstat. 814 81517 January 2013: Wouter 816 - unbound-anchors checks the emailAddress of the signer of the 817 root.xml file, default is dnssec@iana.org. It also checks that 818 the signer has the correct key usage for a digital signature. 819 - update iana port list. 820 8213 January 2013: Wouter 822 - Test that unbound-control checks client credentials. 823 - Test that unbound can handle a CNAME at an intermediate node in 824 the chain of trust (where it seeks a DS record). 825 - Check the commonName of the signer of the root.xml file in 826 unbound-anchor, default is dnssec@iana.org. 827 8282 January 2013: Wouter 829 - Fix openssl lock free on exit (reported by Robert Fleischman). 830 - iana portlist updated. 831 - Tested that unbound implements the RFC5155 Technical Errata id 3441. 832 Unbound already implements insecure classification of an empty 833 nonterminal in NSEC3 optout zone. 834 83520 December 2012: Wouter 836 - Fix unbound-anchor xml parse of entity declarations for safety. 837 83819 December 2012: Wouter 839 - iana portlist updated. 840 84118 December 2012: Wouter 842 - iana portlist updated. 843 84414 December 2012: Wouter 845 - Change of D.ROOT-SERVERS.NET A address in default root hints. 846 84712 December 2012: Wouter 848 - 1.4.19 release. 849 - trunk has 1.4.20 under development. 850 8515 December 2012: Wouter 852 - note support for AAAA RR type RFC. 853 8544 December 2012: Wouter 855 - 1.4.19rc1 tag. 856 85730 November 2012: Wouter 858 - bug 481: fix python example0. 859 - iana portlist updated. 860 86127 November 2012: Wouter 862 - iana portlist updated. 863 8649 November 2012: Wouter 865 - Fix unbound-control forward disables configured stubs below it. 866 8677 November 2012: Wouter 868 - Fixup ldns-testpkts, identical to ldns/examples. 869 - iana portlist updated. 870 87130 October 2012: Wouter 872 - Fix bug #477: unbound-anchor segfaults if EDNS is blocked. 873 87429 October 2012: Matthijs 875 - Fix validation for responses with both CNAME and wildcard 876 expanded CNAME records in answer section. 877 8788 October 2012: Wouter 879 - update ldns-testpkts.c to ldns 1.6.14 version. 880 - fix build of pythonmod in objdir, for unbound.py. 881 - make clean and makerealclean remove generated python and docs. 882 8835 October 2012: Wouter 884 - fix build of pythonmod in objdir (thanks Jakob Schlyter). 885 8863 October 2012: Wouter 887 - fix text in unbound-anchor man page. 888 8891 October 2012: Wouter 890 - ignore trusted-keys globs that have no files (from Paul Wouters). 891 89227 September 2012: Wouter 893 - include: directive in config file accepts wildcards. Patch from 894 Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*" 895 - unbound-control -q option is quiet, patch from Mariano Absatz. 896 - iana portlist updated. 897 - updated contrib/unbound.spec, patch from Valentin Bud. 898 89921 September 2012: Wouter 900 - chdir to / after chroot call (suggested by Camiel Dobbelaar). 901 90217 September 2012: Wouter 903 - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation 904 otherwise it is treated as insecure. The RSAMD5 algorithm is 905 deprecated (RFC6725). The MD5 hash is considered weak for some 906 purposes, if you want to sign your zone, then RSASHA256 is an 907 uncontested hash. 908 90930 August 2012: Wouter 910 - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled. 911 - iana portlist updated. 912 91329 August 2012: Wouter 914 - Nicer comments outgoing-port-avoid, thanks Stu (bug #465). 915 91622 August 2012: Wouter 917 - Fallback to 1472 and 1232, one fragment size without headers. 918 91921 August 2012: Wouter 920 - Fix timeouts so that when a server has been offline for a while 921 and is probed to see it works, it becomes fully available for 922 server selection again. 923 92417 August 2012: Wouter 925 - Add documentation to libunbound for default nonuse of resolv.conf. 926 9272 August 2012: Wouter 928 - trunk has 1.4.19 under development (fixes from 1 aug and 31 july 929 are for 1.4.19). 930 - iana portlist updated. 931 9321 August 2012: Wouter 933 - Fix openssl race condition, initializes openssl locks, reported 934 by Einar Lonn and Patrik Wallstrom. 935 93631 July 2012: Wouter 937 - Improved forward-first and stub-first documentation. 938 - Fix that enables modules to register twice for the same 939 serviced_query, without race conditions or administration issues. 940 This should not happen with the current codebase, but it is robust. 941 - Fix forward-first option where it sets the RD flag wrongly. 942 - added manpage links for libunbound calls (Thanks Paul Wouters). 943 94430 July 2012: Wouter 945 - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012). 946 94727 July 2012: Wouter 948 - unbound-host works with libNSS 949 - fix bogus nodata cname chain not reported as bogus by validator, 950 (Thanks Peter van Dijk). 951 95226 July 2012: Wouter 953 - iana portlist updated. 954 - tag 1.4.18rc1. 955 95625 July 2012: Wouter 957 - review fix for libnss, check hash prefix allocation size. 958 95923 July 2012: Wouter 960 - fix missing break for GOST DS hash function. 961 - implemented forward_first for the root. 962 96320 July 2012: Wouter 964 - Fix bug#452 and another assertion failure in mesh.c, makes 965 assertions in mesh.c resist duplicates. Fixes DS NS search to 966 not generate duplicate sub queries. 967 96819 July 2012: Willem 969 - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac, 970 if CFLAGS is specified at configure time then '-g -O2' is not 971 appended to CFLAGS, so that the user can override them. 972 97318 July 2012: Willem 974 - Fix libunbound report of errors when in background mode. 975 97611 July 2012: Willem 977 - updated iana ports list. 978 9799 July 2012: Willem 980 - Add flush_bogus option for unbound-control 981 9826 July 2012: Wouter 983 - Fix validation of qtype DS queries that result in no data for 984 non-optout NSEC3 zones. 985 9864 July 2012: Wouter 987 - compile libunbound with libnss on Suse, passes regression tests. 988 9893 July 2012: Wouter 990 - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes. 991 9922 July 2012: Wouter 993 - updated iana ports list. 994 99529 June 2012: Wouter 996 - patch for unbound_munin_ script to handle arbitrary thread count by 997 Sven Ulland. 998 99928 June 2012: Wouter 1000 - detect if openssl has FIPS_mode. 1001 - code review: return value of cache_store can be ignored for better 1002 performance in out of memory conditions. 1003 - fix edns-buffer-size and msg-buffer-size manpage documentation. 1004 - updated iana ports list. 1005 100625 June 2012: Wouter 1007 - disable RSAMD5 if in FIPS mode (for openssl and for libnss). 1008 100922 June 2012: Wouter 1010 - implement DS records, NSEC3 and ECDSA for compile with libnss. 1011 101221 June 2012: Wouter 1013 - fix error handling of alloc failure during rrsig verification. 1014 - nss check for verification failure. 1015 - nss crypto works for RSA and DSA. 1016 101720 June 2012: Wouter 1018 - work on --with-nss build option (for now, --with-libunbound-only). 1019 102019 June 2012: Wouter 1021 - --with-libunbound-only build option, only builds the library and 1022 not the daemon and other tools. 1023 102418 June 2012: Wouter 1025 - code review. 1026 102715 June 2012: Wouter 1028 - implement log-time-ascii on windows. 1029 - The key-cache bad key ttl is now 60 seconds. 1030 - updated iana ports list. 1031 - code review. 1032 103311 June 2012: Wouter 1034 - bug #452: fix crash on assert in mesh_state_attachment. 1035 103630 May 2012: Wouter 1037 - silence warning from swig-generated code (md set but not used in 1038 swig initmodule, due to ifdefs in swig-generated code). 1039 104027 May 2012: Wouter 1041 - Fix debian-bugs-658021: Please enable hardened build flags. 1042 104325 May 2012: Wouter 1044 - updated iana ports list. 1045 104624 May 2012: Wouter 1047 - tag for 1.4.17 release. 1048 - trunk is 1.4.18 in development. 1049 105018 May 2012: Wouter 1051 - Review comments, removed duplicate memset to zero in delegpt. 1052 105316 May 2012: Wouter 1054 - Updated doc/FEATURES with RFCs that are implemented but not listed. 1055 - Protect if statements in val_anchor for compile without locks. 1056 - tag for 1.4.17rc1. 1057 105815 May 2012: Wouter 1059 - fix configure ECDSA support in ldns detection for windows compile. 1060 - fix possible uninitialised variable in windows pipe implementation. 1061 10629 May 2012: Wouter 1063 - Fix alignment problem in util/random on sparc64/freebsd. 1064 10658 May 2012: Wouter 1066 - Fix for accept spinning reported by OpenBSD. 1067 - iana portlist updated. 1068 10692 May 2012: Wouter 1070 - Fix validation of nodata for DS query in NSEC zones, reported by 1071 Ondrej Mikle. 1072 107313 April 2012: Wouter 1074 - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older 1075 openssl. 1076 107710 April 2012: Wouter 1078 - Applied patch from Daisuke HIGASHI for rrset-roundrobin and 1079 minimal-responses features. 1080 - iana portlist updated. 1081 10825 April 2012: Wouter 1083 - fix bug #443: --with-chroot-dir not honoured by configure. 1084 - fix bug #444: setusercontext was called too late (thanks Bjorn 1085 Ketelaars). 1086 108727 March 2012: Wouter 1088 - fix bug #442: Fix that Makefile depends on pythonmod headers 1089 even using --without-pythonmodule. 1090 109122 March 2012: Wouter 1092 - contrib/validation-reporter follows rotated log file (patch from 1093 Augie Schwer). 1094 109521 March 2012: Wouter 1096 - new approach to NS fetches for DS lookup that works with 1097 cornercases, and is more robust and considers forwarders. 1098 109919 March 2012: Wouter 1100 - iana portlist updated. 1101 - fix to locate nameservers for DS lookup with NS fetches. 1102 110316 March 2012: Wouter 1104 - Patch for access to full DNS packet data in unbound python module 1105 from Ondrej Mikle. 1106 11079 March 2012: Wouter 1108 - Applied line-buffer patch from Augie Schwer to validation.reporter.sh. 1109 11102 March 2012: Wouter 1111 - flush_infra cleans timeouted servers from the cache too. 1112 - removed warning from --enable-ecdsa. 1113 11141 March 2012: Wouter 1115 - forward-first option. Tries without forward if a query fails. 1116 Also stub-first option that is similar. 1117 111828 February 2012: Wouter 1119 - Fix from code review, if EINPROGRESS not defined chain if statement 1120 differently. 1121 112227 February 2012: Wouter 1123 - Fix bug#434: on windows check registry for config file location 1124 for unbound-control.exe, and unbound-checkconf.exe. 1125 112623 February 2012: Wouter 1127 - Fix to squelch 'network unreachable' errors from tcp connect in 1128 logs, high verbosity will show them. 1129 113016 February 2012: Wouter 1131 - iter_hints is now thread-owned in module env, and thus threadsafe. 1132 - Fix prefetch and sticky NS, now the prefetch works. It picks 1133 nameservers that 'would be valid in the future', and if this makes 1134 the NS timeout, it updates that NS by asking delegation from the 1135 parent again. If child NS has longer TTL, that TTL does not get 1136 refreshed from the lookup to the child nameserver. 1137 113815 February 2012: Wouter 1139 - Fix forward-zone memory, uses malloc and frees original root dp. 1140 - iter hints (stubs) uses malloc inside for more dynamicity. 1141 - unbound-control forward_add, forward_remove, stub_add, stub_remove 1142 can modify stubs and forwards for running unbound (on mobile computer) 1143 they can also add and remove domain-insecure for the zone. 1144 114514 February 2012: Wouter 1146 - Fix sticky NS (ghost domain problem) if prefetch is yes. 1147 - iter forwards uses malloc inside for more dynamicity. 1148 114913 February 2012: Wouter 1150 - RT#2955. Fix for cygwin compilation. 1151 - iana portlist updated. 1152 115310 February 2012: Wouter 1154 - Slightly smaller critical region in one case in infra cache. 1155 - Fix timeouts to keep track of query type, A, AAAA and other, if 1156 another has caused timeout blacklist, different type can still probe. 1157 - unit test fix for nomem_cnametopos.rpl race condition. 1158 11599 February 2012: Wouter 1160 - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h. 1161 11628 February 2012: Wouter 1163 - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This 1164 implementation is experimental at this time and not recommended 1165 for use on the public internet (the protocol numbers have not 1166 been assigned). Needs recent ldns with --enable-ecdsa. 1167 - fix memory leak in errorcase for DSA signatures. 1168 - iana portlist updated. 1169 - workaround for openssl 0.9.8 ecdsa sha2 and evp problem. 1170 11713 February 2012: Wouter 1172 - fix for windows, rename() is not posix compliant on windows. 1173 11742 February 2012: Wouter 1175 - 1.4.16 release tag. 1176 - svn trunk is 1.4.17 in development. 1177 - iana portlist updated. 1178 11791 February 2012: Wouter 1180 - Fix validation failures (like: validation failure xx: no NSEC3 1181 closest encloser from yy for DS zz. while building chain of trust, 1182 because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata 1183 for an NSEC3. Now it does not change rdata, and fixes TTL. 1184 118530 January 2012: Wouter 1186 - Fix version-number in libtool to be version-info so it produces 1187 libunbound.so.2 like it should. 1188 118926 January 2012: Wouter 1190 - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release. 1191 - trunk 1.4.16; includes changes memset testcode, #424 openindiana, 1192 and keyfile write fixup. 1193 - applied patch to support outgoing-interface with ub_ctx_set_option. 1194 119523 January 2012: Wouter 1196 - Fix memset in test code. 1197 119820 January 2012: Wouter 1199 - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2. 1200 120119 January 2012: Wouter 1202 - Fix to write key files completely to a temporary file, and if that 1203 succeeds, replace the real key file. So failures leave a useful file. 1204 120518 January 2012: Wouter 1206 - tag 1.4.15rc1 created 1207 - updated libunbound/ubsyms.def and remade tag 1.4.15rc1. 1208 120917 January 2012: Wouter 1210 - Fix bug where canonical_compare of RRSIG did not downcase the 1211 signer-name. This is mostly harmless because RRSIGs do not have 1212 to be sorted in canonical order, usually. 1213 121412 January 2012: Wouter 1215 - bug#428: add ub_version() call to libunbound. API version increase, 1216 with (binary) backwards compatibility for the previous version. 1217 121810 January 2012: Wouter 1219 - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL 1220 that would be permissible by the RFCs but it is not the TTL in the 1221 cache. 1222 - iana portlist updated. 1223 - uninitialised variable in reprobe for rtt blocked domains fixed. 1224 - lintfix and new flex output. 1225 12262 January 2012: Wouter 1227 - Fix to randomize hash function, based on 28c3 congress, reported 1228 by Peter van Dijk. 1229 123024 December 2011: Wouter 1231 - Fix for memory leak (about 20 bytes when a tcp or udp send operation 1232 towards authority servers failed, takes about 50.000 such failures to 1233 leak one Mb, such failures are also usually logged), reported by 1234 Robert Fleischmann. 1235 - iana portlist updated. 1236 123719 December 2011: Wouter 1238 - Fix for VU#209659 CVE-2011-4528: Unbound denial of service 1239 vulnerabilities from nonstandard redirection and denial of existence 1240 http://www.unbound.net/downloads/CVE-2011-4528.txt 1241 - robust checks for next-closer NSEC3s. 1242 - tag 1.4.14 created. 1243 - trunk has 1.4.15 in development. 1244 124515 December 2011: Wouter 1246 - remove uninit warning from cachedump code. 1247 - Fix parse error on negative SOA RRSIGs if badly ordered in the packet. 1248 124913 December 2011: Wouter 1250 - iana portlist updated. 1251 - svn tag 1.4.14rc1 1252 - fix infra cache comparison. 1253 - Fix to constrain signer_name to be a parent of the lookupname. 1254 12555 December 2011: Wouter 1256 - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc. 1257 - Fix warnings with gcc 4.6 in compat/inet_ntop.c. 1258 - Fix warning unused in compat/strptime.c. 1259 - Fix malloc detection and double defintion. 1260 12612 December 2011: Wouter 1262 - configure generated with autoconf 2.68. 1263 126430 November 2011: Wouter 1265 - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes 1266 SERVFAILs. Also fixed for UDP (but less likely). 1267 126828 November 2011: Wouter 1269 - Fix quartile time estimate, it was too low, (thanks Jan Komissar). 1270 - iana ports updated. 1271 127211 November 2011: Wouter 1273 - Makefile compat with SunOS make, BSD make and GNU make. 1274 - iana ports updated. 1275 127610 November 2011: Wouter 1277 - Makefile changed for BSD make compatibility. 1278 12799 November 2011: Wouter 1280 - added unit test for SSL service and SSL-upstream. 1281 12828 November 2011: Wouter 1283 - can configure ssl service to one port number, and not on others. 1284 - fixup windows compile with ssl support. 1285 - Fix double free in unbound-host, reported by Steve Grubb. 1286 - iana portlist updated. 1287 12881 November 2011: Wouter 1289 - dns over ssl support as a client, ssl-upstream yes turns it on. 1290 It performs an SSL transaction for every DNS query (250 msec). 1291 - documentation for new options: ssl-upstream, ssl-service-key and 1292 ssl-service.pem. 1293 - iana portlist updated. 1294 - fix -flto detection on Lion for llvm-gcc. 1295 129631 October 2011: Wouter 1297 - dns over ssl support, ssl-service-pem and ssl-service-key files 1298 can be given and then TCP queries are serviced wrapped in SSL. 1299 130027 October 2011: Wouter 1301 - lame-ttl and lame-size options no longer exist, it is integrated 1302 with the host info. They are ignored (with verbose warning) if 1303 encountered to keep the config file backwards compatible. 1304 - fix iana-update for changing gzip compression of results. 1305 - fix export-all-symbols on OSX. 1306 130726 October 2011: Wouter 1308 - iana portlist updated. 1309 - Infra cache stores information about ping and lameness per IP, zone. 1310 This fixes bug #416. 1311 - fix iana_update target for gzipped file on iana site. 1312 131324 October 2011: Wouter 1314 - Fix resolve of partners.extranet.microsoft.com with a fix for the 1315 server selection for choosing out of a (particular) list of bad 1316 choices. (bug#415) 1317 - Fix make_new_space function so that the incoming query is not 1318 overwritten if a jostled out query causes a waiting query to be 1319 resumed that then fails and sends an error message. (Thanks to 1320 Matthew Lee). 1321 132221 October 2011: Wouter 1323 - fix --enable-allsymbols, fptr wlist is disabled on windows with this 1324 option enabled because of memory layout exe vs dll. 1325 132619 October 2011: Wouter 1327 - fix unbound-anchor for broken strptime on OSX lion, detected 1328 in configure. 1329 - Detect if GOST really works, openssl1.0 on OSX fails. 1330 - Implement ipv6%interface notation for scope_id usage. 1331 133217 October 2011: Wouter 1333 - better documentation for inform_super (Thanks Yang Zhe). 1334 133514 October 2011: Wouter 1336 - Fix for out-of-memory condition in libunbound (thanks 1337 Robert Fleischman). 1338 133913 October 2011: Wouter 1340 - Fix --enable-allsymbols, it depended on link specifics of the 1341 target platform, or fptr_wlist assertion failures could occur. 1342 134312 October 2011: Wouter 1344 - updated contrib/unbound_munin_ to family=auto so that it works with 1345 munin-node-configure automatically (if installed as 1346 /usr/local/share/munin/plugins/unbound_munin_ ). 1347 134827 September 2011: Wouter 1349 - unbound.exe -w windows option for start and stop service. 1350 135123 September 2011: Wouter 1352 - TCP-upstream calculates tcp-ping so server selection works if there 1353 are alternatives. 1354 135520 September 2011: Wouter 1356 - Fix classification of NS set in answer section, where there is a 1357 parent-child server, and the answer has the AA flag for dir.slb.com. 1358 Thanks to Amanda Constant from Secure64. 1359 136016 September 2011: Wouter 1361 - fix bug #408: accept patch from Steve Snyder that comments out 1362 unused functions in lookup3.c. 1363 - iana portlist updated. 1364 - fix EDNS1480 change memleak and TCP fallback. 1365 - fix various compiler warnings (reported by Paul Wouters). 1366 - max sent count. EDNS1480 only for rtt < 5000. No promiscuous 1367 fetch if sentcount > 3, stop query if sentcount > 16. Count is 1368 reset when referral or CNAME happens. This makes unbound better 1369 at managing large NS sets, they are explored when there is continued 1370 interest (in the form of queries). 1371 137215 September 2011: Wouter 1373 - release 1.4.13. 1374 - trunk contains 1.4.14 in development. 1375 - Unbound probes at EDNS1480 if there an EDNS0 timeout. 1376 137712 September 2011: Wouter 1378 - Reverted dns EDNS backoff fix, it did not help and needs 1379 fragmentation fixes instead. 1380 - tag 1.4.13rc2 1381 13827 September 2011: Wouter 1383 - Fix operation in ipv6 only (do-ip4: no) mode. 1384 13856 September 2011: Wouter 1386 - fedora specfile updated. 1387 13885 September 2011: Wouter 1389 - tag 1.4.13rc1 1390 13912 September 2011: Wouter 1392 - iana portlist updated. 1393 139426 August 2011: Wouter 1395 - Fix num-threads 0 does not segfault, reported by Simon Deziel. 1396 - Fix validation failures due to EDNS backoff retries, the retry 1397 for fetch of data has want_dnssec because the iter_indicate_dnssec 1398 function returns true when validation failure retry happens, and 1399 then the serviced query code does not fallback to noEDNS, even if 1400 the cache says it has this. This helps for DLV deployment when 1401 the DNSSEC status is not known for sure before the lookup concludes. 1402 140324 August 2011: Wouter 1404 - Applied patch from Karel Slany that fixes a memory leak in the 1405 unbound python module, in string conversions. 1406 140722 August 2011: Wouter 1408 - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy 1409 Zhang and Luo Ce). Unbound responds with the RR types that are 1410 available at the name for qtype ANY and validates those RR types. 1411 It does not test for completeness (i.e. with NSEC or NSEC3 query), 1412 and it does not follow the CNAME or DNAME to another name (with 1413 even more data for the already large response). 1414 - Fix that internally, CNAMEs with NXDOMAIN have that as rcode. 1415 - Documented the options that work with control set_option command. 1416 - tcp-upstream yes/no option (works with set_option) for tunnels. 1417 141818 August 2011: Wouter 1419 - fix autoconf call in makedist crosscompile to RC or snapshot. 1420 142117 August 2011: Wouter 1422 - Fix validation of . DS query. 1423 - new xml format at IANA, new awk for iana_update. 1424 - iana portlist updated. 1425 142610 August 2011: Wouter 1427 - Fix python site-packages path to /usr/lib64. 1428 - updated patch from Tom. 1429 - fix memory and fd leak after out-of-memory condition. 1430 14319 August 2011: Wouter 1432 - patch from Tom Hendrikx fixes load of python modules. 1433 14348 August 2011: Wouter 1435 - make clean had ldns-src reference, removed. 1436 14371 August 2011: Wouter 1438 - Fix autoconf 2.68 warnings 1439 144014 July 2011: Wouter 1441 - Unbound implements RFC6303 (since version 1.4.7). 1442 - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the 1443 meantime, those are for 1.4.13). 1444 - iana portlist updated. 1445 144613 July 2011: Wouter 1447 - Quick fix for contrib/unbound.spec example, no ldns-builtin any more. 1448 144911 July 2011: Wouter 1450 - Fix wildcard expansion no-data reply under an optout NSEC3 zone is 1451 validated as insecure, reported by Jia Li (lijia@cnnic.cn). 1452 14534 July 2011: Wouter 1454 - 1.4.12rc1 tag created. 1455 14561 July 2011: Wouter 1457 - version number in example config file. 1458 - fix that --enable-static-exe does not complain about it unknown. 1459 146030 June 2011: Wouter 1461 - tag relase 1.4.11, trunk is 1.4.12 development. 1462 - iana portlist updated. 1463 - fix bug#395: id bits of other query may leak out under conditions 1464 - fix replyaddr count wrong after jostled queries, which leads to 1465 eventual starvation where the daemon has no replyaddrs left to use. 1466 - fix comment about rndc port, that referred to the old port number. 1467 - fix that the listening socket is not closed when too many remote 1468 control connections are made at the same time. 1469 - removed ldns-src tarball inside the unbound tarball. 1470 147123 June 2011: Wouter 1472 - Changed -flto check to support clang compiler. 1473 - tag 1.4.11rc3 created. 1474 147517 June 2011: Wouter 1476 - tag 1.4.11rc1 created. 1477 - remove warning about signed/unsigned from flex (other flex version). 1478 - updated aclocal.m4 and libtool to match. 1479 - tag 1.4.11rc2 created. 1480 148116 June 2011: Wouter 1482 - log-queries: yesno option, default is no, prints querylog. 1483 - version is 1.4.11. 1484 148514 June 2011: Wouter 1486 - Use -flto compiler flag for link time optimization, if supported. 1487 - iana portlist updated. 1488 148912 June 2011: Wouter 1490 - IPv6 service address for d.root-servers.net (2001:500:2D::D). 1491 149210 June 2011: Wouter 1493 - unbound-control has version number in the header, 1494 UBCT[version]_space_ is the header sent by the client now. 1495 - Unbound control port number is registered with IANA: 1496 ub-dns-control 8953/tcp unbound dns nameserver control 1497 This is the new default for the control-port config setting. 1498 - statistics-interval prints the number of jostled queries to log. 1499 150030 May 2011: Wouter 1501 - Fix Makefile for U in environment, since wrong U is more common than 1502 deansification necessity. 1503 - iana portlist updated. 1504 - updated ldns tarball to 1.6.10rc2 snapshot of today. 1505 150625 May 2011: Wouter 1507 - Fix assertion failure when unbound generates an empty error reply 1508 in response to a query, CVE-2011-1922 VU#531342. 1509 - This fix is in tag 1.4.10. 1510 - defense in depth against the above bug, an error is printed to log 1511 instead of an assertion failure. 1512 151310 May 2011: Wouter 1514 - bug#386: --enable-allsymbols option links all binaries to libunbound 1515 and reduces install size significantly. 1516 - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers. 1517 - iana portlist updated. 1518 - Fix TTL of SOA so negative TTL is separately cached from normal TTL. 1519 152014 April 2011: Wouter 1521 - configure created with newer autoconf 2.66. 1522 152312 April 2011: Wouter 1524 - bug#378: Fix that configure checks for ldns_get_random presence. 1525 15268 April 2011: Wouter 1527 - iana portlist updated. 1528 - queries with CD flag set cause DNSSEC validation, but the answer is 1529 not withheld if it is bogus. Thus, unbound will retry if it is bad 1530 and curb the TTL if it is bad, thus protecting the cache for use by 1531 downstream validators. 1532 - val-override-date: -1 ignores dates entirely, for NTP usage. 1533 153429 March 2011: Wouter 1535 - harden-below-nxdomain: changed so that it activates when the 1536 cached nxdomain is dnssec secure. This avoids backwards 1537 incompatibility because those old servers do not have dnssec. 1538 153924 March 2011: Wouter 1540 - iana portlist updated. 1541 - release 1.4.9. 1542 - trunk is 1.5.0 1543 154417 March 2011: Wouter 1545 - bug#370: new unbound.spec for CentOS 5.x from Harold Jones. 1546 Applied but did not do the --disable-gost. 1547 154810 March 2011: Wouter 1549 - tag 1.4.9 release candidate 1 created. 1550 15513 March 2011: Wouter 1552 - updated ldns to today. 1553 15541 March 2011: Wouter 1555 - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout. 1556 - give config parse error for multiple names on a stub or forward zone. 1557 - updated ldns tarball to 1.6.9(todays snapshot). 1558 155924 February 2011: Wouter 1560 - bug #361: Fix, time.elapsed variable not reset with stats_noreset. 1561 156223 February 2011: Wouter 1563 - iana portlist updated. 1564 - common.sh to version 3. 1565 156618 February 2011: Wouter 1567 - common.sh in testdata updated to version 2. 1568 156915 February 2011: Wouter 1570 - Added explicit note on unbound-anchor usage: 1571 Please note usage of unbound-anchor root anchor is at your own risk 1572 and under the terms of our LICENSE (see that file in the source). 1573 157411 February 2011: Wouter 1575 - iana portlist updated. 1576 - tpkg updated with common.sh for common functionality. 1577 15787 February 2011: Wouter 1579 - Added regression test for addition of a .net DS to the root, and 1580 cache effects with different TTL for glue and DNSKEY. 1581 - iana portlist updated. 1582 158328 January 2011: Wouter 1584 - Fix remove private address does not throw away entire response. 1585 158624 January 2011: Wouter 1587 - release 1.4.8 1588 158919 January 2011: Wouter 1590 - fix bug#349: no -L/usr for ldns. 1591 159218 January 2011: Wouter 1593 - ldns 1.6.8 tarball included. 1594 - release 1.4.8rc1. 1595 159617 January 2011: Wouter 1597 - add get and set option for harden-below-nxdomain feature. 1598 - iana portlist updated. 1599 160014 January 2011: Wouter 1601 - Fix so a changed NS RRset does not get moved name stuck on old 1602 server, for type NS the TTL is not increased. 1603 160413 January 2011: Wouter 1605 - Fix prefetch so it does not get stuck on old server for moved names. 1606 160712 January 2011: Wouter 1608 - iana portlist updated. 1609 161011 January 2011: Wouter 1611 - Fix insecure CNAME sequence marked as secure, reported by Bert 1612 Hubert. 1613 161410 January 2011: Wouter 1615 - faster lruhash get_mem routine. 1616 16174 January 2011: Wouter 1618 - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root. 1619 - iana portlist updated. 1620 162123 December 2010: Wouter 1622 - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept. 1623 162421 December 2010: Wouter 1625 - algorithm compromise protection using the algorithms signalled in 1626 the DS record. Also, trust anchors, DLV, and RFC5011 receive this, 1627 and thus, if you have multiple algorithms in your trust-anchor-file 1628 then it will now behave different than before. Also, 5011 rollover 1629 for algorithms needs to be double-signature until the old algorithm 1630 is revoked. 1631 It is not an option, because I see no use to turn the security off. 1632 - iana portlist updated. 1633 163417 December 2010: Wouter 1635 - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them). 1636 - fix validation in this case: CNAME to nodata for co-hosted opt-in 1637 NSEC3 insecure delegation, was bogus, fixed to be insecure. 1638 163916 December 2010: Wouter 1640 - Fix our 'BDS' license (typo reported by Xavier Belanger). 1641 164210 December 2010: Wouter 1643 - iana portlist updated. 1644 - review changes for unbound-anchor. 1645 16462 December 2010: Wouter 1647 - feature typetransparent localzone, does not block other RR types. 1648 16491 December 2010: Wouter 1650 - Fix bug#338: print address when socket creation fails. 1651 165230 November 2010: Wouter 1653 - Fix storage of EDNS failures in the infra cache. 1654 - iana portlist updated. 1655 165618 November 2010: Wouter 1657 - harden-below-nxdomain option, default off (because very old 1658 software may be incompatible). We could enable it by default in 1659 the future. 1660 166117 November 2010: Wouter 1662 - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN. 1663 - make test output nicer. 1664 166515 November 2010: Wouter 1666 - silence 'tcp connect: broken pipe' and 'net down' at low verbosity. 1667 - iana portlist updated. 1668 - so-sndbuf option for very busy servers, a bit like so-rcvbuf. 1669 16709 November 2010: Wouter 1671 - unbound-anchor compiles with openssl 0.9.7. 1672 16738 November 2010: Wouter 1674 - release tag 1.4.7. 1675 - trunk is version 1.4.8. 1676 - Be lenient and accept imgw.pl malformed packet (like BIND). 1677 16785 November 2010: Wouter 1679 - do not synthesize a CNAME message from cache for qtype DS. 1680 16814 November 2010: Wouter 1682 - Use central entropy to seed threads. 1683 16843 November 2010: Wouter 1685 - Change the rtt used to probe EDNS-timeout hosts to 1000 msec. 1686 16872 November 2010: Wouter 1688 - tag 1.4.7rc1. 1689 - code review. 1690 16911 November 2010: Wouter 1692 - GOST code enabled by default (RFC 5933). 1693 169427 October 2010: Wouter 1695 - Fix uninit value in dump_infra print. 1696 - Fix validation failure for parent and child on same server with an 1697 insecure childzone and a CNAME from parent to child. 1698 - Configure detects libev-4.00. 1699 170026 October 2010: Wouter 1701 - dump_infra and flush_infra commands for unbound-control. 1702 - no timeout backoff if meanwhile a query succeeded. 1703 - Change of timeout code. No more lost and backoff in blockage. 1704 At 12sec timeout (and at least 2x lost before) one probe per IP 1705 is allowed only. At 120sec, the IP is blocked. After 15min, a 1706 120sec entry has a single retry packet. 1707 170825 October 2010: Wouter 1709 - Configure errors if ldns is not found. 1710 171122 October 2010: Wouter 1712 - Windows 7 fix for the installer. 1713 171421 October 2010: Wouter 1715 - Fix bug where fallback_tcp causes wrong roundtrip and edns 1716 observation to be noted in cache. Fix bug where EDNSprobe halted 1717 exponential backoff if EDNS status unknown. 1718 - new unresponsive host method, exponentially increasing block backoff. 1719 - iana portlist updated. 1720 172120 October 2010: Wouter 1722 - interface automatic works for some people with ip6 disabled. 1723 Therefore the error check is removed, so they can use the option. 1724 172519 October 2010: Wouter 1726 - Fix for request list growth, if a server has long timeout but the 1727 lost counter is low, then its effective rtt is the one without 1728 exponential backoff applied. Because the backoff is not working. 1729 The lost counter can then increase and the server is blacklisted, 1730 or the lost counter does not increase and the server is working 1731 for some queries. 1732 173318 October 2010: Wouter 1734 - iana portlist updated. 1735 173613 October 2010: Wouter 1737 - Fix TCP so it uses a random outgoing-interface. 1738 - unbound-anchor handles ADDPEND keystate. 1739 174011 October 2010: Wouter 1741 - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where 1742 the zone has a secure delegation hosted on the same server did not 1743 verify as secure (it was insecure by mistake). 1744 - iana portlist updated. 1745 - ldns tarball updated (for reading cachedumps with bad RR data). 1746 17471 October 2010: Wouter 1748 - test for unbound-anchor. fix for reading certs. 1749 - Fix alloc_reg_release for longer uptime in out of memory conditions. 1750 175128 September 2010: Wouter 1752 - unbound-anchor working, it creates or updates a root.key file. 1753 Use it before you start the validator (e.g. at system boot time). 1754 175527 September 2010: Wouter 1756 - iana portlist updated. 1757 175824 September 2010: Wouter 1759 - bug#329: in example.conf show correct ipv4 link-local 169.254/16. 1760 176123 September 2010: Wouter 1762 - unbound-anchor app, unbound requires libexpat (xml parser library). 1763 176422 September 2010: Wouter 1765 - compliance with draft-ietf-dnsop-default-local-zones-14, removed 1766 reverse ipv6 orchid prefix from builtin list. 1767 - iana portlist updated. 1768 176917 September 2010: Wouter 1770 - DLV has downgrade protection again, because the RFC says so. 1771 - iana portlist updated. 1772 177316 September 2010: Wouter 1774 - Algorithm rollover operational reality intrudes, for trust-anchor, 1775 5011-store, and DLV-anchor if one key matches it's good enough. 1776 - iana portlist updated. 1777 - Fix reported validation error in out of memory condition. 1778 177915 September 2010: Wouter 1780 - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout. 1781 178214 September 2010: Wouter 1783 - increased mesh-max-activation from 1000 to 3000 for crazy domains 1784 like _tcp.slb.com with 262 servers. 1785 - iana portlist updated. 1786 178713 September 2010: Wouter 1788 - bug#327: Fix for cannot access stub zones until the root is primed. 1789 17909 September 2010: Wouter 1791 - unresponsive servers are not completely blacklisted (because of 1792 firewalls), but also not probed all the time (because of the request 1793 list size it generates). The probe rate is 1%. 1794 - iana portlist updated. 1795 179620 August 2010: Wouter 1797 - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled. 1798 iterator get_mem includes priv_get_mem. delegpt nodup removed. 1799 listen_pushback, query_info_allocqname, write_socket, send_packet, 1800 comm_point_set_cb_arg and listen_resume removed. 1801 180219 August 2010: Wouter 1803 - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20. 1804 Delegpt structures checked for duplicates always. 1805 No more nameserver lookups generated when depth is full anyway. 1806 - example.conf notes how to do DNSSEC validation and track the root. 1807 - iana portlist updated. 1808 180918 August 2010: Wouter 1810 - Fix bug#322: configure does not respect CFLAGS on Solaris. 1811 Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line 1812 if use sun-cc, but some systems need different flags. 1813 181416 August 2010: Wouter 1815 - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP 1816 changes, uses m4_bpatsubst now. 1817 - make test (or make check) should be more portable and run the unit 1818 test and testbound scripts. (make longtest has special requirements). 1819 182013 August 2010: Wouter 1821 - More pleasant remote control command parsing. 1822 - documentation added for return values reported by doxygen 1.7.1. 1823 - iana portlist updated. 1824 18259 August 2010: Wouter 1826 - Fix name of rrset printed that failed validation. 1827 18285 August 2010: Wouter 1829 - Return NXDOMAIN after chain of CNAMEs ends at name-not-found. 1830 18314 August 2010: Wouter 1832 - Fix validation in case a trust anchor enters into a zone with 1833 unsupported algorithms. 1834 18353 August 2010: Wouter 1836 - updated ldns tarball with bugfixes. 1837 - release tag 1.4.6. 1838 - trunk becomes 1.4.7 develop. 1839 - iana portlist updated. 1840 184122 July 2010: Wouter 1842 - more error details on failed remote control connection. 1843 184415 July 2010: Wouter 1845 - rlimit adjustments for select and ulimit can happen at the same time. 1846 184714 July 2010: Wouter 1848 - Donation text added to README. 1849 - Fix integer underflow in prefetch ttl creation from cache. This 1850 fixes a potential negative prefetch ttl. 1851 185212 July 2010: Wouter 1853 - Changed the defaults for num-queries-per-thread/outgoing-range. 1854 For builtin-select: 512/960, for libevent 1024/4096 and for 1855 windows 24/48 (because of win api). This makes the ratio this way 1856 to improve resilience under heavy load. For high performance, use 1857 libevent and possibly higher numbers. 1858 185910 July 2010: Wouter 1860 - GOST enabled if SSL is recent and ldns has GOST enabled too. 1861 - ldns tarball updated. 1862 18639 July 2010: Wouter 1864 - iana portlist updated. 1865 - Fix validation of qtype DNSKEY when a key-cache entry exists but 1866 no rr-cache entry is used (it expired or prefetch), it then goes 1867 back up to the DS or trust-anchor to validate the DNSKEY. 1868 18697 July 2010: Wouter 1870 - Neat function prototypes, unshadowed local declarations. 1871 18726 July 2010: Wouter 1873 - failure to chown the pidfile is not fatal any more. 1874 - testbound uses UTC timezone. 1875 - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add 1876 /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake. 1877 18785 July 2010: Wouter 1879 - log if a server is skipped because it is on the donotquery list, 1880 at verbosity 4, to enable diagnosis why no queries to 127.0.0.1. 1881 - added feature to print configure date, target and options with -h. 1882 - added feature to print event backend system details with -h. 1883 - wdiff is not actually required by make test, updated requirements. 1884 18851 July 2010: Wouter 1886 - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex 1887 must be signed with all algorithms from the DS rrset at the parent. 1888 This is now checked and becomes bogus if not. 1889 189028 June 2010: Wouter 1891 - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps 1892 in overload situations to be about 5 qps for the class of shortly 1893 serviced queries. 1894 The capacity of the resolver is then about (numqueriesperthread / 2) 1895 / (average time for such long queries) qps for long queries. 1896 And about (numqueriesperthread / 2)/(jostletimeout in whole seconds) 1897 qps for short queries, per thread. 1898 - Fix the max number of reply-address count to be applied for duplicate 1899 queries, and not for new query list entries. This raises the memory 1900 usage to a max of (16+1)*numqueriesperthread reply addresses. 1901 190225 June 2010: Wouter 1903 - Fix handling of corner case reply from lame server, follows rfc2308. 1904 It could lead to a nodata reply getting into the cache if the search 1905 for a non-lame server turned up other misconfigured servers. 1906 - unbound.h has extern "C" statement for easier include in c++. 1907 190823 June 2010: Wouter 1909 - iana portlist updated. 1910 - makedist upgraded cross compile openssl option, like this: 1911 ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost 1912 191322 June 2010: Wouter 1914 - Unbound reports libev or libevent correctly in logs in verbose mode. 1915 - Fix to unload gost dynamic library module for leak testing. 1916 191718 June 2010: Wouter 1918 - iana portlist updated. 1919 192017 June 2010: Wouter 1921 - Add AAAA to root hints for I.ROOT-SERVERS.NET. 1922 192316 June 2010: Wouter 1924 - Fix assertion failure reported by Kai Storbeck from XS4ALL, the 1925 assertion was wrong. 1926 - updated ldns tarball. 1927 192815 June 2010: Wouter 1929 - tag 1.4.5 created. 1930 - trunk contains 1.4.6 in development. 1931 - Fix TCPreply on systems with no writev, if just 1 byte could be sent. 1932 - Fix to use one pointer less for iterator query state store_parent_NS. 1933 - makedist crosscompile to windows uses builtin ldns not host ldns. 1934 - Max referral count from 30 to 130, because 128 one character domains 1935 is valid DNS. 1936 - added documentation for the histogram printout to syslog. 1937 193811 June 2010: Wouter 1939 - When retry to parent the retrycount is not wiped, so failed 1940 nameservers are not tried again. 1941 - iana portlist updated. 1942 194310 June 2010: Wouter 1944 - Fix bug where a long loop could be entered, now cycle detection 1945 has a loop-counter and maximum search amount. 1946 19474 June 2010: Wouter 1948 - iana portlist updated. 1949 - 1.4.5rc1 tag created. 1950 19513 June 2010: Wouter 1952 - ldns tarball updated, 1.6.5. 1953 - review comments, split dependency cycle tracking for parentside 1954 last resort lookups for A and AAAA so there are more lookup options. 1955 19562 June 2010: Wouter 1957 - Fix compile warning if compiled without threads. 1958 - updated ldns-tarball with current ldns svn (pre 1.6.5). 1959 - GOST disabled-by-default, the algorithm number is allocated but the 1960 RFC is still has to pass AUTH48 at the IETF. 1961 19621 June 2010: Wouter 1963 - Ignore Z flag in incoming messages too. 1964 - Fix storage of negative parent glue if that last resort fails. 1965 - libtoolize 2.2.6b, autoconf 2.65 applied to configure. 1966 - new splint flags for newer splint install. 1967 196831 May 2010: Wouter 1969 - Fix AD flag handling, it could in some cases mistakenly copy the AD 1970 flag from upstream servers. 1971 - alloc_special_obtain out of memory is not a fatal error any more, 1972 enabling unbound to continue longer in out of memory conditions. 1973 - parentside names are dispreferred but not said to be dnssec-lame. 1974 - parentside check for cached newname glue. 1975 - fix parentside and querytargets modulestate, for dump_requestlist. 1976 - unbound-control-setup makes keys -rw-r--- so not all users permitted. 1977 - fix parentside from cache to be marked dispreferred for bad names. 1978 197928 May 2010: Wouter 1980 - iana portlist updated. 1981 - parent-child disagreement approach altered. Older fixes are 1982 removed in place of a more exhaustive search for misconfigured data 1983 available via the parent of a delegation. 1984 This is designed to be throttled by cache entries, with TTL from the 1985 parent if possible. Additionally the loop-counter is used. 1986 It also tests for NS RRset differences between parent and child. 1987 The fetch of misconfigured data should be more reliable and thorough. 1988 It should work reliably even with no or only partial data in cache. 1989 Data received from the child (as always) is deemed more 1990 authoritative than information received from the delegation parent. 1991 The search for misconfigured data is not performed normally. 1992 199326 May 2010: Wouter 1994 - Contribution from Migiel de Vos (Surfnet): nagios patch for 1995 unbound-host, in contrib/ (in the source tarball). Makes 1996 unbound-host suitable for monitoring dnssec(-chain) status. 1997 199821 May 2010: Wouter 1999 - EDNS timeout code will not fire if EDNS status already known. 2000 - EDNS failure not stored if EDNS status known to work. 2001 200219 May 2010: Wouter 2003 - Fix resolution for domains like safesvc.com.cn. If the iterator 2004 can not recurse further and it finds the delegation in a state 2005 where it would otherwise have rejected it outhand if so received 2006 from a cache lookup, then it can try to ask higherup (with loop 2007 protection). 2008 - Fix comments in iter_utils:dp_is_useless. 2009 201018 May 2010: Wouter 2011 - Fix various compiler warnings from the clang llvm compiler. 2012 - iana portlist updated. 2013 20146 May 2010: Wouter 2015 - Fix bug#308: spelling error in variable name in parser and lexer. 2016 20174 May 2010: Wouter 2018 - Fix dnssec-missing detection that was turned off by server selection. 2019 - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default 2020 reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa, 2021 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa. 2022 202329 April 2010: Wouter 2024 - Fix for dnssec lameness detection to use the key cache. 2025 - infra cache entries that are expired are wiped clean. Previously 2026 it was possible to not expire host data (if accessed often). 2027 202828 April 2010: Wouter 2029 - ldns tarball updated and GOST support is detected and then enabled. 2030 - iana portlist updated. 2031 - Fix detection of gost support in ldns (reported by Chris Smith). 2032 203327 April 2010: Wouter 2034 - unbound-control get_option domain-insecure shows config file items. 2035 - fix retry sequence if prime hints are recursion-lame. 2036 - autotrust anchor file can be initialized with a ZSK key as well. 2037 - harden-referral-path does not result in failures due to max-depth. 2038 You can increase the max-depth by adding numbers (' 0') after the 2039 target-fetch-policy, this increases the depth to which is checked. 2040 204126 April 2010: Wouter 2042 - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use 2043 CPPFLAGS during configure process. 2044 - if libev is installed on the base system (not libevent), detect 2045 it from the event.h header file and link with -lev. 2046 - configlexer.lex gets config.h, and configyyrename.h added by make, 2047 no more double include. 2048 - More strict scrubber (Thanks to George Barwood for the idea): 2049 NS set must be pertinent to the query (qname subdomain nsname). 2050 - Fix bug#307: In 0x20 backoff fix fallback so the number of 2051 outstanding queries does not become -1 and block the request. 2052 Fixed handling of recursion-lame in combination with 0x20 fallback. 2053 Fix so RRsets are compared canonicalized and sorted if the immediate 2054 comparison fails, this makes it work around round-robin sites. 2055 205623 April 2010: Wouter 2057 - Squelch log message: sendto failed permission denied for 2058 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2). 2059 - Fix to fetch data as last resort more tenaciously. When cycle 2060 targets cause the server selection to believe there are more options 2061 when they really are not there, the server selection is reinitiated. 2062 - Fix fetch from blacklisted dnssec lame servers as last resort. The 2063 server's IP address is then given in validator errors as well. 2064 - Fix local-zone type redirect that did not use the query name for 2065 the answer rrset. 2066 206722 April 2010: Wouter 2068 - tag 1.4.4. 2069 - trunk contains 1.4.5 in development. 2070 - Fix validation failure for qtype ANY caused by a RRSIG parse failure. 2071 The validator error message was 'no signatures from ...'. 2072 207316 April 2010: Wouter 2074 - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN. 2075 - tag 1.4.4rc1. 2076 207715 April 2010: Wouter 2078 - ECC-GOST algorithm number 12 that is assigned by IANA. New test 2079 example key and signatures for GOST. GOST requires openssl-1.0.0. 2080 GOST is still disabled by default. 2081 20829 April 2010: Wouter 2083 - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or 2084 get into an endless loop, if 0x20 was enabled, and buffers are small 2085 or particular broken packets are received. 2086 - Fix chain of trust with CNAME at an intermediate step, for the DS 2087 processing proof. 2088 20898 April 2010: Wouter 2090 - Fix validation of queries with wildcard names (*.example). 2091 20926 April 2010: Wouter 2093 - Fix EDNS probe for .de DNSSEC testbed failure, where the infra 2094 cache timeout coincided with a server update, the current EDNS 2095 backoff is less sensitive, and does not cache the backoff unless 2096 the backoff actually works and the domain is not expecting DNSSEC. 2097 - GOST support with correct algorithm numbers. 2098 20991 April 2010: Wouter 2100 - iana portlist updated. 2101 210224 March 2010: Wouter 2103 - unbound control flushed items are not counted when flushed again. 2104 210523 March 2010: Wouter 2106 - iana portlist updated. 2107 210822 March 2010: Wouter 2109 - unbound-host disables use-syslog from config file so that the 2110 config file for the main server can be used more easily. 2111 - fix bug#301: unbound-checkconf could not parse interface 2112 '0.0.0.0@5353', even though unbound itself worked fine. 2113 211419 March 2010: Wouter 2115 - fix fwd_ancil test to pass if the socket options are not supported. 2116 211718 March 2010: Wouter 2118 - Fixed random numbers for port, interface and server selection. 2119 Removed very small bias. 2120 - Refer to the listing in unbound-control man page in the extended 2121 statistics entry in the unbound.conf man page. 2122 212316 March 2010: Wouter 2124 - Fix interface-automatic for OpenBSD: msg.controllen was too small, 2125 also assertions on ancillary data buffer. 2126 - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO. 2127 - for NSEC3 check if signatures are cached. 2128 212915 March 2010: Wouter 2130 - unit test for util/regional.c. 2131 213212 March 2010: Wouter 2133 - Reordered configure checks so fork and -lnsl -lsocket checks are 2134 earlier, and thus later checks benefit from and do not hinder them. 2135 - iana portlist updated. 2136 - ldns tarball updated. 2137 - Fix python use when multithreaded. 2138 - Fix solaris python compile. 2139 - Include less in config.h and include per code file for ldns, ssl. 2140 214111 March 2010: Wouter 2142 - another memory allocation option: --enable-alloc-nonregional. 2143 exposes the regional allocations to other memory purifiers. 2144 - fix for memory alignment in struct sock_list allocation. 2145 - Fix for MacPorts ldns without ssl default, unbound checks if ldns 2146 has dnssec functionality and uses the builtin if not. 2147 - Fix daemonize on Solaris 10, it did not detach from terminal. 2148 - tag 1.4.3 created. 2149 - trunk is 1.4.4 in development. 2150 - spelling fix in validation error involving cnames. 2151 215210 March 2010: Wouter 2153 - --enable-alloc-lite works with test set. 2154 - portability in the testset: printf format conversions, prototypes. 2155 21569 March 2010: Wouter 2157 - tag 1.4.2 created. 2158 - trunk is 1.4.3 in development. 2159 - --enable-alloc-lite debug option. 2160 21618 March 2010: Wouter 2162 - iana portlist updated. 2163 21644 March 2010: Wouter 2165 - Fix crash in control channel code. 2166 21673 March 2010: Wouter 2168 - better casts in pipe code, brackets placed wrongly. 2169 - iana portlist updated. 2170 21711 March 2010: Wouter 2172 - make install depends on make all. 2173 - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs. 2174 - --enable-checking: enables assertions but does not look nonproduction. 2175 - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with 2176 nxdomain and nodata distinguished. 2177 - ldns tarball updated. 2178 - --disable-rpath fixed for libtool not found errors. 2179 - new fedora specfile from Fedora13 in contrib from Paul Wouters. 2180 218126 February 2010: Wouter 2182 - Fixup prototype for lexer cleanup in daemon code. 2183 - unbound-control list_stubs, list_forwards, list_local_zones and 2184 list_local_data. 2185 218624 February 2010: Wouter 2187 - Fix scrubber bug that potentially let NS records through. Reported 2188 by Amanda Constant. 2189 - Also delete potential poison references from additional. 2190 - Fix: no classification of a forwarder as lame, throw away instead. 2191 219223 February 2010: Wouter 2193 - libunbound ub_ctx_get_option() added. 2194 - unbound-control set_option and get_option commands. 2195 - iana portlist updated. 2196 219718 February 2010: Wouter 2198 - A little more strict DS scrubbing. 2199 - No more blacklisting of unresponsive servers, a 2 minute timeout 2200 is backed off to. 2201 - RD flag not enabled for dnssec-blacklisted tries, unless necessary. 2202 - pickup ldns compile fix, libdl for libcrypto. 2203 - log 'tcp connect: connection timed out' only in high verbosity. 2204 - unbound-control log_reopen command. 2205 - moved get_option code from unbound-checkconf to util/config_file.c 2206 220717 February 2010: Wouter 2208 - Disregard DNSKEY from authority section for chain of trust. 2209 DS records that are irrelevant to a referral scrubbed. Anti-poison. 2210 - iana portlist updated. 2211 221216 February 2010: Wouter 2213 - Check for 'no space left on device' (or other errors) when 2214 writing updated autotrust anchors and print errno to log. 2215 221615 February 2010: Wouter 2217 - Fixed the requery protection, the TTL was 0, it is now 900 seconds, 2218 hardcoded. We made the choice to send out more conservatively, 2219 protecting against an aggregate effect more than protecting a 2220 single user (from their own folly, perhaps in case of misconfig). 2221 222212 February 2010: Wouter 2223 - Re-query pattern changed on validation failure. To protect troubled 2224 authority servers, unbound caches a failure for the DNSKEY or DS 2225 records for the entire zone, and only retries that 900 seconds later. 2226 This implies that only a handful of packets are sent extra to the 2227 authority if the zone fails. 2228 222911 February 2010: Wouter 2230 - ldns tarball update for long label length syntax error fix. 2231 - iana portlist updated. 2232 22339 February 2010: Wouter 2234 - Fixup in compat snprintf routine, %f 1.02 and %g support. 2235 - include math.h for testbound test compile portability. 2236 22372 February 2010: Wouter 2238 - Updated url of IANA itar, interim trust anchor repository, in script. 2239 22401 February 2010: Wouter 2241 - iana portlist updated. 2242 - configure test for memcmp portability. 2243 224427 January 2010: Wouter 2245 - removed warning on format string in validator error log statement. 2246 - iana portlist updated. 2247 224822 January 2010: Wouter 2249 - libtool finish the install of unbound python dynamic library. 2250 225121 January 2010: Wouter 2252 - acx_nlnetlabs.m4 synchronised with nsd's version. 2253 225420 January 2010: Wouter 2255 - Fixup lookup trouble for parent-child domains on the first query. 2256 225714 January 2010: Wouter 2258 - Fixup ldns detection to also check for header files. 2259 226013 January 2010: Wouter 2261 - prefetch-key option that performs DNSKEY queries earlier in the 2262 validation process, and that could halve the latency on DNSSEC 2263 queries. It takes some extra processing (CPU, a cache is needed). 2264 226512 January 2010: Wouter 2266 - Fix unbound-checkconf for auto-trust-anchor-file present checks. 2267 22688 January 2010: Wouter 2269 - Fix for parent-child disagreement code which could have trouble 2270 when (a) ipv6 was disabled and (b) the TTL for parent and child 2271 were different. There were two bugs, the parent-side information 2272 is fixed to no longer block lookup of child side information and 2273 the iterator is fixed to no longer attempt to get ipv6 when it is 2274 not enabled and then give up in failure. 2275 - test and fixes to make prefetch actually store the answer in the 2276 cache. Considers some rrsets 'already expired' but does not allow 2277 overwriting of rrsets considered more secure. 2278 22797 January 2010: Wouter 2280 - Fixup python documentation (thanks Leo Vandewoestijne). 2281 - Work on cache prefetch feature. 2282 - Stats for prefetch, in log print stats, unbound-control stats 2283 and in unbound_munin plugin. 2284 22856 January 2010: Wouter 2286 - iana portlist updated. 2287 - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length. 2288 - verbose output includes parent-side-address notion for lameness. 2289 - documented val-log-level: 2 setting in example.conf and man page. 2290 - change unbound-control-setup from 1024(sha1) to 1536(sha256). 2291 22921 January 2010: Wouter 2293 - iana portlist updated. 2294 229522 December 2009: Wouter 2296 - configure with newer libtool 2.2.6b. 2297 229817 December 2009: Wouter 2299 - review comments. 2300 - tag 1.4.1. 2301 - trunk to version 1.4.2. 2302 230315 December 2009: Wouter 2304 - Answer to qclass=ANY queries, with class IN contents. 2305 Test that validation also works. 2306 - updated ldns snapshot tarball with latest fixes (parsing records). 2307 230811 December 2009: Wouter 2309 - on IPv4 UDP turn off DF flag. 2310 231110 December 2009: Wouter 2312 - requirements.txt updated with design choice explanations. 2313 - Reading fixes: fix to set unlame when child confirms parent glue, 2314 and fix to avoid duplicate addresses in delegation point. 2315 - verify_rrsig routine checks expiration last. 2316 23179 December 2009: Wouter 2318 - Fix Bug#287(reopened): update of ldns tarball with fix for parse 2319 errors generated for domain names like '.example.com'. 2320 - Fix SOA excluded from negative DS responses. Reported by Hauke 2321 Lampe. The negative cache did not include proper SOA records for 2322 negative qtype DS responses which makes BIND barf on it, such 2323 responses are now only used internally. 2324 - Fix negative cache lookup of closestencloser check of DS type bit. 2325 23268 December 2009: Wouter 2327 - Fix for lookup of parent-child disagreement domains, where the 2328 parent-side glue works but it does not provide proper NS, A or AAAA 2329 for itself, fixing domains such as motorcaravanners.eu. 2330 - Feature: you can specify a port number in the interface: line, so 2331 you can bind the same interface multiple times at different ports. 2332 23337 December 2009: Wouter 2334 - Bug#287: Fix segfault when unbound-control remove nonexistent local 2335 data. Added check to tests. 2336 23371 December 2009: Wouter 2338 - Fix crash with module-config "iterator". 2339 - Added unit test that has "iterator" module-config. 2340 234130 November 2009: Wouter 2342 - bug#284: fix parse of # without end-of-line at end-of-file. 2343 234426 November 2009: Wouter 2345 - updated ldns with release candidate for version 1.6.3. 2346 - tag for 1.4.0 release. 2347 - 1.4.1 version in trunk. 2348 - Fixup major libtool version to 2 because of why_bogus change. 2349 It was 1:5:0 but should have been 2:0:0. 2350 235123 November 2009: Wouter 2352 - Patch from David Hubbard for libunbound manual page. 2353 - Fixup endless spinning in unbound-control stats reported by 2354 Attila Nagy. Probably caused by clock reversal. 2355 235620 November 2009: Wouter 2357 - contrib/split-itar.sh contributed by Tom Hendrikx. 2358 235919 November 2009: Wouter 2360 - better argument help for unbound-control. 2361 - iana portlist updated. 2362 236317 November 2009: Wouter 2364 - noted multiple entries for multiple domain names in example.conf. 2365 - iana portlist updated. 2366 236716 November 2009: Wouter 2368 - Fixed signer detection of CNAME responses without signatures. 2369 - Fix#282 libunbound memleak on error condition by Eric Sesterhenn. 2370 - Tests for CNAMEs to deeper trust anchors, secure and bogus. 2371 - svn tag 1.4.0rc1 made. 2372 237313 November 2009: Wouter 2374 - Fixed validation failure for CNAME to optout NSEC3 nodata answer. 2375 - unbound-host does not fail on type ANY. 2376 - Fixed wireparse failure to put RRSIGs together with data in some 2377 long ANY mix cases, which fixes validation failures. 2378 237912 November 2009: Wouter 2380 - iana portlist updated. 2381 - fix manpage errors reported by debian lintian. 2382 - review comments. 2383 - fixup very long vallog2 level error strings. 2384 238511 November 2009: Wouter 2386 - ldns tarball updated (to 1.6.2). 2387 - review comments. 2388 238910 November 2009: Wouter 2390 - Thanks to Surfnet found bug in new dnssec-retry code that failed 2391 to combine well when combined with DLV and a particular failure. 2392 - Fixed unbound-control -h output about argument optionality. 2393 - review comments. 2394 23955 November 2009: Wouter 2396 - lint fixes and portability tests. 2397 - better error text for multiple domain keys in one autotrust file. 2398 23992 November 2009: Wouter 2400 - Fix bug where autotrust does not work when started with a DS. 2401 - Updated GOST unit tests for unofficial algorithm number 249 2402 and DNSKEY-format changes in draft version -01. 2403 240429 October 2009: Wouter 2405 - iana portlist updated. 2406 - edns-buffer-size option, default 4096. 2407 - fixed do-udp: no. 2408 240928 October 2009: Wouter 2410 - removed abort on prealloc failure, error still printed but softfail. 2411 - iana portlist updated. 2412 - RFC 5702: RSASHA256 and RSASHA512 support enabled by default. 2413 - ldns tarball updated (which also enables rsasha256 support). 2414 241527 October 2009: Wouter 2416 - iana portlist updated. 2417 24188 October 2009: Wouter 2419 - please doxygen 2420 - add val-log-level print to corner case (nameserver.epost.bg). 2421 - more detail to errors from insecure delegation checks. 2422 - Fix double time subtraction in negative cache reported by 2423 Amanda Constant and Hugh Mahon. 2424 - Made new validator error string available from libunbound for 2425 applications. It is in result->why_bogus, a zero-terminated string. 2426 unbound-host prints it by default if a result is bogus. 2427 Also the errinf is public in module_qstate (for other modules). 2428 24297 October 2009: Wouter 2430 - retry for validation failure in DS and prime results. Less mem use. 2431 unit test. Provisioning in other tests for requeries. 2432 - retry for validation failure in DNSKEY in middle of chain of trust. 2433 unit test. 2434 - retry for empty non terminals in chain of trust and unit test. 2435 - Fixed security bug where the signatures for NSEC3 records were not 2436 checked when checking for absence of DS records. This could have 2437 enabled the substitution of an insecure delegation. 2438 - moved version number to 1.4.0 because of 1.3.4 release with only 2439 the NSEC3 patch from the entry above. 2440 - val-log-level: 2 shows extended error information for validation 2441 failures, but still one (longish) line per failure. For example: 2442 validation failure <example.com. DNSKEY IN>: signature expired from 2443 192.0.2.4 for trust anchor example.com. while building chain of trust 2444 validation failure <www.example.com. A IN>: no signatures from 2445 192.0.2.6 for key example.com. while building chain of trust 2446 24476 October 2009: Wouter 2448 - Test set updated to provide additional ns lookup result. 2449 The retry would attempt to fetch the data from other nameservers 2450 for bogus data, and this needed to be provisioned in the tests. 2451 24525 October 2009: Wouter 2453 - first validation failure retry code. Retries for data failures. 2454 And unit test. 2455 24562 October 2009: Wouter 2457 - improve 5011 modularization. 2458 - fix unbound-host so -d can be given before -C. 2459 - iana portlist updated. 2460 246128 September 2009: Wouter 2462 - autotrust-anchor-file can read multiline input and $ORIGIN. 2463 - prevent integer overflow in holddown calculation. review fixes. 2464 - fixed race condition in trust point revocation. review fix. 2465 - review fixes to comments, removed unused code. 2466 246725 September 2009: Wouter 2468 - so-rcvbuf: 4m option added. Set this on large busy servers to not 2469 drop the occasional packet in spikes due to full socket buffers. 2470 netstat -su keeps a counter of UDP dropped due to full buffers. 2471 - review of validator/autotrust.c, small fixes and comments. 2472 247323 September 2009: Wouter 2474 - 5011 query failed counts verification failures, not lookup failures. 2475 - 5011 probe failure handling fixup. 2476 - test unbound reading of original autotrust data. 2477 The metadata per-key, such as key state (PENDING, MISSING, VALID) is 2478 picked up, otherwise performs initial probe like usual. 2479 248022 September 2009: Wouter 2481 - autotrust test with algorithm rollover, new ordering of checks 2482 assists in orderly rollover. 2483 - autotrust test with algorithm rollover to unknown algorithm. 2484 checks if new keys are supported before adding them. 2485 - autotrust test with trust point revocation, becomes unsigned. 2486 - fix DNSSEC-missing-signature detection for minimal responses 2487 for qtype DNSKEY (assumes DNSKEY occurs at zone apex). 2488 248918 September 2009: Wouter 2490 - autotrust tests, fix trustpoint timer deletion code. 2491 fix count of valid anchors during missing remove. 2492 - autotrust: pick up REVOKE even if not signed with known other keys. 2493 249417 September 2009: Wouter 2495 - fix compile of unbound-host when --enable-alloc-checks. 2496 - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis. 2497 - Manual page fixes reported by Tony Finch. 2498 249916 September 2009: Wouter 2500 - Fix memory leak reported by Tao Ma. 2501 - Fix memstats test tool for log-time-ascii log format. 2502 250315 September 2009: Wouter 2504 - iana portlist updated. 2505 250610 September 2009: Wouter 2507 - increased MAXSYSLOGLEN so .bg key can be printed in debug output. 2508 - use linebuffering for log-file: output, this can be significantly 2509 faster than the previous fflush method and enable some class of 2510 resolvers to use high verbosity (for short periods). 2511 Not on windows, because line buffering does not work there. 2512 25139 September 2009: Wouter 2514 - Fix bug where DNSSEC-bogus messages were marked with too high TTL. 2515 The RRsets would still expire at the normal time, but this would 2516 keep messages bogus in the cache for too long. 2517 - regression test for that bug. 2518 - documented that load_cache is meant for debugging. 2519 25208 September 2009: Wouter 2521 - fixup printing errors when load_cache, they were printed to the 2522 SSL connection which broke, now to the log. 2523 - new ldns - with fixed parse of large SOA values. 2524 25257 September 2009: Wouter 2526 - autotrust testbound scenarios. 2527 - autotrust fix that failure count is written to file. 2528 - autotrust fix that keys may become valid after add holddown time 2529 alone, before the probe returns. 2530 25314 September 2009: Wouter 2532 - Changes to make unbound work with libevent-2.0.3 alpha. (in 2533 configure detection due to new ssl dependency in libevent) 2534 - do not call sphinx for documentation when python is disabled. 2535 - remove EV_PERSIST from libevent timeout code to make the code 2536 compatible with the libevent-2.0. Works with older libevent too. 2537 - fix memory leak in python code. 2538 25393 September 2009: Wouter 2540 - Got a patch from Luca Bruno for libunbound support on windows to 2541 pick up the system resolvconf nameservers and hosts there. 2542 - included ldns updated (enum warning fixed). 2543 - makefile fix for parallel makes. 2544 - Patch from Zdenek Vasicek and Attila Nagy for using the source IP 2545 from python scripts. See pythonmod/examples/resip.py. 2546 - doxygen comment fixes. 2547 25482 September 2009: Wouter 2549 - TRAFFIC keyword for testbound. Simplifies test generation. 2550 ${range lower val upper} to check probe timeout values. 2551 - test with 5011-prepublish rollover and revocation. 2552 - fix revocation of RR for autotrust, stray exclamation mark. 2553 25541 September 2009: Wouter 2555 - testbound variable arithmetic. 2556 - autotrust probe time is randomised. 2557 - autotrust: the probe is active and does not fetch from cache. 2558 255931 August 2009: Wouter 2560 - testbound variable processing. 2561 256228 August 2009: Wouter 2563 - fixup unbound-control lookup to print forward and stub servers. 2564 256527 August 2009: Wouter 2566 - autotrust: mesh answer callback is empty. 2567 256826 August 2009: Wouter 2569 - autotrust probing. 2570 - iana portlist updated. 2571 257225 August 2009: Wouter 2573 - fixup memleak in trust anchor unsupported algorithm check. 2574 - iana portlist updated. 2575 - autotrust options: add-holddown, del-holddown, keep-missing. 2576 - autotrust store revoked status of trust points. 2577 - ctime_r compat definition. 2578 - detect yylex_destroy() in configure. 2579 - detect SSL_get_compression_methods declaration in configure. 2580 - fixup DS lookup at anchor point with unsigned parent. 2581 - fixup DLV lookup for DS queries to unsigned domains. 2582 258324 August 2009: Wouter 2584 - cleaner memory allocation on exit. autotrust test routines. 2585 - free all memory on program exit, fix for ssl and flex. 2586 258721 August 2009: Wouter 2588 - autotrust: debug routines. Read,write and conversions work. 2589 259020 August 2009: Wouter 2591 - autotrust: save and read trustpoint variables. 2592 259319 August 2009: Wouter 2594 - autotrust: state table updates. 2595 - iana portlist updated. 2596 259717 August 2009: Wouter 2598 - autotrust: process events. 2599 260017 August 2009: Wouter 2601 - Fix so that servers are only blacklisted if they fail to reply 2602 to 16 queries in a row and the timeout gets above 2 minutes. 2603 - autotrust work, split up DS verification of DNSKEYs. 2604 260514 August 2009: Wouter 2606 - unbound-control lookup prints out infra cache information, like RTT. 2607 - Fix bug in DLV lookup reported by Amanda from Secure64. 2608 It could sometimes wrongly classify a domain as unsigned, which 2609 does not give the AD bit on replies. 2610 261113 August 2009: Wouter 2612 - autotrust read anchor files. locked trust anchors. 2613 261412 August 2009: Wouter 2615 - autotrust import work. 2616 261711 August 2009: Wouter 2618 - Check for openssl compatible with gost if enabled. 2619 - updated unit test for GOST=211 code. 2620 Nicer naming of test files. 2621 - iana portlist updated. 2622 26237 August 2009: Wouter 2624 - call OPENSSL_config() in unbound and unit test so that the 2625 operator can use openssl.cnf for configuration options. 2626 - removed small memory leak from config file reader. 2627 26286 August 2009: Wouter 2629 - configure --enable-gost for GOST support, experimental 2630 implementation of draft-dolmatov-dnsext-dnssec-gost-01. 2631 - iana portlist updated. 2632 - ldns tarball updated (with GOST support). 2633 26345 August 2009: Wouter 2635 - trunk moved to 1.3.4. 2636 26374 August 2009: Wouter 2638 - Added test that the examples from draft rsasha256-14 verify. 2639 - iana portlist updated. 2640 - tagged 1.3.3 2641 26423 August 2009: Wouter 2643 - nicer warning when algorithm not supported, tells you to upgrade. 2644 - iana portlist updated. 2645 264627 July 2009: Wouter 2647 - Updated unbound-cacti contribution from Dmitriy Demidov, with 2648 the queue statistics displayed in its own graph. 2649 - iana portlist updated. 2650 265122 July 2009: Wouter 2652 - Fix bug found by Michael Tokarev where unbound would try to 2653 prime the root servers even though forwarders are configured for 2654 the root. 2655 - tagged 1.3.3rc1 2656 265721 July 2009: Wouter 2658 - Fix server selection, so that it waits for open target queries when 2659 faced with lameness. 2660 266120 July 2009: Wouter 2662 - Ignore transient sendto errors, no route to host, and host, net down. 2663 - contrib/update-anchor.sh has -r option for root-hints. 2664 - feature val-log-level: 1 prints validation failures so you can 2665 keep track of them during dnssec deployment. 2666 266716 July 2009: Wouter 2668 - fix replacement malloc code. Used in crosscompile. 2669 - makedist -w creates crosscompiled setup.exe on fedora11. 2670 267115 July 2009: Wouter 2672 - dependencies for compat items, for crosscompile. 2673 - mingw32 crosscompile changes, dependencies and zipfile creation. 2674 and with System.dll from the windows NSIS you can make setup.exe. 2675 - package libgcc_s_sjlj exception handler for NSISdl.dll. 2676 267714 July 2009: Wouter 2678 - updated ldns tarball for solaris x64 compile assistance. 2679 - no need to define RAND_MAX from config.h. 2680 - iana portlist updated. 2681 - configure changes and ldns update for mingw32 crosscompile. 2682 268313 July 2009: Wouter 2684 - Fix for crash at start on windows. 2685 - tag for release 1.3.2. 2686 - trunk has version 1.3.3. 2687 - Fix for ID bits on windows to use all 16. RAND_MAX was not 2688 defined like you'd expect on mingw. Reported by Mees de Roo. 2689 26909 July 2009: Wouter 2691 - tag for release 1.3.1. 2692 - trunk has version 1.3.2. 2693 26947 July 2009: Wouter 2695 - iana portlist updated. 2696 26976 July 2009: Wouter 2698 - prettier error handling in SSL setup. 2699 - makedist.sh uname fix (same as ldns). 2700 - updated fedora spec file. 2701 27023 July 2009: Wouter 2703 - fixup linking when ldnsdir is "". 2704 270530 June 2009: Wouter 2706 - more lenient truncation checks. 2707 270829 June 2009: Wouter 2709 - ldns trunk r2959 imported as tarball, because of solaris cc compile 2710 support for c99. r2960 for better configure. 2711 - better wrongly_truncated check. 2712 - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to 2713 avoid dropped packets at routers. 2714 271526 June 2009: Wouter 2716 - Fix EDNS fallback when EDNS works for short answers but long answers 2717 are dropped. 2718 271922 June 2009: Wouter 2720 - fixup iter priv strict aliasing while preserving size of sockaddr. 2721 - iana portlist updated. (one less port allocated, one more fraction 2722 of a bit for security!) 2723 - updated fedora specfile in contrib from Paul Wouters. 2724 272519 June 2009: Wouter 2726 - Fixup strict aliasing warning in iter priv code. 2727 and config_file code. 2728 - iana portlist updated. 2729 - harden-referral-path: handle cases where NS is in answer section. 2730 273118 June 2009: Wouter 2732 - Fix of message parse bug where (specifically) an NSEC and RRSIG 2733 in the wrong order would be parsed, but put wrongly into internal 2734 structures so that later validation would fail. 2735 - Extreme lenience for wrongly truncated replies where a positive 2736 reply has an NS in the authority but no signatures. They are 2737 turned into minimal responses with only the (secure) answer. 2738 - autoconf 2.63 for configure. 2739 - python warnings suppress. Keep python API away from header files. 2740 274117 June 2009: Wouter 2742 - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was 2743 used for the python code in unbound. (http://www.nic.cz/vip/ in cz). 2744 274516 June 2009: Wouter 2746 - Fixup opportunistic target query generation to it does not 2747 generate queries that are known to fail. 2748 - Touchup on munin total memory report. 2749 - messages picked out of the cache by the iterator are checked 2750 if their cname chain is still correct and if validation status 2751 has to be reexamined. 2752 275315 June 2009: Wouter 2754 - iana portlist updated. 2755 275614 June 2009: Wouter 2757 - Fixed bug where cached responses would lose their security 2758 status on second validation, which especially impacted dlv 2759 lookups. Reported by Hauke Lampe. 2760 276113 June 2009: Wouter 2762 - bug #254. removed random whitespace from example.conf. 2763 276412 June 2009: Wouter 2765 - Fixup potential wrong NSEC picked out of the cache. 2766 - If unfulfilled callbacks are deleted they are called with an error. 2767 - fptr wlist checks for mesh callbacks. 2768 - fwd above stub in configuration works. 2769 277011 June 2009: Wouter 2771 - Fix queries for type DS when forward or stub zones are there. 2772 They are performed to higherup domains, and thus treated as if 2773 going to higher zones when looking up the right forward or stub 2774 server. This makes a stub pointing to a local server that has 2775 a local view of example.com signed with the same keys as are 2776 publicly used work. Reported by Johan Ihren. 2777 - Added build-unbound-localzone-from-hosts.pl to contrib, from 2778 Dennis DeDonatis. It converts /etc/hosts into config statements. 2779 - same thing fixed for forward-zone and DS, chain of trust from 2780 public internet into the forward-zone works now. Added unit test. 2781 27829 June 2009: Wouter 2783 - openssl key files are opened apache-style, when user is root and 2784 before chrooting. This makes permissions on remote-control key 2785 files easier to set up. Fixes bug #251. 2786 - flush_type and flush_name remove msg cache entries. 2787 - codereview - dp copy bogus setting fix. 2788 27898 June 2009: Wouter 2790 - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause 2791 inadvertant behaviour. 2792 - 1.3.0 tarball for release created. 2793 - 1.3.1 development in svn trunk. 2794 - iana portlist updated. 2795 - fix lint from complaining on ldns/sha.h. 2796 - help compiler figure out aliasing in priv_rrset_bad() routine. 2797 - fail to configure with python if swig is not found. 2798 - unbound_munin_ in contrib uses ps to show rss if sbrk does not work. 2799 28003 June 2009: Wouter 2801 - fixup bad free() when wrongly encoded DSA signature is seen. 2802 Reported by Paul Wouters. 2803 - review comments from Matthijs. 2804 28052 June 2009: Wouter 2806 - --enable-sha2 option. The draft rsasha256 changed its algorithm 2807 numbers too often. Therefore it is more prudent to disable the 2808 RSASHA256 and RSASHA512 support by default. 2809 - ldns trunk included as new tarball. 2810 - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point. 2811 281229 May 2009: Wouter 2813 - fixup doc bug in README reported by Matthew Dempsky. 2814 281528 May 2009: Wouter 2816 - update iana port list 2817 - update ldns lib tarball 2818 281927 May 2009: Wouter 2820 - detect lack of IPv6 support on XP (with a different error code). 2821 - Fixup a crash-on-exit which was triggered by a very long queue. 2822 Unbound would try to re-use ports that came free, but this is 2823 of course not really possible because everything is deleted. 2824 Most easily triggered on XP (not Vista), maybe because of the 2825 network stack encouraging large messages backlogs. 2826 - change in debug statements. 2827 - Fixed bug that could cause a crash if root prime failed when there 2828 were message backlogs. 2829 283026 May 2009: Wouter 2831 - Thanks again to Brett Carr, found an assertion that was not true. 2832 Assertion checked if recursion parent query still existed. 2833 283429 April 2009: Wouter 2835 - Thanks to Brett Carr, caught windows resource leak, use 2836 closesocket() and not close() on sockets or else the network stack 2837 starts to leak handles. 2838 - Removed usage of windows Mutex because windows cannot handle enough 2839 mutexes open. Provide own mutex implementation using primitives. 2840 284128 April 2009: Wouter 2842 - created svn tag for 1.3.0. 2843 284427 April 2009: Wouter 2845 - optimised cname from cache. 2846 - ifdef windows functions in testbound. 2847 284823 April 2009: Wouter 2849 - fix for threadsafety in solaris thr_key_create() in tests. 2850 - iana portlist updated. 2851 - fix pylib test for Darwin. 2852 - fix pymod test for Darwin and a python threading bug in pymod init. 2853 - check python >= 2.4 in configure. 2854 - -ldl check for libcrypto 1.0.0beta. 2855 285621 April 2009: Wouter 2857 - fix for build outside sourcedir. 2858 - fix for configure script swig detection. 2859 286017 April 2009: Wouter 2861 - Fix reentrant in minievent handler for unix. Could have resulted 2862 in spurious event callbacks. 2863 - timers do not take up a fd slot for winsock handler. 2864 - faster fix for winsock reentrant check. 2865 - fix rsasha512 unit test for new (interim) algorithm number. 2866 - fix test:ldns doesn't like DOS line endings in keyfiles on unix. 2867 - fix compile warning on ubuntu (configlexer fwrite return value). 2868 - move python include directives into CPPFLAGS instead of CFLAGS. 2869 287016 April 2009: Wouter 2871 - winsock event handler exit very quickly on signal, even if 2872 under heavy load. 2873 - iana portlist updated. 2874 - fixup windows winsock handler reentrant problem. 2875 287614 April 2009: Wouter 2877 - bug #245: fix munin plugin, perform cleanup of stale lockfiles. 2878 - makedist.sh; better help text. 2879 - cache-min-ttl option and tests. 2880 - mingw detect error condition on TCP sockets (NOTCONN). 2881 28829 April 2009: Wouter 2883 - Fix for removal of RSASHA256_NSEC3 protonumber from ldns. 2884 - ldns tarball updated. 2885 - iana portlist update. 2886 - detect GOST support in openssl-1.0.0-beta1, and fix compile problem 2887 because that openssl defines the name STRING for itself. 2888 28896 April 2009: Wouter 2890 - windows compile fix. 2891 - Detect FreeBSD jail without ipv6 addresses assigned. 2892 - python libunbound wrapper unit test. 2893 - installs the following files. Default is to not build them. 2894 from configure --with-pythonmodule: 2895 /usr/lib/python2.x/site-packages/unboundmodule.py 2896 from configure --with-pyunbound: 2897 /usr/lib/python2.x/site-packages/unbound.py 2898 /usr/lib/python2.x/site-packages/_unbound.so* 2899 The example python scripts (pythonmod/examples and 2900 libunbound/python/examples) are not installed. 2901 - python invalidate routine respects packed rrset ids and locks. 2902 - clock skew checks in unbound, config statements. 2903 - nxdomain ttl considerations in requirements.txt 2904 29053 April 2009: Wouter 2906 - Fixed a bug that caused messages to be stored in the cache too 2907 long. Hard to trigger, but NXDOMAINs for nameservers or CNAME 2908 targets have been more vulnerable to the TTL miscalculation bug. 2909 - documentation test fixed for python addition. 2910 29112 April 2009: Wouter 2912 - pyunbound (libunbound python plugin) compiles using libtool. 2913 - documentation for pythonmod and pyunbound is generated in doc/html. 2914 - iana portlist updated. 2915 - fixed bug in unbound-control flush_zone where it would not flush 2916 every message in the target domain. This especially impacted 2917 NXDOMAIN messages which could remain in the cache regardless. 2918 - python module test package. 2919 29201 April 2009: Wouter 2921 - suppress errors when trying to contact authority servers that gave 2922 ipv6 AAAA records for their nameservers with ipv4 mapped contents. 2923 Still tries to do so, could work when deployed in intranet. 2924 Higher verbosity shows the error. 2925 - new libunbound calls documented. 2926 - pyunbound in libunbound/python. Removed compile warnings. 2927 Makefile to make it. 2928 292930 March 2009: Wouter 2930 - Fixup LDFLAGS from libevent sourcedir compile configure restore. 2931 - Fixup so no non-absolute rpaths are added. 2932 - Fixup validation of RRSIG queries, they are let through. 2933 - read /dev/random before chroot 2934 - checkconf fix no python checks when no python module enabled. 2935 - fix configure, pthread first, so other libs do not change outcome. 2936 293727 March 2009: Wouter 2938 - nicer -h output. report linked libraries and modules. 2939 - prints modules in intuitive order (config file friendly). 2940 - python compiles easily on BSD. 2941 294226 March 2009: Wouter 2943 - ignore swig varargs warnings with gcc. 2944 - remove duplicate example.conf text from python example configs. 2945 - outofdir compile fix for python. 2946 - pyunbound works. 2947 - print modules compiled in on -h. manpage. 2948 294925 March 2009: Wouter 2950 - initial import of the python contribution from Zdenek Vasicek and 2951 Marek Vavrusa. 2952 - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0. 2953 295424 March 2009: Wouter 2955 - more neat configure.ac. Removed duplicate config.h includes. 2956 - neater config.h.in. 2957 - iana portlist updated. 2958 - fix util/configlexer.c and solaris -std=c99 flag. 2959 - fix postcommit aclocal errors. 2960 - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R. 2961 - swap order of host detect and libtool generation. 2962 296323 March 2009: Wouter 2964 - added launchd plist example file for MacOSX to contrib. 2965 - deprecation test for daemon(3). 2966 - moved common configure actions to m4 include, prettier Makefile. 2967 296820 March 2009: Wouter 2969 - bug #239: module-config entries order is important. Documented. 2970 - build fix for test asynclook. 2971 297219 March 2009: Wouter 2973 - winrc/README.txt dos-format text file. 2974 - iana portlist updated. 2975 - use _beginthreadex() when available (performs stack alignment). 2976 - defaults for windows baked into configure.ac (used if on mingw). 2977 297818 March 2009: Wouter 2979 - Added tests, unknown algorithms become insecure. fallback works. 2980 - Fix for and test for unknown algorithms in a trust anchor 2981 definition. Trust anchors with no supported algos are ignored. 2982 This means a (higher)DS or DLV entry for them could succeed, and 2983 otherwise they are treated as insecure. 2984 - domain-insecure: "example.com" statement added. Sets domain 2985 insecure regardless of chain of trust DSs or DLVs. The inverse 2986 of a trust-anchor. 2987 298817 March 2009: Wouter 2989 - unit test for unsupported algorithm in anchor warning. 2990 - fixed so queries do not fail on opportunistic target queries. 2991 299216 March 2009: Wouter 2993 - fixup diff error printout in contrib/update-itar.sh. 2994 - added contrib/unbound_cacti for statistics support in cacti, 2995 contributed by Dmitriy Demidov. 2996 299713 March 2009: Wouter 2998 - doxygen and lex/yacc on linux. 2999 - strip update-anchor on makedist -w. 3000 - fix testbound on windows. 3001 - default log to syslog for windows. 3002 - uninstaller can stop unbound - changed text on it to reflect that. 3003 - remove debugging from windows 'cron' actions. 3004 300512 March 2009: Wouter 3006 - log to App.logs on windows prints executable identity. 3007 - fixup tests. 3008 - munin plugin fix benign locking error printout. 3009 - anchor-update for windows, called every 24 hours; unbound reloads. 3010 301111 March 2009: Wouter 3012 - winsock event handler resets WSAevents after signalled. 3013 - winsock event handler tests if signals are really signalled. 3014 - install and service with log to file works on XP and Vista on 3015 default install location. 3016 - on windows logging to the Application logbook works (as a service). 3017 - fix RUN_DIR on windows compile setting in makedist. 3018 - windows registry has Software\Unbound\ConfigFile element. 3019 If does not exist, the default is used. The -c switch overrides it. 3020 - fix makedist version cleanup function. 3021 302210 March 2009: Wouter 3023 - makedist -w strips out old rc.. and snapshot info from version. 3024 - setup.exe starts and stops unbound after install, before uninstall. 3025 - unbound-checkconf recognizes absolute pathnames on windows (C:...). 3026 30279 March 2009: Wouter 3028 - Nullsoft NSIS installer creation script. 3029 30305 March 2009: Wouter 3031 - fixup memory leak introduced on 18feb in mesh reentrant fix. 3032 30333 March 2009: Wouter 3034 - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8). 3035 - service works on xp/vista, no config necessary (using defaults). 3036 - windows registry settings. 3037 30382 March 2009: Wouter 3039 - fixup --export-symbols to be -export-symbls for libtool. 3040 This should fix extraneous symbols exported from libunbound. 3041 Thanks to Ondrej Sury and Robert Edmonds for finding it. 3042 - iana portlist updated. 3043 - document FAQ entry on stub/forward zones and default blocking. 3044 - fix asynclook test app for libunbound not exporting symbols. 3045 - service install and remove utils that work with vista UAC. 3046 304727 February 2009: Wouter 3048 - Fixup lexer, to not give warnings about fwrite. Appeared in 3049 new lexer features. 3050 - makedistro functionality for mingw. Has RC support. 3051 - support spaces and backslashes in configured defaults paths. 3052 - register, deregister in service control manager. 3053 305425 February 2009: Wouter 3055 - windres usage for application resources. 3056 305724 February 2009: Wouter 3058 - isc moved their dlv key download location. 3059 - fixup warning on vista/mingw. 3060 - makedist -w for window zip distribution first version. 3061 306220 February 2009: Wouter 3063 - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped. 3064 Nicer script layout. Added url to site in -h output. 3065 306619 February 2009: Wouter 3067 - unbound-checkconf and unbound print warnings when trust anchors 3068 have unsupported algorithms. 3069 - added contrib/update-itar.sh This script is similar to 3070 update-anchor.sh, and updates from the IANA ITAR repository. 3071 You can provide your own PGP key and trust repo, or can use the 3072 builtin. The program uses wget and gpg to work. 3073 - iana portlist updated. 3074 - update-itar.sh: using ftp:// urls because https godaddy certificate 3075 is not available everywhere and then gives fatal errors. The 3076 security is provided by pgp signature. 3077 307818 February 2009: Wouter 3079 - more cycle detection. Also for target queries. 3080 - fixup bug where during deletion of the mesh queries the callbacks 3081 that were reentrant caused assertion failures. Keep the mesh in 3082 a reentrant safe state. Affects libunbound, reload of server, 3083 on quit and flush_requestlist. 3084 - iana portlist updated. 3085 308613 February 2009: Wouter 3087 - forwarder information now per-thread duplicated. 3088 This keeps it read only for speed, with no locking necessary. 3089 - forward command for unbound control to change forwarders to use 3090 on the fly. 3091 - document that unbound-host reads no config file by default. 3092 - updated iana portlist. 3093 309412 February 2009: Wouter 3095 - call setusercontext if available (on BSD). 3096 - small refactor of stats clearing. 3097 - #227: flush_stats feature for unbound-control. 3098 - stats_noreset feature for unbound-control. 3099 - flush_requestlist feature for unbound-control. 3100 - libunbound version upped API (was changed 5 feb). 3101 - unbound-control status shows if root forwarding is in use. 3102 - slightly nicer memory management in iter-fwd code. 3103 310410 February 2009: Wouter 3105 - keys with rfc5011 REVOKE flag are skipped and not considered when 3106 validating data. 3107 - iana portlist updated 3108 - #226: dump_requestlist feature for unbound-control. 3109 31106 February 2009: Wouter 3111 - contrib contains specfile for fedora 1.2.1 (from Paul Wouters). 3112 - iana portlist updated. 3113 - fixup EOL in include directive (reported by Paul Wouters). 3114 You can no longer specify newlines in the names of included files. 3115 - config parser changed. Gives some syntax errors closer to where they 3116 occurred. Does not enforce a space after keyword anymore. 3117 Does not allow literal newlines inside quoted strings anymore. 3118 - verbosity level 5 logs customer IP for new requestlist entries. 3119 - test fix, lexer and cancel test. 3120 - new option log-time-ascii: yes if you enable it prints timestamps 3121 in the log file as Feb 06 13:45:26 (like syslog does). 3122 - detect event_base_new in libevent-1.4.1 and later and use it. 3123 - #231 unbound-checkconf -o option prints that value from config file. 3124 Useful for scripting in management scripts and the like. 3125 31265 February 2009: Wouter 3127 - ldns 1.5.0 rc as tarball included. 3128 - 1.3.0 development continues: 3129 change in libunbound API: ub_cancel can return an error, that 3130 the async_id did not exist, or that it was already delivered. 3131 The result could have been delivered just before the cancel 3132 routine managed to acquire the lock, so a caller may get the 3133 result at the same time they call cancel. For this case, 3134 ub_cancel tries to return an error code. 3135 Fixes race condition in ub_cancel() libunbound function. 3136 - MacOSX Leopard cleaner text output from configure. 3137 - initgroups(3) is called to drop secondary group permissions, if 3138 applicable. 3139 - configure option --with-ldns-builtin forces the use of the 3140 inluded ldns package with the unbound source. The -I include 3141 is put before the others, so it avoids bad include files from 3142 an older ldns install. 3143 - daemon(3) posix call is used when available. 3144 - testbound test for older fix added. 3145 31464 February 2009: Wouter 3147 - tag for release 1.2.1. 3148 - trunk setup for 1.3.0 development. 3149 31503 February 2009: Wouter 3151 - noted feature requests in doc/TODO. 3152 - printout more detailed errors on ssl certificate loading failures. 3153 - updated IANA portlist. 3154 315516 January 2009: Wouter 3156 - more quiet about ipv6 network failures, i.e. when ipv6 is not 3157 available (network unreachable). Debug still printed on high 3158 verbosity. 3159 - unbound-host -4 and -6 options. Stops annoying ipv6 errors when 3160 debugging with unbound-host -4 -d ... 3161 - more cycle detection for NS-check, addr-check, root-prime and 3162 stub-prime queries in the iterator. Avoids possible deadlock 3163 when priming fails. 3164 316515 January 2009: Wouter 3166 - bug #229: fixup configure checks for compilation with Solaris 3167 Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc 3168 - fixup suncc warnings. 3169 - fix bug where unbound could crash using libevent 1.3 and older. 3170 - update testset for recent retry change. 3171 317214 January 2009: Wouter 3173 - 1.2.1 feature: negative caching for failed queries. 3174 Queries that failed are cached for 5 seconds (NORR_TTL). 3175 If the failure is local, like out of memory, it is not cached. 3176 - the TTL comparison for the cache used different comparisons, 3177 causing many cache responses that used the iterator and validator 3178 state machines unnecessarily. 3179 - retry from 4 to 5 so that EDNS drop retry is part of the first 3180 query resolve attempt, and cached error does not stop EDNS fallback. 3181 - remove debug prints that protect against bad referrals. 3182 - honor QUIET=no on make commandline (or QUIET=yes ). 3183 318413 January 2009: Wouter 3185 - fixed bug in lameness marking, removed printouts. 3186 - find NS rrset more cleanly for qtype NS. 3187 - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for 3188 reporting and logs. 3189 - 1.2.1 feature: stops resolving AAAAs promiscuously when they 3190 are in the negative cache. 3191 319212 January 2009: Wouter 3193 - fixed bug in infrastructure lameness cache, did not lowercase 3194 name of zone to hash when setting lame. 3195 - lameness debugging printouts. 3196 31979 January 2009: Wouter 3198 - created svn tag for 1.2.0 release. 3199 - svn trunk contains 1.2.1 version number. 3200 - iana portlist updated for todays list. 3201 - removed debug print. 3202 32038 January 2009: Wouter 3204 - new version of ldns-trunk (today) included as tarball, fixed 3205 bug #224, building with -j race condition. 3206 - remove possible race condition in the test for race conditions. 3207 32087 January 2009: Wouter 3209 - version 1.2.0 in preparation. 3210 - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file 3211 statements. (Adapted from patch by Paul Wouters). 3212 - typo fix and iana portlist updated. 3213 - porting testsuite; unused var warning, and type fixup. 3214 32156 January 2009: Wouter 3216 - fixup packet-of-death when compiled with --enable-debug. 3217 A malformed packet could cause an internal assertion failure. 3218 - added test for HINFO canonicalisation behaviour. 3219 - fixup reported problem with transparent local-zone data where 3220 queries with different type could get nxdomain. Now queries 3221 with a different name get resolved normally, with different type 3222 get a correct NOERROR/NODATA answer. 3223 - HINFO no longer downcased for validation, making unbound compatible 3224 with bind and ldns. 3225 - fix reading included config files when chrooted. 3226 Give full path names for include files. 3227 Relative path names work if the start dir equals the working dir. 3228 - fix libunbound message transport when no packet buffer is available. 3229 32305 January 2009: Wouter 3231 - fixup getaddrinfo failure handling for remote control port. 3232 - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints. 3233 - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/ 3234 - comm_timer_set performs base_set operation after event_add. 3235 323618 December 2008: Wouter 3237 - fixed bug reported by Duane Wessels: error in DLV lookup, would make 3238 some zones that had correct DLV keys as insecure. 3239 - follows -rc makedist from ldns changes (no _rc). 3240 - ldns tarball updated with 1.4.1rc for DLV unit test. 3241 - verbose prints about recursion lame detection and server selection. 3242 - fixup BSD port for infra host storage. It hashed wrongly. 3243 - fixup makedist snapshot name generation. 3244 - do not reopen syslog to avoid dev/log dependency. 3245 324617 December 2008: Wouter 3247 - follows ldns makedist.sh. -rc option. autom4te dir removed. 3248 - unbound-control status command. 3249 - extended statistics has a number of ipv6 queries counter. 3250 contrib/unbound_munin_ was updated to draw ipv6 in the hits graph. 3251 325216 December 2008: Wouter 3253 - follow makedist improvements from ldns, for maintainers prereleases. 3254 - snapshot version uses _ not - to help rpm distinguish the 3255 version number. 3256 325711 December 2008: Wouter 3258 - better fix for bug #219: use LOG_NDELAY with openlog() call. 3259 Thanks to Tamas Tevesz. 3260 32619 December 2008: Wouter 3262 - bug #221 fixed: unbound checkconf checks if key files exist if 3263 remote control is enabled. Also fixed NULL printf when not chrooted. 3264 - iana portlist updated. 3265 32663 December 2008: Wouter 3267 - Fix problem reported by Jaco Engelbrecht where unbound-control stats 3268 freezes up unbound if this was compiled without threading, and 3269 was using multiple processes. 3270 - iana portlist updated. 3271 - test for remote control with interprocess communication. 3272 - created command distribution mechanism so that remote control 3273 commands other than 'stats' work on all processes in a nonthreaded 3274 compiled version. dump/load cache work, on the first process. 3275 - fixup remote control local_data addition memory corruption bug. 3276 32771 December 2008: Wouter 3278 - SElinux policy files in contrib/selinux for the unbound daemon, 3279 by Paul Wouters and Adam Tkac. 3280 328125 November 2008: Wouter 3282 - configure complains when --without-ssl is given (bug #220). 3283 - skip unsupported feature tests on vista/mingw. 3284 - fixup testcode/streamtcp to work on vista/mingw. 3285 - root-hints test checks version of dig required. 3286 - blacklisted servers are polled at a low rate (1%) to see if they 3287 come back up. But not if there is some other working server. 3288 328924 November 2008: Wouter 3290 - document that the user of the server daemon needs read privileges 3291 on the keys and certificates generated by unbound-control-setup. 3292 This is different per system or distribution, usually, running the 3293 script under the same username as the server uses suffices. 3294 i.e. sudo -u unbound unbound-control-setup 3295 - testset port to vista/mingw. 3296 - tcp_sigpipe to freebsd port. 3297 329821 November 2008: Wouter 3299 - fixed tcp accept, errors were printed when they should not. 3300 - unbound-control-setup.sh removes read/write permissions other 3301 from the keys it creates (as suggested by Dmitriy Demidov). 3302 330320 November 2008: Wouter 3304 - fixup fatal error due to faulty error checking after tcp accept. 3305 - add check in rlimit to avoid integer underflow. 3306 - rlimit check with new formula; better estimate for number interfaces 3307 - nicer comments in rlimit check. 3308 - tag 1.1.1 created in svn. 3309 - trunk label is 1.1.2 3310 331119 November 2008: Wouter 3312 - bug #219: fixed so that syslog which delays opening until the first 3313 log line is written, gets a log line while not chroot'ed yet. 3314 331518 November 2008: Wouter 3316 - iana portlist updated. 3317 - removed cast in unit test debug print that was not 64bit safe. 3318 - trunk back to 1.1.0; copied to tags 1.1.0 release. 3319 - trunk to has version number 1.1.1 again. 3320 - in 1.1.1; make clean nicer. grammar in manpage. 3321 332217 November 2008: Wouter 3323 - theoretical fix for problems reported on mailing list. 3324 If a delegation point has no A but only AAAA and do-ip6 is no, 3325 resolution would fail. Fixed to ask for the A and AAAA records. 3326 It has to ask for both always, so that it can fail quietly, from 3327 TLD perspective, when a zone is only reachable on one transport. 3328 - test for above, only AAAA and doip6 is no. Fix causes A record 3329 for nameserver to be fetched. 3330 - fixup address duplication on cache fillup for delegation points. 3331 - testset updated for new query answer requirements. 3332 333314 November 2008: Wouter 3334 - created 1.1.0 release tag in svn. 3335 - trunk moved to 1.1.1 3336 - fixup unittest-neg for locking. 3337 333813 November 2008: Wouter 3339 - added fedora init and specfile to contrib (by Paul Wouters). 3340 - added configure check for ldns 1.4.0 (using its compat funcs). 3341 - neater comments in worker.h. 3342 - removed doc/plan and updated doc/TODO. 3343 - silenced EHOSTDOWN (verbosity 2 or higher to see it). 3344 - review comments from Jelte, Matthijs. Neater code. 3345 334612 November 2008: Wouter 3347 - add unbound-control manpage to makedist replace list. 3348 334911 November 2008: Wouter 3350 - unit test for negative cache, stress tests the refcounting. 3351 - fix for refcounting error that could cause fptr_wlist fatal exit 3352 in the negative cache rbtree (upcoming 1.1 feature). (Thanks to 3353 Attila Nagy for testing). 3354 - nicer comments in cachedump about failed RR to string conversion. 3355 - fix 32bit wrap around when printing large (4G and more) mem usage 3356 for extended statistics. 3357 335810 November 2008: Wouter 3359 - fixup the getaddrinfo compat code rename. 3360 33618 November 2008: Wouter 3362 - added configure check for eee build warning. 3363 33647 November 2008: Wouter 3365 - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4. 3366 - detect nonblocking problems in network stack in configure script. 3367 33686 November 2008: Wouter 3369 - dname_priv must decompress the name before comparison. 3370 - iana portlist updated. 3371 33725 November 2008: Wouter 3373 - fixed possible memory leak in key_entry_key deletion. 3374 Would leak a couple bytes when trust anchors were replaced. 3375 - if query and reply qname overlap, the bytes are skipped not copied. 3376 - fixed file descriptor leak when messages were jostled out that 3377 had outstanding (TCP) replies. 3378 - DNAMEs used from cache have their synthesized CNAMEs initialized 3379 properly. 3380 - fixed file descriptor leak for localzone type deny (for TCP). 3381 - fixed memleak at exit for nsec3 negative cached zones. 3382 - fixed memleak for the keyword 'nodefault' when reading config. 3383 - made verbosity of 'edns incapable peer' warning higher, so you 3384 do not get spammed by it. 3385 - caught elusive Bad file descriptor error bug, that would print the 3386 error while unnecessarily try to listen to a closed fd. Fixed. 3387 33884 November 2008: Wouter 3389 - fixed -Wwrite-strings warnings that result in better code. 3390 33913 November 2008: Wouter 3392 - fixup build process for Mac OSX linker, use ldns b32 compat funcs. 3393 - generated configure with autoconf-2.61. 3394 - iana portlist updated. 3395 - detect if libssl needs libdl. For static linking with libssl. 3396 - changed to use new algorithm identifiers for sha256/sha512 3397 from ldns 1.4.0 (need very latest version). 3398 - updated the included ldns tarball. 3399 - proper detection of SHA256 and SHA512 functions (not just sizes). 3400 340123 October 2008: Wouter 3402 - a little more debug info for failure on signer names. prints names. 3403 340422 October 2008: Wouter 3405 - CFLAGS are picked up by configure from the environment. 3406 - iana portlist updated. 3407 - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too. 3408 - new stub-prime: yesno option. Default is off, so it does not prime. 3409 can be turned on to get same behaviour as previous unbound release. 3410 - made automated test that checks if builtin root hints are uptodate. 3411 - finished draft-wijngaards-dnsext-resolver-side-mitigation 3412 implementation. The unwanted-reply-threshold can be set. 3413 - fixup so fptr_whitelist test in alloc.c works. 3414 341521 October 2008: Wouter 3416 - fix update-anchors.sh, so it does not report different RR order 3417 as an update. Sorts the keys in the file. Updated copyright. 3418 - fixup testbound on windows, the command control pipe doesn't exist. 3419 - skip 08hostlib test on windows, no fork() available. 3420 - made unbound-remote work on windows. 3421 342220 October 2008: Wouter 3423 - quench a log message that is debug only. 3424 - iana portlist updated. 3425 - do not query bogus nameservers. It is like nameservers that have 3426 the NS or A or AAAA record bogus are listed as donotquery. 3427 - if server selection is faced with only bad choices, it will 3428 attempt to get more options to be fetched. 3429 - changed bogus-ttl default value from 900 to 60 seconds. 3430 In anticipation that operator caused failures are more likely than 3431 actual attacks at this time. And thus repeated validation helps 3432 the operators get the problem fixed sooner. It makes validation 3433 failures go away sooner (60 seconds after the zone is fixed). 3434 Also it is likely to try different nameserver targets every minute, 3435 so that if a zone is bad on one server but not another, it is 3436 likely to pick up the 'correct' one after a couple minutes, 3437 and if the TTL is big enough that solves validation for the zone. 3438 - fixup unbound-control compilation on windows. 3439 344017 October 2008: Wouter 3441 - port Leopard/G5: fixup type conversion size_t/uint32. 3442 please ranlib, stop file without symbols warning. 3443 - harden referral path now also validates the root after priming. 3444 It looks up the root NS authoritatively as well as the root servers 3445 and attemps to validate the entries. 3446 344716 October 2008: Wouter 3448 - Fixup negative TTL values appearing (reported by Attila Nagy). 3449 345015 October 2008: Wouter 3451 - better documentation for 0x20; remove fallback TODO, it is done. 3452 - harden-referral-path feature includes A, AAAA queries for glue, 3453 as well as very careful NS caching (only when doing NS query). 3454 A, AAAA use the delegation from the NS-query. 3455 345614 October 2008: Wouter 3457 - fwd_three.tpkg test was flaky. If the three requests hit the 3458 wrong threads by chance (or bad OS) then the test would fail. 3459 Made less flaky by increasing number of retries. 3460 - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs. 3461 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014). 3462 Which includes the ldns_dname_absolute fix. 3463 - fwd_three test remains flaky now that unbound does not stop 3464 listening when full. Thus, removed timeout problem. 3465 It may be serviced by three threads, or maybe by one. 3466 Mostly only useful for lock-check testing now. 3467 346813 October 2008: Wouter 3469 - fixed recursion servers deployed as authoritative detection, so 3470 that as a last resort, a +RD query is sent there to get the 3471 correct answer. 3472 - iana port list update. 3473 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013). 3474 347510 October 2008: Wouter 3476 - fixup tests - the negative cache contained the correct NSEC3s for 3477 two tests that are supposed to fail to validate. 3478 34799 October 2008: Wouter 3480 - negative cache caps max iterations of NSEC3 done. 3481 - NSEC3 negative cache for qtype DS works. 3482 34838 October 2008: Wouter 3484 - NSEC negative cache for DS. 3485 34866 October 2008: Wouter 3487 - jostle-timeout option, so you can config for slow links. 3488 - 0x20 fallback code. Tries 3xnumber of nameserver addresses 3489 queries that must all be the same. Sent to random nameservers. 3490 - documented choices for DoS, EDNS, 0x20. 3491 34922 October 2008: Wouter 3493 - fixup unlink of pidfile. 3494 - fixup SHA256 algorithm collation code. 3495 - contrib/update-anchor.sh does not overwrite anchors if not needed. 3496 exits 0 when a restart is needed, other values if not. 3497 so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart 3498 can restart unbound exactly when needed. 3499 350030 September 2008: Wouter 3501 - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1. 3502 - tests for sha256 support and downgrade resistance. 3503 - RSASHA256 and RSASHA512 support (using the draft in dnsext), 3504 using the drafted protocol numbers. 3505 - when using stub on localhost (127.0.0.1@10053) unbound works. 3506 Like when running NSD to host a local zone, on the same machine. 3507 The noprime feature. manpages more explanation. Added a test for it. 3508 - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com" 3509 351029 September 2008: Wouter 3511 - EDNS lameness detection, if EDNS packets are dropped this is 3512 detected, eventually. 3513 - multiple query timeout rtt backoff does not backoff too much. 3514 351526 September 2008: Wouter 3516 - tests for remote-control. 3517 - small memory leak in exception during remote control fixed. 3518 - fixup for lock checking but not unchecking in remote control. 3519 - iana portlist updated. 3520 352123 September 2008: Wouter 3522 - Msg cache is loaded. A cache load enables cache responses. 3523 - unbound-control flush [name], flush_type and flush_zone. 3524 352522 September 2008: Wouter 3526 - dump_cache and load_cache statements in unbound-control. 3527 RRsets are dumped and loaded correctly. 3528 Msg cache is dumped. 3529 353019 September 2008: Wouter 3531 - locking on the localdata structure. 3532 - add and remove local zone and data with unbound-control. 3533 - ldns trunk snapshot updated, make tests work again. 3534 353518 September 2008: Wouter 3536 - fixup error in time calculation. 3537 - munin plugin improvements. 3538 - nicer abbreviations for high query types values (ixfr, axfr, any...) 3539 - documented the statistics output in unbound-control man page. 3540 - extended statistics prints out histogram, over unbound-control. 3541 354217 September 2008: Wouter 3543 - locking for threadsafe bogus rrset counter. 3544 - ldns trunk no longer exports b32 functions, provide compat. 3545 - ldns tarball updated. 3546 - testcode/ldns-testpkts.c const fixups. 3547 - fixed rcode stat printout. 3548 - munin plugin in contrib. 3549 - stats always printout uptime, because stats plugins need it. 3550 355116 September 2008: Wouter 3552 - extended-statistics: yesno config option. 3553 - unwanted replies spoof nearmiss detector. 3554 - iana portlist updated. 3555 355615 September 2008: Wouter 3557 - working start, stop, reload commands for unbound-control. 3558 - test for unbound-control working; better exit value for control. 3559 - verbosity control via unbound-control. 3560 - unbound-control stats. 3561 356212 September 2008: Wouter 3563 - removed browser control mentions. Proto speccy. 3564 356511 September 2008: Wouter 3566 - set nonblocking on new TCP streams, because linux does not inherit 3567 the socket options to the accepted socket. 3568 - fix TCP timeouts. 3569 - SSL protected connection between server and unbound-control. 3570 357110 September 2008: Wouter 3572 - remove memleak in privacy addresses on reloads and quits. 3573 - remote control work. 3574 35759 September 2008: Wouter 3576 - smallapp/unbound-control-setup.sh script to set up certificates. 3577 35784 September 2008: Wouter 3579 - scrubber scrubs away private addresses. 3580 - test for private addresses. man page entry. 3581 - code refactored for name and address tree lookups. 3582 35833 September 2008: Wouter 3584 - options for 'DNS Rebinding' protection: private-address and 3585 private-domain. 3586 - dnstree for reuse of routines that help with domain, addr lookups. 3587 - private-address and private-domain config option read, stored. 3588 35892 September 2008: Wouter 3590 - DoS protection features. Queries are jostled out to make room. 3591 - testbound can pass time, increasing the internal timer. 3592 - do not mark unsigned additionals bogus, leave unchecked, which 3593 is removed too. 3594 35951 September 2008: Wouter 3596 - disallow nonrecursive queries for cache snooping by default. 3597 You can allow is using access-control: <subnet> allow_snoop. 3598 The defaults do allow access no authoritative data without RD bit. 3599 - two tests for it and fixups of tests for nonrec refused. 3600 360129 August 2008: Wouter 3602 - version 1.1 number in trunk. 3603 - harden-referral-path option for query for NS records. 3604 Default turns off expensive, experimental option. 3605 360628 August 2008: Wouter 3607 - fixup logfile handling; it is created with correct permissions 3608 again. (from bugfix#199). 3609 Some errors are not written to logfile (pidfile writing, forking), 3610 and these are only visible by using the -d commandline flag. 3611 361227 August 2008: Wouter 3613 - daemon(3) is causing problems for people. Reverting the patch. 3614 bug#200, and 199 and 203 contain sideline discussion on it. 3615 - bug#199 fixed: pidfile can be outside chroot. openlog is done before 3616 chroot and drop permissions. 3617 - config option to set size of aggressive negative cache, 3618 neg-cache-size. 3619 - bug#203 fixed: dlv has been implemented. 3620 362126 August 2008: Wouter 3622 - test for insecure zone when DLV is in use, also does negative cache. 3623 - test for trustanchor when DLV is in use (the anchor works). 3624 - test for DLV used for a zone below a trustanchor. 3625 - added scrub filter for overreaching NSEC records and unit test. 3626 - iana portlist update 3627 - use of setresuid or setreuid when available. 3628 - use daemon(3) if available. 3629 363025 August 2008: Wouter 3631 - realclean patch from Robert Edmonds. 3632 363322 August 2008: Wouter 3634 - nicer debuglogging of DLV. 3635 - test with secure delegation inside the DLV repository. 3636 363721 August 2008: Wouter 3638 - negative cache code linked into validator, for DLV use. 3639 negative cache works for DLV. 3640 - iana portlist update. 3641 - dlv-anchor option for unit tests. 3642 - fixup NSEC_AT_APEX classification for short typemaps. 3643 - ldns-testns has subdomain checks, for unit tests. 3644 364520 August 2008: Wouter 3646 - negative cache code, reviewed. 3647 364818 August 2008: Wouter 3649 - changes info: in logfile to notice: info: or debug: depending on 3650 the verbosity of the statements. Better logfile message 3651 classification. 3652 - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd. 3653 365415 August 2008: Wouter 3655 - DLV nsec code fixed for better detection of closest existing 3656 enclosers from NSEC responses. 3657 - DLV works, straight to the dlv repository, so not for production. 3658 - Iana port update. 3659 366014 August 2008: Wouter 3661 - synthesize DLV messages from the rrset cache, like done for DS. 3662 366313 August 2008: Wouter 3664 - bug #203: nicer do-auto log message when user sets incompatible 3665 options. 3666 - bug #204: variable name ameliorated in log.c. 3667 - bug #206: in iana_update, no egrep, but awk use. 3668 - ldns snapshot r2699 taken (includes DLV type). 3669 - DLV work, config file element, trust anchor read in. 3670 367112 August 2008: Wouter 3672 - finished adjusting testset to provide qtype NS answers. 3673 367411 August 2008: Wouter 3675 - Fixup rrset security updates overwriting 2181 trust status. 3676 This makes validated to be insecure data just as worthless as 3677 nonvalidated data, and 2181 rules prevent cache overwrites to them. 3678 - Fix assertion fail on bogus key handling. 3679 - dnssec lameness detection works on first query at trust apex. 3680 - NS queries get proper cache and dnssec lameness treatment. 3681 - fixup compilation without pthreads on linux. 3682 36838 August 2008: Wouter 3684 - NS queries are done after every referral. 3685 validator is used on those NS records (if anchors enabled). 3686 36877 August 2008: Wouter 3688 - Scrubber more strict. CNAME chains, DNAMEs from cache, other 3689 irrelevant rrsets removed. 3690 - 1.0.2 released from 1.0 support branch. 3691 - fixup update-anchor.sh to work both in BSD shell and bash. 3692 36935 August 2008: Wouter 3694 - fixup DS test so apex nodata works again. 3695 36964 August 2008: Wouter 3697 - iana port update. 3698 - TODO update. 3699 - fix bug 201: null ptr deref on cleanup while udp pkts wait for port. 3700 - added explanatory text for outgoing-port-permit in manpage. 3701 370230 July 2008: Wouter 3703 - fixup bug qtype DS for unsigned zone and signed parent validation. 3704 370525 July 2008: Wouter 3706 - added original copyright statement of OpenBSD arc4random code. 3707 - created tube signaling solution on windows, as a pipe replacement. 3708 this makes background asynchronous resolution work on windows. 3709 - removed very insecure socketpair compat code. It also did not 3710 work with event_waiting. Solved by pipe replacement. 3711 - unbound -h prints openssl version number as well. 3712 371322 July 2008: Wouter 3714 - moved pipe actions to util/tube.c. easier porting and shared code. 3715 - check _raw() commpoint callbacks with fptr_wlist. 3716 - iana port update. 3717 371821 July 2008: Wouter 3719 - #198: nicer entropy warning message. manpage OS hints. 3720 372119 July 2008: Wouter 3722 - #198: fixup man page to suggest chroot entropy fix. 3723 372418 July 2008: Wouter 3725 - branch for 1.0 support. 3726 - trunk work on tube.c. 3727 372817 July 2008: Wouter 3729 - fix bug #196, compile outside source tree. 3730 - fix bug #195, add --with-username=user configure option. 3731 - print error and exit if started with config that requires more 3732 fds than the builtin minievent can handle. 3733 373416 July 2008: Wouter 3735 - made svn tag 1.0.1, trunk now 1.0.2 3736 - sha256 checksums enabled in makedist.sh 3737 373815 July 2008: Wouter 3739 - Follow draft-ietf-dnsop-default-local-zones-06 added reverse 3740 IPv6 example prefix to AS112 default blocklist. 3741 - fixup lookup of DS records by client with trustanchor for same. 3742 - libunbound ub_resolve, fix handling of error condition during setup. 3743 - lowered log_hex blocksize to fit through BSD syslog linesize. 3744 - no useless initialisation if getpwnam not available. 3745 - iana, ldns snapshot updated. 3746 37473 July 2008: Wouter 3748 - Matthijs fixed memory leaks in root hints file reading. 3749 375026 June 2008: Wouter 3751 - fixup streamtcp bounds setting for udp mode, in the test framework. 3752 - contrib item for updating trust anchors. 3753 375425 June 2008: Wouter 3755 - fixup fwd_ancil test typos. 3756 - Fix for newegg lameness : ok for qtype=A, but lame for others. 3757 - fixup unit test for infra cache, test lame merging. 3758 - porting to mingw, bind, listen, getsockopt and setsockopt error 3759 handling. 3760 376124 June 2008: Wouter 3762 - removed testcode/checklocks from production code compilation path. 3763 - streamtcp can use UDP mode (connected UDP socket), for testing IPv6 3764 on windows. 3765 - fwd_ancil test fails if platform support is lacking. 3766 376723 June 2008: Wouter 3768 - fixup minitpkg to cleanup on windows with its file locking troubles. 3769 - minitpkg shows skipped tests in report. 3770 - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not 3771 ipv6 connectivity). 3772 - winsock event handler keeps track of sticky TCP events, that have 3773 not been fully handled yet. when interest in the event(s) resumes, 3774 they are sent again. When WOULDBLOCK is returned events are cleared. 3775 - skip tests that need signals when testing on mingw. 3776 377718 June 2008: Wouter 3778 - open testbound replay files in binary mode, because fseek/ftell 3779 do not work in ascii-mode on windows. The b does nothing on unix. 3780 unittest and testbound tests work on windows (xp too). 3781 - ioctlsocket prints nicer error message. 3782 - fixed up some TCP porting for winsock. 3783 - lack of IPv6 gives a warning, no fatal error. 3784 - use WSAGetLastError() on windows instead of errno for some errors. 3785 378617 June 2008: Wouter 3787 - outgoing num fds 32 by default on windows ; it supports less 3788 fds for waiting on than unixes. 3789 - winsock_event minievent handler for windows. (you could also 3790 attempt to link with libevent/libev ports for windows). 3791 - neater crypto check and gdi32 detection. 3792 - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista. 3793 379416 June 2008: Wouter 3795 - on windows, use windows threads, mutex and thread-local-storage(Tls). 3796 - detect if openssl needs gdi32. 3797 - if no threading, THREADS_DISABLED is defined for use in the code. 3798 - sets USE_WINSOCK if using ws2_32 on windows. 3799 - wsa_strerror() function for more readable errors. 3800 - WSA Startup and Cleanup called in unbound.exe. 3801 380213 June 2008: Wouter 3803 - port mingw32, more signal ifdefs, detect sleep, usleep, 3804 random, srandom (used inside the tests). 3805 - signed or unsigned FD_SET is cast. 3806 380710 June 2008: Wouter 3808 - fixup warnings compiling on eeepc xandros linux. 3809 38109 June 2008: Wouter 3811 - in iteration response type code 3812 * first check for SOA record (negative answer) before NS record 3813 and lameness. 3814 * check if no AA bit for non-forwarder, and thus lame zone. 3815 In response to error report by Richard Doty for mail.opusnet.com. 3816 - fixup unput warning from lexer on freeBSD. 3817 - bug#183. pidfile, rundir, and chroot configure options. Also the 3818 example.conf and manual pages get the configured defaults. 3819 You can use: (or accept the defaults to /usr/local/etc/unbound/) 3820 --with-conf-file=filename 3821 --with-pidfile=filename 3822 --with-run-dir=path 3823 --with-chroot-dir=path 3824 38258 June 2008: Wouter 3826 - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug. 3827 Reported by Robert Edmonds. 3828 - iana port updated. 3829 38304 June 2008: Wouter 3831 - updated libtool files with newer version. 3832 - iana portlist updated. 3833 38343 June 2008: Wouter 3835 - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the 3836 trailing dot is not used during comparison. 3837 38382 June 2008: Wouter 3839 - Jelte fixed bugs in my absence 3840 - bug 178: fixed unportable shell usage in configure (relied on 3841 bash shell). 3842 - bug 180: fixed buffer overflow in unbound-checkconf use of strncat. 3843 - bug 181: fixed buffer overflow in ldns (called by unbound to parse 3844 config file parts). 3845 - fixes by Wouter 3846 - bug 177: fixed compilation failure on opensuse, the 3847 --disable-static configure flag caused problems. (Patch from 3848 Klaus Singvogel) 3849 - bug 179: same fix as 177. 3850 - bug 185: --disable-shared not passed along to ldns included with 3851 unbound. Fixed so that configure parameters are passed to the 3852 subdir configure script. 3853 fixed that ./libtool is used always, you can still override 3854 manually with ./configure libtool=mylibtool or set $libtool in 3855 the environment. 3856 - update of the ldns tarball to current ldns svn version (fix 181). 3857 - bug 184: -r option for unbound-host, read resolv.conf for 3858 forwarder. (Note that forwarder must support DNSSEC for validation 3859 to succeed). 3860 386123 May 2008: Wouter 3862 - mingw32 porting. 3863 - test for sys/wait.h 3864 - WSAEWOULDBLOCK test after nonblocking TCP connect. 3865 - write_iov_buffer removed: unused and no struct iov on windows. 3866 - signed/unsigned warning fixup mini_event. 3867 - use ioctlsocket to set nonblocking I/O if fnctl is unavailable. 3868 - skip signals that are not defined 3869 - detect pwd.h. 3870 - detect getpwnam, getrlimit, setsid, sbrk, chroot. 3871 - default config has no chroot if chroot() unavailable. 3872 - if no kill() then no pidfile is read or written. 3873 - gmtime_r is replaced by nonthreadsafe alternative if unavail. 3874 used in rrsig time validation errors. 3875 387622 May 2008: Wouter 3877 - contrib unbound.spec from Patrick Vande Walle. 3878 - fixup bug#175: call tzset before chroot to have correct timestamps 3879 in system log. 3880 - do not generate lex input and lex unput functions. 3881 - mingw port. replacement functions labelled _unbound. 3882 - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed. 3883 388419 May 2008: Wouter 3885 - fedora 9, check in6_pktinfo define in configure. 3886 - CREDITS fixup of history. 3887 - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative. 3888 388916 May 2008: Wouter 3890 - fixup for MacOSX hosts file reading (reported by John Dickinson). 3891 - created 1.0.0 svn tag. 3892 - trunk version 1.0.1. 3893 389414 May 2008: Wouter 3895 - accepted patch from Ondrej Sury for library version libtool option. 3896 - configure --disable-rpath fixes up libtool for rpath trouble. 3897 Adapted from debian package patch file. 3898 389913 May 2008: Wouter 3900 - Added root ipv6 addresses to builtin root hints. 3901 - TODO modified for post 1.0 plans. 3902 - trunk version set to 1.0.0. 3903 - no unnecessary linking with librt (only when libevent/libev used). 3904 39057 May 2008: Wouter 3906 - fixup no-ip4 problem with error callback in outside network. 3907 390825 April 2008: Wouter 3909 - DESTDIR is honored by the Makefile for rpms. 3910 - contrib files unbound.spec and unbound.init, builds working RPM 3911 on FC7 Linux, a chrooted caching resolver, and libunbound. 3912 - iana ports update. 3913 391424 April 2008: Wouter 3915 - chroot checks improved. working directory relative to chroot. 3916 checks if config file path is inside chroot. Documentation on it. 3917 - nicer example.conf text. 3918 - created 0.11 tag. 3919 392023 April 2008: Wouter 3921 - parseunbound.pl contrib update from Kai Storbeck for threads. 3922 - iana ports update 3923 392422 April 2008: Wouter 3925 - ignore SIGPIPE. 3926 - unit test for SIGPIPE ignore. 3927 392821 April 2008: Wouter 3929 - FEATURES document. 3930 - fixup reread of config file if it was given as a full path 3931 and chroot was used. 3932 393316 April 2008: Wouter 3934 - requirements doc, updated clean query returns. 3935 - parseunbound.pl update from Kai Storbeck. 3936 - sunos4 porting changes. 3937 393815 April 2008: Wouter 3939 - fixup default rc.d pidfile location to /usr/local/etc. 3940 - iana ports updated. 3941 - copyright updated in ldns-testpkts to keep same as in ldns. 3942 - fixup checkconf chroot tests a bit more, chdir must be inside 3943 chroot dir. 3944 - documented 'gcc: unrecognized -KPIC option' errors on Solaris. 3945 - example.conf values changed to /usr/local/etc/unbound 3946 - DSA test work. 3947 - DSA signatures: unbound is compatible with both encodings found. 3948 It will detect and convert when necessary. 3949 395014 April 2008: Wouter 3951 - got update for parseunbound.pl statistics script from Kai Storbeck. 3952 - tpkg tests for udp wait list. 3953 - documented 0x20 status. 3954 - fixup chroot and checkconf, it is much smarter now. 3955 - fixup DSA EVP signature decoding. Solution that Jelte found copied. 3956 - and check first sig byte for the encoding type. 3957 395811 April 2008: Wouter 3959 - random port selection out of the configged ports. 3960 - fixup threadsafety for libevent-1.4.3+ (event_base_get_method). 3961 - removed base_port. 3962 - created 256-port ephemeral space for the OS, 59802 available. 3963 - fixup consistency of port_if out array during heavy use. 3964 396510 April 2008: Wouter 3966 - --with-libevent works with latest libevent 1.4.99-trunk. 3967 - added log file statistics perl script to contrib. 3968 - automatic iana ports update from makefile. 60058 available. 3969 39709 April 2008: Wouter 3971 - configure can detect libev(from its build directory) when passed 3972 --with-libevent=/home/wouter/libev-3.2 3973 libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%). 3974 - unused commpoints not listed in epoll list. 3975 - statistics-cumulative option so that the values are not reset. 3976 - config creates array of available ports, 61841 available, 3977 it excludes <1024 and iana assigned numbers. 3978 config statements to modify the available port numbers. 3979 39808 April 2008: Wouter 3981 - unbound tries to set the ulimit fds when started as server. 3982 if that does not work, it will scale back its requirements. 3983 398427 March 2008: Wouter 3985 - documented /dev/random symlink from chrootdir as FAQ entry. 3986 398726 March 2008: Wouter 3988 - implemented AD bit signaling. If a query sets AD bit (but not DO) 3989 then the AD bit is set in the reply if the answer validated. 3990 Without including DNSSEC signatures. Useful if you have a trusted 3991 path from the client to the resolver. Follows dnssec-updates draft. 3992 399325 March 2008: Wouter 3994 - implemented check that for NXDOMAIN and NOERROR answers a query 3995 section must be present in the reply (by the scrubber). And it must 3996 be equal to the question sent, at least lowercase folded. 3997 Previously this feature happened because the cache code refused 3998 to store such messages. However blocking by the scrubber makes 3999 sure nothing gets into the RRset cache. Also, this looks like a 4000 timeout (instead of an allocation failure) and this retries are 4001 done (which is useful in a spoofing situation). 4002 - RTT banding. Band size 400 msec, this makes band around zero (fast) 4003 include unknown servers. This makes unbound explore unknown servers. 4004 40057 March 2008: Wouter 4006 - -C config feature for harvest program. 4007 - harvest handles CNAMEs too. 4008 40095 March 2008: Wouter 4010 - patch from Hugo Koji Kobayashi for iterator logs spelling. 4011 40124 March 2008: Wouter 4013 - From report by Jinmei Tatuya, rfc2181 trust value for remainder 4014 of a cname trust chain is lower; not full answer_AA. 4015 - test for this fix. 4016 - default config file location is /usr/local/etc/unbound. 4017 Thus prefix is used to determine the location. This is also the 4018 chroot and pidfile default location. 4019 40203 March 2008: Wouter 4021 - Create 0.10 svn tag. 4022 - 0.11 version in trunk. 4023 - indentation nicer. 4024 402529 February 2008: Wouter 4026 - documentation update. 4027 - fixup port to Solaris of perf test tool. 4028 - updated ldns-tarball with decl-after-statement fixes. 4029 403028 February 2008: Wouter 4031 - fixed memory leaks in libunbound (during cancellation and wait). 4032 - libunbound returns the answer packet in full. 4033 - snprintf compat update. 4034 - harvest performs lookup. 4035 - ldns-tarball update with fix for ldns_dname_label. 4036 - installs to sbin by default. 4037 - install all manual pages (unbound-host and libunbound too). 4038 403927 February 2008: Wouter 4040 - option to use caps for id randomness. 4041 - config file option use-caps-for-id: yes 4042 - harvest debug tool 4043 404426 February 2008: Wouter 4045 - delay utility delays TCP as well. If the server that is forwarded 4046 to has a TCP error, the delay utility closes the connection. 4047 - delay does REUSE_ADDR, and can handle a server that closes its end. 4048 - answers use casing from query. 4049 405025 February 2008: Wouter 4051 - delay utility works. Gets decent thoughput too (>20000). 4052 405322 February 2008: Wouter 4054 - +2% for recursions, if identical queries (except for destination 4055 and query ID) in the reply list, avoid re-encoding the answer. 4056 - removed TODO items for optimizations that do not show up in 4057 profile reports. 4058 - default is now minievent - not libevent. As its faster and 4059 not needed for regular installs, only for very large port ranges. 4060 - loop check different speedup pkt-dname-reading, 1% faster for 4061 nocache-recursion check. 4062 - less hashing during msg parse, 4% for recursion. 4063 - small speed fix for dname_count_size_labels, +1 or +2% recursion. 4064 - some speed results noted: 4065 optimization resulted in +40% for recursion (cache miss) and 4066 +70 to +80 for cache hits, and +96% for version.bind. 4067 zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4 4068 www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3 4069 www with DO bit set : BIND 8269.31 Ub 28735.6 qps. 4070 So, unbound can be about equal qps to NSD in cache hits. 4071 And about 3.4x faster than BIND in cache performance. 4072 - delay utility for testing. 4073 407421 February 2008: Wouter 4075 - speedup of root-delegation message encoding by 15%. 4076 - minor speedup of compress tree_lookup, maybe 1%. 4077 - speedup of dname_lab_cmp and memlowercmp - the top functions in 4078 profiler output, maybe a couple percent when it matters. 4079 408020 February 2008: Wouter 4081 - setup speec_cache for need-ldns-testns in dotests. 4082 - check number of queued replies on incoming queries to avoid overload 4083 on that account. 4084 - fptr whitelist checks are not disabled in optimize mode. 4085 - do-daemonize config file option. 4086 - minievent time share initializes time at start. 4087 - updated testdata for nsec3 new algorithm numbers (6, 7). 4088 - small performance test of packet encoding (root delegation). 4089 409019 February 2008: Wouter 4091 - applied patch to unbound-host man page from Jan-Piet Mens. 4092 - fix donotquery-localhost: yes default (it erroneously was switched 4093 to default 'no'). 4094 - time is only gotten once and the value is shared across unbound. 4095 - unittest cleans up crypto, so that it has no memory leaks. 4096 - mini_event shares the time value with unbound this results in 4097 +3% speed for cache responses and +9% for recursions. 4098 - ldns tarball update with new NSEC3 sign code numbers. 4099 - perform several reads per UDP operation. This improves performance 4100 in DoS conditions, and costs very little in normal conditions. 4101 improves cache response +50%, and recursions +10%. 4102 - modified asynclook test. because the callback from async is not 4103 in any sort of lock (and thus can use all library functions freely), 4104 this causes a tiny race condition window when the last lock is 4105 released for a callback and a new cancel() for that callback. 4106 The only way to remove this is by putting callbacks into some 4107 lock window. I'd rather have the small possibility of a callback 4108 for a cancelled function then no use of library functions in 4109 callbacks. Could be possible to only outlaw process(), wait(), 4110 cancel() from callbacks, by adding another lock, but I'd rather not. 4111 411218 February 2008: Wouter 4113 - patch to unbound-host from Jan-Piet Mens. 4114 - unbound host prints errors if fails to configure context. 4115 - fixup perf to resend faster, so that long waiting requests do 4116 not hold up the queue, they become lost packets or SERVFAILs, 4117 or can be sent a little while later (i.e. processing time may 4118 take long, but throughput has to be high). 4119 - fixup iterator operating in no cache conditions (RD flag unset 4120 after a CNAME). 4121 - streamlined code for RD flag setting. 4122 - profiled code and changed dname compares to be faster. 4123 The speedup is about +3% to +8% (depending on the test). 4124 - minievent tests for eintr and eagain. 4125 412615 February 2008: Wouter 4127 - added FreeBSD rc.d script to contrib. 4128 - --prefix option for configure also changes directory: pidfile: 4129 and chroot: defaults in config file. 4130 - added cache speed test, for cache size OK and cache too small. 4131 413214 February 2008: Wouter 4133 - start without a config file (will complain, but start with 4134 defaults). 4135 - perf test program works. 4136 413713 February 2008: Wouter 4138 - 0.9 released. 4139 - 1.0 development. Printout ldns version on unbound -h. 4140 - start of perf tool. 4141 - bugfix to read empty lines from /etc/hosts. 4142 414312 February 2008: Wouter 4144 - fixup problem with configure calling itself if ldns-src tarball 4145 is not present. 4146 414711 February 2008: Wouter 4148 - changed library to use ub_ instead of ub_val_ as prefix. 4149 - statistics output text nice. 4150 - etc/hosts handling. 4151 - library function to put logging to a stream. 4152 - set any option interface. 4153 41548 February 2008: Wouter 4155 - test program for multiple queries over a TCP channel. 4156 - tpkg test for stream tcp queries. 4157 - unbound replies to multiple TCP queries on a TCP channel. 4158 - fixup misclassification of root referral with NS in answer 4159 when validating a nonrec query. 4160 - tag 0.9 4161 - layout of manpages, spelling fix in header, manpages process by 4162 makedist, list asynclook and tcpstream tests as ldns-testns 4163 required. 4164 41657 February 2008: Wouter 4166 - moved up all current level 2 to be level 3. And 3 to 4. 4167 to make room for new debug level 2 for detailed information 4168 for operators. 4169 - verbosity level 2. Describes recursion and validation. 4170 - cleaner configure script and fixes for libevent solaris. 4171 - signedness for log output memory sizes in high verbosity. 4172 41736 February 2008: Wouter 4174 - clearer explanation of threading configure options. 4175 - fixup asynclook test for nothreading (it creates only one process 4176 to do the extended test). 4177 - changed name of ub_val_result_free to ub_val_resolve_free. 4178 - removes warning message during library linking, renamed 4179 libunbound/unbound.c -> libunbound.c and worker to libworker. 4180 - fallback without EDNS if result is NOTIMPL as well as on FORMERR. 4181 41825 February 2008: Wouter 4183 - statistics-interval: seconds option added. 4184 - test for statistics option 4185 - ignore errors making directories, these can occur in parallel builds 4186 - fixup Makefile strip command and libunbound docs typo. 4187 418831 January 2008: Wouter 4189 - bg thread/process reads and writes the pipe nonblocking all the time 4190 so that even if the pipe is buffered or so, the bg thread does not 4191 block, and services both pipes and queries. 4192 419330 January 2008: Wouter 4194 - check trailing / on chrootdir in checkconf. 4195 - check if root hints and anchor files are in chrootdir. 4196 - no route to host tcp error is verbosity level 2. 4197 - removed unused send_reply_iov. and its configure check. 4198 - added prints of 'remote address is 1.2.3.4 port 53' to errors 4199 from netevent; the basic socket errors. 4200 420128 January 2008: Wouter 4202 - fixup uninit use of buffer by libunbound (query id, flags) for 4203 local_zone answers. 4204 - fixup uninit warning from random.c; also seems to fix sporadic 4205 sigFPE coming out of openssl. 4206 - made openssl entropy warning more silent for library use. Needs 4207 verbosity 1 now. 4208 - fixup forgotten locks for rbtree_searches on ctx->query tree. 4209 - random generator cleanup - RND_STATE_SIZE removed, and instead 4210 a super-rnd can be passed at init to chain init random states. 4211 - test also does lock checks if available. 4212 - protect config access in libworker_setup(). 4213 - libevent doesn't like comm_base_exit outside of runloop. 4214 - close fds after removing commpoints only (for epoll, kqueue). 4215 421625 January 2008: Wouter 4217 - added tpkg for asynclook and library use. 4218 - allows localhost to be queried when as a library. 4219 - fixup race condition between cancel and answer (in case of 4220 really fast answers that beat the cancel). 4221 - please doxygen, put doxygen comment in one place. 4222 - asynclook -b blocking mode and test. 4223 - refactor asynclook, nicer code. 4224 - fixup race problems from opensll in rand init from library, with 4225 a mutex around the rand init. 4226 - fix pass async_id=NULL to _async resolve(). 4227 - rewrote _wait() routine, so that it is threadsafe. 4228 - cancelation is threadsafe. 4229 - asynclook extended test in tpkg. 4230 - fixed two races where forked bg process waits for (somehow shared?) 4231 locks, so does not service the query pipe on the bg side. 4232 Now those locks are only held for fg_threads and for bg_as_a_thread. 4233 423424 January 2008: Wouter 4235 - tested the cancel() function. 4236 - asynclook -c (cancel) feature. 4237 - fix fail to allocate context actions. 4238 - make pipe nonblocking at start. 4239 - update plane for retry mode with caution to limit bandwidth. 4240 - fix Makefile for concurrent make of unbound-host. 4241 - renamed ub_val_ctx_wait/poll/process/fd to ub_val*. 4242 - new calls to set forwarding added to header and docs. 4243 424423 January 2008: Wouter 4245 - removed debug prints from if-auto, verb-algo enables some. 4246 - libunbound QUIT setup, remove memory leaks, when using threads 4247 will share memory for passing results instead of writing it over 4248 the pipe, only writes ID number over the pipe (towards the handler 4249 thread that does process() ). 4250 425122 January 2008: Wouter 4252 - library code for async in libunbound/unbound.c. 4253 - fix link testbound. 4254 - fixup exit bug in mini_event. 4255 - background worker query enter and result functions. 4256 - bg query test application asynclook, it looks up multiple 4257 hostaddresses (A records) at the same time. 4258 425921 January 2008: Wouter 4260 - libworker work, netevent raw commpoints, write_msg, serialize. 4261 426218 January 2008: Wouter 4263 - touch up of manpage for libunbound. 4264 - support for IP_RECVDSTADDR (for *BSD ip4). 4265 - fix for BSD, do not use ip4to6 mapping, make two sockets, once 4266 ip6 and once ip4, uses socket options. 4267 - goodbye ip4to6 mapping. 4268 - update ldns-testpkts with latest version from ldns-trunk. 4269 - updated makedist for relative ldns pathnames. 4270 - library API with more information inside the result structure. 4271 - work on background resolves. 4272 427317 January 2008: Wouter 4274 - fixup configure in case -lldns is installed. 4275 - fixup a couple of doxygen warnings, about enum variables. 4276 - interface-automatic now copies the interface address from the 4277 PKT_INFO structure as well. 4278 - manual page with library API, all on one page 'man libunbound'. 4279 - rewrite of PKTINFO structure, it also captures IP4 PKTINFO. 4280 428116 January 2008: Wouter 4282 - incoming queries to the server with TC bit on are replied FORMERR. 4283 - interface-automatic replied the wrong source address on localhost 4284 queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying 4285 to use ifnum=-1 to mean 'no interface, use kernel route'. 4286 428715 January 2008: Wouter 4288 - interface-automatic feature. experimental. Nice for anycast. 4289 - tpkg test for ip6 ancillary data. 4290 - removed debug prints. 4291 - porting experience, define for Solaris, test refined for BSD 4292 compatibility. The feature probably will not work on OpenBSD. 4293 - makedist fixup for ldns-src in build-dir. 4294 429514 January 2008: Wouter 4296 - in no debug sets NDEBUG to remove asserts. 4297 - configure --enable-debug is needed for dependency generation 4298 for assertions and for compiler warnings. 4299 - ldns.tgz updated with ldns-trunk (where buffer.h is updated). 4300 - fix lint, unit test in optimize mode. 4301 - default access control allows ::ffff:127.0.0.1 v6mapped localhost. 4302 430311 January 2008: Wouter 4304 - man page, warning removed. 4305 - added text describing the use of stub zones for private zones. 4306 - checkconf tests for bad hostnames (IP address), and for doubled 4307 interface lines. 4308 - memory sizes can be given with 'k', 'Kb', or M or G appended. 4309 431010 January 2008: Wouter 4311 - typo in example.conf. 4312 - made using ldns-src that is included the package more portable 4313 by linking with .lo instead of .o files in the ldns package. 4314 - nicer do-ip6: yes/no documentation. 4315 - nicer linking of libevent .o files. 4316 - man pages render correctly on solaris. 4317 43189 January 2008: Wouter 4319 - fixup openssl RAND problem, when the system is not configured to 4320 give entropy, and the rng needs to be seeded. 4321 43228 January 2008: Wouter 4323 - print median and quartiles with extensive logging. 4324 43254 January 2008: Wouter 4326 - document misconfiguration in private network. 4327 43282 January 2008: Wouter 4329 - fixup typo in requirements. 4330 - document that 'refused' is a better choice than 'drop' for 4331 the access control list, as refused will stop retries. 4332 43337 December 2007: Wouter 4334 - unbound-host has a -d option to show what happens. This can help 4335 with debugging (why do I get this answer). 4336 - fixup CNAME handling, on nodata, sets and display canonname. 4337 - dot removed from CNAME display. 4338 - respect -v for NXDOMAINs. 4339 - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes). 4340 - size_t to int for portability of the header file. 4341 - fixup bogus handling. 4342 - dependencies and lint for unbound-host. 4343 43446 December 2007: Wouter 4345 - library resolution works in foreground mode, unbound-host app 4346 receives data. 4347 - unbound-host prints rdata using ldns. 4348 - unbound-host accepts trust anchors, and prints validation 4349 information when you give -v. 4350 43515 December 2007: Wouter 4352 - locking in context_new() inside the function. 4353 - setup of libworker. 4354 43554 December 2007: Wouter 4356 - minor Makefile fixup. 4357 - moved module-stack code out of daemon/daemon into services/modstack, 4358 preparing for code-reuse. 4359 - move context into own header file. 4360 - context query structure. 4361 - removed unused variable pwd from checkconf. 4362 - removed unused assignment from outside netw. 4363 - check timeval length of string. 4364 - fixup error in val_utils getsigner. 4365 - fixup same (*var) error in netblocktostr. 4366 - fixup memleak on parse error in localzone. 4367 - fixup memleak on packet parse error. 4368 - put ; after union in parser.y. 4369 - small hardening in iter_operate against iq==NULL. 4370 - hardening, if error reply with rcode=0 (noerror) send servfail. 4371 - fixup same (*var) error in find_rrset in msgparse, was harmless. 4372 - check return value of evtimer_add(). 4373 - fixup lockorder in lruhash_reclaim(), building up a list of locked 4374 entries one at a time. Instead they are removed and unlocked. 4375 - fptr_wlist for markdelfunc. 4376 - removed is_locked param from lruhash delkeyfunc. 4377 - moved bin_unlock during bin_split purely to please. 4378 43793 December 2007: Wouter 4380 - changed checkconf/ to smallapp/ to make room for more support tools. 4381 (such as unbound-host). 4382 - install dirs created with -m 755 because they need to be accessible. 4383 - library extensive featurelist added to TODO. 4384 - please doxygen, lint. 4385 - library test application, with basic functionality. 4386 - fix for building in a subdirectory. 4387 - link lib fix for Leopard. 4388 438930 November 2007: Wouter 4390 - makefile that creates libunbound.la, basic file or libunbound.a 4391 when creating static executables (no libtool). 4392 - more API setup. 4393 439429 November 2007: Wouter 4395 - 0.9 public API start. 4396 439728 November 2007: Wouter 4398 - Changeup plan for 0.8 - no complication needed, a simple solution 4399 has been chosen for authoritative features. 4400 - you can use single quotes in the config file, so it is possible 4401 to specify TXT records in local data. 4402 - fixup small memory problem in implicit transparent zone creation. 4403 - test for implicit zone creation and multiple RR RRsets local data. 4404 - local-zone nodefault test. 4405 - show testbound testlist on commit. 4406 - iterator normalizer changes CNAME chains ending in NXDOMAIN where 4407 the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial 4408 domain exists). 4409 - nicer verbosity: 0 and 1 levels. 4410 - lower nonRDquery chance of eliciting wrongly typed validation 4411 requiring message from the cache. 4412 - fix for nonRDquery validation typing; nodata is detected when 4413 SOA record in auth section (all validation-requiring nodata messages 4414 have a SOA record in authority, so this is OK for the validator), 4415 and NS record is needed to be a referral. 4416 - duplicate checking when adding NSECs for a CNAME, and test. 4417 - created svn tag 0.8, after completing testbed tests. 4418 441927 November 2007: Wouter 4420 - per suggestion in rfc2308, replaced default max-ttl value with 1 day. 4421 - set size of msgparse lookup table to 32, from 1024, so that its size 4422 is below the 2048 regional large size threshold, and does not cause 4423 a call to malloc when a message is parsed. 4424 - update of memstats tool to print number of allocation calls. 4425 This is what is taking time (not space) and indicates the avg size 4426 of the allocations as well. region_alloc stat is removed. 4427 442822 November 2007: Wouter 4429 - noted EDNS in-the-middle dropping trouble as a TODO. 4430 At this point theoretical, no user trouble has been reported. 4431 - added all default AS112 zones. 4432 - answers from local zone content. 4433 * positive answer, the rrset in question 4434 * nodata answer (exist, but not that type). 4435 * nxdomain answer (domain does not exist). 4436 * empty-nonterminal answer. 4437 * But not: wildcard, nsec, referral, rrsig, cname/dname, 4438 or additional section processing, NS put in auth. 4439 - test for correct working of static and transparent and couple 4440 of important defaults (localhost, as112, reverses). 4441 Also checks deny and refuse settings. 4442 - fixup implicit zone generation and AA bit for NXDOMAIN on localdata. 4443 444421 November 2007: Wouter 4445 - local zone internal data setup. 4446 444720 November 2007: Wouter 4448 - 0.8 - str2list config support for double string config options. 4449 - local-zone and local-data options, config storage and documentation. 4450 445119 November 2007: Wouter 4452 - do not downcase NSEC and RRSIG for verification. Follows 4453 draft-ietf-dnsext-dnssec-bis-updates-06.txt. 4454 - fixup leaking unbound daemons at end of tests. 4455 - README file updated. 4456 - nice libevent not found error. 4457 - README talks about gnu make. 4458 - 0.8: unit test for addr_mask and fixups for it. 4459 and unit test for addr_in_common(). 4460 - 0.8: access-control config file element. 4461 and unit test rpl replay file. 4462 - 0.8: fixup address reporting from netevent. 4463 446416 November 2007: Wouter 4465 - privilege separation is not needed in unbound at this time. 4466 TODO item marked as such. 4467 - created beta-0.7 branch for support. 4468 - tagged 0.7 for beta release. 4469 - moved trunk to 0.8 for 0.8(auth features) development. 4470 - 0.8: access control list setup. 4471 447215 November 2007: Wouter 4473 - review fixups from Jelte. 4474 447514 November 2007: Wouter 4476 - testbed script does not recreate configure, since its in svn now. 4477 - fixup checkconf test so that it does not test 4478 /etc/unbound/unbound.conf. 4479 - tag 0.6. 4480 448113 November 2007: Wouter 4482 - remove debug print. 4483 - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists. 4484 448512 November 2007: Wouter 4486 - fixup signal handling where SIGTERM could be ignored if a SIGHUP 4487 arrives later on. 4488 - bugreports to unbound-bugs@nlnetlabs.nl 4489 - fixup testbound so it exits cleanly. 4490 - cleanup the caches on a reload, so that rrsetID numbers won't clash. 4491 44929 November 2007: Wouter 4493 - took ldns snapshot in repo. 4494 - default config file is /etc/unbound/unbound.conf. 4495 If it doesn't exist, it is installed with the doc/example.conf file. 4496 The file is not deleted on uninstall. 4497 - default listening is not all, but localhost interfaces. 4498 44998 November 2007: Wouter 4500 - Fixup chroot and drop user privileges. 4501 - new L root ip address in default hints. 4502 45031 November 2007: Wouter 4504 - Fixup of crash on reload, due to anchors in env not NULLed after 4505 dealloc during deinit. 4506 - Fixup of chroot call. Happens after privileges are dropped, so 4507 that checking the passwd entry still works. 4508 - minor touch up of clear() hashtable function. 4509 - VERB_DETAIL prints out what chdir, username, chroot is being done. 4510 - when id numbers run out, caches are cleared, as in design notes. 4511 Tested with a mock setup with very few bits in id, it worked. 4512 - harden-dnssec-stripped: yes is now default. It insists on dnssec 4513 data for trust anchors. Included tests for the feature. 4514 451531 October 2007: Wouter 4516 - cache-max-ttl config option. 4517 - building outside sourcedir works again. 4518 - defaults more secure: 4519 username: "unbound" 4520 chroot: "/etc/unbound" 4521 The operator can override them to be less secure ("") if necessary. 4522 - fix horrible oversight in sorting rrset references in a message, 4523 sort per reference key pointer, not on referencepointer itself. 4524 - pidfile: "/etc/unbound/unbound.pid" is now the default. 4525 - tests changed to reflect the updated default. 4526 - created hashtable clear() function that respects locks. 4527 452830 October 2007: Wouter 4529 - fixup assertion failure that relied on compressed names to be 4530 smaller than uncompressed names. A packet from comrite.com was seen 4531 to be compressed to a larger size. Added it as unit test. 4532 - quieter logging at low verbosity level for common tcp messages. 4533 - no greedy TTL update. 4534 453523 October 2007: Wouter 4536 - fixup (grand-)parent problem for dnssec-lameness detection. 4537 - fixup tests to do additional section processing for lame replies, 4538 since the detection needs that. 4539 - no longer trust in query section in reply during dnssec lame detect. 4540 - dnssec lameness does not make the server never ever queried, but 4541 non-preferred. If no other servers exist or answer, the dnssec lame 4542 server is used; the fastest dnssec lame server is chosen. 4543 - added test then when trust anchor cannot be primed (nodata), the 4544 insecure mode from unbound works. 4545 - Fixup max queries per thread, any more are dropped. 4546 454722 October 2007: Wouter 4548 - added donotquerylocalhost config option. Can be turned off for 4549 out test cases. 4550 - ISO C compat changes. 4551 - detect RA-no-AA lameness, as LAME. 4552 - DNSSEC-lameness detection, as LAME. 4553 See notes in requirements.txt for choices made. 4554 - tests for lameness detection. 4555 - added all to make test target; need unbound for fwd tests. 4556 - testbound does not pollute /etc/unbound. 4557 455819 October 2007: Wouter 4559 - added configure (and its files) to svn, so that the trunk is easier 4560 to use. ./configure, config.guess, config.sub, ltmain.sh, 4561 and config.h.in. 4562 - added yacc/lex generated files, util/configlexer.c, 4563 util/configparser.c util/configparser.h, to svn. 4564 - without lex no attempt to use it. 4565 - unsecure response validation collated into one block. 4566 - remove warning about const cast of cfgfile name. 4567 - outgoing-interfaces can be different from service interfaces. 4568 - ldns-src configure is done during unbound configure and 4569 ldns-src make is done during unbound make, and so inherits the 4570 make arguments from the unbound make invocation. 4571 - nicer error when libevent problem causes instant exit on signal. 4572 - read root hints from a root hint file (like BIND does). 4573 457418 October 2007: Wouter 4575 - addresses are logged with errors. 4576 - fixup testcode fake event to remove pending before callback 4577 since the callback may create new pending items. 4578 - tests updated because retries are now in iterator module. 4579 - ldns-testpkts code is checked for differences between unbound 4580 and ldns by makedist.sh. 4581 - ldns trunk from today added in svn repo for fallback in case 4582 no ldns is installed on the system. 4583 make download_ldns refreshes the tarball with ldns svn trunk. 4584 - ldns-src.tar.gz is used if no ldns is found on the system, and 4585 statically linked into unbound. 4586 - start of regional allocator code. 4587 - regional uses less memory and variables, simplified code. 4588 - remove of region-allocator. 4589 - alloc cache keeps a cache of recently released regional blocks, 4590 up to a maximum. 4591 - make unit test cleanly free memory. 4592 459317 October 2007: Wouter 4594 - fixup another cycle detect and ns-addr timeout resolution bug. 4595 This time by refusing delegations from the cache without addresses 4596 when resolving a mandatory-glue nameserver-address for that zone. 4597 We're going to have to ask a TLD server anyway; might as well be 4598 the TLD server for this name. And this resolves a lot of cases where 4599 the other nameserver names lead to cycles or are not available. 4600 - changed random generator from random(3) clone to arc4random wrapped 4601 for thread safety. The random generator is initialised with 4602 entropy from the system. 4603 - fix crash where failure to prime DNSKEY tried to print null pointer 4604 in the log message. 4605 - removed some debug prints, only verb_algo (4) enables them. 4606 - fixup test; new random generator took new paths; such as one 4607 where no scripted answer was available. 4608 - mark insecure RRs as insecure. 4609 - fixup removal of nonsecure items from the additional. 4610 - reduced timeout values to more realistic, 376 msec (262 msec has 4611 90% of roundtrip times, 512 msec has 99% of roundtrip times.) 4612 - server selection failover to next server after timeout (376 msec). 4613 461416 October 2007: Wouter 4615 - no malloc in log_hex. 4616 - assertions around system calls. 4617 - protect against gethostname without ending zero. 4618 - ntop output is null terminated by unbound. 4619 - pidfile content null termination 4620 - various snprintf use sizeof(stringbuf) instead of fixed constant. 4621 - changed loopdetect % 8 with & 0x7 since % can become negative for 4622 weird negative input and particular interpretation of integer math. 4623 - dname_pkt_copy checks length of result, to protect result buffers. 4624 prints an error, this should not happen. Bad strings should have 4625 been rejected earlier in the program. 4626 - remove a size_t underflow from msgreply size func. 4627 462815 October 2007: Wouter 4629 - nicer warning. 4630 - fix IP6 TCP, wrong definition check. With test package. 4631 - fixup the fact that the query section was not compressed to, 4632 the code was there but was called by value instead of by reference. 4633 And test for the case, uses xxd and nc. 4634 - more portable ip6 check for sockaddr types. 4635 46368 October 2007: Wouter 4637 - --disable-rpath option in configure for 64bit systems with 4638 several dynamic lib dirs. 4639 46407 October 2007: Wouter 4641 - fixup tests for no AD bit in non-DO queries. 4642 - test that makes sure AD bit is not set on non-DO query. 4643 46446 October 2007: Wouter 4645 - removed logfile open early. It did not have the proper permissions; 4646 it was opened as root instead of the user. And we cannot change user 4647 id yet, since chroot and bind ports need to be done. 4648 - callback checks for event callbacks done from mini_event. Because 4649 of deletions cannot do this from netevent. This means when using 4650 libevent the protection does not work on event-callbacks. 4651 - fixup too small reply (did not zero counts). 4652 - fixup reply no longer AD bit when query without DO bit. 4653 46545 October 2007: Wouter 4655 - function pointer whitelist. 4656 46574 October 2007: Wouter 4658 - overwrite sensitive random seed value after use. 4659 - switch to logfile very soon if not -d (console attached). 4660 - error messages do not reveal the trustanchor contents. 4661 - start work on function pointer whitelists. 4662 46633 October 2007: Wouter 4664 - fix for multiple empty nonterminals, after multiple DSes in the 4665 chain of trust. 4666 - mesh checks if modules are looping, and stops them. 4667 - refetch with CNAMEd nameserver address regression test added. 4668 - fixup line count bug in testcode, so testbound prints correct line 4669 number with parse errors. 4670 - unit test for multiple ENT case. 4671 - fix for cname out of validated unsec zone. 4672 - fixup nasty id=0 reuse. Also added assertions to detect its 4673 return (the assertion catches in the existing test cases). 4674 46751 October 2007: Wouter 4676 - skip F77, CXX, objC tests in configure step. 4677 - fixup crash in refetch glue after a CNAME. 4678 and protection against similar failures (with error print). 4679 468028 September 2007: Wouter 4681 - test case for unbound-checkconf, fixed so it also checks the 4682 interface: statements. 4683 468426 September 2007: Wouter 4685 - SIGHUP will reopen the log file. 4686 - Option to log to syslog. 4687 - please lint, fixup tests (that went to syslog on open, oops). 4688 - config check program. 4689 469025 September 2007: Wouter 4691 - tests for NSEC3. Fixup bitmap checks for NSEC3. 4692 - positive ANY response needs to check if wildcard expansion, and 4693 check that original data did not exist. 4694 - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure 4695 delegation, for abuse of child zone apex nsec3. 4696 - create 0.5 release tag. 4697 469824 September 2007: Wouter 4699 - do not make test programs by default. 4700 - But 'make test' will perform all of the tests. 4701 - Advertise builtin select libevent alternative when no libevent 4702 is found. 4703 - signit can generate NSEC3 hashes, for generating tests. 4704 - multiple nsec3 paramaters in message test. 4705 - too high nsec3 iterations becomes insecure test. 4706 470721 September 2007: Wouter 4708 - fixup empty_DS_name allocated in wrong region (port DEC Alpha). 4709 - fixup testcode lock safety (port FreeBSD). 4710 - removes subscript has type char warnings (port Solaris 9). 4711 - fixup of field with format type to int (port MacOS/X intel). 4712 - added test for infinite loop case in nonRD answer validation. 4713 It was a more general problem, but hard to reproduce. When an 4714 unsigned rrset is being validated and the key fetched, the DS 4715 sequence is followed, but if the final name has no DS, then no 4716 proof is possible - the signature has been stripped off. 4717 471820 September 2007: Wouter 4719 - fixup and test for NSEC wildcard with empty nonterminals. 4720 - makedist.sh fixup for svn info. 4721 - acl features request in plan. 4722 - improved DS empty nonterminal handling. 4723 - compat with ANS nxdomain for empty nonterminals. Attempts the nodata 4724 proof anyway, which succeeds in ANS failure case. 4725 - striplab protection in case it becomes -1. 4726 - plans for static and blacklist config. 4727 472819 September 2007: Wouter 4729 - comments about non-packed usage. 4730 - plan for overload support in 0.6. 4731 - added testbound tests for a failed resolution from the logs 4732 and for failed prime when missing glue. 4733 - fixup so useless delegation points are not returned from the 4734 cache. Also the safety belt is used if priming fails to complete. 4735 - fixup NSEC rdata not to be lowercased, bind compat. 4736 473718 September 2007: Wouter 4738 - wildcard nsec3 testcases, and fixup to get correct wildcard name. 4739 - validator prints subtype classification for debug. 4740 474117 September 2007: Wouter 4742 - NSEC3 hash cache unit test. 4743 - validator nsec3 nameerror test. 4744 474514 September 2007: Wouter 4746 - nsec3 nodata proof, nods proof, wildcard proof. 4747 - nsec3 support for cname chain ending in noerror or nodata. 4748 - validator calls nsec3 proof routines if no NSECs prove anything. 4749 - fixup iterator bug where it stored the answer to a cname under 4750 the wrong qname into the cache. When prepending the cnames, the 4751 qname has to be reset to the original qname. 4752 475313 September 2007: Wouter 4754 - nsec3 find matching and covering, ce proof, prove namerror msg. 4755 475612 September 2007: Wouter 4757 - fixup of manual page warnings, like for NSD bugreport. 4758 - nsec3 work, config, max iterations, filter, and hash cache. 4759 47606 September 2007: Wouter 4761 - fixup to find libevent on mac port install. 4762 - fixup size_t vs unsigned portability in validator/sigcrypt. 4763 - please compiler on different platforms, for unreachable code. 4764 - val_nsec3 file. 4765 - pthread_rwlock type is optional, in case of old pthread libs. 4766 47675 September 2007: Wouter 4768 - cname, name error validator tests. 4769 - logging of qtype ANY works. 4770 - ANY type answers get RRSIG in answer section of replies (but not 4771 in other sections, unless DO bit is on). 4772 - testbound can replay a TCP query (set MATCH TCP in the QUERY). 4773 - DS and noDS referral validation test. 4774 - if you configure many trust anchors, parent trust anchors can 4775 securely deny existance of child trust anchors, if validated. 4776 - not all *.name NSECs are present because a wildcard was matched, 4777 and *.name NSECs can prove nodata for empty nonterminals. 4778 Also, for wildcard name NSECs, check they are not from the parent 4779 zone (for wildcarded zone cuts), and check absence of CNAME bit, 4780 for a nodata proof. 4781 - configure option for memory allocation debugging. 4782 - port configure option for memory allocation to solaris10. 4783 47844 September 2007: Wouter 4785 - fixup of Leakage warning when serviced queries processed multiple 4786 callbacks for the same query from the same server. 4787 - testbound removes config file from /tmp on failed exit. 4788 - fixup for referral cleanup of the additional section. 4789 - tests for cname, referral validation. 4790 - neater testbound tpkg output. 4791 - DNAMEs no longer match their apex when synthesized from the cache. 4792 - find correct signer name for DNAME responses. 4793 - wildcarded DNAME test and fixup code to detect. 4794 - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs. 4795 So that wildcarded CNAMEs get their NSEC with them to the answer. 4796 - test for a CNAME to a DNAME to a CNAME to an answer, all from 4797 different domains, for key fetching and signature checking of 4798 CNAME'd messages. 4799 48003 September 2007: Wouter 4801 - Fixed error in iterator that would cause assertion failure in 4802 validator. CNAME to a NXDOMAIN response was collated into a response 4803 with both a CNAME and the NXDOMAIN rcode. Added a test that the 4804 rcode is changed to NOERROR (because of the CNAME). 4805 - timeout on tcp does not lead to spurious leakage detect. 4806 - account memory for name of lame zones, so that memory leakages does 4807 not show lame cache growth as a leakage growth. 4808 - config setting for lameness cache expressed in bytes, instead of 4809 number of entries. 4810 - tool too summarize allocations per code line. 4811 481231 August 2007: Wouter 4813 - can read bind trusted-keys { ... }; files, in a compatibility mode. 4814 - iterator should not detach target queries that it still could need. 4815 the protection against multiple outstanding queries is moved to a 4816 current_query num check. 4817 - validator nodata, positive, referral tests. 4818 - dname print can print '*' wildcard. 4819 482030 August 2007: Wouter 4821 - fixup override date config option. 4822 - config options to control memory usage. 4823 - caught bad free of un-alloced data in worker_send error case. 4824 - memory accounting for key cache (trust anchors and temporary cache). 4825 - memory accounting fixup for outside network tcp pending waits. 4826 - memory accounting fixup for outside network tcp callbacks. 4827 - memory accounting for iterator fixed storage. 4828 - key cache size and slabs config options. 4829 - lib crypto cleanups at exit. 4830 483129 August 2007: Wouter 4832 - test tool to sign rrsets for testing validator with. 4833 - added RSA and DSA test keys, public and private pairs, 512 bits. 4834 - default configuration is with validation enabled. 4835 Only a trust-anchor needs to be configured for DNSSEC to work. 4836 - do not convert to DER for DSA signature verification. 4837 - validator replay test file, for a DS to DNSKEY DSA key prime and 4838 positive response. 4839 484028 August 2007: Wouter 4841 - removed double use for udp buffers, that could fail, 4842 instead performs a malloc to do the backup. 4843 - validator validates referral messages, by validating all the rrsets 4844 and stores the rrsets in the cache. Further referral (nonRD queries) 4845 replies are made from the rrset cache directly. Unless unchecked 4846 rrsets are encountered, there are then validated. 4847 - enforce that signing is done by a parent domain (or same domain). 4848 - adjust TTL downwards if rrset TTL bigger than signature allows. 4849 - permissive mode feature, sets AD bit for secure, but bogus does 4850 not give servfail (bogus is changed into indeterminate). 4851 - optimization of rrset verification. rr canonical sorting is reused, 4852 for the same rrset. canonical rrset image in buffer is reused for 4853 the same signature. 4854 - if the rrset is too big (64k exactly + large owner name) the 4855 canonicalization routine will fail if it does not fit in buffer. 4856 - faster verification for large sigsets. 4857 - verb_detail mode reports validation failures, but not the entire 4858 algorithm for validation. Key prime failures are reported as 4859 verb_ops level. 4860 486127 August 2007: Wouter 4862 - do not garble the edns if a cache answer fails. 4863 - answer norecursive from cache if possible. 4864 - honor clean_additional setting when returning secure non-recursive 4865 referrals. 4866 - do not store referral in msg cache for nonRD queries. 4867 - store verification status in the rrset cache to speed up future 4868 verification. 4869 - mark rrsets indeterminate and insecure if they are found to be so. 4870 and store this in the cache. 4871 487224 August 2007: Wouter 4873 - message is bogus if unsecure authority rrsets are present. 4874 - val-clean-additional option, so you can turn it off. 4875 - move rrset verification out of the specific proof types into one 4876 routine. This makes the proof routines prettier. 4877 - fixup cname handling in validator, cname-to-positive and cname-to- 4878 nodata work. 4879 - Do not synthesize DNSKEY and DS responses from the rrset cache if 4880 the rrset is from the additional section. Signatures may have 4881 fallen off the packet, and cause validation failure. 4882 - more verbose signature date errors (with the date attached). 4883 - increased default infrastructure cache size. It is important for 4884 performance, and 1000 entries are only 212k (or a 400 k total cache 4885 size). To 10000 entries (for 2M entries, 4M cache size). 4886 488723 August 2007: Wouter 4888 - CNAME handling - move needs_validation to before val_new(). 4889 val_new() setups the chase-reply to be an edited copy of the msg. 4890 new classification, and find signer can find for it. 4891 removal of unsigned crap from additional, and query restart for 4892 cname. 4893 - refuse to follow wildcarded DNAMEs when validating. 4894 But you can query for qtype ANY, or qtype DNAME and validate that. 4895 489622 August 2007: Wouter 4897 - bogus TTL. 4898 - review - use val_error(). 4899 490021 August 2007: Wouter 4901 - ANY response validation. 4902 - store security status in cache. 4903 - check cache security status and either send the query to be 4904 validated, return the query to client, or send servfail to client. 4905 Sets AD bit on validated replies. 4906 - do not examine security status on an error reply in mesh_done. 4907 - construct DS, DNSKEY messages from rrset cache. 4908 - manual page entry for override-date. 4909 491020 August 2007: Wouter 4911 - validate and positive validation, positive wildcard NSEC validation. 4912 - nodata validation, nxdomain validation. 4913 491418 August 2007: Wouter 4915 - process DNSKEY response in FINDKEY state. 4916 491717 August 2007: Wouter 4918 - work on DS2KE routine. 4919 - val_nsec.c for validator NSEC proofs. 4920 - unit test for NSEC bitmap reading. 4921 - dname iswild and canonical_compare with unit tests. 4922 492316 August 2007: Wouter 4924 - DS sig unit test. 4925 - latest release libevent 1.3c and 1.3d have threading fixed. 4926 - key entry fixup data pointer and ttl absolute. 4927 - This makes a key-prime succeed in validator, with DS or DNSKEY as 4928 trust-anchor. 4929 - fixup canonical compare byfield routine, fix bug and also neater. 4930 - fixed iterator response type classification for queries of type 4931 ANY and NS. 4932 dig ANY gives sometimes NS rrset in AN and NS section, and parser 4933 removes the NS section duplicate. dig NS gives sometimes the NS 4934 in the answer section, as referral. 4935 - validator FINDKEY state. 4936 493715 August 2007: Wouter 4938 - crypto calls to verify signatures. 4939 - unit test for rrsig verification. 4940 494114 August 2007: Wouter 4942 - default outgoing ports changed to avoid port 2049 by default. 4943 This port is widely blocked by firewalls. 4944 - count infra lameness cache in memory size. 4945 - accounting of memory improved 4946 - outbound entries are allocated in the query region they are for. 4947 - extensive debugging for memory allocations. 4948 - --enable-lock-checks can be used to enable lock checking. 4949 - protect undefs in config.h from autoheaders ministrations. 4950 - print all received udp packets. log hex will print on multiple 4951 lines if needed. 4952 - fixed error in parser with backwards rrsig references. 4953 - mark cycle targets for iterator did not have CD flag so failed 4954 its task. 4955 495613 August 2007: Wouter 4957 - fixup makefile, if lexer is missing give nice error and do not 4958 mess up the dependencies. 4959 - canonical compare routine updated. 4960 - canonical hinfo compare. 4961 - printout list of the queries that the mesh is working on. 4962 496310 August 2007: Wouter 4964 - malloc and free overrides that track total allocation and frees. 4965 for memory debugging. 4966 - work on canonical sort. 4967 49689 August 2007: Wouter 4969 - canonicalization, signature checks 4970 - dname signature label count and unit test. 4971 - added debug heap size print to memory printout. 4972 - typo fixup in worker.c 4973 - -R needed on solaris. 4974 - validator override option for date check testing. 4975 49768 August 2007: Wouter 4977 - ldns _raw routines created (in ldns trunk). 4978 - sigcrypt DS digest routines 4979 - val_utils uses sigcrypt to perform signature cryptography. 4980 - sigcrypt keyset processing 4981 49827 August 2007: Wouter 4983 - security status type. 4984 - security status is copied when rdata is equal for rrsets. 4985 - rrset id is updated to invalidate all the message cache entries 4986 that refer to NSEC, NSEC3, DNAME rrsets that have changed. 4987 - val_util work 4988 - val_sigcrypt file for validator signature checks. 4989 49906 August 2007: Wouter 4991 - key cache for validator. 4992 - moved isroot and dellabel to own dname routines, with unit test. 4993 49943 August 2007: Wouter 4995 - replanning. 4996 - scrubber check section of lame NS set. 4997 - trust anchors can be in config file or read from zone file, 4998 DS and DNSKEY entries. 4999 - unit test trust anchor storage. 5000 - trust anchors converted to packed rrsets. 5001 - key entry definition. 5002 50032 August 2007: Wouter 5004 - configure change for latest libevent trunk version (needs -lrt). 5005 - query_done and walk_supers are moved out of module interface. 5006 - fixup delegation point duplicates. 5007 - fixup iterator scrubber; lame NS set is let through the scrubber 5008 so that the classification is lame. 5009 - validator module exists, and does nothing but pass through, 5010 with calling of next module and return. 5011 - validator work. 5012 50131 August 2007: Wouter 5014 - set version to 0.5 5015 - module work for module to module interconnections. 5016 - config of modules. 5017 - detect cycle takes flags. 5018 501931 July 2007: Wouter 5020 - updated plan 5021 - release 0.4 tag. 5022 502330 July 2007: Wouter 5024 - changed random state init, so that sequential process IDs are not 5025 cancelled out by sequential thread-ids in the random number seed. 5026 - the fwd_three test, which sends three queries to unbound, and 5027 unbound is kept waiting by ldns-testns for 3 seconds, failed 5028 because the retry timeout for default by unbound is 3 seconds too, 5029 it would hit that timeout and fail the test. Changed so that unbound 5030 is kept waiting for 2 seconds instead. 5031 503227 July 2007: Wouter 5033 - removed useless -C debug option. It did not work. 5034 - text edit of documentation. 5035 - added doc/CREDITS file, referred to by the manpages. 5036 - updated planning. 5037 503826 July 2007: Wouter 5039 - cycle detection, for query state dependencies. Will attempt to 5040 circumvent the cycle, but if no other targets available fails. 5041 - unit test for AXFR, IXFR response. 5042 - test for cycle detection. 5043 504425 July 2007: Wouter 5045 - testbound read ADDRESS and check it. 5046 - test for version.bind and friends. 5047 - test for iterator chaining through several referrals. 5048 - test and fixup for refetch for glue. Refetch fails if glue 5049 is still not provided. 5050 505124 July 2007: Wouter 5052 - Example section in config manual. 5053 - Addr stored for range and moment in replay. 5054 505520 July 2007: Wouter 5056 - Check CNAME chain before returning cache entry with CNAMEs. 5057 - Option harden-glue, default is on. It will discard out of zone 5058 data. If disabled, performance is faster, but spoofing attempts 5059 become a possibility. Note that still normalize scrubbing is done, 5060 and that the potentially spoofed data is used for infrastructure 5061 and not returned to the client. 5062 - if glue times out, refetch by asking parent of delegation again. 5063 Much like asking for DS at the parent side. 5064 - TODO items from forgery-resilience draft. 5065 and on memory handling improvements. 5066 - renamed module_event_timeout to module_event_noreply. 5067 - memory reporting code; reports on memory usage after handling 5068 a network packet (not on cache replies). 5069 507019 July 2007: Wouter 5071 - shuffle NS selection when getting nameserver target addresses. 5072 - fixup of deadlock warnings, yield cpu in checklock code so that 5073 freebsd scheduler selects correct process to run. 5074 - added identity and version config options and replies. 5075 - store cname messages complete answers. 5076 507718 July 2007: Wouter 5078 - do not query addresses, 127.0.0.1, and ::1 by default. 5079 508017 July 2007: Wouter 5081 - forward zone options in config file. 5082 - forward per zone in iterator. takes precendence over stubs. 5083 - fixup commithooks. 5084 - removed forward-to and forward-to-port features, subsumed by 5085 new forward zones. 5086 - fix parser to handle absent server: clause. 5087 - change untrusted rrset test to account for scrubber that is now 5088 applied during the test (which removes the poison, by the way). 5089 - feature, addresses can be specified with @portnumber, like nsd.conf. 5090 - test config files changed over to new forwarder syntax. 5091 509227 June 2007: Wouter 5093 - delete of mesh does a postorder traverse of the tree. 5094 - found and fixed a memory leak. For TTL=0 messages, that would 5095 not be cached, instead the msg-replyinfo structure was leaked. 5096 - changed server selection so it will filter out hosts that are 5097 unresponsive. This is defined as a host with the maximum rto value. 5098 This means that unbound tried the host for retries up to 120 secs. 5099 The rto value will time out after host-ttl seconds from the cache. 5100 This keeps such unresolvable queries from taking up resources. 5101 - utility for keeping histogram. 5102 510326 June 2007: Wouter 5104 - mesh is called by worker, and iterator uses it. 5105 This removes the hierarchical code. 5106 QueryTargets state and Finished state are merged for iterator. 5107 - forwarder mode no longer sets AA bit on first reply. 5108 - rcode in walk_supers is not needed. 5109 511025 June 2007: Wouter 5111 - more mesh work. 5112 - error encode routine for ease. 5113 511422 June 2007: Wouter 5115 - removed unused _node iterator value from rbtree_t. Takes up space. 5116 - iterator can handle querytargets state without a delegation point 5117 set, so that a priming(stub) subquery error can be handled. 5118 - iterator stores if it is priming or not. 5119 - log_query_info() neater logging. 5120 - changed iterator so that it does not alter module_qstate.qinfo 5121 but keeps a chase query info. Also query_flags are not altered, 5122 the iterator uses chase_flags. 5123 - fixup crash in case no ports for the family exist. 5124 512521 June 2007: Wouter 5126 - Fixup secondary buffer in case of error callback. 5127 - cleanup slumber list of runnable states. 5128 - module_subreq_depth fails to work in slumber list. 5129 - fixup query release for cached results to sub targets. 5130 - neater error for tcp connection failure, shows addr in verbose. 5131 - rbtree_init so that it can be used with preallocated memory. 5132 513320 June 2007: Wouter 5134 - new -C option to enable coredumps after forking away. 5135 - doc update. 5136 - fixup CNAME generation by scrubber, and memory allocation of it. 5137 - fixup deletion of serviced queries when all callbacks delete too. 5138 - set num target queries to 0 when you move them to slumber list. 5139 - typo in check caused subquery errors to be ignored, fixed. 5140 - make lint happy about rlim_t. 5141 - freeup of modules after freeup of module-states. 5142 - duplicate replies work, this uses secondary udp buffer in outnet. 5143 514419 June 2007: Wouter 5145 - nicer layout in stats.c, review 0.3 change. 5146 - spelling improvement, review 0.3 change. 5147 - uncapped timeout for server selection, so that very fast or slow 5148 servers will stand out from the rest. 5149 - target-fetch-policy: "3 2 1 0 0" config setting. 5150 - fixup queries answered without RD bit (for root prime results). 5151 - refuse AXFR and IXFR requests. 5152 - fixup RD flag in error reply from iterator. fixup RA flag from 5153 worker error reply. 5154 - fixup encoding of very short edns buffer sizes, now sets TC bit. 5155 - config options harden-short-bufsize and harden-large-queries. 5156 515718 June 2007: Wouter 5158 - same, move subqueries to slumber list when first has resolved. 5159 - fixup last fix for duplicate callbacks. 5160 - another offbyone in targetcounter. Also in Java prototype by the way. 5161 516215 June 2007: Wouter 5163 - if a query asks to be notified of the same serviced query result 5164 multiple times, this will succeed. Only one callback will happen; 5165 multiple outbound-list entries result (but the double cleanup of it 5166 will not matter). 5167 - when iterator moves on due to CNAME or referral, it will remove 5168 the subqueries (for other targets). These are put on the slumber 5169 list. 5170 - state module wait subq is OK with no new subqs, an old one may have 5171 stopped, with an error, and it is still waiting for other ones. 5172 - if a query loops, halt entire query (easy way to clean up properly). 5173 517414 June 2007: Wouter 5175 - num query targets was > 0 , not >= 0 compared, so that fetch 5176 policy of 0 did nothing. 5177 517813 June 2007: Wouter 5179 - debug option: configure --enable-static-exe for compile where 5180 ldns and libevent are linked statically. Default is off. 5181 - make install and make uninstall. Works with static-exe and without. 5182 installation of unbound binary and manual pages. 5183 - alignement problem fix on solaris 64. 5184 - fixup address in case of TCP error. 5185 518612 June 2007: Wouter 5187 - num target queries was set to 0 at a bad time. Default it to 0 and 5188 increase as target queries are done. 5189 - synthesize CNAME and DNAME responses from the cache. 5190 - Updated doxygen config for doxygen 1.5. 5191 - aclocal newer version. 5192 - doxygen 1.5 fixes for comments (for the strict check on docs). 5193 519411 June 2007: Wouter 5195 - replies on TCP queries have the address field set in replyinfo, 5196 for serviced queries, because the initiator does not know that 5197 a TCP fallback has occured. 5198 - omit DNSSEC types from nonDO replies, except if qtype is ANY or 5199 if qtype directly queries for the type (and then only show that 5200 'unknown type' in the answer section). 5201 - fixed message parsing where rrsigs on their own would be put 5202 in the signature list over the rrsig type. 5203 52047 June 2007: Wouter 5205 - fixup error in double linked list insertion for subqueries and 5206 for outbound list of serviced queries for iterator module. 5207 - nicer printout of outgoing port selection. 5208 - fixup cname target readout. 5209 - nicer debug output. 5210 - fixup rrset counts when prepending CNAMEs to the answer. 5211 - fixup rrset TTL for prepended CNAMEs. 5212 - process better check for looping modules, and which submodule to 5213 run next. 5214 - subreq insertion code fixup for slumber list. 5215 - VERB_DETAIL, verbosity: 2 level gives short but readable output. 5216 VERB_ALGO, verbosity: 3 gives extensive output. 5217 - fixup RA bit in cached replies. 5218 - fixup CNAME responses from the cache no longer partial response. 5219 - error in network send handled without leakage. 5220 - enable ip6 from config, and try ip6 addresses if available, 5221 if ip6 is not connected, skips to next server. 5222 52235 June 2007: Wouter 5224 - iterator state finished. 5225 - subrequests without parent store in cache and stop. 5226 - worker slumber list for ongoing promiscuous queries. 5227 - subrequest error handling. 5228 - priming failure returns SERVFAIL. 5229 - priming gives LAME result, returns SERVFAIL. 5230 - debug routine to print dns_msg as handled by iterator. 5231 - memleak in config file stubs fixup. 5232 - more small bugs, in scrubber, query compare no ID for lookup, 5233 in dname validation for NS targets. 5234 - sets entry.key for new special allocs. 5235 - lognametypeclass can display unknown types and classes. 5236 52374 June 2007: Wouter 5238 - random selection of equally preferred nameserver targets. 5239 - reply info copy routine. Reuses existing code. 5240 - cache lameness in response handling. 5241 - do not touch qstate after worker_process_query because it may have 5242 been deleted by that routine. 5243 - Prime response state. 5244 - Process target response state. 5245 - some memcmp changed to dname_compare for case preservation. 5246 52471 June 2007: Wouter 5248 - normalize incoming messages. Like unbound-java, with CNAME chain 5249 checked, DNAME checked, CNAME's synthesized, glue checked. 5250 - sanitize incoming messages. 5251 - split msgreply encode functions into own file msgencode.c. 5252 - msg_parse to queryinfo/replyinfo conversion more versatile. 5253 - process_response, classify response, delegpt_from_message. 5254 525531 May 2007: Wouter 5256 - querytargets state. 5257 - dname_subdomain_c() routine. 5258 - server selection, based on RTT. ip6 is filtered out if not available, 5259 and lameness is checked too. 5260 - delegation point copy routine. 5261 526230 May 2007: Wouter 5263 - removed FLAG_CD from message and rrset caches. This was useful for 5264 an agnostic forwarder, but not for a sophisticated (trust value per 5265 rrset enabled) cache. 5266 - iterator reponse typing. 5267 - iterator cname handle. 5268 - iterator prime start. 5269 - subquery work. 5270 - processInitRequest and processInitRequest2. 5271 - cache synthesizes referral messages, with DS and NSEC. 5272 - processInitRequest3. 5273 - if a request creates multiple subrequests these are all activated. 5274 527529 May 2007: Wouter 5276 - routines to lock and unlock array of rrsets moved to cache/rrset. 5277 - lookup message from msg cache (and copy to region). 5278 - fixed cast error in dns msg lookup. 5279 - message with duplicate rrset does not increase its TTLs twice. 5280 - 'qnamesize' changed to 'qname_len' for similar naming scheme. 5281 528225 May 2007: Wouter 5283 - Acknowledge use of unbound-java code in iterator. Nicer readme. 5284 - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and 5285 rrset cache from module environment. 5286 - packed rrset key has type and class as easily accessable struct 5287 members. They are still kept in network format for fast msg encode. 5288 - dns cache find_delegation routine. 5289 - iterator main functions setup. 5290 - dns cache lookup setup. 5291 529224 May 2007: Wouter 5293 - small changes to prepare for subqueries. 5294 - iterator forwarder feature separated out. 5295 - iterator hints stub code, config file stub code, so that first 5296 testing can proceed locally. 5297 - replay tests now have config option to enable forwarding mode. 5298 529923 May 2007: Wouter 5300 - outside network does precise timers for roundtrip estimates for rtt 5301 and for setting timeout for UDP. Pending_udp takes milliseconds. 5302 - cleaner iterator sockaddr conversion of forwarder address. 5303 - iterator/iter_utils and iter_delegpt setup. 5304 - root hints. 5305 530622 May 2007: Wouter 5307 - outbound query list for modules and support to callback with the 5308 outbound entry to the module. 5309 - testbound support for new serviced queries. 5310 - test for retry to TCP cannot use testbound any longer. 5311 - testns test for EDNS fallback, test for TCP fallback already exists. 5312 - fixes for no-locking compile. 5313 - mini_event timer precision and fix for change in timeouts during 5314 timeout callback. Fix for fwd_three tests, performed nonexit query. 5315 531621 May 2007: Wouter 5317 - small comment on hash table locking. 5318 - outside network serviced queries, contain edns and tcp fallback, 5319 and udp retries and rtt timing. 5320 532116 May 2007: Wouter 5322 - lruhash_touch() would cause locking order problems. Fixup in 5323 lock-verify in case locking cycle is found. 5324 - services/cache/rrset.c for rrset cache code. 5325 - special rrset_cache LRU updating function that uses the rrset id. 5326 - no dependencies calculation when make clean is called. 5327 - config settings for infra cache. 5328 - daemon code slightly cleaner, only creates caches once. 5329 533015 May 2007: Wouter 5331 - host cache code. 5332 - unit test for host cache. 5333 533414 May 2007: Wouter 5335 - Port to OS/X and Dec Alpha. Printf format and alignment fixes. 5336 - extensive lock debug report on join timeout. 5337 - proper RTT calculation, in utility code. 5338 - setup of services/cache/infra, host cache. 5339 534011 May 2007: Wouter 5341 - iterator/iterator.c module. 5342 - fixup to pass reply_info in testcode and in netevent. 5343 534410 May 2007: Wouter 5345 - created release-0.3 svn tag. 5346 - util/module.h 5347 - fixed compression - no longer compresses root name. 5348 53499 May 2007: Wouter 5350 - outside network cleans up waiting tcp queries on exit. 5351 - fallback to TCP. 5352 - testbound replay with retry in TCP mode. 5353 - tpkg test for retry in TCP mode, against ldns-testns server. 5354 - daemon checks max number of open files and complains if not enough. 5355 - test where data expires in the cache. 5356 - compiletests: fixed empty body ifstatements in alloc.c, in case 5357 locks are disabled. 5358 53598 May 2007: Wouter 5360 - outgoing network keeps list of available tcp buffers for outgoing 5361 tcp queries. 5362 - outgoing-num-tcp config option. 5363 - outgoing network keeps waiting list of queries waiting for buffer. 5364 - netevent supports outgoing tcp commpoints, nonblocking connects. 5365 53667 May 2007: Wouter 5367 - EDNS read from query, used to make reply smaller. 5368 - advertised edns value constants. 5369 - EDNS BADVERS response, if asked for too high edns version. 5370 - EDNS extended error reponses once the EDNS record from the query 5371 has successfully been parsed. 5372 53734 May 2007: Wouter 5374 - msgreply sizefunc is more accurate. 5375 - config settings for rrset cache size and slabs. 5376 - hashtable insert takes argument so that a thread can use its own 5377 alloc cache to store released keys. 5378 - alloc cache special_release() locks if necessary. 5379 - rrset trustworthiness type added. 5380 - thread keeps a scratchpad region for handling messages. 5381 - writev used in netevent to write tcp length and data after another. 5382 This saves a roundtrip on tcp replies. 5383 - test for one rrset updated in the cache. 5384 - test for one rrset which is not updated, as it is not deemed 5385 trustworthy enough. 5386 - test for TTL refreshed in rrset. 5387 53883 May 2007: Wouter 5389 - fill refs. Use new parse and encode to answer queries. 5390 - stores rrsets in cache. 5391 - uses new msgreply format in cache. 5392 53932 May 2007: Wouter 5394 - dname unit tests in own file and spread out neatly in functions. 5395 - more dname unit tests. 5396 - message encoding creates truncated TC flagged messages if they do 5397 not fit, and will leave out (whole)rrsets from additional if needed. 5398 53991 May 2007: Wouter 5400 - decompress query section, extremely lenient acceptance. 5401 But only for answers from other servers, not for plain queries. 5402 - compression and decompression test cases. 5403 - some stats added. 5404 - example.conf interface: line is changed from 127.0.0.1 which leads 5405 to problems if used (restricting communication to the localhost), 5406 to a documentation and test address. 5407 540827 April 2007: Wouter 5409 - removed iov usage, it is not good for dns message encoding. 5410 - owner name compression more optimal. 5411 - rrsig owner name compression. 5412 - rdata domain name compression. 5413 541426 April 2007: Wouter 5415 - floating point exception fix in lock-verify. 5416 - lint uses make dependency 5417 - fixup lint in dname owner domain name compression code. 5418 - define for offset range that can be compressed to. 5419 542025 April 2007: Wouter 5421 - prettier code; parse_rrset->type kept in host byte order. 5422 - datatype used for hashvalue of converted rrsig structure. 5423 - unit test compares edns section data too. 5424 542524 April 2007: Wouter 5426 - ttl per RR, for RRSIG rrsets and others. 5427 - dname_print debug function. 5428 - if type is not known, size calc will skip DNAME decompression. 5429 - RRSIG parsing and storing and putting in messages. 5430 - dnssec enabled unit tests (from nlnetlabs.nl and se queries). 5431 - EDNS extraction routine. 5432 543320 April 2007: Wouter 5434 - code comes through all of the unit tests now. 5435 - disabled warning about spurious extra data. 5436 - documented the RRSIG parse plan in msgparse.h. 5437 - rrsig reading and outputting. 5438 543919 April 2007: Wouter 5440 - fix unit test to actually to tests. 5441 - fix write iov helper, and fakevent code. 5442 - extra builtin testcase (small packet). 5443 - ttl converted to network format in packets. 5444 - flags converted correctly 5445 - rdatalen off by 2 error fixup. 5446 - uses less iov space for header. 5447 544818 April 2007: Wouter 5449 - review of msgparse code. 5450 - smaller test cases. 5451 545217 April 2007: Wouter 5453 - copy and decompress dnames. 5454 - store calculated hash value too. 5455 - routine to create message out of stored information. 5456 - util/data/msgparse.c for message parsing code. 5457 - unit test, and first fixes because of test. 5458 * forgot rrset_count addition. 5459 * did & of ptr on stack for memory position calculation. 5460 * dname_pkt_copy forgot to read next label length. 5461 - test from file and fixes 5462 * double frees fixed in error conditions. 5463 * types with less than full rdata allowed by parser. 5464 Some dynamic update packets seem to use it. 5465 546616 April 2007: Wouter 5467 - following a small change in LDNS, parsing code calculates the 5468 memory size to allocate for rrs. 5469 - code to handle ID creation. 5470 547113 April 2007: Wouter 5472 - parse routines. Code that parses rrsets, rrs. 5473 547412 April 2007: Wouter 5475 - dname compare routine that preserves case, with unit tests. 5476 547711 April 2007: Wouter 5478 - parse work - dname packet parse, msgparse, querysection parse, 5479 start of sectionparse. 5480 548110 April 2007: Wouter 5482 - Improved alignment of reply_info packet, nice for 32 and 64 bit. 5483 - Put RRset counts in reply_info, because the number of RRs can change 5484 due to RRset updates. 5485 - import of region-allocator code from nsd. 5486 - set alloc special type to ub_packed_rrset_key. 5487 Uses lruhash entry overflow chain next pointer in alloc cache. 5488 - doxygen documentation for region-allocator. 5489 - setup for parse scratch data. 5490 54915 April 2007: Wouter 5492 - discussed packed rrset with Jelte. 5493 54944 April 2007: Wouter 5495 - moved to version 0.3. 5496 - added util/data/dname.c 5497 - layout of memory for rrsets. 5498 54993 April 2007: Wouter 5500 - detect sign of msghdr.msg_iovlen so that the cast to that type 5501 in netevent (which is there to please lint) can be correct. 5502 The type on several OSes ranges from int, int32, uint32, size_t. 5503 Detects unsigned or signed using math trick. 5504 - constants for DNS flags. 5505 - compilation without locks fixup. 5506 - removed include of unportable header from lookup3.c. 5507 - more portable use of struct msghdr. 5508 - casts for printf warning portability. 5509 - tweaks to tests to port them to the testbed. 5510 - 0.2 tag created. 5511 55122 April 2007: Wouter 5513 - check sizes of udp received messages, not too short. 5514 - review changes. Some memmoves can be memcpys: 4byte aligned. 5515 set id correctly on cached answers. 5516 - review changes msgreply.c, memleak on error condition. AA flag 5517 clear on cached reply. Lowercase queries on hashing. 5518 unit test on lowercasing. Test AA bit not set on cached reply. 5519 Note that no TTLs are managed. 5520 552129 March 2007: Wouter 5522 - writev or sendmsg used when answering from cache. 5523 This avoids a copy of the data. 5524 - do not do useless byteswap on query id. Store reply flags in uint16 5525 for easier access (and no repeated byteswapping). 5526 - reviewed code. 5527 - configure detects and config.h includes sys/uio.h for writev decl. 5528 552928 March 2007: Wouter 5530 - new config option: num-queries-per-thread. 5531 - added tpkg test for answering three queries at the same time 5532 using one thread (from the query service list). 5533 553427 March 2007: Wouter 5535 - added test for cache and not cached answers, in testbound replays. 5536 - testbound can give config file and commandline options from the 5537 replay file to unbound. 5538 - created test that checks if items drop out of the cache. 5539 - added word 'partitioned hash table' to documentation on slab hash. 5540 A slab hash is a partitioned hash table. 5541 - worker can handle multiple queries at a time. 5542 554326 March 2007: Wouter 5544 - config settings for slab hash message cache. 5545 - test for cached answer. 5546 - Fixup deleting fake answer from testbound list. 5547 554823 March 2007: Wouter 5549 - review of yesterday's commits. 5550 - covered up memory leak of the entry locks. 5551 - answers from the cache correctly. Copies flags correctly. 5552 - sanity check for incoming query replies. 5553 - slabbed hash table. Much nicer contention, need dual cpu to see. 5554 555522 March 2007: Wouter 5556 - AIX configure check. 5557 - lock-verify can handle references to locks that are created 5558 in files it has not yet read in. 5559 - threaded hash table test. 5560 - unit test runs lock-verify afterwards and checks result. 5561 - need writelock to update data on hash_insert. 5562 - message cache code, msgreply code. 5563 556421 March 2007: Wouter 5565 - unit test of hash table, fixup locking problem in table_grow(). 5566 - fixup accounting of sizes for removing items from hashtable. 5567 - unit test for hash table, single threaded test of integrity. 5568 - lock-verify reports errors nicely. More quiet in operation. 5569 557016 March 2007: Wouter 5571 - lock-verifier, checks consistent order of locking. 5572 557314 March 2007: Wouter 5574 - hash table insert (and subroutines) and lookup implemented. 5575 - hash table remove. 5576 - unit tests for hash internal bin, lru functions. 5577 557813 March 2007: Wouter 5579 - lock_unprotect in checklocks. 5580 - util/storage/lruhash.h for LRU hash table structure. 5581 558212 March 2007: Wouter 5583 - configure.ac moved to 0.2. 5584 - query_info and replymsg util/data structure. 5585 55869 March 2007: Wouter 5587 - added rwlock writelock checking. 5588 So it will keep track of the writelock, and readlocks are enforced 5589 to not change protected memory areas. 5590 - log_hex function to dump hex strings to the logfile. 5591 - checklocks zeroes its destroyed lock after checking memory areas. 5592 - unit test for alloc. 5593 - identifier for union in checklocks to please older compilers. 5594 - created 0.1 tag. 5595 55968 March 2007: Wouter 5597 - Reviewed checklock code. 5598 55997 March 2007: Wouter 5600 - created a wrapper around thread calls that performs some basic 5601 checking for data race and deadlock, and basic performance 5602 contention measurement. 5603 56046 March 2007: Wouter 5605 - Testbed works with threading (different machines, different options). 5606 - alloc work, does the special type. 5607 56082 March 2007: Wouter 5609 - do not compile fork funcs unless needed. Otherwise will give 5610 type errors as their typedefs have not been enabled. 5611 - log shows thread numbers much more nicely (and portably). 5612 - even on systems with nonthreadsafe libevent signal handling, 5613 unbound will exit if given a signal. 5614 Reloads will not work, and exit is not graceful. 5615 - start of alloc framework layout. 5616 56171 March 2007: Wouter 5618 - Signals, libevent and threads work well, with libevent patch and 5619 changes to code (close after event_del). 5620 - set ipc pipes nonblocking. 5621 562227 February 2007: Wouter 5623 - ub_thread_join portable definition. 5624 - forking is used if no threading is available. 5625 Tested, it works, since pipes work across processes as well. 5626 Thread_join is replaced with waitpid. 5627 - During reloads the daemon will temporarily handle signals, 5628 so that they do not result in problems. 5629 - Also randomize the outgoing port range for tests. 5630 - If query list is full, will stop selecting listening ports for read. 5631 This makes all threads service incoming requests, instead of one. 5632 No memory is leaking during reloads, service of queries, etc. 5633 - test that uses ldns-testns -f to test threading. Have to answer 5634 three queries at the same time. 5635 - with verbose=0 operates quietly. 5636 563726 February 2007: Wouter 5638 - ub_random code used to select ID and port. 5639 - log code prints thread id. 5640 - unbound can thread itself, with reload(HUP) and quit working 5641 correctly. 5642 - don't open pipes for #0, doesn't need it. 5643 - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload). 5644 564523 February 2007: Wouter 5646 - Can do reloads on sigHUP. Everything is stopped, and freed, 5647 except the listening ports. Then the config file is reread. 5648 And everything is started again (and listening ports if needed). 5649 - Ports for queries are shared. 5650 - config file added interface:, chroot: and username:. 5651 - config file: directory, logfile, pidfile. And they work too. 5652 - will daemonize by default now. Use -d to stay in the foreground. 5653 - got BSD random[256 state] code, made it threadsafe. util/random. 5654 565522 February 2007: Wouter 5656 - Have a config file. Removed commandline options, moved to config. 5657 - tests use config file. 5658 565921 February 2007: Wouter 5660 - put -c option in man page. 5661 - minievent fd array capped by FD_SETSIZE. 5662 566320 February 2007: Wouter 5664 - Added locks code and pthread spinlock detection. 5665 - can use no locks, or solaris native thread library. 5666 - added yacc and lex configure, and config file parsing code. 5667 also makedist.sh, and manpage. 5668 - put include errno.h in config.h 5669 567019 February 2007: Wouter 5671 - Created 0.0 svn tag. 5672 - added acx_pthread.m4 autoconf check for pthreads from 5673 the autoconf archive. It is GPL-with-autoconf-exception Licensed. 5674 You can specify --with-pthreads, or --without-pthreads to configure. 5675 567616 February 2007: Wouter 5677 - Updated testbed script, works better by using make on remote end. 5678 - removed check decls, we can compile without them. 5679 - makefile supports LIBOBJ replacements. 5680 - docs checks ignore compat code. 5681 - added util/mini-event.c and .h, a select based alternative used with 5682 ./configure --with-libevent=no 5683 It is limited to 1024 file descriptors, and has less features. 5684 - will not create ip6 sockets if ip6 not on the machine. 5685 568615 February 2007: Wouter 5687 - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64, 5688 Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc. 5689 - malloc rndstate, so that it is aligned for access. 5690 - fixed rbtree cleanup with postorder traverse. 5691 - fixed pending messages are deleted when handled. 5692 - You can control verbosity; default is not verbose, every -v 5693 adds more verbosity. 5694 569514 February 2007: Wouter 5696 - Included configure.ac changes from ldns. 5697 - detect (some) headers before the standards check. 5698 - do not use isblank to test c99, since its not available on solaris9. 5699 - review of testcode. 5700 * entries in a RANGE are no longer reversed. 5701 * print name of file with replay entry parse errors. 5702 - port to OSX: cast to int for some prints of sizet. 5703 - Makefile copies ldnstestpkts.c before doing dependencies on it. 5704 570513 February 2007: Wouter 5706 - work on fake events, first fwd replay works. 5707 - events can do timeouts and errors on queries to servers. 5708 - test package that runs replay scenarios. 5709 571012 February 2007: Wouter 5711 - work on fake events. 5712 57139 February 2007: Wouter 5714 - replay file reading. 5715 - fake event setup, it creates fake structures, and teardowns, 5716 added signal callbacks to reply to be able to fake those, 5717 and main structure of event replay routines. 5718 57198 February 2007: Wouter 5720 - added tcp test. 5721 - replay storage. 5722 - testcode/fake_event work. 5723 57247 February 2007: Wouter 5725 - return answer with the same ID as query was sent with. 5726 - created udp forwarder test. I've done some effort to make it perform 5727 quickly. After servers are created, no big sleep statements but 5728 it checks the logfiles to see if servers have come up. Takes 0.14s. 5729 - set addrlen value when calling recvfrom. 5730 - comparison of addrs more portable. 5731 - LIBEVENT option for testbed to set libevent directory. 5732 - work on tcp input. 5733 57346 February 2007: Wouter 5735 - reviewed code and improved in places. 5736 57375 February 2007: Wouter 5738 - Picked up stdc99 and other define tests from ldns. Improved 5739 POSIX define test to include getaddrinfo. 5740 - defined constants for netevent callback error code. 5741 - unit test for strisip6. 5742 57432 February 2007: Wouter 5744 - Created udp4 and udp6 port arrays to provide service for both 5745 address families. 5746 - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets. 5747 - listens on both ip4 and ip6 ports to provide correct return address. 5748 - worker fwder address filled correctly. 5749 - fixup timer code. 5750 - forwards udp queries and sends answer. 5751 57521 February 2007: Wouter 5753 - outside network more UDP work. 5754 - moved * closer to type. 5755 - comm_timer object and events. 5756 575731 January 2007: Wouter 5758 - Added makedist.sh script to make release tarball. 5759 - Removed listen callback layer, did not add anything. 5760 - Added UDP recv to netevent, worker callback for udp. 5761 - netevent communication reply storage structure. 5762 - minimal query header sanity checking for worker. 5763 - copied over rbtree implementation from NSD (BSD licensed too). 5764 - outgoing network query service work. 5765 576630 January 2007: Wouter 5767 - links in example/ldns-testpkts.c and .h for premade packet support. 5768 - added callback argument to listen_dnsport and daemon/worker. 5769 577029 January 2007: Wouter 5771 - unbound.8 a short manpage. 5772 577326 January 2007: Wouter 5774 - fixed memleak. 5775 - make lint works on BSD and Linux (openssl defines). 5776 - make tags works. 5777 - testbound program start. 5778 577925 January 2007: Wouter 5780 - fixed lint so it may work on BSD. 5781 - put license into header of every file. 5782 - created verbosity flag. 5783 - fixed libevent configure flag. 5784 - detects event_base_free() in new libevent 1.2 version. 5785 - getopt in daemon. fatal_exit() and verbose() logging funcs. 5786 - created log_assert, that throws assertions to the logfile. 5787 - listen_dnsport service. Binds ports. 5788 578924 January 2007: Wouter 5790 - cleaned up configure.ac. 5791 579223 January 2007: Wouter 5793 - added libevent to configure to link with. 5794 - util/netevent setup work. 5795 - configure searches for libevent. 5796 - search for libs at end of configure (when other headers and types 5797 have been found). 5798 - doxygen works with ATTR_UNUSED(). 5799 - util/netevent implementation. 5800 580122 January 2007: Wouter 5802 - Designed header file for network communication. 5803 580416 January 2007: Wouter 5805 - added readme.svn and readme.tests. 5806 58074 January 2007: Wouter 5808 - Testbed script (run on multiple platforms the test set). 5809 Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5. 5810 - added unit test tpkg. 5811 58123 January 2007: Wouter 5813 - committed first set of files into subversion repository. 5814 svn co svn+ssh://unbound.net/svn/unbound 5815 You need a ssh login. There is no https access yet. 5816 - Added LICENSE, the BSD license. 5817 - Added doc/README with compile help. 5818 - main program stub and quiet makefile. 5819 - minimal logging service (to stderr). 5820 - added postcommit hook that serves emails. 5821 - added first test 00-lint. postcommit also checks if build succeeds. 5822 - 01-doc: doxygen doc target added for html docs. And stringent test 5823 on documented files, functions and parameters. 5824 582515 December 2006: Wouter 5826 - Created Makefile.in and configure.ac. 5827