xref: /freebsd/contrib/unbound/doc/Changelog (revision 924226fba12cc9a228c73b956e1b7fa24c60b055)
127 May 2022: Wouter
2	- Fix #684: [FTBS] configure script error with libmnl on openSUSE 15.3 (and possibly other distributions)
3	- Version is set to 1.16.0 for release. Release tag 1.16.0rc1.
4
520 May 2022: Wouter
6	- Fix to silence test for ede error output to the console from the
7	  test setup script.
8	- Fix ede test to not use default pidfile, and use local interface.
9	- Fix some lint type warnings.
10
1118 May 2022: George
12	- Fix typos in config_set_option for the 'num-threads' and
13	  'ede-serve-expired' options.
14
1515 May 2022: George
16	- Fix #678: [FR] modify behaviour of unbound-control rpz_enable zone,
17	  by updating unbound-control's documentation.
18
1912 May 2022: George
20	- Fix #417: prefetch and ECS causing cache corruption when used
21	  together.
22
2312 May 2022: Wouter
24	- Merge #677: Allow using system certificates not only on Windows,
25	  from pemensik.
26	- For #677: Added tls-system-cert to config parser and documentation.
27
2811 May 2022: Wouter
29	- Fix #673: DNS over TLS: error: SSL_handshake syscall: No route to
30	  host.
31
3210 May 2022: George
33	- Fix Python build in non-source directory; based on patch by
34	  Michael Tokarev.
35
366 May 2022: Tom
37	- Merge PR #604: Add basic support for EDE (RFC8914).
38
3928 April 2022: Wouter
40	- Fix #670: SERVFAIL problems with unbound 1.15.0 running on
41	  OpenBSD 7.1.
42
438 April 2022: Wouter
44	- Fix zonemd check to allow unsupported algorithms to load.
45	  If there are only unsupported algorithms, or unsupported schemes,
46	  and no failed or successful other ZONEMD records, or malformed
47	  or bad ZONEMD records, the unsupported records allow the zone load.
48	- Fix zonemd unsupported algo check.
49	- Fix zonemd unsupported algo check reason to not copy to next record,
50	  and check for success for debug printout.
51	- Fix zonemd unsupported algo check to print unsupported reason before
52	  zeroing it.
53	- Fix zonemd unsupported algo check to set reason to NULL before the
54	  check routine, but after malformed checks, to get the correct NULL
55	  output when the digest matches.
56
5725 March 2022: Wouter
58	- Fix spelling error in comment in sldns_str2wire_svcparam_key_lookup.
59
6023 March 2022: Wouter
61	- Fix #651: [FR] Better logging for refused queries.
62
6318 March 2022: George
64	- Merge PR #648 from eaglegai: fix -q doesn't work when use with
65	  'unbound-control stats_shm'.
66
6717 March 2022: Wouter
68	- Fix to describe auth-zone and other configuration at the local-zone
69	  configuration option, to allow for more broadly view of the options.
70
7116 March 2022: Wouter
72	- Fix to ensure uniform handling of spaces and tabs when parsing RRs.
73
749 March 2022: Wouter
75	- Merge #644: Make `install-lib` make target install the pkg-config
76	  file.
77
787 March 2022: Wouter
79	- Fix configure for python to use sysutils, because distutils is
80	  deprecated. It uses sysutils when available, distutils otherwise.
81
823 March 2022: Wouter
83	- Fix #637: Integer Overflow in sldns_str2period function.
84	- Fix for #637: fix integer overflow checks in sldns_str2period.
85
862 March 2022: George
87	- Merge PR #632 from scottrw93: Match cnames in ipset.
88	- Various fixes for #632: variable initialisation, convert the qinfo
89	  to str once, accept trailing dot in the local-zone ipset option.
90
912 March 2022: Wouter
92	- Fix compile warnings for printf ll format on mingw compile.
93
941 March 2022: Wouter
95	- Fix pythonmod for change in iter_dp_is_useless function prototype.
96
9728 February 2022: George
98	- Fix #630: Unify the RPZ log messages.
99	- Merge #623 from rex4539: Fix typos.
100
10128 February 2022: Wouter
102	- Fix #633: Document unix domain socket support for unbound-control.
103	- Fix for #633: updated fix with new text.
104	- Fix edns client subnet to add the option based on the option list,
105	  so that it is not state dependent, after the state fix of #605 for
106	  double EDNS options.
107	- Fix for edns client subnet option add fix in removal code, from review.
108
10925 February 2022: Wouter
110	- Fix to detect that no IPv6 support means that IPv6 addresses are
111	  useless for delegation point lookups.
112	- update Makefile dependencies.
113	- Fix check interface existence for support detection in remote lookup.
114
11518 February 2022: Wouter
116	- Fix that address not available is squelched from the logs for
117	  udp connect failures. It is visible on verbosity 4 and more.
118	- Merge #631 from mollyim: Replace OpenSSL's ERR_PACK with
119	  ERR_GET_REASON.
120
12116 February 2022: Wouter
122	- Fix for #628: fix rpz-passthru for qname trigger by localzone type.
123
12415 February 2022: Wouter
125	- Fix #628: A rpz-passthru action is not ending RPZ zone processing.
126
12711 February 2022: Wouter
128	- Fix #624: Unable to stop Unbound in Windows console (does not
129	  respond to CTRL+C command).
130	- Fix #618: enabling interface-automatic disables DNS-over-TLS.
131	  Adds the option to list interface-automatic-ports.
132	- Remove debug info from #618 fix.
133
1347 February 2022: Wouter
135	- Fix that TCP interface does not use TLS when TLS is also configured.
136
1374 February 2022: Wouter
138	- Fix #412: cache invalidation issue with CNAME+A.
139
1403 February 2022: Wouter
141	- Fix for #611: Integer overflow in sldns_wire2str_pkt_scan.
142	- Tag for 1.15.0rc1 created. That became 1.15.0 on 10 feb 2022.
143	  The repository continues with version 1.15.1.
144
1452 February 2022: George
146	- Merge PR #532 from Shchelk: Fix: buffer overflow bug.
147	- Merge PR #616: Update ratelimit logic. It also introduces
148	  ratelimit-backoff and ip-ratelimit-backoff configuration options.
149	- Change aggressive-nsec default to yes.
150	- Merge PR #617: Update stub/forward-host notation to accept port and
151	  tls-auth-name.
152	- Update stream_ssl.tdir test to also use the new forward-host
153	  notation.
154
1552 February 2022: Wouter
156	- Update version number in repo to 1.15.0 for upcoming release,
157	  since it changes the aggressive-nsec default and the ratelimit change.
158	- Fix header comment for doxygen for authextstrtoaddr.
159	- please clang analyzer for loop in test code.
160	- Fix docker splint test to use more portable uname.
161	- Update contrib/aaaa-filter-iterator.patch with diff for current
162	  software version.
163
1641 February 2022: George
165	- Merge PR #603 from fobser: Use OpenSSL 1.1 API to access DSA and RSA
166	  internals.
167
16831 January 2022: George
169	- Fix review comment for use-after-free when failing to send UDP out.
170
17131 January 2022: Wouter
172	- iana portlist update.
173
17429 January 2022: George
175	- Fix tls-* and ssl-* documented alternate syntax to also be available
176	  through remote-control and unbound-checkconf.
177	- Better cleanup on failed DoT/DoH listening socket creation.
178
17926 January 2022: George
180	- Fix #599: [FR] RFC 9156 (obsoletes RFC 7816), by noting the new RFC
181	  document.
182
18326 January 2022: Wouter
184	- Test for NSID in SERVFAIL response due to DNSSEC bogus.
185
18625 January 2022: George
187	- Fix #588: Unbound 1.13.2 crashes due to p->pc is NULL in
188	  serviced_udp_callback.
189	- Merge PR #612: TCP race condition.
190
19125 January 2022: Wouter
192	- Fix #610: Undefine-shift in sldns_str2wire_hip_buf.
193
19419 January 2022: George
195	- For dnstap, do not wakeupnow right there. Instead zero the timer to
196	  force the wakeup callback asap.
197
19814 January 2022: George
199	- Merge PR #605:
200	  - Fix EDNS to upstream where the same option could be attached
201	     more than once.
202	  - Add a region to serviced_query for allocations.
203
20414 January 2022: Wouter
205	- Add rpz: for-downstream: yesno option, where the RPZ zone is
206	  authoritatively answered for, so the RPZ zone contents can be
207	  checked with DNS queries directed at the RPZ zone.
208	- For #602: Allow the module-config "subnetcache validator cachedb
209	  iterator".
210
21111 January 2022: George
212	- Fix prematurely terminated TCP queries when a reply has the same ID.
213
2147 January 2022: Wouter
215	- Merge #600 from pemensik: Change file mode before changing file
216	  owner.
217
2185 January 2022: Wouter
219	- Fix for #596: fix that rpz return message is returned and not just
220	  the rcode from the iterator return path. This fixes signal unset RA
221	  after a CNAME.
222	- Fix unit tests for rpz now that the AA flag returns successfully from
223	  the iterator loop.
224	- Fix for #596: add unit test for nsdname trigger and signal unset RA.
225	- Fix for #596: add unit test for nsip trigger and signal unset RA.
226	- Fix #598: Fix unbound-checkconf fatal error: module conf
227	  'respip dns64 validator iterator' is not known to work.
228	- Fix for #596: Fix rpz-signal-nxdomain-ra to work for clientip
229	  triggered operation.
230
2314 January 2022: Wouter
232	- Fix #596: unset the RA bit when a query is blocked by an unbound
233	  RPZ nxdomain reply. The option rpz-signal-nxdomain-ra allows to
234	  signal that a domain is externally blocked to clients when it
235	  is blocked with NXDOMAIN by unsetting RA.
236	- Fix to add test for rpz-signal-nxdomain-ra.
237	- Fix #596: only unset RA when NXDOMAIN is signalled.
238	- Fix that RPZ does not set RD flag on replies, it should be copied
239	  from the query.
240
24122 December 2021: George
242	- contrib/aaaa-filter-iterator.patch file renewed diff content to
243	  apply cleanly to the current coderepo for the current code version.
244
24520 December 2021: George
246	- Fix #591: Unbound-anchor manpage links to non-existent license file.
247
24813 December 2021: George
249	- Add missing configure flags for optional features in the
250	  documentation.
251	- Fix Unbound capitalization in the documentation.
252
25313 December 2021: Wouter
254	- Fix to pick up other class local zone information before unlock.
255
25610 December 2021: George
257	- Allow local-data for classes other than IN to inherit a configured
258	  local-zone's type if possible, instead of defaulting to type
259	  transparent as per the implicit rule.
260
26110 December 2021: Wouter
262	- Add code similar to fix for ldns for tab between strings, for
263	  consistency, the test case was not broken.
264
2656 December 2021: Wouter
266	- Merge PR #581 from fobser: Fix -Wmissing-prototypes and -Wshadow
267	  warnings in rpz.
268	- Fix validator debug output about DS support, print correct algorithm.
269
2703 December 2021: Wouter
271	- Fix compile warning for if_nametoindex on windows 64bit.
272
2731 December 2021: Wouter
274	- configure is set to 1.14.0, and release branch.
275	  This was released as version 1.14.0 on 9 Dec 2021, with the doxygen
276	  fix below included. The main branch continues as 1.14.1.
277	- Fix doc/unbound.doxygen to remove obsolete tag warning.
278
2791 December 2021: George
280	- Merge PR #511 from yan12125: Reduce unnecessary linking.
281	- Merge PR #493 from Jaap: Fix generation of libunbound.pc.
282	- Merge PR #555 from fobser: Allow interface names as scope-id in IPv6
283	  link-local addresses.
284	- Merge PR #562 from Willem: Reset keepalive per new tcp session.
285	- Merge PR #522 from sibeream: memory management violations fixed.
286	- Merge PR #530 from Shchelk: Fix: dereferencing a null pointer.
287	- Fix #454: listen_dnsport.c:825: error: ‘IPV6_TCLASS’ undeclared.
288	- Fix #574: Review fixes for size allocation.
289
29030 November 2021: Wouter
291	- Fix to remove git tracking and ci information from release tarballs.
292	- iana portlist update.
293
29429 November 2021: Wouter
295	- Merge PR #570 from rex4539: Fix typos.
296	- Fix for #570: regen aclocal.m4, fix configure.ac for spelling.
297	- Fix to make python module opt_list use opt_list_in.
298	- Fix #574: unbound-checkconf reports fatal error if interface names
299	  are used as value for interfaces:
300	- Fix #574: Review fixes for it.
301	- Fix #576: [FR] UB_* error codes in unbound.h
302	- Fix #574: Review fix for spelling.
303
30415 November 2021: Tom
305	- Improve EDNS option handling, now also works for synthesised
306	  responses such as local-data and server.id CH TXT responses.
307
3085 November 2021: George
309	- Fix for #558: fix loop in comm_point->tcp_free when a comm_point is
310	  reclaimed more than once during callbacks.
311	- Fix for #558: clear the UB_EV_TIMEOUT bit before adding an event.
312
3135 November 2021: Wouter
314	- Fix that forward-zone name is documented as the full name of the
315	  zone. It is not relative but a fully qualified domain name.
316	- Fix analyzer review failure in rpz action override code to not
317	  crash on unlocking the local zone lock.
318	- Fix to remove unused code from rpz resolve client and action
319	  function.
320	- Merge #565: unbound.service.in: Disable ProtectKernelTunables again.
321
3222 November 2021: Wouter
323	- Fix #552: Unbound assumes index.html exists on RPZ host.
324
32511 October 2021: Wouter
326	- Fix chaos replies to have truncation for short message lengths,
327	  or long reply strings.
328	- Fix to protect custom regional create against small values.
329
3304 October 2021: Wouter
331	- Fix to add example.conf note for outbound-msg-retry.
332
33327 September 2021: Wouter
334	- Implement RFC8375: Special-Use Domain 'home.arpa.'.
335
33621 September 2021: Wouter
337	- For crosscompile on windows, detect 64bit stackprotector library.
338	- Fix crosscompile shell syntax.
339	- Fix crosscompile windows to use libssp when it exists.
340	- For the windows compile script disable gost.
341	- Fix that on windows, use BIO_set_callback_ex instead of deprecated
342	  BIO_set_callback.
343	- Fix crosscompile script for the shared build flags.
344
34520 September 2021: Wouter
346	- Fix crosscompile on windows to work with openssl 3.0.0 the
347	  link with ws2_32 needs -l:libssp.a for __strcpy_chk.
348	  Also copy results from lib64 directory if needed.
349
35010 September 2021: Wouter
351	- Fix initialisation errors reported by gcc sanitizer.
352	- Fix lock debug code for gcc sanitizer reports.
353	- Fix more initialisation errors reported by gcc sanitizer.
354
3558 September 2021: Wouter
356	- Merged #41 from Moritz Schneider: made outbound-msg-retry
357	  configurable.
358	- Small fixes for #41: changelog, conflicts resolved,
359	  processQueryResponse takes an iterator env argument like other
360	  functions in the iterator, no colon in string for set_option,
361	  and some whitespace style, to make it similar to the rest.
362	- Fix for #41: change outbound retry to int to fix signed comparison
363	  warnings.
364	- Fix root_anchor test to check with new icannbundle date.
365
3663 September 2021: Wouter
367	- Fix #538: Fix subnetcache statistics.
368
3691 September 2021: Wouter
370	- Fix tcp fastopen failure when disabled, try normal connect instead.
371
37227 August 2021: Wouter
373	- Fix #533: Negative responses get cached even when setting
374	  cache-max-negative-ttl: 1
375
37625 August 2021: Wouter
377	- Merge #401: RPZ triggers. This add additional RPZ triggers,
378	  unbound supports a full set of rpz triggers, and this now
379	  includes nsdname, nsip and clientip triggers. Also actions
380	  are fully supported, and this now includes the tcp-only action.
381	- Fix #536: error: RPZ: name of record (drop.spamhaus.org.rpz.local.)
382	  to insert into RPZ.
383	- Fix the stream wait stream_wait_count_lock and http2 buffer locks
384	  setup and desetup from race condition.
385	- Fix RPZ locks. Do not unlock zones lock if requested and rpz find
386	  zone does not find the zone. Readlock the clientip that is found
387	  for ipbased triggers. Unlock the nsdname zone lock when done.
388	  Unlock zone and ip in rpz nsip and nsdname callback. Unlock
389	  authzone and localzone if clientip found in rpz worker call.
390	- Fix compile warning in libunbound for listen desetup routine.
391	- Fix asynclook unit test for setup of lockchecks before log.
392
39320 August 2021: Wouter
394	- Fix #529: Fix: log_assert does nothing if UNBOUND_DEBUG is
395	  undefined.
396	- Fix #531: Fix: passed to proc after free.
397
39817 August 2021: Wouter
399	- Fix that --with-ssl can use "/usr/include/openssl11" to pass the
400	  location of a different openssl version.
401	- Fix #527: not sending quad9 cert to syslog (and may be more).
402	- Fix sed script in ssldir split handling.
403
40416 August 2021: George
405	- Merge PR #528 from fobser: Make sldns_str2wire_svcparam_buf()
406	  static.
407
40816 August 2021: Wouter
409	- Fix to support harden-algo-downgrade for ZONEMD dnssec checks.
410
41113 August 2021: Wouter
412	- Support using system-wide crypto policies.
413	- Fix for #431: Squelch permission denied errors for udp connect,
414	  and udp send, they are visible at higher verbosity settings.
415	- Fix zonemd verification of key that is not in DNS but in the zone
416	  and needs a chain of trust.
417	- zonemd, fix order of bogus printout string manipulation.
418
41912 August 2021: George
420	- Merge PR #514, from ziollek: Docker environment for run tests.
421	- For #514: generate configure.
422
42312 August 2021: Wouter
424	- And 1.13.2rc1 became the 1.13.2 with the fix for the python module
425	  build. The current code repository continues with version 1.13.3.
426	- Add test tool readzone to .gitignore.
427	- Merge #521: Update mini_event.c.
428	- Merge #523: fix: free() call more than once with the same pointer.
429	- Merge #519: Support for selective enabling tcp-upstream for
430	  stub/forward zones.
431	- For #519: note stub-tcp-upstream and forward-tcp-upstream in
432	  the example configuration file.
433	- For #519: yacc and lex. And fix python bindings, and test program
434	  unbound-dnstap-socket.
435	- For #519: fix comments for doxygen.
436	- Fix to print error from unbound-anchor for writing to the key
437	  file, also when not verbose.
438
4395 August 2021: Wouter
440	- Tag for 1.13.2rc1 release.
441	- Fix #520: Unbound 1.13.2rc1 fails to build python module.
442
4434 August 2021: George
444	- Merge PR #415 from sibeream: Use
445	  /proc/sys/net/ipv4/ip_local_port_range to determine available outgoing
446	  ports. (New --enable-linux-ip-local-port-range configuration option)
447	- Bump MAX_RESTART_COUNT to 11 from 8; in relation to #438. This
448	  allows longer CNAME chains in Unbound.
449
4504 August 2021: Wouter
451	- In unit test use openssl set security level to allow keys in test.
452	- Fix static analysis warnings about localzone locks that are unused.
453	- Fix missing locks in zonemd unit test.
454	- Fix readzone compile under debug config.
455	- Fix out of sourcedir run of zonemd unit tests.
456	- Fix libnettle zonemd unit test.
457	- Fix unit test zonemd_reload for use in run_vm.
458
4593 August 2021: George
460	- Listen to read or write events after the SSL handshake.
461	  Sticky events on windows would stick on read when write was needed.
462
4633 August 2021: Wouter
464	- Merge PR #517 from dyunwei: #420 breaks the mesh reply list
465	  function that need to reuse the dns answer.
466	- Annotate assertion into error printout; we think it may be an
467	  error, but the situation looks harmless.
468	- Fix sign comparison warning on FreeBSD.
469
4702 August 2021: Wouter
471	- Prepare for OpenSSL 3.0.0 provider API usage, move the sldns
472	  keyraw functions to produce EVP_PKEY results.
473	- Move RSA and DSA to use OpenSSL 3.0.0 API.
474	- Move ECDSA functions to use OpenSSL 3.0.0 API.
475	- iana portlist update.
476	- Fix verbose printout failure in tcp reuse unit test.
477
47830 July 2021: Wouter
479	- Fix #515: Compilation against openssl 3.0.0 beta2 is failing to
480	  build unbound.
481	- For #515: Fix compilation with openssl 3.0.0 beta2, lib64 dir and
482	  SSL_get_peer_certificate.
483	- Move acx_nlnetlabs.m4 to version 41, with lib64 openssl dir check.
484
48526 July 2021: George
486	- Merge #513: Stream reuse, attempt to fix #411, #439, #469. This
487	  introduces a couple of fixes for the stream reuse functionality
488	  that could result in broken internal structures.
489
49026 July 2021: Wouter
491	- Merge #512: unbound.service.in: upgrade hardening to latest
492	  standards.
493	- Fix readzone unknown type print for memory resize.
494
49521 July 2021: Wouter
496	- Fix that ldns_zone_new_frm_fp_l counts the line number for an empty
497	  line after a comment.
498
49916 July 2021: George
500	- Introduce 'http-user-agent:' and 'hide-http-user-agent:' options.
501
50216 July 2021: Wouter
503	- Merge #510 from ndptech: Don't call a function which hasn't been
504	  defined.
505	- Fix for #510: in depth, use ifdefs for windows api event calls.
506	- Fix spelling in doc/unbound.doxygen comment.
507	- Fix spelling in localzone.h comment.
508	- Fix unbound-control local_data and local_datas to print detailed
509	  syntax errors.
510	- review fix to remove duplicate error printout.
511	- Insert header into testcode/readzone.c, it was missing.
512	- Fix from lint for ignored return value.
513	- Fix for older parsers for function call in serve expired get cached.
514
5156 July 2021: Wouter
516	- iana portlist update.
517
5185 July 2021: George
519	- Fix compiler warnings for #491.
520	- Fix clang-analysis warnings for testcode/readzone.c.
521
5224 July 2021: George
523	- Fix Wunused-result compile warnings.
524
5252 July 2021: Tom
526	- Merge PR #491: Add SVCB and HTTPS types and handling according to
527	  draft-ietf-dnsop-svcb-https.
528
5292 July 2021: Wouter
530	- Fix #506: Python Module Seems to Leak Memory if it Experiences an
531	  Unhandled Exception.
532
53325 June 2021: Wouter
534	- Fix up permissions on rpl data file in tests.
535	- Fix testbound newline treatment in moment_read and tempfile write.
536	- Fix configure grep for reuseport default for failure.
537	- Fix compat ctime_r return value
538	- Fix configure does not require pkg-config if not needed.
539	- Fix unit test in the ctime_r calls for autotrust and in testbound.
540	- Fix auth zone download on windows to unlink before rename.
541
54224 June 2021: Wouter
543	- Add analyzer and port compile github workflow.
544
54523 June 2021: Wouter
546	- Fix #503: DNS over HTTPS response truncated.
547	- Fix warnings reported by the gcc analyzer.
548
54921 June 2021: George
550	- Fix #495: Documentation or implementation of "verbosity" option.
551
55218 June 2021: Wouter
553	- Fix a number of warnings reported by the gcc analyzer.
554
55515 June 2021: George
556	- Merge #440 by kimheino: Various fixes to contrib/unbound_munin_ file.
557
55814 June 2021: Wouter
559	- Fix configure nonblocking test and onmingw test to use host.
560
56110 June 2021: Wouter
562	- Fix #500: SPEC file in version 1.13.1 references version 1.4;
563	  unable to build RPM from source.
564	- Fix contrib/unbound.spec, fixed url and comment.
565
5669 June 2021: George
567	- Merge #486 by fobster: Make VAL_MAX_RESTART_COUNT configurable.
568	- Generated lexer and parser for #486; updated example.conf.
569	- Fix #413 (based on patch by k-ronny): unbound: does not compile
570	  on macOS 11.1-x86_64 host.
571	- Use host_os instead of target_os in configure for Darwin8 build.
572
5738 June 2021: George
574	- Fix unused variable warning when compiling with --enable-dnstap.
575
5767 June 2021: George
577	- Merge #448 from shoeper: Update unbound-control.8.in, fix
578	  rpz_disable typo.
579	- Fix #425: Document auth-zone supports communication with DNS
580	  primary on nondefault port.
581
5821 June 2021: George
583	- Fix test for zonemd-check option.
584
58527 May 2021: Wouter
586	- Merge #496 from banburybill: Use build system endianness if
587	  available, otherwise try to work it out.
588	- zonemd-check: yesno option, default no, enables the processing
589	  of ZONEMD records for that zone.
590
59125 May 2021: Wouter
592	- Move the NSEC3 max iterations count in line with the 150 value
593	  used by BIND, Knot and PowerDNS. This sets the default value
594	  for it in the configuration to 150 for all key sizes.
595	- Fix #492: module-config respip missing in unbound.conf.5.in man
596	  page. Merges #494 from he32.
597	- For #492: Fix font highlighting for the man page on emacs.
598
59921 May 2021: Wouter
600	- Test code has -q option for quiet output.
601
60219 May 2021: George
603	- Fix for #411, #439, #469: Reset the DNS message ID when moving queries
604	  between TCP streams.
605	- Refactor for uniform way to produce random DNS message IDs.
606
60717 May 2021: Wouter
608	- Fix #489: Compile using MSYS2 MinGW 64-bit.
609
61012 May 2021: Wouter
611	- Fix that auth-zone zonefiles use last TTL if no TTL is specified.
612
61310 May 2021: Wouter
614	- Merge PR #487: ifdef RLIMIT_AS in recently added check.
615
6167 May 2021: Wouter
617	- Fix #485: Unbound occasionally reports broken stats.
618	- Add ./configure --with-deprecate-rsa-1024 that turns off RSA 1024.
619	- Remove case fallthrough from deprecate-rsa-1024 code.
620
6214 May 2021: George
622	- Fix for #367: only attempt to get the interface for queries that are no
623	  longer on the tcp_waiting_list.
624	- Add more logging for out-of-memory cases.
625
6264 May 2021: Wouter
627	- Merge #478: Allow configuration of TCP timeout while waiting for
628	  response.
629	- Fix to squelch tcp socket bind failures when the interface is gone.
630	- Rerun flex and bison.
631
6323 May 2021: Wouter
633	- Fix #481: Fix comment in configuration file.
634
63529 April 2021: Wouter
636	- Add that log-servfail prints an IP address and more information
637	  about one of the last failures for that query.
638
63928 April 2021: George
640	- Fix compiler warning for signed/unsigned comparison for
641	  max_reuse_tcp_queries.
642
64328 April 2021: Wouter
644	- Fix #474: always_null and others inside view.
645
64626 April 2021: Wouter
647	- Merge #470 from edevil: Allow configuration of persistent TCP
648	  connections.
649
65022 April 2021: Wouter
651	- Merge #466 from FGasper: Support OpenSSLs that lack
652	  SSL_get0_alpn_selected.
653	- Fix #468: OpenSSL 1.0.1 can no longer build Unbound.
654	- Further fix for #468: detect SSL_CTX_set_alpn_protos for build with
655	  OpenSSL 1.0.1.
656	- Fix that testcode dohclient has OpenSSL initialisation calls.
657
65813 April 2021: George
659	- Fix documentation comment for files previously residing in checkconf/.
660	- Remove unused functions worker_handle_reply and libworker_handle_reply.
661
66213 April 2021: Wouter
663	- Fix that nxdomain synthesis does not happen above the stub or
664	  forward definition.
665
66612 April 2021: George
667	- Fix (increase) verbosity level for iterator error log in
668	  processQueryTargets().
669
67012 April 2021: Wouter
671	- Fix permission denied sendto log, squelch the log messages
672	  unless high verbosity is set.
673
6749 April 2021: Wouter
675	- rebuild configure to set EXTRALINK to libunbound.la for #460.
676
6777 April 2021: Wouter
678	- Fix for #411: Depth protect for crash on deleted element timeout.
679
6801 April 2021: Wouter
681	- Merge #460 from orbea: build: Link with the libtool archive.
682	- Fix to stop IPv6 PMTU discovery.
683
68431 March 2021: George
685	- Clean makedist.sh.
686
68731 March 2021: Wouter
688	- Fix stack-protector change to not override other CFLAGS options.
689
69030 March 2021: George
691	- Disable the use of stack-protector for cross compiled 32-bit windows
692	  builds; relates to #444.
693
69425 March 2021: Wouter
695	- Fix #429: Also fix end of transfer for http download of auth zones.
696
69724 March 2021: Wouter
698	- Fix deprecation test to work for iOS TVOS and WatchOS, it uses
699	  CFLAGS and CPPFLAGS and also checks if the item is unavailable.
700	- Travis, fix script to fail when tasks fail.
701	- Travis, fix warning in ubsan compile.
702	- Fix configure Targetconfiditionals.h header check, to use compile.
703	- Fix that cachedb does not produce empty object files when disabled.
704
70523 March 2021: Wouter
706	- Travis enable all tests again. Clang analyzer only a couple times,
707	  when there is a difference. homebrew updates disabled, so it does
708	  not hang. removed trailing slashes from configure paths. Moved iOS
709	  tests to allow-failure.
710	- travis, analyzer disabled on test without debug, that does not
711	  run anway.  Turn off failing tests except one.  Update iOS test
712	  to xcode image 12.2.
713
71422 March 2021: George
715	- Fix unused-function warning when compiling with --enable-dnscrypt.
716	- Fix for #367: fix memory leak when cannot bind to listening port.
717	- Reformat pythonmod/pythonmod_utils.{c,h}.
718
71922 March 2021: Wouter
720	- Merge #449 from orbea: build: Add missing linker flags.
721	- iana portlist update.
722	- Comment out nonworking OSX and IOS travis tests, vm fails to start.
723	- Fix compile error in listen_dnsport on Android.
724	- Fix memory leak reported by asan in rpz SOA record query name.
725
72619 March 2021: Wouter
727	- Fix for #447: squelch connection refused tcp connection failures
728	  from the log, unless verbosity is high.
729
73017 March 2021: Wouter
731	- Fix #441: Minimal NSEC range not accepted for top level domains.
732
73311 March 2021: Wouter
734	- Fix parse of LOC RR type for decimetres.
735
7365 March 2021: Wouter
737	- Workaround for #439: prevent loops in the reuse rbtree.
738	- Debug output for #411 and #439: printout internal error and details.
739
7404 March 2021: Wouter
741	- iana portlist update.
742	- Fix spurious errors about "Could not generate request: out of
743	  memory".  The mesh detect cycle routine no longer wrongly stops
744	  the check when the calling mesh state is unique.
745
74626 February 2021: George
747	- Fix for #367: rc_ports don't have ub_sock; skip cleaning up.
748
74926 February 2021: Wouter
750	- Fix: Resolve interface names on control-interface too.
751
75225 February 2021: Wouter
753	- Merge PR #367 : DNSTAP log local address.  With code from PR #365
754	  and fixes #368 : dnstap does not log the DNS message ID for
755	  FORWARDER_QUERY.
756	- Fix to allow rpz with wildcard that applies to all TLDs at once.
757
75824 February 2021: George
759	- Fix #384: (1) A minor request to improve the log (2) A minor bug in one
760	  log message.
761	- ipsecmod: Better logging for detecting a cycle when attaching the
762	  A/AAAA subquery.
763
76424 February 2021: Wouter
765	- On startup of unbound it checks if rlimits on memory size look
766	  sufficient for the configured cache size, and logs warning if not.
767	- Fix function documentation.
768	- Fix unit test for added ulimit checks.
769	- spelling fix in header.
770
77123 February 2021: Wouter
772	- Fix for zonemd, that domain-insecure zones work without dnssec.
773	- Fix for zonemd, do not reject insecure result from trust anchor
774	  validation step in dnssec chain of trust.
775
77622 February 2021: Wouter
777	- Fix #431: Squelch permission denied errors for tcp connect
778	  and udp connect from the logs, unless at high verbosity.
779	- Fix for zonemd, that nxdomain for the chain of trust is allowed
780	  for island zones, it is treated as an insecure zone for verification.
781
78218 February 2021: Wouter
783	- Merge PR #317: ZONEMD Zone Verification, with RFC 8976 support.
784	  ZONEMD records are checked for zones loaded as auth-zone,
785	  with DNSSEC if available.  There is an added option
786	  zonemd-permissive-mode that makes it log but not fail wrong zones.
787	  With zonemd-reject-absence for an auth-zone the presence of a
788	  zonemd can be mandated for specific zones.
789	- Fix doxygen and pydoc warnings.
790	- Fix #429: rpz: url: with https: broken (regression in 1.13.1).
791	- rpz skip nsec3param records, and nicer log for unsupported actions.
792
79315 February 2021: Wouter
794	- Fix #422: IPv6 fallback issues when IPv6 is not properly
795	  enabled/configured.
796	- Fix to make tests work with support indicators set for iterator.
797	- Fix build on Python 3.10.
798
79910 February 2021: Wouter
800	- Merge PR #420 from dyunwei: DOH not responsing with
801	  "http2_query_read_done failure" logged.
802
8039 February 2021: Wouter
804	- Fix for Python 3.9, no longer use deprecated functions of
805	  PyEval_CallObject (now PyObject_Call), PyEval_InitThreads (now
806	  none), PyParser_SimpleParseFile (now Py_CompileString).
807
8084 February 2021: Wouter
809	- release 1.13.1rc2 tag on branch-1.13.1 with added changes of 2 feb.
810	  This became 1.13.1 release tag on 9 feb.  The main branch is set
811	  to version 1.13.2.
812
8132 February 2021: Wouter
814	- branch-1.13.1 is created, with release-1.13.1rc1 tag.
815	- Fix dynlibmod link on rhel8 for -ldl inclusion.
816	- Fix windows dependency on libssp.dll because of default stack
817	  protector in mingw.
818	- Fix indentation of root anchor for use by windows install script.
819
8201 February 2021: George
821	- Attempt to fix NULL keys in the reuse_tcp tree; relates to #411.
822
82329 January 2021: Wouter
824	- Fix for doxygen 1.8.20 compatibility.
825
82628 January 2021: Wouter
827	- Annotate that we ignore the return value of if_indextoname.
828	- Fix to use correct type for label count in rpz routine.
829	- Fix empty clause warning in config_file nsid parse.
830	- Fix to use correct type for label count in ipdnametoaddr rpz routine.
831	- Fix empty clause warning in edns pass for padding.
832	- Fix fwd ancil test post script when not supported.
833
83426 January 2021: George
835	- Merge PR #408 from fobser: Prevent a few more yacc clashes.
836	- Merge PR #275 from Roland van Rijswijk-Deij: Add feature to return the
837	  original instead of a decrementing TTL ('serve-original-ttl')
838	- Merge PR #355 from noloader: Make ICANN Update CA and DS Trust Anchor
839	  static data.
840	- Ignore cache blacklisting when trying to reply with expired data from
841	  cache (#394).
842
84326 January 2021: Wouter
844	- Fix compile of unbound-dnstap-socket without dnstap installed.
845
84622 January 2021: Willem
847	- Padding of queries and responses with DNS over TLS as specified in
848	  RFC7830 and RFC8467.
849
85022 January 2021: George
851	- Fix TTL of SOA record for negative answers (localzone and
852	  authzone data) to be the minimum of the SOA TTL and the SOA.MINIMUM.
853
85419 January 2021: Willem
855	- Support for RFC5001: DNS Name Server Identifier (NSID) Option
856	  with the nsid: option in unbound.conf
857
85818 January 2021: Wouter
859	- Fix #404: DNS query with small edns bufsize fail.
860	- Fix declaration before statement and signed comparison warning in
861	  dns64.
862
86315 January 2021: Wouter
864	- Merge #402 from fobser: Implement IPv4-Embedded addresses according
865	  to RFC6052.
866
86714 January 2021: Wouter
868	- Fix for #93: dynlibmodule import library is named libunbound.dll.a.
869
87013 January 2021: Wouter
871	- Merge #399 from xiangbao227: The lock of lruhash table should
872	  unlocked after markdel entry.
873	- Fix for #93: dynlibmodule link fix for Windows.
874
87512 January 2021: Wouter
876	- Fix #397: [Feature request] add new type always_null to local-zone
877	  similar to always_nxdomain.
878	- Fix so local zone types always_nodata and always_deny can be used
879	  from the config file.
880
8818 January 2021: Wouter
882	- Merge PR #391 from fhriley: Add start_time to reply callbacks so
883	  modules can compute the response time.
884	- For #391: use struct timeval* start_time for callback information.
885	- For #391: fix indentation.
886	- For #391: more double casts in python start time calculation.
887	- Add comment documentation.
888	- Fix clang analysis warning.
889
8906 January 2021: Wouter
891	- Fix #379: zone loading over HTTP appears to have buffer issues.
892	- Merge PR #395 from mptre: add missing null check.
893	- Fix #387: client-subnet-always-forward seems to effectively bypass
894	  any caching?
895
8965 January 2021: Wouter
897	- Fix #385: autoconf 2.70 impacts unbound build
898	- Merge PR #375 by fhriley: Add rpz_enable and rpz_disable commands
899	  to unbound-control.
900
9014 January 2021: Wouter
902	- For #376: Fix that comm point event is not double removed or double
903	  added to event map.
904	- iana portlist updated.
905
90616 December 2020: George
907	- Fix error cases when udp-connect is set and send() returns an error
908	  (modified patch from Xin Li @delphij).
909
91011 December 2020: Wouter
911	- Fix #371: unbound-control timeout when Unbound is not running.
912	- Fix to squelch permission denied and other errors from remote host,
913	  they are logged at higher verbosity but not on low verbosity.
914	- Merge PR #335 from fobser: Sprinkle in some static to prevent
915	  missing prototype warnings.
916	- Merge PR #373 from fobser: Warning: arithmetic on a pointer to void
917	  is a GNU extension.
918	- Fix missing prototypes in the code.
919
9203 December 2020: Wouter
921	- make depend.
922	- iana portlist updated.
923
9242 December 2020: Wouter
925	- Fix #360: for the additionally reported TCP Fast Open makes TCP
926	  connections fail, in that case we print a hint that this is
927	  happening with the error in the logs.
928	- Fix #356: deadlock when listening tcp.
929	- Fix unbound-dnstap-socket to not use log routine from interrupt
930	  handler and not print so frequently when invoked in sequence.
931	- Fix on windows to ignore connection failure on UDP, unless verbose.
932	- Fix for #283: fix stream reuse and tcp fast open.
933	- Fix update, with write event check with streamreuse and fastopen.
934
9351 December 2020: Wouter
936	- Fix #358: Squelch udp connect 'no route to host' errors on low
937	  verbosity.
938
93930 November 2020: Wouter
940	- Fix assertion failure on double callback when iterator loses
941	  interest in query at head of line that then has the tcp stream
942	  not kept for reuse.
943	- tag for the 1.13.0rc4 release.  This also became the 1.13.0
944	  release version on 3 dec 2020 with the streamreuse and fastopen
945	  fix from 2 dec 2020.  The code repo continues for 1.13.1 in
946	  development.
947
94827 November 2020: Wouter
949	- Fix compile warning for type cast in http2_submit_dns_response.
950	- Fix when use free buffer to initialize rbtree for stream reuse.
951	- Fix compile warnings for windows.
952	- Fix compile warnings in rpz initialization.
953	- Fix contrib/metrics.awk for FreeBSD awk compatibility.
954	- tag for the 1.13.0rc3 release.
955
95626 November 2020: Wouter
957	- Fix to omit UDP receive errors from log, if verbosity low.
958	  These happen because of udp-connect.
959	- For #352: contrib/metrics.awk for Prometheus style metrics output.
960	- Fix that after failed read, the readagain cannot activate.
961	- Clear readagain upon decommission of pending tcp structure.
962
96325 November 2020: Wouter
964	- with udp-connect ignore connection refused with UDP timeouts.
965	- Fix udp-connect on FreeBSD, do send calls on connected UDP socket.
966	- Better fix for reuse tree comparison for is-tls sockets.  Where
967	  the tree key identity is preserved after cleanup of the TLS state.
968	- Remove debug commands from reuse tests.
969	- Fix memory leak for edns client tag opcode config element.
970	- Attempt fix for libevent state in tcp reuse cases after a packet
971	  is written.
972	- Fix readagain and writeagain callback functions for comm point
973	  cleanup.
974	- tag for the 1.13.0rc2 release.
975
97624 November 2020: Wouter
977	- Merge PR #283 : Stream reuse.  This implements upstream stream
978	  reuse for performing several queries over the same TCP or TLS
979	  channel.
980	- set version of main branch to 1.13.0 for upcoming release.
981	- iana portlist updated.
982	- Fix one port unit test for udp-connect.
983	- tag for the 1.13.0rc1 release.
984	- Fix crash when TLS connection is closed prematurely, when
985	  reuse tree comparison is not properly identical to insertion.
986	- Fix padding of struct regional for 32bit systems.
987
98823 November 2020: George
989	- Merge PR #313 from Ralph Dolmans: Replace edns-client-tag with
990	  edns-client-string option.
991
99223 November 2020: Wouter
993	- Merge #351 from dvzrv: Add AF_NETLINK to set of allowed socket
994	  address families.
995	- Fix #350: with the AF_NETLINK permission, to fix 1.12.0 error:
996	  failed to list interfaces: getifaddrs: Address family not
997	  supported by protocol.
998	- Fix #347: IP_DONTFRAG broken on Apple xcode 12.2.
999	- Option to toggle udp-connect, default is enabled.
1000	- Fix for #303 CVE-2020-28935 : Fix that symlink does not interfere
1001	  with chown of pidfile.
1002	- Further fix for it and retvalue 0 fix for it.
1003
100412 November 2020: Wouter
1005	- Fix to connect() to UDP destinations, default turned on,
1006	  this lowers vulnerability to ICMP side channels.
1007	- Retry for interfaces with unused ports if possible.
1008
100910 November 2020: Wouter
1010	- Fix #341: fixing a possible memory leak.
1011	- Fix memory leak after fix for possible memory leak failure.
1012	- Fix #343: Fail to build --with-libnghttp2 with error: 'SSIZE_MAX'
1013	  undeclared.
1014
101527 October 2020: Wouter
1016	- In man page note that tls-cert-bundle is read before permission
1017	  drop and chroot.
1018
101922 October 2020: Wouter
1020	- Fix #333: Unbound Segmentation Fault w/ log_info Functions From
1021	  Python Mod.
1022	- Fix that minimal-responses does not remove addresses from a priming
1023	  query response.
1024
102521 October 2020: George
1026	- Fix #327: net/if.h check fails on some darwin versions; contribution by
1027	  Joshua Root.
1028	- Fix #320: potential memory corruption due to size miscomputation upton
1029	  custom region alloc init.
1030
103121 October 2020: Wouter
1032	- Merge PR #228 : infra-keep-probing option to probe hosts that are
1033	  down.  Add infra-keep-probing: yes option. Hosts that are down are
1034	  probed more frequently.
1035	  With the option turned on, it probes about every 120 seconds,
1036	  eventually after exponential backoff, and that keeps that way. If
1037	  traffic keeps up for the domain. It probes with one at a time, eg.
1038	  one query is allowed to probe, other queries within that 120 second
1039	  interval are turned away.
1040
104119 October 2020: George
1042	- Merge PR #324 from James Renken: Add modern X.509v3 extensions to
1043	  unbound-control TLS certificates.
1044	- Fix for PR #324 to attach the x509v3 extensions to the client
1045	  certificate.
1046
104719 October 2020: Ralph
1048	- local-zone regional allocations outside of chunk
1049
105019 October 2020: Wouter
1051	- Fix that http settings have colon in set_option, for
1052	  http-endpoint, http-max-streams, http-query-buffer-size,
1053	  http-response-buffer-size, and http-nodelay.
1054	- Fix memory leak of https port string when reading config.
1055	- Fix #330: [Feature request] Add unencrypted DNS over HTTPS support.
1056	  This adds the option http-notls-downstream: yesno to change that,
1057	  and the dohclient test code has the -n option.
1058	- Fix python documentation warning on functions.rst inplace_cb_reply.
1059	- Fix dnstap test to wait for log timer to see if queries are logged.
1060	- Log ip address when http session recv fails, eg. due to tls fail.
1061	- Fix to set the tcp handler event toggle flag back to default when
1062	  the handler structure is reused.
1063	- Clean the fix for out of order TCP processing limits on number
1064	  of queries.  It was tested to work.
1065
106616 October 2020: Wouter
1067	- Fix that the out of order TCP processing does not limit the
1068	  number of outstanding queries over a connection.
1069
107015 October 2020: George
1071	- Fix that if there are reply callbacks for the given rcode, those
1072	  are called per reply and a new message created if that was modified
1073	  by the call.
1074	- Pass the comm_reply information to the inplace_cb_reply* functions
1075	  during the mesh state and update the documentation on that.
1076
107715 October 2020: Wouter
1078	- Merge PR #326 from netblue30: DoH: implement content-length
1079	  header field
1080	- DoH content length, simplify code, remove declaration after
1081	  statement and fix cast warning.
1082
108314 October 2020: Wouter
1084	- Fix for python reply callback to see mesh state reply_list member,
1085	  it only removes it briefly for the commpoint call so that it does
1086	  not drop it and attempt to modify the reply list during reply.
1087	- Fix that if there are on reply callbacks, those are called per
1088	  reply and a new message created if that was modified by the call.
1089	- Free up auth zone parse region after use for lookup of host
1090
109113 October 2020: Wouter
1092	- Fix #323: unbound testsuite fails on mock build in systemd-nspawn
1093	  if systemd support is build.
1094
10959 October 2020: Wouter
1096	- Fix dnstap socket and the chroot not applied properly to the dnstap
1097	  socket path.
1098	- Fix warning in libnss compile, nss_buf2dsa is not used without DSA.
1099
11008 October 2020: Wouter
1101	- Tag for 1.12.0 release.
1102	- Current repo is version 1.12.1 in development.
1103	- Fix #319: potential memory leak on config failure, in rpz config.
1104
11051 October 2020: Wouter
1106	- Current repo is version 1.12.0 for release.  Tag for 1.12.0rc1.
1107
110830 September 2020: Wouter
1109	- Fix doh tests when not compiled in.
1110	- Add dohclient test executable to gitignore.
1111	- Fix stream_ssl, ssl_req_order and ssl_req_timeout tests for
1112	  alloc check debug output.
1113	- Easier kill of unbound-dnstap-socket tool in test.
1114	- Fix memory leak of edns tags at libunbound context delete.
1115	- Fix double loopexit for unbound-dnstap-socket after sigterm.
1116
111729 September 2020: Ralph
1118	- DNS Flag Day 2020: change edns-buffer-size default to 1232.
1119
112028 September 2020: Wouter
1121	- Fix unit test for dnstap changes, so that it waits for the timer.
1122
112323 September 2020: Wouter
1124	- Fix #305: dnstap logging significantly affects unbound performance
1125	  (regression in 1.11).
1126	- Fix #305: only wake up thread when threshold reached.
1127	- Fix to ifdef fptr wlist item for dnstap.
1128
112923 September 2020: Ralph
1130	- Fix edns-client-tags get_option typo
1131	- Add edns-client-tag-opcode option
1132	- Use inclusive language in configuration
1133
113421 September 2020: Ralph
1135	- Fix #304: dnstap logging not recovering after dnstap process restarts
1136
113721 September 2020: Wouter
1138	- Merge PR #311 by luismerino: Dynlibmod leak.
1139	- Error message is logged for dynlibmod malloc failures.
1140	- iana portlist updated.
1141
114218 September 2020: Wouter
1143	- Fix that prefer-ip4 and prefer-ip6 can be get and set with
1144	  unbound-control, with libunbound and the unbound-checkconf option
1145	  output function.
1146	- iana portlist updated.
1147
114815 September 2020: George
1149	- Introduce test for statistics.
1150
115115 September 2020: Wouter
1152	- Spelling fix.
1153
115411 September 2020: Wouter
1155	- Remove x file mode on ipset/ipset.c and h files.
1156
11579 September 2020: Wouter
1158	- Fix num.expired statistics output.
1159
116031 August 2020: Wouter
1161	- Merge PR #293: Add missing prototype.  Also refactor to use the new
1162	  shorthand function to clean up the code.
1163	- Refactor to use sock_strerr shorthand function.
1164	- Fix #296: systemd nss-lookup.target is reached before unbound can
1165	  successfully answer queries. Changed contrib/unbound.service.in.
1166
116727 August 2020: Wouter
1168	- Similar to NSD PR#113, implement that interface names can be used,
1169	  eg. something like interface: eth0 is resolved at server start and
1170	  uses the IP addresses for that named interface.
1171	- Review fix, doxygen and assign null in case of error free.
1172
117326 August 2020: George
1174	- Update documentation in python example code.
1175
117624 August 2020: Wouter
1177	- Fix that dnstap reconnects do not spam the log with the repeated
1178	  attempts.  Attempts on the timer are only logged on high verbosity,
1179	  if they produce a connection failure error.
1180	- Fix to apply chroot to dnstap-socket-path, if chroot is enabled.
1181	- Change configure to use EVP_sha256 instead of HMAC_Update for
1182	  openssl-3.0.0.
1183
118420 August 2020: Ralph
1185	- Fix stats double count issue (#289).
1186
118713 August 2020: Ralph
1188	- Create and init edns tags data for libunbound.
1189
119010 August 2020: Ralph
1191	- Merge (modified) PR #277, use EVP_MAC_CTX_set_params if available,
1192	  by Vítězslav Čížek.
1193
119410 August 2020: Wouter
1195	- Fix #287: doc typo: "Additionaly".
1196	- Rerun autoconf
1197
11986 August 2020: Wouter
1199	- Merge PR #284 and Fix #246: Remove DLV entirely from Unbound.
1200	  The DLV has been decommisioned and in unbound 1.5.4, in 2015, there
1201	  was advise to stop using it.  The current code base does not contain
1202	  DLV code any more.  The use of dlv options displays a warning.
1203
12045 August 2020: Wouter
1205	- contrib/aaaa-filter-iterator.patch file renewed diff content to
1206	  apply cleanly to the current coderepo for the current code version.
1207
12085 August 2020: Ralph
1209	- Merge PR #272: Add EDNS client tag functionality.
1210
12114 August 2020: George
1212	- Improve error log message when inserting rpz RR.
1213	- Merge PR #280, Make tvOS & watchOS checks verify truthiness as well as
1214	  definedness, by Felipe Gasper.
1215
12164 August 2020: Wouter
1217	- Fix mini_event.h on OpenBSD cannot find fd_set.
1218
121931 July 2020: Wouter
1220	- Fix doxygen comment for no ssl for tls session ticket key callback
1221	  routine.
1222
122327 July 2020: George
1224	- Merge PR #268, draft-ietf-dnsop-serve-stale-10 has become RFC 8767 on
1225	  March 2020, by and0x000.
1226
122727 July 2020: Ralph
1228	- Merge PR #269, Fix python module len() implementations, by Torbjörn
1229	  Lönnemark
1230
123127 July 2020: Wouter
1232	- branch now named 1.11.1.  1.11.0rc1 became the 1.11.0 release.
1233	- Merge PR #270 from cgzones: munin plugin: always exit 0 in autoconf
1234
123520 July 2020: Wouter
1236	- Fix streamtcp to print packet data to stdout.  This makes the
1237	  stdout and stderr not mix together lines, when parsing its output.
1238	- Fix contrib/fastrpz.patch to apply cleanly.  It fixes for changes
1239	  due to added libdynmod, but it does not compile, it conflicts with
1240	  new rpz code.
1241	- branch now named 1.11.0 and 1.11.0rc1 tag.
1242
124317 July 2020: Wouter
1244	- Fix libnettle compile for session ticket key callback function
1245	  changes.
1246	- Fix lock dependency cycle in rpz zone config setup.
1247
124817 July 2020: Ralph
1249	- Merge PR #234 - Ensure proper alignment of cmsg buffers by Jérémie
1250	  Courrèges-Anglas.
1251	- Fix PR #234 log_assert sizeof to use union buffer.
1252
125316 July 2020: Wouter
1254	- Fix check conf test for referencing installation paths.
1255	- Fix unused variable warning for clang analyzer.
1256
125716 July 2020: George
1258	- Introduce 'include-toplevel:' configuration option.
1259
126016 July 2020: Ralph
1261	- Add bidirectional frame streams support.
1262
12638 July 2020: Wouter
1264	- Fix add missing DSA header, for compilation without deprecated
1265	  OpenSSL APIs.
1266	- Fix to use SSL_CTX_set_tlsext_ticket_key_evp_cb in OpenSSL
1267	  3.0.0-alpha4.
1268	- Longer keys for the test set, this avoids weak crypto errors.
1269
12707 July 2020: Wouter
1271	- Fix #259: Fix unbound-checkconf does not check view existence.
1272	  unbound-checkconf checks access-control-view, access-control-tags,
1273	  access-control-tag-actions and access-control-tag-datas.
1274	- Fix offset of error printout for access-control-tag-datas.
1275	- Review fixes for checkconf #259 change.
1276
12776 July 2020: Wouter
1278	- run_vm cleanup better and removes trailing slash on single argument.
1279
128029 June 2020: Wouter
1281	- Move reply list clean for serve expired mesh callback to after
1282	  the reply is sent, so that script callbacks have reply_info.
1283	- Also move reply list clean for mesh callbacks to the scrip callback
1284	  can see the reply_info.
1285	- Fix for mesh accounting if the reply list already empty to begin
1286	  with.
1287	- Fix for mesh accounting when rpz decides to drop a reply with a
1288	  tcp stream waiting for it.
1289	- Review fix for number of detached states due to use of variable
1290	  after end of loop.
1291	- Fix tcp req info drop due to size call into mesh accounting
1292	  removal of mesh state during mesh send reply.
1293
129424 June 2020: Wouter
1295	- iana portlist updated.
1296	- doxygen file comments for dynlibmodule.
1297
129817 June 2020: Wouter
1299	- Fix default explanation in man page for qname-minimisation-strict.
1300	- Fix display of event loop method with libev.
1301
13028 June 2020: Wouter
1303	- Mention tls name possible when tls is enabled for stub-addr in the
1304	  man page.
1305
130627 May 2020: George
1307	- Merge PR #241 by Robert Edmonds: contrib/libunbound.pc.in: Do not use
1308	  "Requires:".
1309
131025 May 2020: George
1311	- Update contrib/aaaa-filter-iterator.patch for the recent
1312	  generate_sub_request() change and to apply cleanly.
1313
131421 May 2020: George
1315	- Fix for integer overflow when printing RDF_TYPE_TIME.
1316
131719 May 2020: Wouter
1318	- CVE-2020-12662 Unbound can be tricked into amplifying an incoming
1319	  query into a large number of queries directed to a target.
1320	- CVE-2020-12663 Malformed answers from upstream name servers can be
1321	  used to make Unbound unresponsive.
1322	- Release 1.10.1 is 1.10.0 with fixes, code repository continues,
1323	  including those fixes, towards the next release.  Configure has
1324	  version 1.10.2 version number in it.
1325	- For PR #93: windows compile warnings removal
1326	- windows compile warnings removal for ip dscp option code.
1327	- For PR #93: unit test for dynlib module.
1328
132918 May 2020: Wouter
1330	- For PR #93: dynlibmod can handle reloads and deinit and inits again,
1331	  with dlclose and dlopen of the library again.  Also for multiple
1332	  modules.  Fix memory leak by not closing dlopened content.  Fix
1333	  to allow one dynlibmod instance by unbound-checkconf.
1334	- For PR #93: checkconf allows multiple dynlib in module-config, for
1335	  a couple cases.
1336	- For PR #93: checkconf allows python dynlib in module-config, for
1337	  a couple cases.
1338	- For PR #93: man page spelling reference fix.
1339	- For PR #93: fix link of other executables for dynlibmod dependency.
1340
134115 May 2020: Wouter
1342	- Merge PR #93: Add dynamic library support.
1343	- Fixed conflicts for PR #93 and make configure, yacc, lex.
1344	- For PR #93: Fix warnings for dynlibmodule.
1345
134615 May 2020: Ralph
1347	- Cache ECS answers with longest scope of CNAME chain.
1348
134922 April 2020: George
1350	- Explicitly use 'rrset-roundrobin: no' for test cases.
1351
135221 April 2020: Wouter
1353	- Merge #225 from akhait: KSK-2010 has been revoked. It removes the
1354	  KSK-2010 from the default list in unbound-anchor, now that the
1355	  revocation period is over.  KSK-2017 is the only trust anchor in
1356	  the shipped default now.
1357
135821 April 2020: George
1359	- Change default value for 'rrset-roundrobin' to yes.
1360	- Fix tests for new rrset-roundrobin default.
1361
136220 April 2020: Wouter
1363	- Fix #222: --enable-rpath, fails to rpath python lib.
1364	- Fix for count of reply states in the mesh.
1365	- Remove unneeded was_mesh_reply check.
1366
136717 April 2020: George
1368	- Add SNI support on more TLS connections (fixes #193).
1369	- Add SNI support to unbound-anchor.
1370
137116 April 2020: George
1372	- Add doxygen documentation for DSCP.
1373
137416 April 2020: Wouter
1375	- Fix help return code in unbound-control-setup script.
1376	- Fix for posix shell syntax for trap in nsd-control-setup.
1377	- Fix for posix shell syntax for trap in run_msg.sh test script.
1378
137915 April 2020: George
1380	- Fix #220: auth-zone section in config may lead to segfault.
1381
13827 April 2020: Wouter
1383	- Merge PR #214 from gearnode: unbound-control-setup recreate
1384	  certificates.  With the -r option the certificates are created
1385	  again, without it, only the files that do not exist are created.
1386
13876 April 2020: Ralph
1388	- Keep track of number of timeouts. Use this counter to determine if
1389	  capsforid fallback should be started.
1390
13916 April 2020: George
1392	- More documentation for redis-expire-records option.
1393
13941 April 2020: George
1395	- Merge PR #206: Redis TTL, by Talkabout.
1396
139730 March 2020: Wouter
1398	- Merge PR #207: Clarify if-automatic listens on 0.0.0.0 and ::
1399	- Merge PR #208: Fix uncached CLIENT_RESPONSE'es on stateful
1400	  transports.
1401
140227 March 2020: Wouter
1403	- Merge PR #203 from noloader: Update README-Travis.md with current
1404	  procedures.
1405
140627 March 2020: Ralph
1407	- Make unbound-control error returned on missing domain name more user
1408	  friendly.
1409
141026 March 2020: Ralph
1411	- Fix RPZ concurrency issue when using auth_zone_reload.
1412
141325 March 2020: George
1414	- Merge PR #201 from noloader: Fix OpenSSL cross-compaile warnings.
1415	- Fix on #201.
1416
141724 March 2020: Wouter
1418	- Merge PR #200 from yarikk: add ip-dscp option to specify the DSCP
1419	  tag for outgoing packets.
1420	- Fixes on #200.
1421	- Travis fix for ios by omitting tools from install.
1422
142323 March 2020: Wouter
1424	- Fix compile on Solaris for unbound-checkconf.
1425
142620 March 2020: George
1427	- Merge PR #198 from fobser: Declare lz_enter_rr_into_zone() static, it's
1428	  only used in this file.
1429
143020 March 2020: Wouter
1431	- Merge PR #197 from fobser: Make log_ident_revert_to_default() a
1432	  proper prototype.
1433
143419 March 2020: Ralph
1435	- Merge PR#191: Update iOS testing on Travis, by Jeffrey Walton.
1436	- Fix #158: open tls-session-ticket-keys as binary, for Windows. By
1437	  Daisuke HIGASHI.
1438	- Merge PR#134, Allow the kernel to provide random source ports. By
1439	  Florian Obser.
1440	- Log warning when using outgoing-port-permit and outgoing-port-avoid
1441	  while explicit port randomisation is disabled.
1442	- Merge PR#194: Add libevent testing to Travis, by Jeffrey Walton.
1443	- Fix .travis.yml error, missing 'env' option.
1444
144516 March 2020: Wouter
1446	- Fix #192: In the unbound-checkconf tool, the module config of
1447	  dns64 subnetcache respip validator iterator is whitelisted, it was
1448	  reported it seems to work.
1449
145012 March 2020: Wouter
1451	- Fix compile of test tools without protobuf.
1452
145311 March 2020: Ralph
1454	- Add check to make sure RPZ records are subdomains of configured
1455	  zone origin.
1456
145711 March 2020: George
1458	- Fix #189: mini_event.h:142:17: error: field 'ev_timeout' has incomplete
1459	  type, by noloader.
1460	- Changelog entry for (Fix #189, Merge PR #190).
1461
146211 March 2020: Wouter
1463	- Fix #188: unbound-control.c:882:6: error: 'execlp' is
1464	  unavailable: not available on tvOS.
1465
14666 March 2020: George
1467	- Merge PR #186, fix #183: Fix unrecognized 'echo -n' option on OS X, by
1468	  noloader
1469
14705 March 2020: Wouter
1471	- Fix PR #182 from noloader: Add iOS testing to Travis.
1472
14734 March 2020: Ralph
1474	- Update README-Travis.md (from PR #179), by Jeffrey Walton.
1475
14764 March 2020: George
1477	- Merge PR #181 from noloader: Fix OpenSSL -pie warning on Android.
1478
14794 March 2020: Wouter
1480	- Merge PR #180 from noloader: Avoid calling exit in Travis script.
1481
14823 March 2020: George
1483	- Upgrade config.guess(2020-01-01) and config.sub(2020-01-01).
1484
14852 March 2020: Ralph
1486	- Fix #175, Merge PR #176: fix link error when OpenSSL is configured
1487 	  with no-engine, thanks noloader.
1488
14892 March 2020: George
1490	- Fix compiler warning in dns64/dns64.c
1491	- Merge PR #174: Add Android to Travis testing, by noloader.
1492	- Move android build scripts to contrib/ and allow android tests to fail.
1493
14942 March 2020: Wouter
1495	- Fix #177: dnstap does not build on macOS.
1496
149728 February 2020: Ralph
1498	- Merge PR #172: Add IBM s390x arch for testing, by noloader.
1499
150028 February 2020: Wouter
1501	- Merge PR #173: updated makedist.sh for config.guess and
1502	  config.sub and sha256 digest for gpg, by noloader.
1503	- Merge PR #164: Framestreams, this branch implements dnstap
1504	  unidirectional connectivity in unbound. This has a number of
1505	  new features.
1506
1507	  The dependency on libfstrm is removed. The fstrm protocol code
1508	  resides in dnstap/dnstap_fstrm.h and dnstap/dnstap_fstrm.c. This
1509	  contains a brief definition of what unbound needs.
1510
1511	  The make unbound-dnstap-socket builds a debug tool,
1512	  unbound-dnstap-socket. It can listen, accept multiple DNSTAP
1513	  streams and print information. Commandline options control it.
1514
1515	  Unbound can reconnect if the unix domain socket file socket is
1516	  closed. This uses exponential backoff after which it uses a
1517	  one second timer to throttle cpu down. There is also support
1518	  to use TCP and TLS for connecting to the log server. There
1519	  are new config options to turn them on, in the dnstap section
1520	  in the man page and example config file. dnstap-ip with IP
1521	  address of server for TCP or TLS use. dnstap-tls to turn
1522	  on TLS. And dnstap-tls-server-name, dnstap-tls-cert-bundle,
1523	  dnstap-tls-client-key-file and dnstap-tls-client-cert-file
1524	  to configure the certificates for server authentication and
1525	  client authentication, or leave at "" to not use that.
1526
152727 February 2020: George
1528	- Merge PR #171: Add additional compilers and platforms to Travis
1529	  testing, by noloader.
1530
153127 February 2020: Wouter
1532	- Fix #169: Fix warning for daemon/remote.c output may be truncated
1533	  from snprintf.
1534	- Fix #170: Fix gcc undefined sanitizer signed integer overflow
1535	  warning in signature expiry RFC1982 serial number arithmetic.
1536	- Fix more undefined sanitizer issues, in respip copy_rrset null
1537	  dname, and in the client_info_compare routine for null memcmp.
1538
153926 February 2020: Wouter
1540	- iana portlist updated.
1541
154225 February 2020: Wouter
1543	- Fix #165: Add prefer-ip4: yesno config option to prefer ipv4 for
1544	  using ipv4 filters, because the hosts ip6 netblock /64 is not owned
1545	  by one operator, and thus reputation is shared.
1546
154724 February 2020: George
1548	- Merge PR #166: Fix typo in unbound.service.in, by glitsj16.
1549
155020 February 2020: Wouter
1551	- Updated contrib/unbound_smf23.tar.gz with Solaris SMF service for
1552	  Unbound from Yuri Voinov.
1553	- master branch has 1.10.1 version.
1554
155518 February 2020: Wouter
1556	- protect X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS with ifdef for
1557	  different openssl versions.
1558
155917 February 2020: Wouter
1560	- changelog point where the tag for 1.10.0rc2 release is.  And with
1561	  the unbound_smf23 commit added to it, that is the 1.10.0 release.
1562
156317 February 2020: Ralph
1564	- Add respip to supported module-config options in unbound-checkconf.
1565
156617 February 2020: George
1567	- Remove unused variable.
1568
156917 February 2020: Wouter
1570	- contrib/drop2rpz: perl script that converts the Spamhaus DROP-List
1571	  in RPZ-Format, contributed by Andreas Schulze.
1572
157314 February 2020: Wouter
1574	- Fix spelling in unbound.conf.5.in.
1575	- Stop unbound-checkconf from insisting that auth-zone and rpz
1576	  zonefiles have to exist.  They can not exist, and download later.
1577
157813 February 2020: Wouter
1579	- tag for 1.10.0rc1 release.
1580
158112 February 2020: Wouter
1582	- Fix with libnettle make test with dsa disabled.
1583	- Fix contrib/fastrpz.patch to apply cleanly.  Fix for serve-stale
1584	  fixes, but it does not compile, conflicts with new rpz code.
1585	- Fix to clean memory leak of respip_addr.lock when ip_tree deleted.
1586	- Fix compile warning when threads disabled.
1587	- updated version number to 1.10.0.
1588
158910 February 2020: George
1590	- Document 'ub_result.was_ratelimited' in libunbound.
1591	- Fix use after free on log-identity after a reload; Fixes #163.
1592
15936 February 2020: George
1594	- Fix num_reply_states and num_detached_states counting with
1595	  serve_expired_callback.
1596	- Cleaner code in mesh_serve_expired_lookup.
1597	- Document in unbound.conf manpage that configuration clauses can be
1598	  repeated in the configuration file.
1599
16006 February 2020: Wouter
1601	- Fix num_reply_addr counting in mesh and tcp drop due to size
1602	  after serve_stale commit.
1603	- Fix to create and destroy rpz_lock in auth_zones structure.
1604	- Fix to lock zone before adding rpz qname trigger.
1605	- Fix to lock and release once in mesh_serve_expired_lookup.
1606	- Fix to put braces around empty if body when threading is disabled.
1607
16085 February 2020: George
1609	- Added serve-stale functionality as described in
1610	  draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used
1611	  to configure the behavior.
1612	- Updated cachedb to honor `serve-expired-ttl`; Fixes #107.
1613	- Renamed statistic `num.zero_ttl` to `num.expired` as expired replies
1614	  come with a configurable TTL value (`serve-expired-reply-ttl`).
1615	- Fixed stats when replying with cached, cname-aliased records.
1616	- Added missing default values for redis cachedb backend.
1617
16183 February 2020: Ralph
1619	- Add assertion to please static analyzer
1620
162131 January 2020: Wouter
1622	- Fix fclose on error in TLS session ticket code.
1623
162430 January 2020: Ralph
1625	- Fix memory leak in error condition remote.c
1626	- Fix double free in error condition view.c
1627	- Fix memory leak in do_auth_zone_transfer on success
1628	- Merge RPZ support into master. Only QNAME and Response IP triggers are
1629	  supported.
1630	- Stop working on socket when socket() call returns an error.
1631	- Check malloc return values in TLS session ticket code
1632
163330 January 2020: Wouter
1634	- Fix subnet tests for disabled DSA algorithm by default.
1635	- Update contrib/fastrpz.patch for clean diff with current code.
1636	- Merge PR#151: Fixes for systemd units, by Maryse47, Edmonds
1637	  and Frzk.  Updates the unbound.service systemd file and adds
1638	  a portable systemd service file.
1639	- updated .gitignore for added contrib file.
1640	- Add build rule for ipset to Makefile
1641	- Add getentropy_freebsd.o to Makefile dependencies.
1642
164329 January 2020: Ralph
1644	- Merge PR#156 from Alexander Berkes; Added unbound-control
1645	  view_local_datas_remove command.
1646
164729 January 2020: Wouter
1648	- Fix #157: undefined reference to `htobe64'.
1649
165028 January 2020: Ralph
1651	- Merge PR#147; change rfc reference for reserved top level dns names.
1652
165328 January 2020: Wouter
1654	- iana portlist updated.
1655	- Fix to silence the tls handshake errors for broken pipe and reset
1656	  by peer, unless verbosity is set to 2 or higher.
1657
165827 January 2020: Ralph
1659	- Merge PR#154; Allow use of libbsd functions with configure option
1660	  --with-libbsd. By Robert Edmonds and Steven Chamberlain.
1661	- Merge PR#148; Add some TLS stats to unbound_munin_. By Fredrik Pettai.
1662
166327 January 2020: Wouter
1664	- Merge PR#155 from Robert Edmonds: contrib/libunbound.pc.in: Fixes
1665	  to Libs/Requires for crypto library dependencies.
1666	- Fix #153: Disable validation for DSA algorithms.  RFC 8624
1667	  compliance.
1668
166923 January 2020: Wouter
1670	- Merge PR#150 from Frzk: Systemd unit without chroot.  It add
1671	  contrib/unbound_nochroot.service.in, a systemd file for use with
1672	  chroot: "", see comments in the file, it uses systemd protections
1673	  instead.
1674
167514 January 2020: Wouter
1676	- Removed the dnscrypt_queries and dnscrypt_queries_chacha tests,
1677	  because dnscrypt-proxy (2.0.36) does not support the test setup
1678	  any more, and also the config file format does not seem to have
1679	  the appropriate keys to recreate that setup.
1680	- Fix crash after reload where a stats lookup could reference old key
1681	  cache and neg cache structures.
1682	- Fix for memory leak when edns subnet config options are read when
1683	  compiled without edns subnet support.
1684	- Fix auth zone support for NSEC3 records without salt.
1685
168610 January 2020: Wouter
1687	- Fix the relationship between serve-expired and prefetch options,
1688	  patch from Saksham Manchanda from Secure64.
1689	- Fix unreachable code in ssl set options code.
1690
16918 January 2020: Ralph
1692	- Fix #138: stop binding pidfile inside chroot dir in systemd service
1693	  file.
1694
16958 January 2020: Wouter
1696	- Fix 'make test' to work for --disable-sha1 configure option.
1697	- Fix out-of-bounds null-byte write in sldns_bget_token_par while
1698	  parsing type WKS, reported by Luis Merino from X41 D-Sec.
1699	- Updated sldns_bget_token_par fix for also space for the zero
1700	  delimiter after the character.  And update for more spare space.
1701
17026 January 2020: George
1703	- Downgrade compat/getentropy_solaris.c to version 1.4 from OpenBSD.
1704	  The dl_iterate_phdr() function introduced in newer versions raises
1705	  compilation errors on solaris 10.
1706	- Changes to compat/getentropy_solaris.c for,
1707	  ifdef stdint.h inclusion for older systems.
1708	  ifdef sha2.h inclusion for older systems.
1709
17106 January 2020: Wouter
1711	- Merge #135 from Florian Obser: Use passed in neg and key cache
1712	  if non-NULL.
1713	- Fix #140: Document slave not downloading new zonefile upon update.
1714
171516 December 2019: George
1716	- Update mailing list URL.
1717
171812 December 2019: Ralph
1719	- Master is 1.9.7 in development.
1720	- Fix typo to let serve-expired-ttl work with ub_ctx_set_option(), by
1721	  Florian Obser
1722
172310 December 2019: Wouter
1724	- Fix to make auth zone IXFR to fallback to AXFR if a single
1725	  response RR is received over TCP with the SOA in it.
1726
17276 December 2019: Wouter
1728	- Fix ipsecmod compile.
1729	- Fix Makefile.in for ipset module compile, from Adi Prasaja.
1730	- release-1.9.6 tag, which became the 1.9.6 release
1731
17325 December 2019: Wouter
1733	- unbound-fuzzers.tar.bz2: three programs for fuzzing, that are 1:1
1734	  replacements for unbound-fuzzme.c that gets created after applying
1735	  the contrib/unbound-fuzzme.patch.  They are contributed by
1736	  Eric Sesterhenn from X41 D-Sec.
1737	- tag for 1.9.6rc1.
1738
17394 December 2019: Wouter
1740	- Fix lock type for memory purify log lock deletion.
1741	- Fix testbound for alloccheck runs, memory purify and lock checks.
1742	- update contrib/fastrpz.patch to apply more cleanly.
1743	- Fix Make Test Fails when Configured With --enable-alloc-nonregional,
1744	  reported by X41 D-Sec.
1745
17463 December 2019: Wouter
1747	- Merge pull request #124 from rmetrich: Changed log lock
1748	  from 'quick' to 'basic' because this is an I/O lock.
1749	- Fix text around serial arithmatic used for RRSIG times to refer
1750	  to correct RFC number.
1751	- Fix Assert Causing DoS in synth_cname(),
1752	  reported by X41 D-Sec.
1753	- Fix similar code in auth_zone synth cname to add the extra checks.
1754	- Fix Assert Causing DoS in dname_pkt_copy(),
1755	  reported by X41 D-Sec.
1756	- Fix OOB Read in sldns_wire2str_dname_scan(),
1757	  reported by X41 D-Sec.
1758	- Fix Out of Bounds Write in sldns_str2wire_str_buf(),
1759	  reported by X41 D-Sec.
1760	- Fix Out of Bounds Write in sldns_b64_pton(),
1761	  fixed by check in sldns_str2wire_int16_data_buf(),
1762	  reported by X41 D-Sec.
1763	- Fix Insufficient Handling of Compressed Names in dname_pkt_copy(),
1764	  reported by X41 D-Sec.
1765	- Fix Out of Bound Write Compressed Names in rdata_copy(),
1766	  reported by X41 D-Sec.
1767	- Fix Hang in sldns_wire2str_pkt_scan(),
1768	  reported by X41 D-Sec.
1769	  This further lowers the max to 256.
1770	- Fix snprintf() supports the n-specifier,
1771	  reported by X41 D-Sec.
1772	- Fix Bad Indentation, in dnscrypt.c,
1773	  reported by X41 D-Sec.
1774	- Fix Client NONCE Generation used for Server NONCE,
1775	  reported by X41 D-Sec.
1776	- Fix compile error in dnscrypt.
1777	- Fix _vfixed not Used, removed from sbuffer code,
1778	  reported by X41 D-Sec.
1779	- Fix Hardcoded Constant, reported by X41 D-Sec.
1780	- make depend
1781
17822 December 2019: Wouter
1783	- Merge pull request #122 from he32: In tcp_callback_writer(),
1784	  don't disable time-out when changing to read.
1785
178622 November 2019: George
1787	- Fix compiler warnings.
1788
178922 November 2019: Wouter
1790	- Fix dname loop maximum, reported by Eric Sesterhenn from X41 D-Sec.
1791	- Add make distclean that removes everything configure produced,
1792	  and make maintainer-clean that removes bison and flex output.
1793
179420 November 2019: Wouter
1795	- Fix Out of Bounds Read in rrinternal_get_owner(),
1796	  reported by X41 D-Sec.
1797	- Fix Race Condition in autr_tp_create(),
1798	  reported by X41 D-Sec.
1799	- Fix Shared Memory World Writeable,
1800	  reported by X41 D-Sec.
1801	- Adjust unbound-control to make stats_shm a read only operation.
1802	- Fix Weak Entropy Used For Nettle,
1803	  reported by X41 D-Sec.
1804	- Fix Randomness Error not Handled Properly,
1805	  reported by X41 D-Sec.
1806	- Fix Out-of-Bounds Read in dname_valid(),
1807	  reported by X41 D-Sec.
1808	- Fix Config Injection in create_unbound_ad_servers.sh,
1809	  reported by X41 D-Sec.
1810	- Fix Local Memory Leak in cachedb_init(),
1811	  reported by X41 D-Sec.
1812	- Fix Integer Underflow in Regional Allocator,
1813	  reported by X41 D-Sec.
1814	- Upgrade compat/getentropy_linux.c to version 1.46 from OpenBSD.
1815	- Synchronize compat/getentropy_win.c with version 1.5 from
1816	  OpenBSD, no changes but makes the file, comments, identical.
1817	- Upgrade compat/getentropy_solaris.c to version 1.13 from OpenBSD.
1818	- Upgrade compat/getentropy_osx.c to version 1.12 from OpenBSD.
1819	- Changes to compat/getentropy files for,
1820	  no link to openssl if using nettle, and hence config.h for
1821	  HAVE_NETTLE variable.
1822	  compat definition of MAP_ANON, for older systems.
1823	  ifdef stdint.h inclusion for older systems.
1824	  ifdef sha2.h inclusion for older systems.
1825	- Fixed Compat Code Diverging from Upstream, reported by X41 D-Sec.
1826	- Fix compile with --enable-alloc-checks, reported by X41 D-Sec.
1827	- Fix Terminating Quotes not Written, reported by X41 D-Sec.
1828	- Fix Useless memset() in validator, reported by X41 D-Sec.
1829	- Fix Unrequired Checks, reported by X41 D-Sec.
1830	- Fix Enum Name not Used, reported by X41 D-Sec.
1831	- Fix NULL Pointer Dereference via Control Port,
1832	  reported by X41 D-Sec.
1833	- Fix Bad Randomness in Seed, reported by X41 D-Sec.
1834	- Fix python examples/calc.py for eval, reported by X41 D-Sec.
1835	- Fix comments for doxygen in dns64.
1836
183719 November 2019: Wouter
1838	- Fix CVE-2019-18934, shell execution in ipsecmod.
1839	- 1.9.5 is 1.9.4 with bugfix, trunk is 1.9.6 in development.
1840	- Fix authzone printout buffer length check.
1841	- Fixes to please lint checks.
1842	- Fix Integer Overflow in Regional Allocator,
1843	  reported by X41 D-Sec.
1844	- Fix Unchecked NULL Pointer in dns64_inform_super()
1845	  and ipsecmod_new(), reported by X41 D-Sec.
1846	- Fix Out-of-bounds Read in rr_comment_dnskey(),
1847	  reported by X41 D-Sec.
1848	- Fix Integer Overflows in Size Calculations,
1849	  reported by X41 D-Sec.
1850	- Fix Integer Overflow to Buffer Overflow in
1851	  sldns_str2wire_dname_buf_origin(), reported by X41 D-Sec.
1852	- Fix Out of Bounds Read in sldns_str2wire_dname(),
1853	  reported by X41 D-Sec.
1854	- Fix Out of Bounds Write in sldns_bget_token_par(),
1855	  reported by X41 D-Sec.
1856
185718 November 2019: Wouter
1858	- In unbound-host use separate variable for get_option to please
1859	  code checkers.
1860	- update to bison output of 3.4.1 in code repository.
1861	- Provide a prototype for compat malloc to remove compile warning.
1862	- Portable grep usage for reuseport configure test.
1863	- Check return type of HMAC_Init_ex for openssl 0.9.8.
1864	- gitignore .source tempfile used for compatible make.
1865
186613 November 2019: Wouter
1867	- iana portlist updated.
1868	- contrib/fastrpz.patch updated to apply for current code.
1869	- fixes for splint cleanliness, long vs int in SSL set_mode.
1870
187111 November 2019: Wouter
1872	- Fix #109: check number of arguments for stdin-pipes in
1873	  unbound-control and fail if too many arguments.
1874	- Merge #102 from jrtc27: Add getentropy emulation for FreeBSD.
1875
187624 October 2019: Wouter
1877	- Fix #99: Memory leak in ub_ctx (event_base will never be freed).
1878
187923 October 2019: George
1880	- Add new configure option `--enable-fully-static` to enable full static
1881	  build if requested; in relation to #91.
1882
188323 October 2019: Wouter
1884	- Merge #97: manpage: Add missing word on unbound.conf,
1885	  from Erethon.
1886
188722 October 2019: Wouter
1888	- drop-tld.diff: adds option drop-tld: yesno that drops 2 label
1889	  queries, to stop random floods.  Apply with
1890	  patch -p1 < contrib/drop-tld.diff and compile.
1891	  From Saksham Manchanda (Secure64).  Please note that we think this
1892	  will drop DNSKEY and DS lookups for tlds and hence break DNSSEC
1893	  lookups for downstream clients.
1894
18957 October 2019: Wouter
1896	- Add doxygen comments to unbound-anchor source address code, in #86.
1897
18983 October 2019: Wouter
1899	- Merge #90 from vcunat: fix build with nettle-3.5.
1900	- Merge 1.9.4 release with fix for vulnerability CVE-2019-16866.
1901	- Continue with development of 1.9.5.
1902	- Merge #86 from psquarejho: Added -b source address option to
1903	  smallapp/unbound-anchor.c, from Lukas Wunner.
1904
190526 September 2019: Wouter
1906	- Merge #87 from hardfalcon: Fix contrib/unbound.service.in,
1907	  Drop CAP_KILL, use + prefix for ExecReload= instead.
1908
190925 September 2019: Wouter
1910	- The unbound.conf includes are sorted ascending, for include
1911	  statements with a '*' from glob.
1912
191323 September 2019: Wouter
1914	- Merge #85 for #84 from sam-lunt: Add kill capability to systemd
1915	  service file to fix that systemctl reload fails.
1916
191720 September 2019: Wouter
1918	- Merge #82 from hardfalcon: Downgrade CAP_NET_ADMIN to CAP_NET_RAW
1919	  in unbound.service.
1920	- Merge #81 from Maryse47: Consistently use /dev/urandom instead
1921	  of /dev/random in scripts and docs.
1922	- Merge #83 from Maryse47: contrib/unbound.service.in: do not fork
1923	  into the background.
1924
192519 September 2019: Wouter
1926	- Fix #78: Memory leak in outside_network.c.
1927	- Merge pull request #76 from Maryse47: Improvements and fixes for
1928	  systemd unbound.service.
1929	- oss-fuzz badge on README.md.
1930	- Fix fix for #78 to also free service callback struct.
1931	- Fix for oss-fuzz build warning.
1932	- Fix wrong response ttl for prepended short CNAME ttls, this would
1933	  create a wrong zero_ttl response count with serve-expired enabled.
1934	- Merge #80 from stasic: Improve wording in man page.
1935
193611 September 2019: Wouter
1937	- Use explicit bzero for wiping clear buffer of hash in cachedb,
1938	  reported by Eric Sesterhenn from X41 D-Sec.
1939
19409 September 2019: Wouter
1941	- Fix #72: configure --with-syslog-facility=LOCAL0-7 with default
1942	  LOG_DAEMON (as before) can set the syslog facility that the server
1943	  uses to log messages.
1944
19454 September 2019: Wouter
1946	- Fix #71: fix openssl error squelch commit compilation error.
1947
19483 September 2019: Wouter
1949	- squelch DNS over TLS errors 'ssl handshake failed crypto error'
1950	  on low verbosity, they show on verbosity 3 (query details), because
1951	  there is a high volume and the operator cannot do anything for the
1952	  remote failure.  Specifically filters the high volume errors.
1953
19542 September 2019: Wouter
1955	- ipset module #28: log that an address is added, when verbosity high.
1956	- ipset: refactor long routine into three smaller ones.
1957	- updated Makefile dependencies.
1958
195923 August 2019: Wouter
1960	- Fix contrib/fastrpz.patch asprintf return value checks.
1961
196222 August 2019: Wouter
1963	- Fix that pkg-config is setup before --enable-systemd needs it.
1964	- 1.9.3rc2 release candidate tag.  And this became the 1.9.3 release.
1965	  Master is 1.9.4 in development.
1966
196721 August 2019: Wouter
1968	- Fix log_dns_msg to log irrespective of minimal responses config.
1969
197019 August 2019: Ralph
1971	- Document limitation of pidfile removal outside of chroot directory.
1972
197316 August 2019: Wouter
1974	- Fix unittest valgrind false positive uninitialised value report,
1975	  where if gcc 9.1.1 uses -O2 (but not -O1) then valgrind 3.15.0
1976	  issues an uninitialised value for the token buffer at the str2wire.c
1977	  rrinternal_get_owner() strcmp with the '@' value.  Rewritten to use
1978	  straight character comparisons removes the false positive.  Also
1979	  valgrinds --expensive-definedness-checks=yes can stop this false
1980	  positive.
1981	- Please doxygen's parser for "@" occurrence in doxygen comment.
1982	- Fixup contrib/fastrpz.patch
1983	- Remove warning about unknown cast-function-type warning pragma.
1984
198515 August 2019: Wouter
1986	- iana portlist updated.
1987	- Fix autotrust temp file uniqueness windows compile.
1988	- avoid warning about upcast on 32bit systems for autotrust.
1989	- escape commandline contents for -V.
1990	- Fix character buffer size in ub_ctx_hosts.
1991	- 1.9.3rc1 release candidate tag.
1992	- Option -V prints if TCP fastopen is available.
1993
199414 August 2019: George
1995	- Fix #59, when compiled with systemd support check that we can properly
1996	  communicate with systemd through the `NOTIFY_SOCKET`.
1997
199814 August 2019: Wouter
1999	- Generate configlexer with newer flex.
2000	- Fix warning for unused variable for compilation without systemd.
2001
200212 August 2019: George
2003	- Introduce `-V` option to print the version number and build options.
2004	  Previously reported build options like linked libs and linked modules
2005	  are now moved from `-h` to `-V` as well for consistency.
2006	- PACKAGE_BUGREPORT now also includes link to GitHub issues.
2007
20081 August 2019: Wouter
2009	- For #52 #53, second context does not close logfile override.
2010	- Fix #52 #53, fix for example fail program.
2011	- Fix to return after failed auth zone http chunk write.
2012	- Fix to remove unused test for task_probe existance.
2013	- Fix to timeval_add for remaining second in microseconds.
2014	- Check repinfo in worker_handle_request, if null, drop it.
2015
201629 July 2019: Wouter
2017	- Add verbose log message when auth zone file is written, at level 4.
2018	- Add hex print of trust anchor pointer to trust anchor file temp
2019	  name to make it unique, for libunbound created multiple contexts.
2020
202123 July 2019: Wouter
2022	- Fix question section mismatch in local zone redirect.
2023
202419 July 2019: Wouter
2025	- Fix #49: Set no renegotiation on the SSL context to stop client
2026	  session renegotiation.
2027
202812 July 2019: Wouter
2029	- Fix #48: Unbound returns additional records on NODATA response,
2030	  if minimal-responses is enabled, also the additional for negative
2031	  responses is removed.
2032
20339 July 2019: Ralph
2034	- Fix in respip addrtree selection. Absence of addr_tree_init_parents()
2035	  call made it impossible to go up the tree when the matching netmask is
2036	  too specific.
2037
20385 July 2019: Ralph
2039	- Fix for possible assertion failure when answering respip CNAME from
2040	  cache.
2041
204225 June 2019: Wouter
2043	- For #45, check that 127.0.0.1 and ::1 are not used in unbound.conf
2044	  when do-not-query-localhost is turned on, or at default on,
2045	  unbound-checkconf prints a warning if it is found in forward-addr or
2046	  stub-addr statements.
2047
204824 June 2019: Wouter
2049	- Fix memleak in unit test, reported from the clang 8.0 static analyzer.
2050
205118 June 2019: Wouter
2052	- PR #28: IPSet module, by Kevin Chou.  Created a module to support
2053	  the ipset that could add the domain's ip to a list easily.
2054	  Needs libmnl, and --enable-ipset and config it, doc/README.ipset.md.
2055	- Fix to omit RRSIGs from addition to the ipset.
2056	- Fix to make unbound-control with ipset, remove unused variable,
2057	  use unsigned type because of comparison, and assign null instead
2058	  of compare with it.  Remade lex and yacc output.
2059	- make depend
2060	- Added documentation to the ipset files (for doxygen output).
2061	- Merge PR #6: Python module: support multiple instances
2062	- Merge PR #5: Python module: define constant MODULE_RESTART_NEXT
2063	- Merge PR #4: Python module: assign something useful to the
2064	  per-query data store 'qdata'
2065	- Fix python dict reference and double free in config.
2066
206717 June 2019: Wouter
2068	- Master contains version 1.9.3 in development.
2069	- Fix #39: In libunbound, leftover logfile is close()d unpredictably.
2070	- Fix for #24: Fix abort due to scan of auth zone masters using old
2071	  address from previous scan.
2072
207312 June 2019: Wouter
2074	- Fix another spoolbuf storage code point, in prefetch.
2075	- 1.9.2rc3 release candidate tag.  Which became the 1.9.2 release
2076	  on 17 June 2019.
2077
207811 June 2019: Wouter
2079	- Fix that fixes the Fix that spoolbuf is not used to store tcp
2080	  pipelined response between mesh send and callback end, this fixes
2081	  error cases that did not use the correct spoolbuf.
2082	- 1.9.2rc2 release candidate tag.
2083
20846 June 2019: Wouter
2085	- 1.9.2rc1 release candidate tag.
2086
20874 June 2019: Wouter
2088	- iana portlist updated.
2089
209029 May 2019: Wouter
2091	- Fix to guard _OPENBSD_SOURCE from redefinition.
2092
209328 May 2019: Wouter
2094	- Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD.
2095	- gitignore config.h.in~.
2096
209727 May 2019: Wouter
2098	- Fix double file close in tcp pipelined response code.
2099
210024 May 2019: Wouter
2101	- Fix that spoolbuf is not used to store tcp pipelined response
2102	  between mesh send and callback end.
2103
210420 May 2019: Wouter
2105	- Note that so-reuseport at extreme load is better turned off,
2106	  otherwise queries are not distributed evenly, on Linux 4.4.x.
2107
210816 May 2019: Wouter
2109	- Fix #31: swig 4.0 and python module.
2110
211113 May 2019: Wouter
2112	- Squelch log messages from tcp send about connection reset by peer.
2113	  They can be enabled with verbosity at higher values for diagnosing
2114	  network connectivity issues.
2115	- Attempt to fix malformed tcp response.
2116
21179 May 2019: Wouter
2118	- Revert fix for oss-fuzz, error is in that build script that
2119	  unconditionally includes .o files detected by configure, also
2120	  when the machine architecture uses different LIBOBJS files.
2121
21228 May 2019: Wouter
2123	- Attempt to fix build failure in oss-fuzz because of reallocarray.
2124	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14648.
2125	  Does not omit compile flags from commandline.
2126
21277 May 2019: Wouter
2128	- Fix edns-subnet locks, in error cases the lock was not unlocked.
2129	- Fix doxygen output error on readme markdown vignettes.
2130
21316 May 2019: Wouter
2132	- Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64.
2133	- Fix #30: AddressSanitizer finding in lookup3.c.  This sets the
2134	  hash function to use a slower but better auditable code that does
2135	  not read beyond array boundaries.  This makes code better security
2136	  checkable, and is better for security.  It is fixed to be slower,
2137	  but not read outside of the array.
2138
21392 May 2019: Wouter
2140	- contrib/fastrpz.patch updated for code changes, and with git diff.
2141	- Fix .gitignore, add pythonmod and dnstap generated files.
2142	  And unit test generated files, and generated doc files.
2143
21441 May 2019: Wouter
2145	- Update makedist for git.
2146	- Nicer travis output for clang analysis.
2147	- PR #16: XoT support, AXFR over TLS, turn it on with
2148	  master: <ip>#<authname> in unbound.conf.  This uses TLS to
2149	  download the AXFR (or IXFR).
2150
215125 April 2019: Wouter
2152	- Fix wrong query name in local zone redirect answers with a CNAME,
2153	  the copy of the local alias is in unpacked form.
2154
215518 April 2019: Ralph
2156	- Scrub RRs from answer section when reusing NXDOMAIN message for
2157	  subdomain answers.
2158	- For harden-below-nxdomain: do not consider a name to be non-exitent
2159	  when message contains a CNAME record.
2160
216118 April 2019: Wouter
2162	- travis build file.
2163
216416 April 2019: Wouter
2165	- Better braces in if statement in TCP fastopen code.
2166	- iana portlist updated.
2167
216815 April 2019: Wouter
2169	- Fix tls write event for read state change to re-call SSL_write and
2170	  not resume the TLS handshake.
2171
217211 April 2019: George
2173	- Update python documentation for init_standard().
2174	- Typos.
2175
217611 April 2019: Wouter
2177	- Fix that auth zone uses correct network type for sockets for
2178	  SOA serial probes.  This fixes that probes fail because earlier
2179	  probe addresses are unreachable.
2180	- Fix that auth zone fails over to next master for timeout in tcp.
2181	- Squelch SSL read and write connection reset by peer and broken pipe
2182	  messages.  Verbosity 2 and higher enables them.
2183
21848 April 2019: Wouter
2185	- Fix to use event_assign with libevent for thread-safety.
2186	- verbose information about auth zone lookup process, also lookup
2187	  start, timeout and fail.
2188	- Fix #17: Add python module example from Jan Janak, that is a
2189	  plugin for the Unbound DNS resolver to resolve DNS records in
2190	  multicast DNS [RFC 6762] via Avahi.  The plugin communicates
2191	  with Avahi via DBus. The comment section at the beginning of
2192	  the file contains detailed documentation.
2193	- Fix to wipe ssl ticket keys from memory with explicit_bzero,
2194	  if available.
2195
21965 April 2019: Wouter
2197	- Fix to reinit event structure for accepted TCP (and TLS) sockets.
2198
21994 April 2019: Wouter
2200	- Fix spelling error in log output for event method.
2201
22023 April 2019: Wouter
2203	- Move goto label in answer_from_cache to the end of the function
2204	  where it is more visible.
2205	- Fix auth-zone NSEC3 response for wildcard nodata answers,
2206	  include the closest encloser in the answer.
2207
22082 April 2019: Wouter
2209	- Fix auth-zone NSEC3 response for empty nonterminals with exact
2210	  match nsec3 records.
2211	- Fix for out of bounds integers, thanks to OSTIF audit.  It is in
2212	  allocation debug code.
2213	- Fix for auth zone nsec3 ent fix for wildcard nodata.
2214
221525 March 2019: Wouter
2216	- Fix that tls-session-ticket-keys: "" on its own in unbound.conf
2217	  disables the tls session ticker key calls into the OpenSSL API.
2218	- Fix crash if tls-servic-pem not filled in when necessary.
2219
222021 March 2019: Wouter
2221	- Fix #4240: Fix whitespace cleanup in example.conf.
2222
222319 March 2019: Wouter
2224	- add type CAA to libpyunbound (accessing libunbound from python).
2225
222618 March 2019: Wouter
2227	- Add log message, at verbosity 4, that says the query is encrypted
2228	  with TLS, if that is enabled for the query.
2229	- Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482.
2230
22317 March 2019: Wouter
2232	- Fix for #4233: guard use of NDEBUG, so that it can be passed in
2233	  CFLAGS into configure.
2234
22355 March 2019: Wouter
2236	- Tag release 1.9.1rc1.  Which became 1.9.1 on 12 March 2019.  Trunk
2237	  has 1.9.2 in development.
2238
22391 March 2019: Wouter
2240	- output forwarder log in ssl_req_order test.
2241
224228 February 2019: Wouter
2243	- Remove memory leak on pythonmod python2 script file init.
2244	- Remove swig gcc8 python function cast warnings, they are ignored.
2245	- Print correct module that failed when module-config is wrong.
2246
224727 February 2019: Wouter
2248	- Fix #4229: Unbound man pages lack information, about access-control
2249	  order and local zone tags, and elements in views.
2250	- Fix #14: contrib/unbound.init: Fix wrong comparison judgment
2251	  before copying.
2252	- Fix for python module on Windows, fix fopen.
2253
225425 February 2019: Wouter
2255	- Fix #4227: pair event del and add for libevent for tcp_req_info.
2256
225721 February 2019: Wouter
2258	- Fix the error for unknown module in module-config is understandable,
2259	  and explains it was not compiled in and where to see the list.
2260	- In example.conf explain where to put cachedb module in module-config.
2261	- In man page and example config explain that most modules have to
2262	  be listed at the start of module-config.
2263
226420 February 2019: Wouter
2265	- Fix pythonmod include and sockaddr_un ifdefs for compile on
2266	  Windows, and for libunbound.
2267
226818 February 2019: Wouter
2269	- Print query name with ip_ratelimit exceeded log lines.
2270	- Spaces instead of tabs in that log message.
2271	- Print query name and IP address when domain rate limit exceeded.
2272
227314 February 2019: Wouter
2274	- Fix capsforid canonical sort qsort callback.
2275
227611 February 2019: Wouter
2277	- Note default for module-config in man page.
2278	- Fix recursion lame test for qname minimisation asked queries,
2279	  that were not present in the set of prepared answers.
2280	- Fix #13: Remove left-over requirements on OpenSSL >= 1.1.0 for
2281	  cert name matching, from man page.
2282	- make depend, with newer gcc, nicer layout.
2283
22847 February 2019: Wouter
2285	- Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2.
2286	- Fix that qname minimisation does not skip a label when missing
2287	  nameserver targets need to be fetched.
2288	- Fix #4225: clients seem to erroneously receive no answer with
2289	  DNS-over-TLS and qname-minimisation.
2290
22914 February 2019: Wouter
2292	- Fix that log-replies prints the correct name for local-alias
2293	  names, for names that have a CNAME in local-data configuration.
2294	  It logs the original query name, not the target of the CNAME.
2295	- Add local-zone type inform_redirect, which logs like type inform,
2296	  and redirects like type redirect.
2297	- Perform canonical sort for 0x20 capsforid compare of replies,
2298	  this sorts rrsets in the authority and additional section before
2299	  comparison, so that out of order rrsets do not cause failure.
2300
230131 January 2019: Wouter
2302	- Set ub_ctx_set_tls call signature in ltrace config file for
2303	  libunbound in contrib/libunbound.so.conf.
2304	- improve documentation for tls-service-key and forward-first.
2305	- #10: fixed pkg-config operations, PKG_PROG_PKG_CONFIG moved out of
2306	  conditional section, fixes systemd builds, from Enrico Scholz.
2307	- #9: For openssl 1.0.2 use the CRYPTO_THREADID locking callbacks,
2308	  still supports the set_id_callback previous API.  And for 1.1.0
2309	  no locking callbacks are needed.
2310	- #8: Fix OpenSSL without ENGINE support compilation.
2311	- Wipe TLS session key data from memory on exit.
2312
231330 January 2019: Ralph
2314	- Fix case in which query timeout can result in marking delegation
2315	  as edns_lame_known.
2316
231729 January 2019: Wouter
2318	- Fix spelling of tls-ciphers in example.conf.in.
2319	- Fix #4224: auth_xfr_notify.rpl test broken due to typo
2320	- Fix locking for libunbound context setup with broken port config.
2321
232228 January 2019: Wouter
2323	- ub_ctx_set_tls call for libunbound that enables DoT for the machines
2324	  set with ub_ctx_set_fwd.  Patch from Florian Obser.
2325	- Set build system for added call in the libunbound API.
2326	- List example config for root zone copy locally hosted with auth-zone
2327	  as suggested from draft-ietf-dnsop-7706-bis-02.  But with updated
2328	  B root address.
2329	- set version to 1.9.0 for release.  And this was released with the
2330	  spelling for tls-ciphers fix as 1.9.0 on Feb 5.  Trunk has 1.9.1 in
2331	  development.
2332
233325 January 2019: Wouter
2334	- Fix that tcp for auth zone and outgoing does not remove and
2335	  then gets the ssl read again applied to the deleted commpoint.
2336	- updated contrib/fastrpz.patch to cleanly diff.
2337	- no lock when threads disabled in tcp request buffer count.
2338	- remove compile warnings from libnettle compile.
2339	- output of newer lex 2.6.1 and bison 3.0.5.
2340
234124 January 2019: Wouter
2342	- Newer aclocal and libtoolize used for generating configure scripts,
2343	  aclocal 1.16.1 and libtoolize 2.4.6.
2344	- Fix unit test for python 3.7 new keyword 'async'.
2345	- clang analysis fixes, assert arc4random buffer in init,
2346	  no check for already checked delegation pointer in iterator,
2347	  in testcode check for NULL packet matches, in perf do not copy
2348	  from NULL start list when growing capacity.  Adjust host and file
2349	  only when present in test header read to please checker.  In
2350	  testcode for unknown macro operand give zero result. Initialise the
2351	  passed argv array in test code.  In test code add EDNS data
2352	  segment copy only when nonempty.
2353	- Patch from Florian Obser fixes some compiler warnings:
2354	  include mini_event.h to have a prototype for mini_ev_cmp
2355	  include edns.h to have a prototype for apply_edns_options
2356	  sldns_wire2str_edns_keepalive_print is only called in the wire2str,
2357	  module declare it static to get rid of compiler warning:
2358	  no previous prototype for function
2359	  infra_find_ip_ratedata() is only called in the infra module,
2360	  declare it static to get rid of compiler warning:
2361	  no previous prototype for function
2362	  do not shadow local variable buf in authzone
2363	  auth_chunks_delete and az_nsec3_findnode are only called in the
2364	  authzone module, declare them static to get rid of compiler warning:
2365	  no previous prototype for function...
2366	  copy_rrset() is only called in the respip module, declare it
2367	  static to get rid of compiler warning:
2368	  no previous prototype for function 'copy_rrset'
2369	  no need for another variable "r"; gets rid of compiler warning:
2370	  declaration shadows a local variable in libunbound.c
2371	  no need for another variable "ns"; gets rid of compiler warning:
2372	  declaration shadows a local variable in iterator.c
2373	- Moved includes and make depend.
2374
237523 January 2019: Wouter
2376	- Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites
2377	  options for unbound.conf.
2378	- Fixes for the patch, and man page entry.
2379	- Fix configure to detect SSL_CTX_set_ciphersuites, for better
2380	  library compatibility when compiling.
2381	- Patch for TLS session resumption from Manabu Sonoda,
2382	  enable with tls-session-ticket-keys in unbound.conf.
2383	- Fixes for patch (includes, declarations, warnings).  Free at end
2384	  and keep config options in order read from file to keep the first
2385	  one as the first one.
2386	- Fix for IXFR fallback to reset counter when IXFR does not timeout.
2387
238822 January 2019: Wouter
2389	- Fix space calculation for tcp req buffer size.
2390	- Doc for stream-wait-size and unit test.
2391	- unbound-control stats has mem.streamwait that counts TCP and TLS
2392	  waiting result buffers.
2393	- Fix for #4219: secondaries not updated after serial change, unbound
2394	  falls back to AXFR after IXFR gives several timeout failures.
2395	- Fix that auth zone after IXFR fallback tries the same master.
2396
239721 January 2019: Wouter
2398	- Fix tcp idle timeout test, for difference in the tcp reply code.
2399	- Unit test for tcp request reorder and timeouts.
2400	- Unit tests for ssl out of order processing.
2401	- Fix that multiple dns fragments can be carried in one TLS frame.
2402	- Add stream-wait-size: 4m config option to limit the maximum
2403	  memory used by waiting tcp and tls stream replies.  This avoids
2404	  a denial of service where these replies use up all of the memory.
2405
240617 January 2019: Wouter
2407	- For caps-for-id fallback, use the whitelist to avoid timeout
2408	  starting a fallback sequence for it.
2409	- increase mesh max activation count for capsforid long fetches.
2410
241116 January 2019: Ralph
2412	- Get ready for the DNS flag day: remove EDNS lame procedure, do not
2413	  re-query without EDNS after timeout.
2414
241515 January 2019: Wouter
2416	- In the out of order processing, reset byte count for (potential)
2417	  partial read.
2418	- Review fixes in out of order processing.
2419
242014 January 2019: Wouter
2421	- streamtcp option -a send queries consecutively and prints answers
2422	  as they arrive.
2423	- Fix for out of order processing administration quit cleanup.
2424	- unit test for tcp out of order processing.
2425
242611 January 2019: Wouter
2427	- Initial commit for out-of-order processing for TCP and TLS.
2428
24299 January 2019: Wouter
2430	- Log query name for looping module errors.
2431
24328 January 2019: Wouter
2433	- Fix syntax in comment of local alias processing.
2434	- Fix NSEC3 record that is returned in wildcard replies from
2435	  auth-zone zones with NSEC3 and wildcards.
2436
24377 January 2019: Wouter
2438	- On FreeBSD warn if systcl settings do not allow server TCP FASTOPEN,
2439	  and server tcp fastopen is enabled at compile time.
2440	- Document interaction between the tls-upstream option in the server
2441	  section and forward-tls-upstream option in the forward-zone sections.
2442	- Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews,
2443	  the patch adds a program used for fuzzing.
2444
244512 December 2018: Wouter
2446	- Fix for crash in dns64 module if response is null.
2447
244810 December 2018: Wouter
2449	- Fix config parser memory leaks.
2450	- ip-ratelimit-factor of 1 allows all traffic through, instead of the
2451	  previous blocking everything.
2452	- Fix for FreeBSD port make with dnscrypt and dnstap enabled.
2453	- Fix #4206: support openssl 1.0.2 for TLS hostname verification,
2454	  alongside the 1.1.0 and later support that is already there.
2455	- Fixup openssl 1.0.2 compile
2456
24576 December 2018: Wouter
2458	- Fix dns64 allocation in wrong region for returned internal queries.
2459
24603 December 2018: Wouter
2461	- Fix icon, no ragged edges and nicer resolutions available, for eg.
2462	  Win 7 and Windows 10 display.
2463	- cache-max-ttl also defines upperbound of initial TTL in response.
2464
246530 November 2018: Wouter
2466	- Patch for typo in unbound.conf man page.
2467	- log-tag-queryreply: yes in unbound.conf tags the log-queries and
2468	  log-replies in the log file for easier log filter maintenance.
2469
247029 November 2018: Wouter
2471	- iana portlist updated.
2472	- Fix chroot auth-zone fix to remove chroot prefix.
2473	- tag for 1.8.2rc1, which became 1.8.2 on 4 dec 2018, with icon
2474	  updated.  Trunk contains 1.8.3 in development.
2475	  Which became 1.8.3 on 11 december with only the dns64 fix of 6 dec.
2476	  Trunk then became 1.8.4 in development.
2477	- Fix that unbound-checkconf does not complains if the config file
2478	  is not placed inside the chroot.
2479	- Refuse to start with no ports.
2480	- Remove clang analysis warnings.
2481
248228 November 2018: Wouter
2483	- Fix leak in chroot fix for auth-zone.
2484	- Fix clang analysis for outside directory build test.
2485
248627 November 2018: Wouter
2487	- Fix DNS64 to not store intermediate results in cache, this avoids
2488	  other threads from picking up the wrong data.  The module restores
2489	  the previous no_cache_store setting when the the module is finished.
2490	- Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work.
2491	- New and better fix for Fix #4193: Fix that prefetch failure does
2492	  not overwrite valid cache entry with SERVFAIL.
2493	- auth-zone give SERVFAIL when expired, fallback activates when
2494	  expired, and this is documented in the man page.
2495	- stat count SERVFAIL downstream auth-zone queries for expired zones.
2496	- Put new logos into windows installer.
2497	- Fix windows compile for new rrset roundrobin fix.
2498	- Update contrib fastrpz patch for latest release.
2499
250026 November 2018: Wouter
2501	- Fix to not set GLOB_NOSORT so the unbound.conf include: files are
2502	  sorted and in a predictable order.
2503	- Fix #4193: Fix that prefetch failure does not overwrite valid cache
2504	  entry with SERVFAIL.
2505	- Add unbound-control view_local_datas command, like local_datas.
2506	- Fix that unbound-control can send file for view_local_datas.
2507
250822 November 2018: Wouter
2509	- With ./configure --with-pyunbound --with-pythonmodule
2510	  PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests
2511	  succeed for the python module.
2512	- pythonmod logs the python error and traceback on failure.
2513	- ignore debug python module for test in doxygen output.
2514	- review fixes for python module.
2515	- Fix #4209: Crash in libunbound when called from getdns.
2516	- auth zone zonefiles can be in a chroot, the chroot directory
2517	  components are removed before use.
2518	- Fix that empty zonefile means the zonefile is not set and not used.
2519	- make depend.
2520
252121 November 2018: Wouter
2522	- Scrub NS records from NODATA responses as well.
2523
252420 November 2018: Wouter
2525	- Scrub NS records from NXDOMAIN responses to stop fragmentation
2526	  poisoning of the cache.
2527	- Add patch from Jan Vcelak for pythonmod,
2528	  add sockaddr_storage getters, add support for query callbacks,
2529	  allow raw address access via comm_reply and update API documentation.
2530	- Removed compile warnings in pythonmod sockaddr routines.
2531
253219 November 2018: Wouter
2533	- Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes
2534	  option in unbound.conf.
2535
25366 November 2018: Ralph
2537	- Bugfix min-client-subnet-ipv6
2538
253925 October 2018: Ralph
2540	- Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options.
2541
254225 October 2018: Wouter
2543	- Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query.
2544	- Fix #4190: Please create a "ANY" deny option, adds the option
2545	  deny-any: yes in unbound.conf.  This responds with an empty message
2546	  to queries of type ANY.
2547	- Fix #4141: More randomness to rrset-roundrobin.
2548	- Fix #4132: Openness/closeness of RANGE intervals in rpl files.
2549	- Fix #4126: RTT_band too low on VSAT links with 600+ms latency,
2550	  adds the option unknown-server-time-limit to unbound.conf that
2551	  can be increased to avoid the problem.
2552	- remade makefile dependencies.
2553	- Fix #4152: Logs shows wrong time when using log-time-ascii: yes.
2554
255524 October 2018: Ralph
2556	- Add markdel function to ECS slabhash.
2557	- Limit ECS scope returned to client to the scope used for caching.
2558	- Make lint like previous #4154 fix.
2559
256022 October 2018: Wouter
2561	- Fix #4192: unbound-control-setup generates keys not readable by
2562	  group.
2563	- check that the dnstap socket file can be opened and exists, print
2564	  error if not.
2565	- Fix #4154: make ECS_MAX_TREESIZE configurable, with
2566	  the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options.
2567
256822 October 2018: Ralph
2569	- Change fast-server-num default to 3.
2570
25718 October 2018: Ralph
2572	- Add fast-server-permil and fast-server-num options.
2573	- Deprecate low-rtt and low-rtt-permil options.
2574
25758 October 2018: Wouter
2576	- Squelch log of failed to tcp initiate after TCP Fastopen failure.
2577
25785 October 2018: Wouter
2579	- Squelch EADDRNOTAVAIL errors when the interface goes away,
2580	  this omits 'can't assign requested address' errors unless
2581	  verbosity is set to a high value.
2582	- Set default for so-reuseport to no for FreeBSD.  It is enabled
2583	  by default for Linux and DragonFlyBSD.  The setting can
2584	  be configured in unbound.conf to override the default.
2585	- iana port update.
2586
25872 October 2018: Wouter
2588	- updated contrib/fastrpz.patch to apply for this version
2589	- dnscrypt.c removed sizeof to get array bounds.
2590	- Fix testlock code to set noreturn on error routine.
2591	- Remove unused variable from contrib fastrpz/rpz.c and
2592	  remove unused diagnostic pragmas that themselves generate warnings
2593	- clang analyze test is used only when assertions are enabled.
2594
25951 October 2018: Wouter
2596	- tag for release 1.8.1rc1.  Became release 1.8.1 on 8 oct, with
2597	  fastrpz.patch fix included.  Trunk has 1.8.2 in development.
2598
259927 September 2018: Wouter
2600	- Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes
2601	  qname minimisation with a forwarder when connectivity has issues
2602	  from rejecting responses.
2603
260425 September 2018: Wouter
2605	- Perform TLS SNI indication of the host that is being contacted
2606	  for DNS over TLS service.  It sets the configured tls auth name.
2607	  This is useful for hosts that apart from the DNS over TLS services
2608	  also provide other (web) services.
2609	- Fix #4149: Add SSL cleanup for tcp timeout.
2610
261117 September 2018: Wouter
2612	- Fix compile on Mac for unbound, provide explicit_bzero when libc
2613	  does not have it.
2614	- Fix unbound for openssl in FIPS mode, it uses the digests with
2615	  the EVP call contexts.
2616	- Fix that with harden-below-nxdomain and qname minisation enabled
2617	  some iterator states for nonresponsive domains can get into a
2618	  state where they waited for an empty list.
2619	- Stop UDP to TCP failover after timeouts that causes the ping count
2620	  to be reset by the TCP time measurement (that exists for TLS),
2621	  because that causes the UDP part to not be measured as timeout.
2622	- Fix #4156: Fix systemd service manager state change notification.
2623
262413 September 2018: Wouter
2625	- Fix seed for random backup code to use explicit zero when wiped.
2626	- exit log routine is annotated as noreturn function.
2627	- free memory leaks in config strlist and str2list insert functions.
2628	- do not move unused argv variable after getopt.
2629	- Remove unused if clause in testcode.
2630	- in testcode, free async ids, initialise array, and check for null
2631	  pointer during test of the test.  And use exit for return to note
2632	  irregular program stop.
2633	- Free memory leak in config strlist append.
2634	- make sure nsec3 comparison salt is initialized.
2635	- unit test has clang analysis.
2636	- remove unused variable assignment from iterator scrub routine.
2637	- check for null in delegation point during iterator refetch
2638	  in forward zone.
2639	- neater pointer cast in libunbound context quit routine.
2640	- initialize statistics totals for printout.
2641	- in authzone check that node exists before adding rrset.
2642	- in unbound-anchor, use readwrite memory BIO.
2643	- assertion in autotrust that packed rrset is formed correctly.
2644	- Fix memory leak when message parse fails partway through copy.
2645	- remove unused udpsize assignment in message encode.
2646	- nicer bio free code in unbound-anchor.
2647	- annotate exit functions with noreturn in unbound-control.
2648
264911 September 2018: Wouter
2650	- Fixed unused return value warnings in contrib/fastrpz.patch for
2651	  asprintf.
2652	- Fix to squelch respip warning in unit test, it is printed at
2653	  higher verbosity settings.
2654	- Fix spelling errors.
2655	- Fix initialisation in remote.c
2656
265710 September 2018: Wouter
2658	- 1.8.1 in svn trunk. (changes from 4,5,.. sep apply).
2659	- iana port update.
2660
26615 September 2018: Wouter
2662	- Fix spelling error in header, from getdns commit by Andreas Gelmini.
2663
26644 September 2018: Ralph
2665	- More explicitly mention the type of ratelimit when applying
2666	  ip-ratelimit.
2667
26684 September 2018: Wouter
2669	- Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018.
2670
267131 August 2018: Wouter
2672	- Disable minimal-responses in subnet unit tests.
2673
267430 August 2018: Wouter
2675	- Fix that a local-zone with a local-zone-type that is transparent
2676	  in a view with view-first, makes queries check for answers from the
2677	  local-zones defined outside of views.
2678
267928 August 2018: Ralph
2680	- Disable minimal-responses in ipsecmod unit tests.
2681	- Added serve-expired-ttl and serve-expired-ttl-reset options.
2682
268327 August 2018: Wouter
2684	- Set defaults to yes for a number of options to increase speed and
2685	  resilience of the server.  The so-reuseport, harden-below-nxdomain,
2686	  and minimal-responses options are enabled by default.  They used
2687	  to be disabled by default, waiting to make sure they worked.  They
2688	  are enabled by default now, and can be disabled explicitly by
2689	  setting them to "no" in the unbound.conf config file.  The reuseport
2690	  and minimal options increases speed of the server, and should be
2691	  otherwise harmless.  The harden-below-nxdomain option works well
2692	  together with the recently default enabled qname minimisation, this
2693	  causes more fetches to use information from the cache.
2694	- next release is called 1.8.0.
2695	- Fix lintflags for lint on FreeBSD.
2696
269722 August 2018: George
2698	- #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This
2699	  gives access to reply information for the client's communication
2700	  point when the callback is called before the mesh state (modules).
2701	  Changes to C and Python's inplace_callback signatures were also
2702	  necessary.
2703
270421 August 2018: Wouter
2705	- log-local-actions: yes option for unbound.conf that logs all the
2706	  local zone actions, a patch from Saksham Manchanda (Secure64).
2707	- #4146: num.query.subnet and num.query.subnet_cache counters.
2708	- Fix only misc failure from log-servfail when val-log-level is not
2709	  enabled.
2710
271117 August 2018: Ralph
2712	- Fix classification for QTYPE=CNAME queries when QNAME minimisation is
2713 	  enabled.
2714
271517 August 2018: Wouter
2716	- Set libunbound to increase current, because the libunbound change
2717	  to the event callback function signature.  That needs programs,
2718	  that use it, to recompile against the new header definition.
2719	- print servfail info to log as error.
2720	- added more servfail printout statements, to the iterator.
2721	- log-servfail: yes prints log lines that say why queries are
2722	  returning SERVFAIL to clients.
2723
272416 August 2018: Wouter
2725	- Fix warning on compile without threads.
2726	- Fix contrib/fastrpz.patch.
2727
272815 August 2018: Wouter
2729	- Fix segfault in auth-zone read and reorder of RRSIGs.
2730
273114 August 2018: Wouter
2732	- Fix that printout of error for cycle targets is a verbosity 4
2733	  printout and does not wrongly print it is a memory error.
2734	- Upgraded crosscompile script to include libunbound DLL in the
2735	  zipfile.
2736
273710 August 2018: Wouter
2738	- Fix #4144: dns64 module caches wrong (negative) information.
2739
27409 August 2018: Wouter
2741	- unbound-checkconf checks if modules exist and prints if they are
2742	  not compiled in the name of the wrong module.
2743	- document --enable-subnet in doc/README.
2744	- Patch for stub-no-cache and forward-no-cache options that disable
2745	  caching for the contents of that stub or forward, for when you
2746	  want immediate changes visible, from Bjoern A. Zeeb.
2747
27487 August 2018: Ralph
2749	- Make capsforid fallback QNAME minimisation aware.
2750
27517 August 2018: Wouter
2752	- Fix #4142: unbound.service.in: improvements and fixes.
2753	  Add unit dependency ordering (based on systemd-resolved).
2754	  Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings
2755	  about missing privileges during startup). Add 'AF_INET6' to
2756	  'RestrictAddressFamilies' (without it IPV6 can't work). From
2757	  Guido Shanahan.
2758	- Patch to implement tcp-connection-limit from Jim Hague (Sinodun).
2759	  This limits the number of simultaneous TCP client connections
2760	  from a nominated netblock.
2761	- make depend, yacc, lex, doc, headers.  And log the limit exceeded
2762	  message only on high verbosity, so as to not spam the logs when
2763	  it is busy.
2764
27656 August 2018: Wouter
2766	- Fix for #4136: Fix to unconditionally call destroy in daemon.c.
2767
27683 August 2018: George
2769	- Expose if a query (or a subquery) was ratelimited (not src IP
2770	  ratelimiting) to libunbound under 'ub_result.was_ratelimited'.
2771	  This also introduces a change to 'ub_event_callback_type' in
2772	  libunbound/unbound-event.h.
2773	- Tidy pylib tests.
2774
27753 August 2018: Wouter
2776	- Revert previous change for #4136: because it introduces build
2777	  problems.
2778	- New fix for #4136: This one ignores lex without without
2779	  yylex_destroy.
2780
27811 August 2018: Wouter
2782	- Fix to remove systemd sockaddr function check, that is not
2783	  always present.  Make socket activation more lenient.  But not
2784	  different when socket activation is not used.
2785	- iana port list update.
2786
278731 July 2018: Wouter
2788	- Patches from Jim Hague (Sinodun) for EDNS KeepAlive.
2789	- Sort out test runs when the build directory isn't the project
2790	  root directory.
2791	- Add config tcp-idle-timeout (default 30s). This applies to
2792	  client connections only; the timeout on TCP connections upstream
2793	  is unaffected.
2794	- Error if EDNS Keepalive received over UDP.
2795	- Add edns-tcp-keepalive and edns-tcp-keepalive timeout options
2796	  and implement option in client responses.
2797	- Correct and expand manual page entries for keepalive and idle timeout.
2798	- Implement progressive backoff of TCP idle/keepalive timeout.
2799	- Fix 'make depend' to work when build dir is not project root.
2800	- Add delay parameter to streamtcp, -d secs.
2801	  To be used when testing idle timeout.
2802	- From Wouter: make depend, the dependencies in the patches did not
2803	  apply cleanly.  Also remade yacc and lex.
2804	- Fix mesh.c incompatible pointer pass.
2805	- Please doxygen so it passes.
2806	- Fix #4139: Fix unbound-host leaks memory on ANY.
2807
280830 July 2018: Wouter
2809	- Fix #4136: insufficiency from mismatch of FLEX capability between
2810	  released tarball and build host.
2811
281227 July 2018: Wouter
2813	- Fix man page, say that chroot is enabled by default.
2814
281526 July 2018: Wouter
2816	- Fix #4135: 64-bit Windows Installer Creates Entries Under The
2817	  Wrong Registry Key, reported by Brian White.
2818
281923 July 2018: Wouter
2820	- Fix use-systemd readiness signalling, only when use-systemd is yes
2821	  and not in signal handler.
2822
282320 July 2018: Wouter
2824	- Fix #4130: print text describing -dd and unbound-checkconf on
2825	  config file read error at startup, the errors may have been moved
2826	  away by the startup process.
2827	- Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared.
2828
282919 July 2018: Wouter
2830	- Fix #4129 unbound-control error message with wrong cert permissions
2831	  is too cryptic.
2832
283317 July 2018: Wouter
2834	- Fix #4127 unbound -h does not list -p help.
2835	- Print error if SSL name verification configured but not available
2836	  in the ssl library.
2837	- Fix that ratelimit and ip-ratelimit are applied after reload of
2838	  changed config file.
2839	- Resize ratelimit and ip-ratelimit caches if changed on reload.
2840
284116 July 2018: Wouter
2842	- Fix qname minimisation NXDOMAIN validation lookup failures causing
2843	  error_supers assertion fails.
2844	- Squelch can't bind socket errors with Permission denied unless
2845	  verbosity is 4 or higher, for UDP outgoing sockets.
2846
284712 July 2018: Wouter
2848	- Fix to improve systemd socket activation code file descriptor
2849	  assignment.
2850	- Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more
2851	  easily changed to adjust default rtt assumptions.
2852
285310 July 2018: Wouter
2854	- Note in documentation that the cert name match code needs
2855	  OpenSSL 1.1.0 or later to be enabled.
2856
28576 July 2018: Wouter
2858	- Fix documentation ambiguity for tls-win-cert in tls-upstream and
2859	  forward-tls-upstream docs.
2860	- iana port update.
2861	- Note RFC8162 support.  SMIMEA record type can be read in by the
2862	  zone record parser.
2863	- Fix round robin for failed addresses with prefer-ip6: yes
2864
28654 July 2018: Wouter
2866	- Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass
2867	  if DNSSEC is not enabled.  New option -R allows fallback from
2868	  resolv.conf to direct queries.
2869
28703 July 2018: Wouter
2871	- Better documentation for unblock-lan-zones and insecure-lan-zones
2872	  config statements.
2873	- Fix permission denied printed for auth zone probe random port nrs.
2874
28752 July 2018: Wouter
2876	- Fix checking for libhiredis printout in configure output.
2877	- Fix typo on man page in ip-address description.
2878	- Update libunbound/python/examples/dnssec_test.py example code to
2879	  also set the 20326 trust anchor for the root in the example code.
2880
288129 June 2018: Wouter
2882	- dns64-ignore-aaaa: config option to list domain names for which the
2883	  existing AAAA is ignored and dns64 processing is used on the A
2884	  record.
2885
288628 June 2018: Wouter
2887	- num.queries.tls counter for queries over TLS.
2888	- log port number with err_addr logs.
2889
289027 June 2018: Wouter
2891	- #4109: Fix that package config depends on python unconditionally.
2892	- Patch, do not export python from pkg-config, from Petr Menšík.
2893
289426 June 2018: Wouter
2895	- Partial fix for permission denied on IPv6 address on FreeBSD.
2896	- Fix that auth-zone master reply with current SOA serial does not
2897	  stop scan of masters for an updated zone.
2898	- Fix that auth-zone does not start the wait timer without checking
2899	  if the wait timer has already been started.
2900
290121 June 2018: Wouter
2902	- #4108: systemd reload hang fix.
2903	- Fix usage printout for unbound-host, hostname has to be last
2904	  argument on BSDs and Windows.
2905
290619 June 2018: Wouter
2907	- Fix for unbound-control on Windows and set TCP socket parameters
2908	  more closely.
2909	  This fix is part of 1.7.3.
2910	- Windows example service.conf edited with more windows specific
2911	  configuration.
2912	- Fix windows unbound-control no cert bad file descriptor error.
2913	  This fix is part of 1.7.3.
2914
291518 June 2018: Wouter
2916	- Fix that control-use-cert: no works for 127.0.0.1 to disable certs.
2917	  This fix is part of 1.7.3rc2.
2918	- Fix unbound-checkconf for control-use-cert.
2919	  This fix is part of 1.7.3.
2920
292115 June 2018: Wouter
2922	- tag for 1.7.3rc1.
2923	- trunk has 1.7.4.
2924	- unbound-control auth_zone_reload _zone_ option rereads the zonefile.
2925	- unbound-control auth_zone_transfer _zone_ option starts the probe
2926	  sequence for a master to transfer the zone from and transfers when
2927	  a new zone version is available.
2928
292914 June 2018: Wouter
2930	- #4103: Fix that auth-zone does not insist on SOA record first in
2931	  file for url downloads.
2932	- Fix that first control-interface determines if TLS is used.  Warn
2933	  when IP address interfaces are used without TLS.
2934	- Fix nettle compile.
2935
293612 June 2018: Ralph
2937	- Don't count CNAME response types received during qname minimisation as
2938	  query restart.
2939
294012 June 2018: Wouter
2941	- #4102 for NSD, but for Unbound.  Named unix pipes do not use
2942	  certificate and key files, access can be restricted with file and
2943	  directory permissions.  The option control-use-cert is no longer
2944	  used, and ignored if found in unbound.conf.
2945	- Rename tls-additional-ports to tls-additional-port, because every
2946	  line adds one port.
2947	- Fix buffer size warning in unit test.
2948	- remade dependencies in the Makefile.
2949
29506 June 2018: Wouter
2951	- Patch to fix openwrt for mac os build darwin detection in configure.
2952
29535 June 2018: Wouter
2954	- Fix crash if ratelimit taken into use with unbound-control
2955	  instead of with unbound.conf.
2956
29574 June 2018: Wouter
2958	- Fix deadlock caused by incoming notify for auth-zone.
2959	- tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018,
2960	  trunk is 1.7.3 in development from this point.
2961	- #4100: Fix stub reprime when it becomes useless.
2962
29631 June 2018: Wouter
2964	- Rename additional-tls-port to tls-additional-ports.
2965	  The older name is accepted for backwards compatibility.
2966
296730 May 2018: Wouter
2968	- Patch from Syzdek: Add ability to ignore RD bit and treat all
2969	  requests as if the RD bit is set.
2970
297129 May 2018: Wouter
2972	- in compat/arc4random call getentropy_urandom when getentropy fails
2973	  with ENOSYS.
2974	- Fix that fallback for windows port.
2975
297628 May 2018: Wouter
2977	- Fix windows tcp and tls spin on events.
2978	- Add routine from getdns to add windows cert store to the SSL_CTX.
2979	- tls-win-cert option that adds the system certificate store for
2980	  authenticating DNS-over-TLS connections.  It can be used instead
2981	  of the tls-cert-bundle option, or with it to add certificates.
2982
298325 May 2018: Wouter
2984	- For TCP and TLS connections that don't establish, perform address
2985	  update in infra cache, so future selections can exclude them.
2986	- Fix that tcp sticky events are removed for closed fd on windows.
2987	- Fix close events for tcp only.
2988
298924 May 2018: Wouter
2990	- Fix that libunbound can do DNS-over-TLS, when configured.
2991	- Fix that windows unbound service can use DNS-over-TLS.
2992	- unbound-host initializes ssl (for potential DNS-over-TLS usage
2993	  inside libunbound), when ssl upstream or a cert-bundle is configured.
2994
299523 May 2018: Wouter
2996	- Use accept4 to speed up incoming TCP (and TLS) connections,
2997	  available on Linux, FreeBSD and OpenBSD.
2998
299917 May 2018: Ralph
3000	- Qname minimisation default changed to yes.
3001
300215 May 2018: Wouter
3003	- Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand.
3004
300511 May 2018: Wouter
3006	- Fix contrib/libunbound.pc for libssl libcrypto references,
3007	  from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914
3008
30097 May 2018: Wouter
3010	- Fix windows to not have sticky TLS events for TCP.
3011	- Fix read of DNS over TLS length and data in one read call.
3012	- Fix mesh state assertion failure due to callback removal.
3013
30143 May 2018: Wouter
3015	- Fix that configure --with-libhiredis also turns on cachedb.
3016	- Fix gcc 8 buffer warning in testcode.
3017	- Fix function type cast warning in libunbound context callback type.
3018
30192 May 2018: Wouter
3020	- Fix fail to reject dead peers in forward-zone, with ssl-upstream.
3021
30221 May 2018: Wouter
3023	- Fix that unbound-control reload frees the rrset keys and returns
3024	  the memory pages to the system.
3025
302630 April 2018: Wouter
3027	- Fix spelling error in man page and note defaults as no instead of
3028	  off.
3029
303026 April 2018: Wouter
3031	- Fix for crash in daemon_cleanup with dnstap during reload,
3032	  from Saksham Manchanda.
3033	- Also that for dnscrypt.
3034	- tag for 1.7.1rc1 release.  Became 1.7.1 release on 3 May, trunk
3035	  is from here 1.7.2 in development.
3036
303725 April 2018: Ralph
3038	- Fix memory leak when caching wildcard records for aggressive NSEC use
3039
304024 April 2018: Wouter
3041	- Fix contrib/fastrpz.patch for this release.
3042	- Fix auth https for libev.
3043
304424 April 2018: Ralph
3045	- Added root-key-sentinel support
3046
304723 April 2018: Wouter
3048	- makedist uses bz2 for expat code, instead of tar.gz.
3049	- Fix #4092: libunbound: use-caps-for-id lacks colon in
3050	  config_set_option.
3051	- auth zone http download stores exact copy of downloaded file,
3052	  including comments in the file.
3053	- Fix sldns parse failure for CDS alternate delete syntax empty hex.
3054	- Attempt for auth zone fix; add of callback in mesh gets from
3055	  callback does not skip callback of result.
3056	- Fix cname classification with qname minimisation enabled.
3057	- list_auth_zones unbound-control command.
3058
305920 April 2018: Wouter
3060	- man page documentation for dns-over-tls forward-addr '#' notation.
3061	- removed free from failed parse case.
3062	- Fix #4091: Fix that reload of auth-zone does not merge the zonefile
3063	  with the previous contents.
3064	- Delete auth zone when removed from config.
3065
306619 April 2018: Wouter
3067	- Can set tls authentication with forward-addr: IP#tls.auth.name
3068	  And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem".
3069	  such as forward-addr: 9.9.9.9@853#dns.quad9.net or
3070	  1.1.1.1@853#cloudflare-dns.com
3071	- Fix #658: unbound using TLS in a forwarding configuration does not
3072	  verify the server's certificate (RFC 8310 support).
3073	- For addr with #authname and no @port notation, the default is 853.
3074
307518 April 2018: Wouter
3076	- Fix auth-zone retry timer to be on schedule with retry timeout,
3077	  with backoff.  Also time a refresh at the zone expiry.
3078
307917 April 2018: Wouter
3080	- auth zone notify work.
3081	- allow-notify: config statement for auth-zones.
3082	- unit test for allow-notify
3083
308416 April 2018: Wouter
3085	- Fix auth zone target lookup iterator.
3086	- auth zone notify with prefix
3087	- auth zone notify work.
3088
308913 April 2018: Wouter
3090	- Fix for max include depth for authzones.
3091	- Fix memory free on fail for $INCLUDE in authzone.
3092	- Fix that an internal error to look up the wrong rr type for
3093	  auth zone gets stopped, before trying to send there.
3094	- auth zone notify work.
3095
309610 April 2018: Ralph
3097	- num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN
3098	  statistics counters.
3099
310010 April 2018: Wouter
3101	- documentation for low-rtt and low-rtt-pct.
3102	- auth zone notify work.
3103
31049 April 2018: Wouter
3105	- Fix that flush_zone sets prefetch ttl expired, so that with
3106	  serve-expired enabled it'll start prefetching those entries.
3107	- num.query.authzone.up and num.query.authzone.down statistics counters.
3108	- Fix downstream auth zone, only fallback when auth zone fails to
3109	  answer and fallback is enabled.
3110	- Accept both option names with and without colon for get_option
3111	  and set_option.
3112	- low-rtt and low-rtt-pct in unbound.conf enable the server selection
3113	  of fast servers for some percentage of the time.
3114
31155 April 2018: Wouter
3116	- Combine write of tcp length and tcp query for dns over tls.
3117	- nitpick fixes in example.conf.
3118	- Fix above stub queries for type NS and useless delegation point.
3119	- Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3
3120	  tls_choose_sigalg routine does not allow the ciphers for the pipe,
3121	  so use TLSv1.2.
3122	- ED448 support.
3123
31243 April 2018: Wouter
3125	- Fix #4043: make test fails due to v6 presentation issue in macOS.
3126	- Fix unable to resolve after new WLAN connection, due to auth-zone
3127	  failing with a forwarder set.  Now, auth-zone is only used for
3128	  answers (not referrals) when a forwarder is set.
3129
313029 March 2018: Ralph
3131	- Check "result" in dup_all(), by Florian Obser.
3132
313323 March 2018: Ralph
3134	- Fix unbound-control get_option aggressive-nsec
3135
313621 March 2018: Ralph
3137	- Do not use cached NSEC records to generate negative answers for
3138	  domains under DNSSEC Negative Trust Anchors.
3139
314019 March 2018: Wouter
3141	- iana port update.
3142
314316 March 2018: Wouter
3144	- corrected a minor typo in the changelog.
3145	- move htobe64/be64toh portability code to cachedb.c.
3146
314715 March 2018: Wouter
3148	- Add --with-libhiredis, unbound support for a new cachedb backend
3149	  that uses a Redis server as the storage.  This implementation
3150	  depends on the hiredis client library (https://redislabs.com/lp/hiredis/).
3151	  And unbound should be built with both --enable-cachedb and
3152	  --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h
3153	  should exist).  Patch from Jinmei Tatuya (Infoblox).
3154	- Fix #3817: core dump happens in libunbound delete, when queued
3155	  servfail hits deleted message queue.
3156	- Create additional tls service interfaces by opening them on other
3157	  portnumbers and listing the portnumbers as additional-tls-port: nr.
3158
315913 March 2018: Wouter
3160	- Fix typo in documentation.
3161	- Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually
3162	  flushed with serve-expired on.
3163
316412 March 2018: Wouter
3165	- Added documentation for aggressive-nsec: yes.
3166	- tag 1.7.0rc3.  That became the 1.7.0 release on 15 Mar, trunk
3167	  now has 1.7.1 in development.
3168	- Fix #3727: Protocol name is TLS, options have been renamed but
3169	  documentation is not consistent.
3170	- Check IXFR start serial.
3171
31729 March 2018: Wouter
3173	- Fix #3598: Fix swig build issue on rhel6 based system.
3174	  configure --disable-swig-version-check stops the swig version check.
3175
31768 March 2018: Wouter
3177	- tag 1.7.0rc2.
3178
31797 March 2018: Wouter
3180	- Fixed contrib/fastrpz.patch, even though this already applied
3181	  cleanly for me, now also for others.
3182	- patch to log creates keytag queries, from A. Schulze.
3183	- patch suggested by Debian lintian: allow to -> allow one to, from
3184	  A. Schulze.
3185	- Attempt to remove warning about trailing whitespace.
3186
31876 March 2018: Wouter
3188	- Reverted fix for #3512, this may not be the best way forward;
3189	  although it could be changed at a later time, to stay similar to
3190	  other implementations.
3191	- svn trunk contains 1.7.0, this is the number for the next release.
3192	- Fix for windows compile.
3193	- tag 1.7.0rc1.
3194
31955 March 2018: Wouter
3196	- Fix to check define of DSA for when openssl is without deprecated.
3197	- iana port update.
3198	- Fix #3582: Squelch address already in use log when reuseaddr option
3199	  causes same port to be used twice for tcp connections.
3200
320127 February 2018: Wouter
3202	- Fixup contrib/fastrpz.patch so that it applies.
3203	- Fix compile without threads, and remove unused variable.
3204	- Fix compile with staticexe and python module.
3205	- Fix nettle compile.
3206
320722 February 2018: Ralph
3208	- Save wildcard RRset from answer with original owner for use in
3209 	  aggressive NSEC.
3210
321121 February 2018: Wouter
3212	- Fix #3512: unbound incorrectly reports SERVFAIL for CAA query
3213	  when there is a CNAME loop.
3214	- Fix validation for CNAME loops.  When it detects a cname loop,
3215	  by finding the cname, cname in the existing list, it returns
3216	  the partial result with the validation result up to then.
3217	- more robust cachedump rrset routine.
3218
321919 February 2018: Wouter
3220	- Fix #3505: Documentation for default local zones references
3221	  wrong RFC.
3222	- Fix #3494: local-zone noview can be used to break out of the view
3223	  to the global local zone contents, for queries for that zone.
3224	- Fix for more maintainable code in localzone.
3225
322616 February 2018: Wouter
3227	- Fixes for clang static analyzer, the missing ; in
3228	  edns-subnet/addrtree.c after the assert made clang analyzer
3229	  produce a failure to analyze it.
3230
323113 February 2018: Ralph
3232	- Aggressive NSEC tests
3233
323413 February 2018: Wouter
3235	- tls-cert-bundle option in unbound.conf enables TLS authentication.
3236	- iana port update.
3237
323812 February 2018: Wouter
3239	- Unit test for auth zone https url download.
3240
324112 February 2018: Ralph
3242	- Added tests with wildcard expanded NSEC records (CVE-2017-15105 test)
3243	- Processed aggressive NSEC code review remarks Wouter
3244
32458 February 2018: Ralph
3246	- Aggressive use of NSEC implementation. Use cached NSEC records to
3247	  generate NXDOMAIN, NODATA and positive wildcard answers.
3248
32498 February 2018: Wouter
3250	- iana port update.
3251	- auth zone url config.
3252
32535 February 2018: Wouter
3254	- Fix #3451: dnstap not building when you have a separate build dir.
3255	  And removed protoc warning, set dnstap.proto syntax to proto2.
3256	- auth-zone provides a way to configure RFC7706 from unbound.conf,
3257	  eg. with auth-zone: name: "." for-downstream: no for-upstream: yes
3258	  fallback-enabled: yes and masters or a zonefile with data.
3259
32602 February 2018: Wouter
3261	- Fix unfreed locks in log and arc4random at exit of unbound.
3262	- unit test with valgrind
3263	- Fix lock race condition in dns cache dname synthesis.
3264	- lock subnet new item before insertion to please checklocks,
3265	  no modification of critical regions outside of lock region.
3266
32671 February 2018: Wouter
3268	- fix unaligned structure making a false positive in checklock
3269	  unitialised memory.
3270
327129 January 2018: Ralph
3272	- Use NSEC with longest ce to prove wildcard absence.
3273	- Only use *.ce to prove wildcard absence, no longer names.
3274
327525 January 2018: Wouter
3276	- ltrace.conf file for libunbound in contrib.
3277
327823 January 2018: Wouter
3279	- Fix that unbound-checkconf -f flag works with auto-trust-anchor-file
3280	  for startup scripts to get the full pathname(s) of anchor file(s).
3281	- Print fatal errors about remote control setup before log init,
3282	  so that it is printed to console.
3283
328422 January 2018: Wouter
3285	- Accept tls-upstream in unbound.conf, the ssl-upstream keyword is
3286	  also recognized and means the same.  Also for tls-port,
3287	  tls-service-key, tls-service-pem, stub-tls-upstream and
3288	  forward-tls-upstream.
3289	- Fix #3397: Fix that cachedb could return a partial CNAME chain.
3290	- Fix #3397: Fix that when the cache contains an unsigned DNAME in
3291	  the middle of a cname chain, a result without the DNAME could
3292	  be returned.
3293
329419 January 2018: Wouter
3295	- tag 1.6.8 for release with CVE fix.
3296	- trunk has 1.6.9 with fix and previous commits.
3297	- patch for CVE-2017-15105: vulnerability in the processing of
3298	  wildcard synthesized NSEC records.
3299	- iana port update.
3300	- make depend: code dependencies updated in Makefile.
3301
33024 January 2018: Ralph
3303	- Copy query and correctly set flags on REFUSED answers when cache
3304	  snooping is not allowed.
3305
33063 January 2018: Ralph
3307	- Fix queries being leaked above stub when refetching glue.
3308
33092 January 2017: Wouter
3310	- Fix that DS queries with referral replies are answered straight
3311	  away, without a repeat query picking the DS from cache.
3312	  The correct reply should have been an answer, the reply is fixed
3313	  by the scrubber to have the answer in the answer section.
3314	- Remove clang optimizer disable,
3315	  Fix that expiration date checks don't fail with clang -O2.
3316
331715 December 2017: Wouter
3318	- Fix timestamp failure because of clang optimizer failure, by
3319	  disabling -O2 when the compiler --version is clang.
3320	- iana port update.
3321	- Also disable -flto for clang, to make incep-expi signature check
3322	  work.
3323
332412 December 2017: Ralph
3325	- Fix qname-minimisation documentation (A QTYPE, not NS)
3326
332712 December 2017: Wouter
3328	- authzone work, transfer connect.
3329
33307 December 2017: Ralph
3331	- Check whether --with-libunbound-only is set when using --with-nettle
3332	  or --with-nss.
3333
33344 December 2017: Wouter
3335	- Fix link failure on OmniOS.
3336
33371 December 2017: Wouter
3338	- auth zone work.
3339
334030 November 2017: Wouter
3341	- Fix #3299 - forward CNAME daisy chain is not working
3342
334314 November 2017: Wouter
3344	- Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is
3345	  set for stub zone.  It no longer searches for DNSSEC information.
3346	- auth xfer work on probe timer and lookup.
3347
334813 November 2017: Wouter
3349	- Fix #2801: Install libunbound.pc.
3350	- Fix qname minimisation to send AAAA queries at zonecut like type A.
3351	- reverted AAAA change.
3352
33537 November 2017: Wouter
3354	- Fix #2492: Documentation libunbound.
3355
33563 November 2017: Wouter
3357	- Fix #2362: TLS1.3/openssl-1.1.1 not working.
3358	- Fix #2034 - Autoconf and -flto.
3359	- Fix #2141 - for libsodium detect lack of entropy in chroot, print
3360	  a message and exit.
3361
33622 November 2017: Wouter
3363	- Fix #1913: ub_ctx_config is under circumstances thread-safe.
3364	- make ip-transparent option work on OpenBSD.
3365
336631 October 2017: Wouter
3367	- Document that errno is left informative on libunbound config read
3368	  fail.
3369	- lexer output.
3370	- iana port update.
3371
337225 October 2017: Ralph
3373	- Fixed libunbound manual typo.
3374	- Fix #1949: [dnscrypt] make provider name mismatch more obvious.
3375	- Fix #2031: Double included headers
3376
337724 October 2017: Ralph
3378	- Update B root ipv4 address.
3379
338019 October 2017: Wouter
3381	- authzone work, probe timer setup.
3382
338318 October 2017: Wouter
3384	- lint for recent authzone commit.
3385
338617 October 2017: Wouter
3387	- Fix #1749: With harden-referral-path: performance drops, due to
3388	  circular dependency in NS and DS lookups.
3389	- [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert
3390	  duplicates
3391	- [dnscrypt] introduce dnscrypt-provider-cert-rotated option,
3392	  from Manu Bretelle.
3393	This option allows handling multiple cert/key pairs while only
3394	distributing some of them.
3395	In order to reliably match a client magic with a given key without
3396	strong assumption as to how those were generated, we need both key and
3397	cert. Likewise, in order to know which ES version should be used.
3398	On the other hand, when rotating a cert, it can be desirable to only
3399	serve the new cert but still be able to handle clients that are still
3400	using the old certs's public key.
3401	The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not
3402	publish the cert as part of the DNS's provider_name's TXT answer.
3403	- Better documentation for cache-max-negative-ttl.
3404	- Work on local root zone code.
3405
340610 October 2017: Wouter
3407	- tag 1.6.7
3408	- trunk has version 1.6.8.
3409
34106 October 2017: Wouter
3411	- Fix spelling in unbound-control man page.
3412
34135 October 2017: Wouter
3414	- Fix trust-anchor-signaling works in libunbound.
3415	- Fix some more crpls in testdata for different signaling default.
3416	- tag 1.6.7rc1
3417
34185 October 2017: Ralph
3419	- Set trust-anchor-signaling default to yes
3420	- Use RCODE from A query on DNS64 synthesized answer.
3421
34222 October 2017: Wouter
3423	- Fix param unused warning for windows exportsymbol compile.
3424
342525 September 2017: Ralph
3426	- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
3427	   (by Danilo G. Baio).
3428
342921 September 2017: Ralph
3430	- Log name of looping module
3431
343219 September 2017: Wouter
3433	- use a cachedb answer even if it's "expired" when serve-expired is yes
3434	  (patch from Jinmei Tatuya).
3435	- trigger refetching of the answer in that case (this will bypass
3436	  cachedb lookup)
3437	- allow storing a 0-TTL answer from cachedb in the in-memory message
3438	  cache when serve-expired is yes
3439	- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
3440
344118 September 2017: Ralph
3442	- Fix #1400: allowing use of global cache on ECS-forwarding unless
3443	  always-forward.
3444
344518 September 2017: Wouter
3446	- tag 1.6.6 (is 1.6.6rc2)
3447	- Fix that looping modules always stop the query, and don't pass
3448	  control.
3449	- Fix #1435: Please allow UDP to be disabled separately upstream and
3450	  downstream.
3451	- Fix #1440: [dnscrypt] client nonce cache.
3452
345315 September 2017: Wouter
3454	- Fix unbound-host to report error for DNSSEC state of failed lookups.
3455	- Spelling fixes, from Josh Soref.
3456
345713 September 2017: Wouter
3458	- tag 1.6.6rc2, became 1.6.6 on 18 sep.  trunk 1.6.7 in development.
3459
346012 September 2017: Wouter
3461	- Add dns64 for client-subnet in unbound-checkconf.
3462
34634 September 2017: Ralph
3464	- Fix #1412: QNAME minimisation strict mode not honored
3465	- Fix #1434: Fix windows openssl 1.1.0 linking.
3466
34674 September 2017: Wouter
3468	- tag 1.6.6rc1
3469	- makedist fix for windows binaries, with openssl 1.1.0 windres fix,
3470	  and expat 2.2.4 install target fix.
3471
34721 September 2017: Wouter
3473	- Recommend 1472 buffer size in unbound.conf
3474
347531 August 2017: Wouter
3476	- Fix #1424: cachedb:testframe is not thread safe.
3477	- For #1417: escape ; in dnscrypt tests.
3478	- but reverted that, tests fails with that escape.
3479	- Fix #1417: [dnscrypt] shared secret cache counters, and works when
3480	  dnscrypt is not enabled.  And cache size configuration option.
3481	- make depend
3482	- Fix #1418: [ip ratelimit] initialize slabhash using
3483	  ip-ratelimit-slabs.
3484
348530 August 2017: Wouter
3486	- updated contrib/fastrpz.patch to apply with configparser changes.
3487	- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
3488
348929 August 2017: Wouter
3490	- Fix #1414: fix segfault on parse failure and log_replies.
3491	- zero qinfo in handle_request, this zeroes local_alias and also the
3492	  qname member.
3493	- new keys and certs for dnscrypt tests.
3494	- fixup WKS test on buildhost without servicebyname.
3495
349628 August 2017: Wouter
3497	- Fix #1415: patch to free dnscrypt environment on reload.
3498	- iana portlist update
3499	- Fix #1415: [dnscrypt] shared secret cache, patch from
3500	  Manu Bretelle.
3501	- Small fixes for the shared secret cache patch.
3502	- Fix WKS records on kvm autobuild host, with default protobyname
3503	  entries for udp and tcp.
3504
350523 August 2017: Wouter
3506	- Fix #1407: Add ECS options check to unbound-checkconf.
3507	- make depend
3508	- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
3509	  allocation failure.
3510
351122 August 2017: Wouter
3512	- Fix install of trust anchor when two anchors are present, makes both
3513	  valid. Checks hash of DS but not signature of new key. This fixes
3514	  the root.key file if created when unbound is installed between
3515	  sep11 and oct11 2017.
3516	- tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix).
3517	- trunk version 1.6.6 in development.
3518	- Fix issue on macOX 10.10 where TCP fast open is detected but not
3519	  implemented causing TCP to fail. The fix allows fallback to regular
3520	  TCP in this case and is also more robust for cases where connectx()
3521	  fails for some reason.
3522	- Fix #1402: squelch invalid argument error for fd_set_block on windows.
3523
352410 August 2017: Wouter
3525	- Patch to show DNSCrypt status in help output, from Carsten
3526	  Strotmann.
3527
35288 August 2017: Wouter
3529	- Fix #1398: make cachedb secret configurable.
3530	- Remove spaces from Makefile.
3531
35327 August 2017: Wouter
3533	- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
3534
35353 August 2017: Ralph
3536	- Remove unused iter_env member (ip6arpa_dname)
3537	- Do not reset rrset.bogus stats when called using stats_noreset.
3538	- Added stats for queries that have been ratelimited by domain
3539	  recursion.
3540	- Do not add rrset_bogus and query ratelimiting stats per thread, these
3541	  module stats are global.
3542
35433 August 2017: Wouter
3544	- Fix #1394: mix of serve-expired and response-ip could cause a crash.
3545
354624 July 2017: Wouter
3547	- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
3548	  config.sub(2016-09-05).
3549	- annotate case statement fallthrough for gcc 7.1.1.
3550	- flex output from flex 2.6.1.
3551	- snprintf of thread number does not warn about truncated string.
3552	- squelch TCP fast open error on FreeBSD when kernel has it disabled,
3553	  unless verbosity is high.
3554	- remove warning from windows compile.
3555	- Fix compile with libnettle
3556	- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
3557	- Fix #1365: Add Ed25519 support using libnettle.
3558	- iana portlist update
3559
356017 July 2017: Wouter
3561	- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
3562	- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
3563	  With the -p option unbound does not create a pidfile.
3564
356511 July 2017: Wouter
3566	- Fix #1344: RFC6761-reserved domains: test. and invalid.
3567	- Redirect all localhost names to localhost address for RFC6761.
3568
35696 July 2017: Wouter
3570	- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
3571	- Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists)..
3572
35734 July 2017: Wouter
3574	- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
3575
35763 July 2017: Wouter
3577	- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
3578	  on.
3579	- Fix #1331: libunbound segfault in threaded mode when context is
3580	  deleted.
3581	- Fix pythonmod link line option flag.
3582	- Fix openssl 1.1.0 load of ssl error strings from ssl init.
3583
358429 June 2017: Wouter
3585	- Fix python example0 return module wait instead of error for pass.
3586	- iana portlist update
3587	- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
3588	  security settings.
3589
359027 June 2017: Wouter
3591	- Tag 1.6.4 is created with the 1.6.4rc2 contents.
3592	- Trunk contains 1.6.5, with changes from 26, 27 june.
3593	- Remove signed unsigned warning from authzone.
3594	- Fix that infra cache host hash does not change after reconfig.
3595
359626 June 2017: Wouter
3597	- (for 1.6.5)
3598	  Better fixup of dnscrypt_cert_chacha test for different escapes.
3599	- First fix for zero b64 and hex text zone format in sldns.
3600	- unbound-control dump_infra prints port number for address if not 53.
3601
360223 June 2017: Wouter
3603	- (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
3604
360522 June 2017: Wouter
3606	- Tag 1.6.4rc2
3607
360822 June 2017: Ralph
3609	- Added fastrpz patch to contrib
3610
361121 June 2017: Wouter
3612	- Fix #1316: heap read buffer overflow in parse_edns_options.
3613
361420 June 2017: Wouter
3615	- Fix warning in pythonmod under clang compiler.
3616	- Tag 1.6.4rc1
3617	- Fix lintian typo.
3618
361916 June 2017: Ralph
3620	- Fix #1277: disable domain ratelimit by setting value to 0.
3621
362216 June 2017: Wouter
3623	- Fix #1301: memory leak in respip and tests.
3624	- Free callback in edns-subnetmod on exit and restart.
3625	- Fix memory leak in sldns_buffer_new_frm_data.
3626	- Fix memory leak in dnscrypt config read.
3627	- Fix dnscrypt chacha cert support ifdefs.
3628	- Fix dnscrypt chacha cert unit test escapes in grep.
3629	- Remove asynclook tests that cause test and purifier problems.
3630	- Fix to unlock view in view test.
3631
363215 June 2017: Wouter
3633	- Fix stub zone queries leaking to the internet for
3634	  harden-referral-path ns checks.
3635	- Fix query for refetch_glue of stub leaking to internet.
3636
363713 June 2017: Wouter
3638	- Fix #1279: Memory leak on reload when python module is enabled.
3639	- Fix #1280: Unbound fails assert when response from authoritative
3640	  contains malformed qname.  When 0x20 caps-for-id is enabled, when
3641	  assertions are not enabled the malformed qname is handled correctly.
3642	- 1.6.3 tag created, with only #1280 fix, trunk is 1.6.4 development.
3643	- More fixes in depth for buffer checks in 0x20 qname checks.
3644
364512 June 2017: Wouter
3646	- Fix #1278: Incomplete wildcard proof.
3647
36488 June 2017: Ralph
3649	- Added domain name based ECS whitelist.
3650
36518 June 2017: Wouter
3652	- Detect chacha for dnscrypt at configure time.
3653	- dnscrypt unit tests with chacha.
3654
36557 June 2017: Wouter
3656	- Fix that unbound-control can set val_clean_additional and val_permissive_mode.
3657	- Add dnscrypt XChaCha20 tests.
3658
36596 June 2017: Wouter
3660	- Add an explicit type cast for TCP FASTOPEN fix.
3661	- renumbering B-Root's IPv6 address to 2001:500:200::b.
3662	- Fix #1275: cached data in cachedb is never used.
3663	- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
3664
36651 June 2017: Ralph
3666	- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
3667	  (from Manu Bretelle).
3668
36691 June 2017: Wouter
3670	- Fix fastopen EPIPE fallthrough to perform connect.
3671
367231 May 2017: Ralph
3673	- Also use global local-zones when there is a matching view that does
3674	  not have any local-zone specified.
3675
367631 May 2017: Wouter
3677	- Fix #1273: cachedb.c doesn't compile with -Wextra.
3678	- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
3679
368030 May 2017: Ralph
3681	- Fix #1269: inconsistent use of built-in local zones with views.
3682	- Add defaults for new local-zone trees added to views using
3683	  unbound-control.
3684
368530 May 2017: Wouter
3686	- Support for openssl EVP_DigestVerify.
3687	- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
3688
368929 May 2017: Wouter
3690	- Fix assertion for low buffer size and big edns payload when worker
3691	  overrides udpsize.
3692
369326 May 2017: Ralph
3694	- Added redirect-bogus.patch to contrib directory.
3695
369626 May 2017: Wouter
3697	- Fix #1270: unitauth.c doesn't compile with higher warning level
3698	  and optimization
3699	- exec_prefix is by default equal to prefix.
3700	- printout localzone for duplicate local-zone warnings.
3701
370224 May 2017: Wouter
3703	- authzone cname chain, no rrset duplicates, wildcard doesn't change
3704	  rrsets added for cname chain.
3705
370623 May 2017: Wouter
3707	- first services/authzone check in, it compiles and reads and writes
3708	  zonefiles.
3709	- iana portlist update
3710
371122 May 2017: Wouter
3712	- Fix #1268: SIGSEGV after log_reopen.
3713
371418 May 2017: Wouter
3715	- Fix #1265 to use /bin/kill.
3716	- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
3717	  and compatibility with BoringSSL.
3718
371917 May 2017: Wouter
3720	- Fix #1265: contrib/unbound.service contains hardcoded path.
3721
372217 May 2017: George
3723	- Use qstate's region for IPSECKEY rrset (ipsecmod).
3724
372516 May 2017: George
3726	- Implemented opportunistic IPsec support module (ipsecmod).
3727	- Some whitespace fixup.
3728
372916 May 2017: Wouter
3730	- updated dependencies in the makefile.
3731	- document trust-anchor-signaling in example config file.
3732	- updated configure, dependencies and flex output.
3733	- better module memory lookup, fix of unbound-control shm names for
3734	  module memory printout of statistics.
3735	- Fix type AVC sldns rrdef.
3736
373712 May 2017: Wouter
3738	- Adjust servfail by iterator to not store in cache when serve-expired
3739	  is enabled, to avoid overwriting useful information there.
3740	- Fix queries for nameservers under a stub leaking to the internet.
3741
37429 May 2017: Ralph
3743	- Add 'c' to getopt() in testbound.
3744	- iana portlist update
3745
37468 May 2017: Wouter
3747	- Fix tcp-mss failure printout text.
3748	- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
3749	  connect limited tcp connections.  With the option tcp connections
3750	  can share the same source port (for different destinations).
3751
37522 May 2017: Ralph
3753	- Added mesh_add_sub to add detached mesh entries.
3754	- Use mesh_add_sub for key tag signaling query.
3755
37562 May 2017: Wouter
3757	- Added test for leak of stub information.
3758	- Fix sldns wire2str printout of RR type CAA tags.
3759	- Fix sldns int16_data parse.
3760	- Fix sldns parse and printout of TSIG RRs.
3761	- sldns SMIMEA and AVC definitions, same as getdns definitions.
3762
37631 May 2017: Wouter
3764	- Fix #1259: "--disable-ecdsa" argument overwritten
3765	  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
3766	- iana portlist update
3767	- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
3768	  and fix that 64bit getting installed in C:\Program Files (x86).
3769
377026 April 2017: Ralph
3771	- Implemented trust anchor signaling using key tag query.
3772
377326 April 2017: Wouter
3774	- Based on #1257: check parse limit before t increment in sldns RR
3775	  string parse routine.
3776
377724 April 2017: Wouter
3778	- unbound-checkconf -o allows query of dnstap config variables.
3779	  Also unbound-control get_option.  Also for dnscrypt.
3780	- trunk contains 1.6.3 version number (changes from 1.6.2 back from
3781	  when the 1.6.2rc1 tag has been created).
3782
378321 April 2017: Ralph
3784	- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
3785	- iana portlist update
3786
378718 April 2017: Ralph
3788	- Fix #1252: more indentation inconsistencies.
3789	- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
3790
379113 April 2017: Ralph
3792	- Added ECS unit test (from Manu Bretelle).
3793	- ECS documentation fix (from Manu Bretelle).
3794
379513 April 2017: Wouter
3796	- Fix #1250: inconsistent indentation in services/listen_dnsport.c.
3797	- tag for 1.6.2rc1
3798	- (for 1.6.3:) unbound.h exports the shm stats structures.  They use
3799	  type long long and no ifdefs, and ub_ before the typenames.
3800
380112 April 2017: Wouter
3802	- subnet mem value is available in shm, also when not enabled,
3803	  to make the struct easier to memmap by other applications,
3804	  independent of the configuration of unbound.
3805
380612 April 2017: Ralph
3807	- Fix #1247: unbound does not shorten source prefix length when
3808	  forwarding ECS.
3809	- Properly check for allocation failure in local_data_find_tag_datas.
3810	- Fix #1249: unbound doesn't return FORMERR to bogus ECS.
3811	- Set SHM ECS memory usage to 0 when module not loaded.
3812
381311 April 2017: Ralph
3814	- Display ECS module memory usage.
3815
381610 April 2017: Wouter
3817	- harden-algo-downgrade: no also makes unbound more lenient about
3818	  digest algorithms in DS records.
3819
382010 April 2017: Ralph
3821	- Remove ECS option after REFUSED answer.
3822	- Fix small memory leak in edns_opt_copy_alloc.
3823	- Respip dereference after NULL check.
3824	- Zero initialize addrtree allocation.
3825	- Use correct identifier for SHM destroy.
3826
38277 April 2017: George
3828	- Fix pythonmod for cb changes.
3829	- Some whitespace fixup.
3830
38317 April 2017: Ralph
3832	- Unlock view in respip unit test
3833
38346 April 2017: Ralph
3835	- Generalise inplace callback (de)registration
3836	- (de)register inplace callbacks for module id
3837	- No unbound-control set_option for ECS options
3838	- Deprecated client-subnet-opcode config option
3839	- Introduced client-subnet-always-forward config option
3840	- Changed max-client-subnet-ipv6 default to 56 (as in RFC)
3841	- Removed extern ECS config options
3842	- module_restart_next now calls clear on all following modules
3843	- Also create ECS module qstate on module_event_pass event
3844	- remove malloc from inplace_cb_register
3845
38466 April 2017: Wouter
3847	- Small fixup for documentation.
3848	- iana portlist update
3849	- Fix respip for braces when locks arent used.
3850	- Fix pythonmod for cb changes.
3851
38524 April 2017: Wouter
3853	- Fix #1244: document that use of chroot requires trust anchor file to
3854	  be under chroot.
3855	- iana portlist update
3856
38573 April 2017: Ralph
3858	- Do not add current time twice to TTL before ECS cache store.
3859	- Do not touch rrset cache after ECS cache message generation.
3860	- Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode.
3861
38623 April 2017: Wouter
3863	- Fix #1217: Add metrics to unbound-control interface showing
3864	  crypted, cert request, plaintext and malformed queries (from
3865	  Manu Bretelle).
3866	- iana portlist update
3867
386827 March 2017: Wouter
3869	- Remove (now unused) event2 include from dnscrypt code.
3870
387124 March 2017: George
3872	- Fix to prevent non-referal query from being cached as referal when the
3873	  no_cache_store flag was set.
3874
387523 March 2017: Wouter
3876	- Fix #1239: configure fails to find python distutils if python
3877	  prints warning.
3878
387922 March 2017: Wouter
3880	- Fix #1238: segmentation fault when adding through the remote
3881	  interface a per-view local zone to a view with no previous
3882	  (configured) local zones.
3883	- Fix #1229: Systemd service sandboxing, options in wrong sections.
3884
388521 March 2017: Ralph
3886	- Merge EDNS Client subnet implementation from feature branch into main
3887	  branch, using new EDNS processing framework.
3888
388921 March 2017: Wouter
3890	- Fix doxygen for dnscrypt files.
3891
389220 March 2017: Wouter
3893	- #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then
3894	  enabled in the config file from Manu Bretelle.
3895	- make depend, autoconf, remove warnings about statement before var.
3896	- lru_demote and lruhash_insert_or_retrieve functions for getdns.
3897	- fixup for lruhash (whitespace and header file comment).
3898	- dnscrypt tests.
3899
390017 March 2017: Wouter
3901	- Patch for view functionality for local-data-ptr from Björn Ketelaars.
3902	- Fix #1237 - Wrong resolving in chain, for norec queries that get
3903	  SERVFAIL returned.
3904
390516 March 2017: Wouter
3906	- Fix that SHM is not inited if not enabled.
3907	- Add trustanchor.unbound CH TXT that gets a response with a number
3908	  of TXT RRs with a string like "example.com. 2345 1234" with
3909	  the trust anchors and their keytags.
3910	- Fix that looped DNAMEs do not cause unbound to spend effort.
3911	- trustanchor tags are sorted.  reusable routine to fetch taglist.
3912
391313 March 2017: Wouter
3914	- testbound understands Deckard MATCH rcode question answer commands.
3915	- Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead
3916	  of YXDOMAIN + query loop, reported by Petr Spacek.
3917
391810 March 2017: Wouter
3919	- Fix #1234: shortening DNAME loop produces duplicate DNAME records
3920	  in ANSWER section.
3921
39229 March 2017: Wouter
3923	- --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and
3924	  DS records.  NSEC3 is not disabled.
3925	- fake-sha1 test option; print warning if used.  To make unit tests.
3926	- unbound-control list local zone and data commands listed in the
3927	  help output.
3928
39298 March 2017: Wouter
3930	- make depend for build dependencies.
3931	- swig version 2.0.1 required.
3932	- fix enum conversion warnings
3933
39347 March 2017: Wouter
3935	- Fix #1230: swig version 2.0.0 is required for pythonmod, with
3936	  1.3.40 it crashes when running repeatly unbound-control reload.
3937	- Response actions based on IP address from Jinmei Tatuya (Infoblox).
3938
39396 March 2017: Wouter
3940	- Fix #1229: Systemd service sandboxing in contrib/unbound.service.
3941	- iana portlist update
3942
394328 February 2017: Ralph
3944	- Fix testpkts.c, check if DO bit is set, not only if there is an OPT
3945	  record.
3946
394728 February 2017: Wouter
3948	- For #1227: if we have sha256, set the cipher list to have no
3949	  known vulns.
3950
395127 February 2017: Wouter
3952	- Fix #1227: Fix that Unbound control allows weak ciphersuits.
3953	- Fix #1226: provide official 32bit binary for windows.
3954
395524 February 2017: Wouter
3956	- include sys/time.h for new shm code on NetBSD.
3957
395823 February 2017: Wouter
3959	- Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to
3960	  redirect.
3961	- Patch from Luiz Fernando Softov for Stats Shared Memory.
3962	- unbound-control stats_shm command prints stats using shared memory,
3963	  which uses less cpu.
3964	- make depend, autoconf, doxygen and lint fixed up.
3965
396622 February 2017: Wouter
3967	- Fix #1224: Fix that defaults should not fall back to "Program Files
3968	  (x86) if Unbound is 64bit by default on windows.
3969
397021 February 2017: Wouter
3971	- iana portlist update
3972
397316 February 2017: Wouter
3974	- sldns updated for vfixed and buffer resize indication from getdns.
3975
397615 February 2017: Wouter
3977	- sldns has ED25519 and ED448 algorithm number and name for display.
3978
397914 February 2017: Wouter
3980	- tag 1.6.1rc3. -- which became 1.6.1 on 21feb, trunk has 1.6.2
3981
398213 February 2017: Wouter
3983	- Fix autoconf of systemd check for lack of pkg-config.
3984
398510 February 2017: Wouter
3986	- Fix pythonmod for typedef changes.
3987	- Fix dnstap for warning of set but not used.
3988	- tag 1.6.1rc2.
3989
39909 February 2017: Wouter
3991	- tag 1.6.1rc1.
3992
39938 February 2017: Wouter
3994	- Fix for type name change and fix warning on windows compile.
3995
39967 February 2017: Wouter
3997	- Include root trust anchor id 20326 in unbound-anchor.
3998
39996 February 2017: Wouter
4000	- Fix compile on solaris of the fix to use $host detect.
4001
40024 February 2017: Wouter
4003	- fix root_anchor test for updated icannbundle.pem lower certificates.
4004
400526 January 2017: Wouter
4006	- Fix 1211: Fix can't enable interface-automatic if no IPv6 with
4007	  more helpful error message.
4008
400920 January 2017: Wouter
4010	- Increase MAX_MODULE to 16.
4011
401219 January 2017: Wouter
4013	- Fix to Rename ub_callback_t to ub_callback_type, because POSIX
4014	  reserves _t typedefs.
4015	- Fix to rename internally used types from _t to _type, because _t
4016	  type names are reserved by POSIX.
4017	- iana portlist update
4018
401912 January 2017: Wouter
4020	- Fix to also block meta types 128 through to 248 with formerr.
4021	- Fix #1206: Some view-related commands are missing from 'unbound-control -h'
4022
40239 January 2017: Wouter
4024	- Fix #1202: Fix code comment that packed_rrset_data is not always
4025	  'packed'.
4026
40276 January 2017: Wouter
4028	- Fix #1201: Fix missing unlock in answer_from_cache error condition.
4029
40305 January 2017: Wouter
4031	- Fix to return formerr for queries for meta-types, to avoid
4032	  packet amplification if this meta-type is sent on to upstream.
4033	- Fix #1184: Log DNS replies. This includes the same logging
4034	  information that DNS queries and response code and response size,
4035	  patch from Larissa Feng.
4036	- Fix #1187: Source IP rate limiting, patch from Larissa Feng.
4037
40383 January 2017: Wouter
4039	- configure --enable-systemd and lets unbound use systemd sockets if
4040	  you enable use-systemd: yes in unbound.conf.
4041	  Also there are contrib/unbound.socket and contrib/unbound.service:
4042	  systemd files for unbound, install them in /usr/lib/systemd/system.
4043	  Contributed by Sami Kerola and Pavel Odintsov.
4044	- Fix reload chdir failure when also chrooted to that directory.
4045
40462 January 2017: Wouter
4047	- Fix #1194: Cross build fails when $host isn't `uname` for getentropy.
4048
404923 December 2016: Ralph
4050	- Fix #1190: Do not echo back EDNS options in local-zone error response.
4051	- iana portlist update
4052
405321 December 2016: Ralph
4054	- Fix #1188: Unresolved symbol 'fake_dsa' in libunbound.so when built
4055	  with Nettle
4056
405719 December 2016: Ralph
4058	- Fix #1191: remove comment about view deletion.
4059
406015 December 2016: Wouter
4061	- iana portlist update
4062	- 64bit is default for windows builds.
4063	- Fix inet_ntop and inet_pton warnings in windows compile.
4064
406514 December 2016: Wouter
4066	- Fix #1178: attempt to fix setup error at end, pop result values
4067	  at end of install.
4068
406913 December 2016: Wouter
4070	- Fix #1182: Fix Resource leak (socket), at startup.
4071	- Fix unbound-control and ipv6 only.
4072
40739 December 2016: Wouter
4074	- Fix #1176: stack size too small for Alpine Linux.
4075
40768 December 2016: Wouter
4077	- Fix downcast warnings from visual studio in sldns code.
4078	- tag 1.6.0rc1 which became 1.6.0 on 15 dec, and trunk is 1.6.1.
4079
40807 December 2016: Ralph
4081	- Add DSA support for OpenSSL 1.1.0
4082	- Fix remote control without cert for LibreSSL
4083
40846 December 2016: George
4085	- Added generic EDNS code for registering known EDNS option codes,
4086	  bypassing the cache response stage and uniquifying mesh states. Four EDNS
4087	  option lists were added to module_qstate (module_qstate.edns_opts_*) to
4088	  store EDNS options from/to front/back side.
4089	- Added two flags to module_qstate (no_cache_lookup, no_cache_store) that
4090	  control the modules' cache interactions.
4091	- Added code for registering inplace callback functions. The registered
4092	  functions can be called just before replying with local data or Chaos,
4093	  replying from cache, replying with SERVFAIL, replying with a resolved
4094	  query, sending a query to a nameserver. The functions can inspect the
4095	  available data and maybe change response/query related data (i.e. append
4096	  EDNS options).
4097	- Updated Python module for the above.
4098	- Updated Python documentation.
4099
41005 December 2016: Ralph
4101	- Fix #1173: differ local-zone type deny from unset
4102	  tag_actions element.
4103
41045 December 2016: Wouter
4105	- Fix #1170: document that 'inform' local-zone uses local-data.
4106
41071 December 2016: Ralph
4108	- hyphen as minus fix, by Andreas Schulze
4109
411030 November 2016: Ralph
4111	- Added local-zones and local-data bulk addition and removal
4112	  functionality in unbound-control (local_zones, local_zones_remove,
4113	  local_datas and local_datas_remove).
4114	- iana portlist update
4115
411629 November 2016: Wouter
4117	- version 1.6.0 is in the development branch.
4118	- braces in view.c around lock statements.
4119
412028 November 2016: Wouter
4121	- new install-sh.
4122
412325 November 2016: Wouter
4124	- Fix that with openssl 1.1 control-use-cert: no uses less cpu, by
4125	  using no encryption over the unix socket.
4126
412722 Novenber 2016: Ralph
4128	- Make access-control-tag-data RDATA absolute. This makes the RDATA
4129	  origin consistent between local-data and access-control-tag-data.
4130	- Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
4131	  subdomain of the NSEC owner.
4132	- QNAME minimisation uses QTYPE=A, therefore always check cache for
4133	  this type in harden-below-nxdomain functionality.
4134	- Added unit test for QNAME minimisation + harden below nxdomain
4135	  synergy.
4136
413722 November 2016: Wouter
4138	- iana portlist update.
4139	- Fix unit tests for DS hash processing for fake-dsa test option.
4140	- patch from Dag-Erling Smorgrav that removes code that relies
4141	  on sbrk().
4142
414321 November 2016: Wouter
4144	- Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
4145	  Underneath" for the harden-below-nxdomain option.
4146
414710 November 2016: Ralph
4148	- Fix #1155: test status code of unbound-control in 04-checkconf,
4149	  not the status code from the tee command.
4150
41514 November 2016: Ralph
4152	- Added stub-ssl-upstream and forward-ssl-upstream options.
4153
41544 November 2016: Wouter
4155	- configure detects ssl security level API function in the autoconf
4156	  manner.  Every function on its own, so that other libraries (eg.
4157	  LibreSSL) can develop their API without hindrance.
4158	- Fix #1154: segfault when reading config with duplicate zones.
4159	- Note that for harden-below-nxdomain the nxdomain must be secure,
4160	  this means nsec3 with optout is insufficient.
4161
41623 November 2016: Ralph
4163	- Set OpenSSL security level to 0 when using aNULL ciphers.
4164
41653 November 2016: Wouter
4166	- .gitattributes line for githubs code language display.
4167	- log-identity: config option to set sys log identity, patch from
4168	  "Robin H. Johnson" <robbat2@gentoo.org>
4169
41702 November 2016: Wouter
4171	- iana portlist update.
4172
417331 October 2016: Wouter
4174	- Fix failure to build on arm64 with no sbrk.
4175	- iana portlist update.
4176
417728 October 2016: Wouter
4178	- Patch for server.num.zero_ttl stats for count of expired replies,
4179	  from Pavel Odintsov.
4180
418126 October 2016: Wouter
4182	- Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled
4183	  with the undocumented switch 'fake-dsa'.  It logs a warning.
4184
418525 October 2016: Wouter
4186	- Fix #1134: unbound-control set_option -- val-override-date: -1 works
4187	  immediately to ignore datetime, or back to 0 to enable it again.
4188	  The -- is to ignore the '-1' as an option flag.
4189
419024 October 2016: Wouter
4191	- serve-expired config option: serve expired responses with TTL 0.
4192	- g.root-servers.net has AAAA address.
4193
419421 October 2016: Wouter
4195	- Ported tests for local_cname unit test to testbound framework.
4196
419720 October 2016: Wouter
4198	- suppress compile warning in lex files.
4199	- init lzt variable, for older gcc compiler warnings.
4200	- fix --enable-dsa to work, instead of copying ecdsa enable.
4201	- Fix DNSSEC validation of query type ANY with DNAME answers.
4202	- Fixup query_info local_alias init.
4203
420419 October 2016: Wouter
4205	- Fix #1130: whitespace in example.conf.in more consistent.
4206
420718 October 2016: Wouter
4208	- Patch that resolves CNAMEs entered in local-data conf statements that
4209	  point to data on the internet, from Jinmei Tatuya (Infoblox).
4210	- Removed patch comments from acllist.c and msgencode.c
4211	- Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf,
4212	  from Jinmei Tatuya (Infoblox).
4213	- Fix #1125: unbound could reuse an answer packet incorrectly for
4214	  clients with different EDNS parameters, from Jinmei Tatuya.
4215	- Fix #1118: libunbound.pc sets strange Libs, Libs.private values.
4216	- Added Requires line to libunbound.pc
4217	- Please doxygen by modifying mesh.h
4218
421917 October 2016: Wouter
4220	- Re-fix #839 from view commit overwrite.
4221	- Fixup const void cast warning.
4222
422312 October 2016: Ralph
4224	- Free view config elements.
4225
422611 October 2016: Ralph
4227	- Added qname-minimisation-strict config option.
4228	- iana portlist update.
4229	- fix memoryleak logfile when in debug mode.
4230
42315 October 2016: Ralph
4232	- Added views functionality.
4233	- Fix #1117: spelling errors, from Robert Edmonds.
4234
423530 September 2016: Wouter
4236	- Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.
4237
423829 September 2016: Wouter
4239	- Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
4240	- Fix #839: Memory grows unexpectedly with large RPZ files.
4241	- Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile.
4242	- Fix #841: big local-zone's make it consume large amounts of memory.
4243
424427 September 2016: Wouter
4245	- tag for 1.5.10 release
4246	- trunk contains 1.5.11 in development.
4247	- Fix dnstap relaying "random" messages instead of resolver/forwarder
4248	  responses, from Nikolay Edigaryev.
4249	- Fix #836: unbound could echo back EDNS options in an error response.
4250
425120 September 2016: Wouter
4252	- iana portlist update.
4253	- Fix #835: fix --disable-dsa with nettle verify.
4254	- tag for 1.5.10rc1 release.
4255
425615 September 2016: Wouter
4257	- Fix 883: error for duplicate local zone entry.
4258	- Test for openssl init_crypto and init_ssl functions.
4259
426015 September 2016: Ralph
4261	- fix potential memory leak in daemon/remote.c and nullpointer
4262	  dereference in validator/autotrust.
4263	- iana portlist update.
4264
426513 September 2016: Wouter
4266	- Silenced flex-generated sign-unsigned warning print with gcc
4267	  diagnostic pragma.
4268	- Fix for new splint on FreeBSD.  Fix cast for sockaddr_un.sun_len.
4269
42709 September 2016: Wouter
4271	- Fix #831: workaround for spurious fread_chk warning against petal.c
4272
42735 September 2016: Ralph
4274	- Take configured minimum TTL into consideration when reducing TTL
4275	  to original TTL from RRSIG.
4276
42775 September 2016: Wouter
4278	- Fix #829: doc of sldns_wire2str_rdata_buf() return value has an
4279	  off-by-one typo, from Jinmei Tatuya (Infoblox).
4280	- Fix incomplete prototypes reported by Dag-Erling Smørgrav.
4281	- Fix #828: missing type in access-control-tag-action redirect results
4282	  in NXDOMAIN.
4283
42842 September 2016: Wouter
4285	- Fix compile with openssl 1.1.0 with api=1.1.0.
4286
42871 September 2016: Wouter
4288	- RFC 7958 is now out, updated docs for unbound-anchor.
4289	- Fix for compile without warnings with openssl 1.1.0.
4290	- Fix #826: Fix refuse_non_local could result in a broken response.
4291	- iana portlist update.
4292
429329 August 2016: Wouter
4294	- Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A.
4295	  Siewior.
4296	- Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
4297
429825 August 2016: Ralph
4299	- Clarify local-zone-override entry in unbound.conf.5
4300
430125 August 2016: Wouter
4302	- 64bit build option for makedist windows compile, -w64.
4303
430424 August 2016: Ralph
4305	- Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter
4306	  in each iteration in find_tag_datas().
4307	- unbound.conf.5 entries for define-tag, access-control-tag,
4308	  access-control-tag-action, access-control-tag-data, local-zone-tag,
4309	  and local-zone-override.
4310
431123 August 2016: Wouter
4312	- Fix #804: unbound stops responding after outage.  Fixes queries
4313	  that attempt to wait for an empty list of subqueries.
4314	- Fix #804: lower num_target_queries for iterator also for failed
4315	  lookups.
4316
43178 August 2016: Wouter
4318	- Note that OPENPGPKEY type is RFC 7929.
4319
43204 August 2016: Wouter
4321	- Fix #807: workaround for possible some "unused" function parameters
4322	  in test code, from Jinmei Tatuya.
4323
43243 August 2016: Wouter
4325	- use sendmsg instead of sendto for TFO.
4326
432728 July 2016: Wouter
4328	- Fix #806: wrong comment removed.
4329
433026 July 2016: Wouter
4331	- nicer ratelimit-below-domain explanation.
4332
433322 July 2016: Wouter
4334	- Fix #801: missing error condition handling in
4335	  daemon_create_workers().
4336	- Fix #802: workaround for function parameters that are "unused"
4337	  without log_assert.
4338	- Fix #803: confusing (and incorrect) code comment in daemon_cleanup().
4339
434020 July 2016: Wouter
4341	- Fix typo in unbound.conf.
4342
434318 July 2016: Wouter
4344	- Fix #798: Client-side TCP fast open fails (Linux).
4345
434614 July 2016: Wouter
4347	- TCP Fast open patch from Sara Dickinson.
4348	- Fixed unbound.doxygen for 1.8.11.
4349
43507 July 2016: Wouter
4351	- access-control-tag-data implemented. verbose(4) prints tag debug.
4352
43535 July 2016: Wouter
4354	- Fix dynamic link of anchor-update.exe on windows.
4355	- Fix detect of mingw for MXE package build.
4356	- Fixes for 64bit windows compile.
4357	- Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and
4358	  --with-libunbound-only --with-nettle.
4359
43604 July 2016: Wouter
4361	- For #787: prefer-ip6 option for unbound.conf prefers to send
4362	  upstream queries to ipv6 servers.
4363	- Fix #787: outgoing-interface netblock/64 ipv6 option to use linux
4364	  freebind to use 64bits of entropy for every query with random local
4365	  part.
4366
436730 June 2016: Wouter
4368	- Document always_transparent, always_refuse, always_nxdomain types.
4369
437029 June 2016: Wouter
4371	- Fix static compile on windows missing gdi32.
4372
437328 June 2016: Wouter
4374	- Create a pkg-config file for libunbound in contrib.
4375
437627 June 2016: Wouter
4377	- Fix #784: Build configure assumess that having getpwnam means there
4378	  is endpwent function available.
4379	- Updated repository with newer flex and bison output.
4380
438124 June 2016: Ralph
4382	- Possibility to specify local-zone type for an acl/tag pair
4383	- Possibility to specify (override) local-zone type for a source address
4384	  block
438516 June 2016: Ralph
4386	- Decrease dp attempts at each QNAME minimisation iteration
4387
438816 June 2016: Wouter
4389	- Fix tcp timeouts in tv.usec.
4390
439115 June 2016: Wouter
4392	- TCP_TIMEOUT is specified in milliseconds.
4393	- If more than half of tcp connections are in use, a shorter timeout
4394	  is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
4395
439614 June 2016: Ralph
4397	- QNAME minimisation unit test for dropped QTYPE=A queries.
4398
439914 June 2016: Wouter
4400	- Fix 775: unbound-host and unbound-anchor crash on windows, ignore
4401	  null delete for wsaevent.
4402	- Fix spelling in freebind option man page text.
4403	- Fix windows link of ssl with crypt32.
4404	- Fix 779: Union casting is non-portable.
4405	- Fix 780: MAP_ANON not defined in HP-UX 11.31.
4406	- Fix 781: prealloc() is an HP-UX system library call.
4407
440813 June 2016: Ralph
4409	- Use QTYPE=A for QNAME minimisation.
4410	- Keep track of number of time-outs when performing QNAME minimisation.
4411	  Stop minimising when number of time-outs for a QNAME/QTYPE pair is
4412	  more than three.
4413
441413 June 2016: Wouter
4415	- Fix #778: unbound 1.5.9: -h segfault (null deref).
4416	- Fix directory: fix for unbound-checkconf, it restores cwd.
4417
441810 June 2016: Wouter
4419	- And delete service.conf.shipped on uninstall.
4420	- In unbound.conf directory: dir immediately changes to that directory,
4421	  so that include: file below that is relative to that directory.
4422	  With chroot, make the directory an absolute path inside chroot.
4423	- keep debug symbols in windows build.
4424	- do not delete service.conf on windows uninstall.
4425	- document directory immediate fix and allow EXECUTABLE syntax in it
4426	  on windows.
4427
44289 June 2016: Wouter
4429	- Trunk is called 1.5.10 (with previous fixes already in there to 2
4430	  june).
4431	- Revert fix for NetworkService account on windows due to breakage
4432	  it causes.
4433	- Fix that windows install will not overwrite existing service.conf
4434	  file (and ignore gui config choices if it exists).
4435
44367 June 2016: Ralph
4437	- Lookup localzones by taglist from acl.
4438	- Possibility to lookup local_zone, regardless the taglist.
4439	- Added local_zone/taglist/acl unit test.
4440
44417 June 2016: Wouter
4442	- Fix #773: Non-standard Python location build failure with pyunbound.
4443	- Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
4444
44456 June 2016: Wouter
4446	- Better help text from -h (from Ray Griffith).
4447	- access-control-tag config directive.
4448	- local-zone-override config directive.
4449	- access-control-tag-action and access-control-tag-data config
4450	  directives.
4451	- free acl-tags, acltag-action and acltag-data config lists during
4452	  initialisation to free up memory for more entries.
4453
44543 June 2016: Wouter
4455	- Fix to not ignore return value of chown() in daemon startup.
4456
44572 June 2016: Wouter
4458	- Fix libubound for edns optlist feature.
4459	- Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc.
4460	- Fix #752: retry resource temporarily unavailable on control pipe.
4461	- un-document localzone tags.
4462	- tag for release 1.5.9rc1.
4463	  And this also became release 1.5.9.
4464	- Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to
4465	  Program Files with (x86) appended.
4466	- re-documented localzone tags in example.conf.
4467
446831 May 2016: Wouter
4469	- Fix windows service to be created run with limited rights, as a
4470	  network service account, from Mario Turschmann.
4471	- compat strsep implementation.
4472	- generic edns option parse and store code.
4473	- and also generic edns options for upstream messages (and replies).
4474	  after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID),
4475	  to insert use edns_opt_append(edns, region, code, len, bindata) on
4476	  the opt_list passed to send_query, or in edns_opt_inplace_reply.
4477
447830 May 2016: Wouter
4479	- Fix time in case answer comes from cache in ub_resolve_event().
4480	- Attempted fix for #765: _unboundmodule missing for python3.
4481
448227 May 2016: Wouter
4483	- Fix #770: Small subgroup attack on DH used in unix pipe on localhost
4484	  if unbound control uses a unix local named pipe.
4485	- Document write permission to directory of trust anchor needed.
4486	- Fix #768:  Unbound Service Sometimes Can Not Shutdown
4487	  Completely, WER Report Shown Up.  Close handle before closing WSA.
4488
448926 May 2016: Wouter
4490	- Updated patch from Charles Walker.
4491
449224 May 2016: Wouter
4493	- disable-dnssec-lame-check config option from Charles Walker.
4494	- remove memory leak from lame-check patch.
4495	- iana portlist update.
4496
449723 May 2016: Wouter
4498	- Fix #767:  Reference to an expired Internet-Draft in
4499	  harden-below-nxdomain documentation.
4500
450120 May 2016: Ralph
4502	- No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC
4503	  signed zones.
4504	- iana portlist update.
4505
450619 May 2016: Wouter
4507	- Fix #766: dns64 should synthesize results on timeout/errors.
4508
450918 May 2016: Wouter
4510	- Fix #761: DNSSEC LAME false positive resolving nic.club.
4511
451217 May 2016: Wouter
4513	- trunk updated with output of flex 2.6.0.
4514
45156 May 2016: Wouter
4516	- Fix memory leak in out-of-memory conditions of local zone add.
4517
451829 April 2016: Wouter
4519	- Fix sldns with static checking fixes copied from getdns.
4520
452128 April 2016: Wouter
4522	- Fix #759: 0x20 capsforid no longer checks type PTR, for
4523	  compatibility with cisco dns guard.  This lowers false positives.
4524
452518 April 2016: Wouter
4526	- Fix some malformed responses to edns queries get fallback to nonedns.
4527
452815 April 2016: Wouter
4529	- cachedb module event handling design.
4530
453114 April 2016: Wouter
4532	- cachedb module framework (empty).
4533	- iana portlist update.
4534
453512 April 2016: Wouter
4536	- Fix #753: document dump_requestlist is for first thread.
4537
453824 March 2016: Wouter
4539	- Document permit-small-holddown for 5011 debug.
4540	- Fix #749: unbound-checkconf gets SIGSEGV when use against a
4541	  malformatted conf file.
4542
454323 March 2016: Wouter
4544	- OpenSSL 1.1.0 portability, --disable-dsa configure option.
4545
454621 March 2016: Wouter
4547	- Fix compile of getentropy_linux for SLES11 servicepack 4.
4548	- Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev.
4549	- Fix test for openssl to use HMAC_Update for 1.1.0.
4550	- acx_nlnetlabs.m4 to v33, with HMAC_Update.
4551	- acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto.
4552	- ERR_remove_state deprecated since openssl 1.0.0.
4553	- OPENSSL_config is deprecated, removing.
4554
455518 March 2016: Ralph
4556	- Validate QNAME minimised NXDOMAIN responses.
4557	- If QNAME minimisation is enabled, do cache lookup for QTYPE NS in
4558	  harden-below-nxdomain.
4559
456017 March 2016: Ralph
4561	- Limit number of QNAME minimisation iterations.
4562
456317 March 2016: Wouter
4564	- Fix #746: Fix unbound sets CD bit on all forwards.
4565	  If no trust anchors, it'll not set CD bit when forwarding to another
4566	  server.  If a trust anchor, no CD bit on the first attempt to a
4567	  forwarder, but CD bit thereafter on repeated attempts to get DNSSEC.
4568	- iana portlist update.
4569
457016 March 2016: Wouter
4571	- Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma.
4572	- Fix ip-transparent for tcp on freebsd.
4573
457415 March 2016: Wouter
4575	- ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for
4576	  binding to an IP address while the interface or address is down.
4577
457814 March 2016: Wouter
4579	- Fix warnings in ifdef corner case, older or unknown libevent.
4580	- Fix compile for ub_event code with older libev.
4581
458211 March 2016: Wouter
4583	- Remove warning about unused parameter in event_pluggable.c.
4584	- Fix libev usage of dispatch return value.
4585	- No side effects in tolower() call, in case it is a macro.
4586	- For test put free in pluggable api in parenthesis.
4587
458810 March 2016: Wouter
4589	- Fixup backend2str for libev.
4590
459109 March 2016: Willem
4592	- User defined pluggable event API for libunbound
4593	- Fixup of compile fix for pluggable event API from P.Y. Adi
4594	  Prasaja.
4595
459609 March 2016: Wouter
4597	- Updated configure and ltmain.sh.
4598	- Updated L root IPv6 address.
4599
460007 March 2016: Wouter
4601	- Fix #747: assert in outnet_serviced_query_stop.
4602	- iana ports fetched via https.
4603	- iana portlist update.
4604
460503 March 2016: Wouter
4606	- configure tests for the weak attribute support by the compiler.
4607
460802 March 2016: Wouter
4609	- 1.5.8 release tag
4610	- trunk contains 1.5.9 in development.
4611	- iana portlist update.
4612	- Fix #745: unbound.py - idn2dname throws UnicodeError when idnname
4613	  contains trailing dot.
4614
461524 February 2016: Wouter
4616	- Fix OpenBSD asynclook lock free that gets used later (fix test code).
4617	- Fix that NSEC3 negative cache is used when there is no salt.
4618
461923 February 2016: Wouter
4620	- ub_ctx_set_stub() function for libunbound to config stub zones.
4621	- sorted ubsyms.def file with exported libunbound functions.
4622
462319 February 2016: Wouter
4624	- Print understandable debug log when unusable DS record is seen.
4625	- load gost algorithm if digest is seen before key algorithm.
4626	- iana portlist update.
4627
462817 February 2016: Wouter
4629	- Fix that "make install" fails due to "text file busy" error.
4630
463116 February 2016: Wouter
4632	- Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
4633
463415 February 2016: Wouter
4635	- ip-transparent option for FreeBSD with IP_BINDANY socket option.
4636	- wait for sendto to drain socket buffers when they are full.
4637
46389 February 2016: Wouter
4639	- Test for type OPENPGPKEY.
4640	- insecure-lan-zones: yesno config option, patch from Dag-Erling
4641	  Smørgrav.
4642
46438 February 2016: Wouter
4644	- Fix patch typo in prevuous commit for 734 from Adi Prasaja.
4645	- RR Type CSYNC support RFC 7477, in debug printout and config input.
4646	- RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
4647
464829 January 2016: Wouter
4649	- Neater cmdline_verbose increment patch from Edgar Pettijohn.
4650
465127 January 2016: Wouter
4652	- Made netbsd sendmsg test nonfatal, in case of false positives.
4653	- Fix #741: log message for dnstap socket connection is more clear.
4654
465526 January 2016: Wouter
4656	- Fix #734: chown the pidfile if it resides inside the chroot.
4657	- Use arc4random instead of random in tests (because it is
4658	  available, possibly as compat, anyway).
4659	- Fix cmsg alignment for argument to sendmsg on NetBSD.
4660	- Fix that unbound complains about unimplemented IP_PKTINFO for
4661	  sendmsg on NetBSD (for interface-automatic).
4662
466325 January 2016: Wouter
4664	- Fix #738: Swig should not be invoked with CPPFLAGS.
4665
466619 January 2016: Wouter
4667	- Squelch 'cannot assign requested address' log messages unless
4668	  verbosity is high, it was spammed after network down.
4669
467014 January 2016: Wouter
4671	- Fix to simplify empty string checking from Michael McConville.
4672	- iana portlist update.
4673
467412 January 2016: Wouter
4675	- Fix #734: Do not log an error when the PID file cannot be chown'ed.
4676	  Patch from Simon Deziel.
4677
467811 January 2016: Wouter
4679	- Fix test if -pthreads unused to use better grep for portability.
4680
468106 January 2016: Wouter
4682	- Fix mingw crosscompile for recent mingw.
4683	- Update aclocal, autoconf output with new versions (1.15, 2.4.6).
4684
468505 January 2016: Wouter
4686	- #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch
4687	  from Daisuke Higashi.
4688	- Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
4689	  by default, and can be unblocked with "nodefault" localzone config.
4690
469104 January 2016: Wouter
4692	- Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
4693	  for Linux glibc 2.20.
4694	- Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
4695	  source code, so it applies cleanly again.  Removed unused variable
4696	  warnings.
4697
469815 December 2015: Ralph
4699	- Fix #729: omit use of escape sequences in echo since they are not
4700	  portable (unbound-control-setup).
4701
470211 December 2015: Wouter
4703	- remove NULL-checks before free, patch from Michael McConville.
4704	- updated ax_pthread.m4 to version 21 with clang support, this
4705	  removes a warning from compilation.
4706	- OSX portability, detect if sbrk is deprecated.
4707	- OSX clang, stop -pthread unused during link stage warnings.
4708	- OSX clang new flto check.
4709
471010 December 2015: Wouter
4711	- 1.5.7 release
4712	- trunk has 1.5.8 in development.
4713
47148 December 2015: Wouter
4715	- Fixup 724 for unbound-control.
4716
47177 December 2015: Ralph
4718	- Do not minimise forwarded requests.
4719
47204 December 2015: Wouter
4721	- Removed unneeded whitespace from example.conf.
4722
47233 December 2015: Ralph
4724	- (after rc1 tag)
4725	- Committed fix to qname minimisation and unit test case for it.
4726
47273 December 2015: Wouter
4728	- iana portlist update.
4729	- 1.5.7rc1 prerelease tag.
4730
47312 December 2015: Wouter
4732	- Fixup 724: Fix PCA prompt for unbound-service-install.exe.
4733	  re-enable stdout printout.
4734	- For 724: Add Changelog to windows binary dist.
4735
47361 December 2015: Ralph
4737	- Qname minimisation review fixes
4738
47391 December 2015: Wouter
4740	- Fixup 724 fix for fname_after_chroot() calls.
4741	- Remove stdout printout for unbound-service-install.exe
4742	- .gitignore for git users.
4743
474430 November 2015: Ralph
4745	- Implemented qname minimisation
4746
474730 November 2015: Wouter
4748	- Fix for #724: conf syntax to read files from run dir (on Windows).
4749
475025 November 2015: Wouter
4751	- Fix for #720, fix unbound-control-setup windows batch file.
4752
475324 November 2015: Wouter
4754	- Fix #720: add windows scripts to zip bundle.
4755	- iana portlist update.
4756
475720 November 2015: Wouter
4758	- Added assert on rrset cache correctness.
4759	- Fix that malformed EDNS query gets a response without malformed EDNS.
4760
476118 November 2015: Wouter
4762	- newer acx_nlnetlabs.m4.
4763	- spelling fixes from Igor Sobrado Delgado.
4764
476517 November 2015: Wouter
4766	- Fix #594. libunbound: optionally use libnettle for crypto.
4767	  Contributed by Luca Bruno.  Added --with-nettle for use with
4768	  --with-libunbound-only.
4769	- refactor nsec3 hash implementation to be more library-portable.
4770	- iana portlist update.
4771	- Fixup DER encoded DSA signatures for libnettle.
4772
477316 November 2015: Wouter
4774	- Fix for lenient accept of reverse order DNAME and CNAME.
4775
47766 November 2015: Wouter
4777	- Change example.conf: ftp.internic.net to https://www.internic.net
4778
47795 November 2015: Wouter
4780	- ACX_SSL_CHECKS no longer adds -ldl needlessly.
4781
47823 November 2015: Wouter
4783	- Fix #718: Fix unbound-control-setup with support for env
4784	  without HEREDOC bash support.
4785
478629 October 2015: Wouter
4787	- patch from Doug Hogan for SSL_OP_NO_SSLvx options.
4788	- Fix #716: nodata proof with empty non-terminals and wildcards.
4789
479028 October 2015: Wouter
4791	- Fix checklock testcode for linux threads on exit.
4792
479327 October 2015: Wouter
4794	- isblank() compat implementation.
4795	- detect libexpat without xml_StopParser function.
4796	- portability fixes.
4797	- portability, replace snprintf if return value broken.
4798
479923 October 2015: Wouter
4800	- Fix #714: Document config to block private-address for IPv4
4801	  mapped IPv6 addresses.
4802
480322 October 2015: Wouter
4804	- Fix #712: unbound-anchor appears to not fsync root.key.
4805
480620 October 2015: Wouter
4807	- 1.5.6 release.
4808	- trunk tracks development of 1.5.7.
4809
481015 October 2015: Wouter
4811	- Fix segfault in the dns64 module in the formaterror error path.
4812	- Fix sldns_wire2str_rdata_scan for malformed RRs.
4813	- tag for 1.5.6rc1 release.
4814
481514 October 2015: Wouter
4816	- ANY responses include DNAME records if present, as per Evan Hunt's
4817	  remark in dnsop.
4818	- Fix manpage to suggest using SIGTERM to terminate the server.
4819
48209 October 2015: Wouter
4821	- Default for ssl-port is port 853, the temporary port assignment
4822	  for secure domain name system traffic.
4823	  If you used to rely on the older default of port 443, you have
4824	  to put a clause in unbound.conf for that.  The new value is likely
4825	  going to be the standardised port number for this traffic.
4826	- iana portlist update.
4827
48286 October 2015: Wouter
4829	- 1.5.5 release.
4830	- trunk tracks the development of 1.5.6.
4831
483228 September 2015: Wouter
4833	- MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution
4834	  failures.
4835	- tag for 1.5.5rc1 release.
4836	- makedist.sh: pgp sig echo commands.
4837
483825 September 2015: Wouter
4839	- Fix unbound-control flush that does not succeed in removing data.
4840
484122 September 2015: Wouter
4842	- Fix config globbed include chroot treatment, this fixes reload of
4843	  globs (patch from Dag-Erling Smørgrav).
4844	- iana portlist update.
4845	- Fix #702: New IPs for for h.root-servers.net.
4846	- Remove confusion comment from canonical_compare() function.
4847	- Fix #705: ub_ctx_set_fwd() return value mishandled on windows.
4848	- testbound selftest also works in non-debug mode.
4849	- Fix minor error in unbound.conf.5.in
4850	- Fix unbound.conf(5) access-control description for precedence
4851	  and default.
4852
485331 August 2015: Wouter
4854	- changed windows setup compression to be more transparent.
4855
485628 August 2015: Wouter
4857	- Fix #697: Get PY_MAJOR_VERSION failure at configure for python
4858	  2.4 to 2.6.
4859	- Feature #699: --enable-pie option to that builds PIE binary.
4860	- Feature #700: --enable-relro-now option that enables full read-only
4861	  relocation.
4862
486324 August 2015: Wouter
4864	- Fix deadlock for local data add and zone add when unbound-control
4865	  list_local_data printout is interrupted.
4866	- iana portlist update.
4867	- Change default of harden-algo-downgrade to off.  This is lenient
4868	  for algorithm rollover.
4869
487013 August 2015: Wouter
4871	- 5011 implementation does not insist on all algorithms, when
4872	  harden-algo-downgrade is turned off.
4873	- Reap the child process that libunbound spawns.
4874
487511 August 2015: Wouter
4876	- Fix #694: configure script does not detect LibreSSL 2.2.2
4877
48784 August 2015: Wouter
4879	- Document that local-zone nodefault matches exactly and transparent
4880	  can be used to release a subzone.
4881
48823 August 2015: Wouter
4883	- Document in the manual more text about configuring locally served
4884	  zones.
4885	- Fix 5011 anchor update timer after reload.
4886	- Fix mktime in unbound-anchor not using UTC.
4887
488830 July 2015: Wouter
4889	- please afl-gcc (llvm) for uninitialised variable warning.
4890	- Added permit-small-holddown config to debug fast 5011 rollover.
4891
489224 July 2015: Wouter
4893	- Fix #690: Reload fails when so-reuseport is yes after changing
4894	  num-threads.
4895	- iana portlist update.
4896
489721 July 2015: Wouter
4898	- Fix configure to detect SSL_CTX_set_ecdh_auto.
4899	- iana portlist update.
4900
490120 July 2015: Wouter
4902	- Enable ECDHE for servers.  Where available, use
4903	  SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to
4904	  enable ECDHE.  Otherwise, manually offer curve p256.
4905	  Client connections should automatically use ECDHE when available.
4906	  (thanks Daniel Kahn Gillmor)
4907
490818 July 2015: Willem
4909	- Allow certificate chain files to allow for intermediate certificates.
4910	  (thanks Daniel Kahn Gillmor)
4911
491213 July 2015: Wouter
4913	- makedist produces sha1 and sha256 files for created binaries too.
4914
49159 July 2015: Wouter
4916	- 1.5.4 release tag
4917	- trunk has 1.5.5 in development.
4918	- Fix #681: Setting forwarders with unbound-control forward
4919	  implicitly turns on forward-first.
4920
492129 June 2015: Wouter
4922	- iana portlist update.
4923	- Fix alloc with log for allocation size checks.
4924
492526 June 2015: Wouter
4926	- Fix #677 Fix DNAME responses from cache that failed internal chain
4927	  test.
4928	- iana portlist update.
4929
493022 June 2015: Wouter
4931	- Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly
4932	  and was therefore always synthesized (thanks to Valentin Dietrich).
4933
49344 June 2015: Wouter
4935	- RFC 7553 RR type URI support, is now enabled by default.
4936
49372 June 2015: Wouter
4938	- Fix #674: Do not free pointers given by getenv.
4939
494029 May 2015: Wouter
4941	- Fix that unparseable error responses are ratelimited.
4942	- SOA negative TTL is capped at minimumttl in its rdata section.
4943	- cache-max-negative-ttl config option, default 3600.
4944
494526 May 2015: Wouter
4946	- Document that ratelimit works with unbound-control set_option.
4947
494821 May 2015: Wouter
4949	- iana portlist update.
4950	- documentation proposes ratelimit of 1000 (closer to what upstream
4951	  servers expect from us).
4952
495320 May 2015: Wouter
4954	- DLV is going to be decommissioned.  Advice to stop using it, and
4955	  put text in the example configuration and man page to that effect.
4956
495710 May 2015: Wouter
4958	- Change syntax of particular validator error to be easier for
4959	  machine parse, swap rrset and ip adres info so it looks like:
4960	  validation failure <www.example.nl. TXT IN>: signature crypto
4961	  failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
4962
49631 May 2015: Wouter
4964	- caps-whitelist in unbound.conf allows whitelist of loadbalancers
4965	  that cannot work with caps-for-id or its fallback.
4966
496730 April 2015: Wouter
4968	- Unit test for type ANY synthesis.
4969
497022 April 2015: Wouter
4971	- Removed contrib/unbound_unixsock.diff, because it has been
4972	  integrated, use control-interface: /path in unbound.conf.
4973	- iana portlist update.
4974
497517 April 2015: Wouter
4976	- Synthesize ANY responses from cache.  Does not search exhaustively,
4977	  but MX,A,AAAA,SOA,NS also CNAME.
4978	- Fix leaked dns64prefix configuration string.
4979
498016 April 2015: Wouter
4981	- Add local-zone type inform_deny, that logs query and drops answer.
4982	- Ratelimit does not apply to prefetched queries, and ratelimit-factor
4983	  is default 10.  Repeated normal queries get resolved and with
4984	  prefetch stay in the cache.
4985	- Fix bug#664: libunbound python3 related fixes (from Tomas Hozza)
4986	  Use print_function also for Python2.
4987	  libunbound examples: produce sorted output.
4988	  libunbound-Python: libldns is not used anymore.
4989	  Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
4990
499110 April 2015: Wouter
4992	- unbound-control ratelimit_list lists high rate domains.
4993	- ratelimit feature, ratelimit: 100, or some sensible qps, can be
4994	  used to turn it on.  It ratelimits recursion effort per zone.
4995	  For particular names you can configure exceptions in unbound.conf.
4996	- Fix that get_option for cache-sizes does not print double newline.
4997	- Fix#663: ssl handshake fails when using unix socket because dh size
4998	  is too small.
4999
50008 April 2015: Wouter
5001	- Fix crash in dnstap: Do not try to log TCP responses after timeout.
5002
50037 April 2015: Wouter
5004	- Libunbound skips dos-line-endings from etc/hosts.
5005	- Unbound exits with a fatal error when the auto-trust-anchor-file
5006	  fails to be writable.  This is seconds after startup.  You can
5007	  load a readonly auto-trust-anchor-file with trust-anchor-file.
5008	  The file has to be writable to notice the trust anchor change,
5009	  without it, a trust anchor change will be unnoticed and the system
5010	  will then become inoperable.
5011	- unbound-control list_insecure command shows the negative trust
5012	  anchors currently configured, patch from Jelte Jansen.
5013
50142 April 2015: Wouter
5015	- Fix #660: Fix interface-automatic broken in the presence of
5016	  asymmetric routing.
5017
501826 March 2015: Wouter
5019	- remote.c probedelay line is easier to read.
5020	- rename ldns subdirectory to sldns to avoid name collision.
5021
502225 March 2015: Wouter
5023	- Fix #657:  libunbound(3) recommends deprecated
5024	  CRYPTO_set_id_callback.
5025	- If unknown trust anchor algorithm, and libressl is used, error
5026	  message encourages upgrade of the libressl package.
5027
502823 March 2015: Wouter
5029	- Fix segfault on user not found at startup (from Maciej Soltysiak).
5030
503120 March 2015: Wouter
5032	- Fixed to add integer overflow checks on allocation (defense in depth).
5033
503419 March 2015: Wouter
5035	- Add ip-transparent config option for bind to non-local addresses.
5036
503717 March 2015: Wouter
5038	- Use reallocarray for integer overflow protection, patch submitted
5039	  by Loganaden Velvindron.
5040
504116 March 2015: Wouter
5042	- Fixup compile on cygwin, more portable openssl thread id.
5043
504412 March 2015: Wouter
5045	- Updated default keylength in unbound-control-setup to 3k.
5046
504710 March 2015: Wouter
5048	- Fix lintian warning in unbound-checkconf man page (from Andreas
5049	  Schulze).
5050	- print svnroot when building windows dist.
5051	- iana portlist update.
5052	- Fix warning on sign compare in getentropy_linux.
5053
50549 March 2015: Wouter
5055	- Fix #644: harden-algo-downgrade option, if turned off, fixes the
5056	  reported excessive validation failure when multiple algorithms
5057	  are present.  It allows the weakest algorithm to validate the zone.
5058	- iana portlist update.
5059
50605 March 2015: Wouter
5061	- contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
5062	  scripts.  Contributed by Yuri Voinov.
5063	- Document that incoming-num-tcp increase is good for large servers.
5064	- stats reports tcp usage, of incoming-num-tcp buffers.
5065
50664 March 2015: Wouter
5067	- Patch from Brad Smith that syncs compat/getentropy_linux with
5068	  OpenBSD's version (2015-03-04).
5069	- 0x20 fallback improved: servfail responses do not count as missing
5070	  comparisons (except if all responses are errors),
5071	  inability to find nameservers does not fail equality comparisons,
5072	  many nameservers does not try to compare more than max-sent-count,
5073	  parse failures start 0x20 fallback procedure.
5074	- store caps_response with best response in case downgrade response
5075	  happens to be the last one.
5076	- Document windows 8 tests.
5077
50783 March 2015: Wouter
5079	- tag 1.5.3rc1
5080	[ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ]
5081
50822 March 2015: Wouter
5083	- iana portlist update.
5084
508520 February 2015: Wouter
5086	- Use the getrandom syscall introduced in Linux 3.17 (from Heiner
5087	  Kallweit).
5088	- Fix #645 Portability to Solaris 10, use AF_LOCAL.
5089	- Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
5090	- Fix #647 crash in 1.5.2 because pwd.db no longer accessible after
5091	  reload.
5092
509319 February 2015: Wouter
5094	- 1.5.2 release tag.
5095	- svn trunk contains 1.5.3 under development.
5096
509713 February 2015: Wouter
5098	- Fix #643: doc/example.conf.in: unnecessary whitespace.
5099
510012 February 2015: Wouter
5101	- tag 1.5.2rc1
5102
510311 February 2015: Wouter
5104	- iana portlist update.
5105
510610 February 2015: Wouter
5107	- Fix scrubber with harden-glue turned off to reject NS (and other
5108	  not-address) records.
5109
51109 February 2015: Wouter
5111	- Fix validation failure in case upstream forwarder (ISC BIND) does
5112	  not have the same trust anchors and decides to insert unsigned NS
5113	  record in authority section.
5114
51152 February 2015: Wouter
5116	- infra-cache-min-rtt patch from Florian Riehm, for expected long
5117	  uplink roundtrip times.
5118
511930 January 2015: Wouter
5120	- Fix 0x20 capsforid fallback to omit gratuitous NS and additional
5121	  section changes.
5122	- Portability fix for Solaris ('sun' is not usable for a variable).
5123
512429 January 2015: Wouter
5125	- Fix pyunbound byte string representation for python3.
5126
512726 January 2015: Wouter
5128	- Fix unintended use of gcc extension for incomplete enum types,
5129	  compile with pedantic c99 compliance (from Daniel Dickman).
5130
513123 January 2015: Wouter
5132	- windows port fixes, no AF_LOCAL, no chown, no chmod(grp).
5133
513416 January 2015: Wouter
5135	- unit test for local unix connection.  Documentation and log_addr
5136	  does not inspect port for AF_LOCAL.
5137	- unbound-checkconf -f prints chroot with pidfile path.
5138
513913 January 2015: Wouter
5140	- iana portlist update.
5141
514212 January 2015: Wouter
5143	- Cast sun_len sizeof to socklen_t.
5144	- Fix pyunbound ord call, portable for python 2 and 3.
5145
51467 January 2015: Wouter
5147	- Fix warnings in pythonmod changes.
5148
51496 January 2015: Wouter
5150	- iana portlist update.
5151	- patch for remote control over local sockets, from Dag-Erling
5152	  Smorgrav, Ilya Bakulin.  Use control-interface: /path/sock and
5153	  control-use-cert: no.
5154	- Fixup that patch and uid lookup (only for daemon).
5155	- coded the default of control-use-cert, to yes.
5156
51575 January 2015: Wouter
5158	- getauxval test for ppc64 linux compatibility.
5159	- make strip works for unbound-host and unbound-anchor.
5160	- patch from Stephane Lapie that adds to the python API, that
5161	  exposes struct delegpt, and adds the find_delegation function.
5162	- print query name when max target count is exceeded.
5163	- patch from Stuart Henderson that fixes DESTDIR in
5164	  unbound-control-setup for installs where config is not in
5165	  the prefix location.
5166	- Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing
5167	  IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne).
5168	- Updated contrib warmup.cmd/sh to support two modes - load
5169	  from pre-defined list of domains or (with filename as argument)
5170	  load from user-specified list of domains, and updated contrib
5171	  unbound_cache.sh/cmd to support loading/save/reload cache to/from
5172	  default path or (with secondary argument) arbitrary path/filename,
5173	  from Yuri Voinov.
5174	- Patch from Philip Paeps to contrib/unbound_munin_ that uses
5175	  type ABSOLUTE.  Allows munin.conf: [idleserver.example.net]
5176	  unbound_munin_hits.graph_period minute
5177
51789 December 2014: Wouter
5179	- svn trunk has 1.5.2 in development.
5180	- config.guess and config.sub update from libtoolize.
5181	- local-zone: example.com inform makes unbound log a message with
5182	  client IP for queries in that zone.  Eg. for finding infected hosts.
5183
51848 December 2014: Wouter
5185	- Fix CVE-2014-8602: denial of service by making resolver chase
5186	  endless series of delegations.
5187
51881 December 2014: Wouter
5189	- Fix bug#632: unbound fails to build on AArch64, protects
5190	  getentropy compat code from calling sysctl if it is has been removed.
5191
519229 November 2014: Wouter
5193	- Add include to getentropy_linux.c, hopefully fixing debian build.
5194
519528 November 2014: Wouter
5196	- Fix makefile for build from noexec source tree.
5197
519826 November 2014: Wouter
5199	- Fix libunbound undefined symbol errors for main.
5200	  Referencing main does not seem to be possible for libunbound.
5201
520224 November 2014: Wouter
5203	- Fix log at high verbosity and memory allocation failure.
5204	- iana portlist update.
5205
520621 November 2014: Wouter
5207	- Fix crash on multiple thread random usage on systems without
5208	  arc4random.
5209
521020 November 2014: Wouter
5211	- fix compat/getentropy_win.c check if CryptGenRandom works and no
5212	  immediate exit on windows.
5213
521419 November 2014: Wouter
5215	- Fix cdflag dns64 processing.
5216
521718 November 2014: Wouter
5218	- Fix that CD flag disables DNS64 processing, returning the DNSSEC
5219	  signed AAAA denial.
5220	- iana portlist update.
5221
522217 November 2014: Wouter
5223	- Fix #627: SSL_CTX_load_verify_locations return code not properly
5224	  checked.
5225
522614 November 2014: Wouter
5227	- parser with bison 2.7
5228
522913 November 2014: Wouter
5230	- Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter,
5231	added to contrib/aaaa-filter-iterator.patch.
5232
523312 November 2014: Wouter
5234	- trunk has 1.5.1 in development.
5235	- Patch from Robert Edmonds to build pyunbound python module
5236	  differently.  No versioninfo, with -shared and without $(LIBS).
5237	- Patch from Robert Edmonds fixes hyphens in unbound-anchor man page.
5238	- Removed 'increased limit open files' log message that is written
5239	  to console.  It is only written on verbosity 4 and higher.
5240	  This keeps system bootup console cleaner.
5241	- Patch from James Raftery, always print stats for rcodes 0..5.
5242
524311 November 2014: Wouter
5244	- iana portlist update.
5245	- Fix bug where forward or stub addresses with same address but
5246	  different port number were not tried.
5247	- version number in svn trunk is 1.5.0
5248	- tag 1.5.0rc1
5249	- review fix from Ralph.
5250
52517 November 2014: Wouter
5252	- dnstap fixes by Robert Edmonds:
5253		dnstap/dnstap.m4: cosmetic fixes
5254		dnstap/: Remove compiled protoc-c output files
5255		dnstap/dnstap.m4: Error out if required libraries are not found
5256		dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of
5257			protobuf-c 1.0.0
5258		dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0)
5259
52604 November 2014: Wouter
5261	- Add ub_ctx_add_ta_autr function to add a RFC5011 automatically
5262	  tracked trust anchor to libunbound.
5263	- Redefine internal minievent symbols to unique symbols that helps
5264	  linking on platforms where the linker leaks names across modules.
5265
526627 October 2014: Wouter
5267	- Disabled use of SSLv3 in remote-control and ssl-upstream.
5268	- iana portlist update.
5269
527016 October 2014: Wouter
5271	- Documented dns64 configuration in unbound.conf man page.
5272
527313 October 2014: Wouter
5274	- Fix #617: in ldns in unbound, lowercase WKS services.
5275	- Fix ctype invocation casts.
5276
527710 October 2014: Wouter
5278	- Fix unbound-checkconf check for module config with dns64 module.
5279	- Fix unbound capsforid fallback, it ignores TTLs in comparison.
5280
52816 October 2014: Wouter
5282	- Fix #614: man page variable substitution bug.
52836 October 2014: Willem
5284	- Whitespaces after $ORIGIN are not part of the origin dname (ldns).
5285	- $TTL's value starts at position 5 (ldns).
5286
52871 October 2014: Wouter
5288	- fix #613: Allow tab ws in var length last rdfs (in ldns str2wire).
5289
529029 September 2014: Wouter
5291	- Fix #612: create service with service.conf in present directory and
5292	  auto load it.
5293	- Fix for mingw compile openssl ranlib.
5294
529525 September 2014: Wouter
5296	- updated configure and aclocal with newer autoconf 1.13.
5297
529822 September 2014: Wouter
5299	- Fix swig and python examples for Python 3.x.
5300	- Fix for mingw compile with openssl-1.0.1i.
5301
530219 September 2014: Wouter
5303	- improve python configuration detection to build on Fedora 22.
5304
530518 September 2014: Wouter
5306	- patches to also build with Python 3.x (from Pavel Simerda).
5307
530816 September 2014: Wouter
5309	- Fix tcp timer waiting list removal code.
5310	- iana portlist update.
5311	- Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue
5312	  is longer and more tcp connections can be handled.
5313
531415 September 2014: Wouter
5315	- Fix unit test for CDS typecode.
5316
53175 September 2014: Wouter
5318	- type CDS and CDNSKEY types in sldns.
5319
532025 August 2014: Wouter
5321	- Fixup checklock code for log lock and its mutual initialization
5322	  dependency.
5323	- iana portlist update.
5324	- Removed necessity for pkg-config from the dnstap.m4, new are
5325	  the --with-libfstrm and --with-protobuf-c configure options.
5326
532719 August 2014: Wouter
5328	- Update unbound manpage with more explanation (from Florian Obser).
5329
533018 August 2014: Wouter
5331	- Fix #603: unbound-checkconf -o <option> should skip verification
5332	  checks.
5333	- iana portlist update.
5334	- Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings.
5335
53365 August 2014: Wouter
5337	- dnstap support, with a patch from Farsight Security, written by
5338	  Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c.
5339	  It is BSD licensed (see dnstap/dnstap.c).
5340	  Building with --enable-dnstap needs pkg-config with this patch.
5341	- Noted dnstap in doc/README and doc/CREDITS.
5342	- Changes to the dnstap patch.
5343	  - lint fixes.
5344	  - dnstap/dnstap_config.h should not have been added to the repo,
5345	    because is it generated.
5346
53471 August 2014: Wouter
5348	- Patch add msg, rrset, infra and key cache sizes to stats command
5349	  from Maciej Soltysiak.
5350	- iana portlist update.
5351
535231 July 2014: Wouter
5353	- DNS64 from Viagenie (BSD Licensed), written by Simon Perrault.
5354	  Initial commit of the patch from the FreeBSD base (with its fixes).
5355	  This adds a module (for module-config in unbound.conf) dns64 that
5356	  performs DNS64 processing, see README.DNS64.
5357	- Changes from DNS64:
5358	  strcpy changed to memmove.
5359	  arraybound check fixed from prefix_net/8/4 to prefix_net/8+4.
5360	  allocation of result consistently in the correct region.
5361	  time_t is now used for ttl in unbound (since the patch's version).
5362	- testdata/dns64_lookup.rpl for unit test for dns64 functionality.
5363
536429 July 2014: Wouter
5365	- Patch from Dag-Erling Smorgrav that implements feature, unbound -dd
5366	  does not fork in the background and also logs to stderr.
5367
536821 July 2014: Wouter
5369	- Fix endian.h include for OpenBSD.
5370
537116 July 2014: Wouter
5372	- And Fix#596: Bail out of unbound-control dump_infra when ssl
5373	  write fails.
5374
537515 July 2014: Wouter
5376	- Fix #596: Bail out of unbound-control list_local_zones when ssl
5377	  write fails.
5378	- iana portlist update.
5379
538013 July 2014: Wouter
5381	- Configure tests if main can be linked to from getentropy compat.
5382
538312 July 2014: Wouter
5384	- Fix getentropy compat code, function refs were not portable.
5385	- Fix to check openssl version number only for OpenSSL.
5386	- LibreSSL provides compat items, check for that in configure.
5387	- Fix bug in fix for log locks that caused deadlock in signal handler.
5388	- update compat/getentropy and arc4random to the most recent ones from OpenBSD.
5389
539011 July 2014: Matthijs
5391	- fake-rfc2553 patch (thanks Benjamin Baier).
5392
539311 July 2014: Wouter
5394	- arc4random in compat/ and getentropy, explicit_bzero, chacha for
5395	  dependencies, from OpenBSD.  arc4_lock and sha512 in compat.
5396	  This makes arc4random available on all platforms, except when
5397	  compiled with LIBNSS (it uses libNSS crypto random).
5398	- fix strptime implicit declaration error on OpenBSD.
5399	- arc4random, getentropy and explicit_bzero compat for Windows.
5400
54014 July 2014: Wouter
5402	- Fix #593: segfault or crash upon rotating logfile.
5403
54043 July 2014: Wouter
5405	- DLV tests added.
5406	- signit tool fixup for compile with libldns library.
5407	- iana portlist updated.
5408
540927 June 2014: Wouter
5410	- so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X.
5411
541226 June 2014: Wouter
5413	- unbound-control status reports if so-reuseport was successful.
5414	- iana portlist updated.
5415
541624 June 2014: Wouter
5417	- Fix caps-for-id fallback, and added fallback attempt when servers
5418	  drop 0x20 perturbed queries.
5419	- Fixup testsetup for VM tests (run testcode/run_vm.sh).
5420
542117 June 2014: Wouter
5422	- iana portlist updated.
5423
54243 June 2014: Wouter
5425	- Add AAAA for B root server to default root hints.
5426
54272 June 2014: Wouter
5428	- Remove unused define from iterator.h
5429
543030 May 2014: Wouter
5431	- Fixup sldns_enum_edns_option typedef definition.
5432
543328 May 2014: Wouter
5434	- Code cleanup patch from Dag-Erling Smorgrav, with compiler issue
5435	  fixes from FreeBSD's copy of Unbound, he notes:
5436	  Generate unbound-control-setup.sh at build time so it respects
5437	  prefix and sysconfdir from the configure script.  Also fix the
5438	  umask to match the comment, and the comment to match the umask.
5439	  Add const and static where needed.  Use unions instead of
5440	  playing pointer poker.  Move declarations that are needed in
5441	  multiple source files into a shared header.  Move sldns_bgetc()
5442	  from parse.c to buffer.c where it belongs.  Introduce a new
5443	  header file, worker.h, which declares the callbacks that
5444	  all workers must define.  Remove those declarations from
5445	  libworker.h.	Include the correct headers in the correct places.
5446	  Fix a few dummy callbacks that don't match their prototype.
5447	  Fix some casts.  Hide the sbrk madness behind #ifdef HAVE_SBRK.
5448	  Remove a useless printf which breaks reproducible builds.
5449	  Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're
5450	  no longer used.  Add unbound-control-setup.sh to the list of
5451	  generated files.  The prototype for libworker_event_done_cb()
5452	  needs to be moved from libunbound/libworker.h to
5453	  libunbound/worker.h.
5454	- Fixup out-of-directory compile with unbound-control-setup.sh.in.
5455	- make depend.
5456
545723 May 2014: Wouter
5458	- unbound-host -D enabled dnssec and reads root trust anchor from
5459	  the default root key file that was compiled in.
5460
546120 May 2014: Wouter
5462	- Feature, unblock-lan-zones: yesno that you can use to make unbound
5463	  perform 10.0.0.0/8 and other reverse lookups normally, for use if
5464	  unbound is running service for localhost on localhost.
5465
546616 May 2014: Wouter
5467	- Updated create_unbound_ad_servers and unbound_cache scripts from
5468	  Yuri Voinov in the source/contrib directory. Added
5469	  warmup.cmd (and .sh): warm up the DNS cache with your MRU domains.
5470
54719 May 2014: Wouter
5472	- Implement draft-ietf-dnsop-rfc6598-rfc6303-01.
5473	- iana portlist updated.
5474
54758 May 2014: Wouter
5476	- Contrib windows scripts from Yuri Voinov added to src/contrib:
5477	  create_unbound_ad_servers.cmd: enters anti-ad server lists.
5478	  unbound_cache.cmd: saves and loads the cache.
5479	- Added unbound-control-setup.cmd from Yuri Voinov to the windows
5480	  unbound distribution set.  It requires openssl installed in %PATH%.
5481
54826 May 2014: Wouter
5483	- Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier.
5484
54855 May 2014: Wouter
5486	- More #567: remove : from output of stub and forward lists, this is
5487	  easier to parse.
5488
548929 April 2014: Wouter
5490	- iana portlist updated.
5491	- Add unbound-control flush_negative that flushed nxdomains, nodata,
5492	  and errors from the cache.  For dnssec-trigger and NetworkManager,
5493	  fixes cases where network changes have localdata that was already
5494	  negatively cached from the previous network.
5495
549623 April 2014: Wouter
5497	- Patch from Jeremie Courreges-Anglas to use arc4random_uniform
5498	  if available on the OS, it gets entropy from the OS.
5499
550015 April 2014: Wouter
5501	- Fix compile with libevent2 on FreeBSD.
5502
550311 April 2014: Wouter
5504	- Fix #502: explain that do-ip6 disable does not stop AAAA lookups,
5505	  but it stops the use of the ipv6 transport layer for DNS traffic.
5506	- iana portlist updated.
5507
550810 April 2014: Wouter
5509	- iana portlist updated.
5510	- Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation
5511	  option for DNS fragmentation defense.
5512	- Document that dump_requestlist only prints queries from thread 0.
5513	- unbound-control stats prints num.query.tcpout with number of TCP
5514	  outgoing queries made in the previous statistics interval.
5515	- Fix #567: unbound lists if forward zone is secure or insecure with
5516	  +i annotation in output of list_forwards, also for list_stubs
5517	  (for NetworkManager integration.)
5518	- Fix #554: use unsigned long to print 64bit statistics counters on
5519	  64bit systems.
5520	- Fix #558: failed prefetch lookup does not remove cached response
5521	  but delays next prefetch (in lieu of caching a SERVFAIL).
5522	- Fix #545: improved logging, the ip address of the error is printed
5523	  on the same log-line as the error.
5524
55258 April 2014: Wouter
5526	- Fix #574: make test fails on Ubuntu 14.04.  Disabled remote-control
5527	  in testbound scripts.
5528	- iana portlist updated.
5529
55307 April 2014: Wouter
5531	- C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root
5532	  hints (patch from Anand Buddhdev).
5533	- Fix #572: Fix unit test failure for systems with different
5534	  /etc/services.
5535
553628 March 2014: Wouter
5537	- Fix #569: do_tcp is do-tcp in unbound.conf man page.
5538
553925 March 2014: Wouter
5540	- Patch from Stuart Henderson to build unbound-host man from .1.in.
5541
554224 March 2014: Wouter
5543	- Fix print filename of encompassing config file on read failure.
5544
554512 March 2014: Wouter
5546	- tag 1.4.22
5547	- trunk has 1.4.23 in development.
5548
554910 March 2014: Wouter
5550	- Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes
5551	  because of spelling.  Patch from Chris Coates.
5552
555327 February 2014: Wouter
5554	- tag 1.4.22rc1
5555
555621 February 2014: Wouter
5557	- iana portlist updated.
5558
555920 February 2014: Matthijs
5560	- Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is
5561	  received. This is okay according 4035, but not after revising
5562	  existence in 4592.  NSEC empty non-terminals exist and thus the
5563	  RCODE should have been NOERROR. If this occurs, and the RRsets
5564	  are secure, we set the RCODE to NOERROR and the security status
5565	  of the response is also considered secure.
5566
556714 February 2014: Wouter
5568	- Works on Minix (3.2.1).
5569
557011 February 2014: Wouter
5571	- Fix parse of #553(NSD) string in sldns, quotes without spaces.
5572
55737 February 2014: Wouter
5574	- iana portlist updated.
5575	- add body to ifstatement if locks disabled.
5576	- add TXT string"string" test case to unit test.
5577	- Fix #551: License change "Regents" to "Copyright holder", matching
5578	  the BSD license on opensource.org.
5579
55806 February 2014: Wouter
5581	- sldns has type HIP.
5582	- code documentation on the module interface.
5583
55845 February 2014: Wouter
5585	- Fix sldns parse tests on osx.
5586
55873 February 2014: Wouter
5588	- Detect libevent2 install automatically by configure.
5589	- Fixup link with lib/event2 subdir.
5590	- Fix parse in sldns of quoted parenthesized text strings.
5591
559231 January 2014: Wouter
5593	- unit test for ldns wire to str and back with zones, root, nlnetlabs
5594	  and types.sidnlabs.
5595	- Fix for hex to string in unknown, atma and nsap.
5596	- fixup nss compile (no ldns in it).
5597	- fixup warning in unitldns
5598	- fixup WKS and rdata type service to print unsigned because strings
5599	  are not portable; they cannot be read (for sure) on other computers.
5600	- fixup type EUI48 and EUI64, type APL and type IPSECKEY in string
5601	  parse sldns.
5602
560330 January 2014: Wouter
5604	- delay-close does not act if there are udp-wait queries, so that
5605	  it does not make a socketdrain DoS easier.
5606
560728 January 2014: Wouter
5608	- iana portlist updated.
5609	- iana portlist test updated so it does not touch the source
5610	  if there are no changes.
5611	- delay-close: msec option that delays closing ports for which
5612	  the UDP reply has timed out.  Keeps the port open, only accepts
5613	  the correct reply.  This correct reply is not used, but the port
5614	  is open so that no port-denied ICMPs are generated.
5615
561627 January 2014: Wouter
5617	- reuseport is attempted, then fallback to without on failure.
5618
561924 January 2014: Wouter
5620	- Change unbound-event.h to use void* buffer, length idiom.
5621	- iana portlist updated.
5622	- unbound-event.h is installed if you configure --enable-event-api.
5623	- speed up unbound (reports say it could be up to 10%), by reducing
5624	  lock contention on localzones.lock.  It is changed to an rwlock.
5625	- so-reuseport: yesno option to distribute queries evenly over
5626	  threads on Linux (Thanks Robert Edmonds).
5627	- made lint clean.
5628
562921 January 2014: Wouter
5630	- Fix #547: no trustanchor written if filesystem full, fclose checked.
5631
563217 January 2014: Wouter
5633	- Fix isprint() portability in sldns, uses unsigned int.
5634	- iana portlist updated.
5635
563616 January 2014: Wouter
5637	- fix #544: Fixed +i causes segfault when running with module conf
5638	  "iterator".
5639	- Windows port, adjust %lld to %I64d, and warning in win_event.c.
5640
564114 January 2014: Wouter
5642	- iana portlist updated.
5643
56445 Dec 2013: Wouter
5645	- Fix bug in cachedump that uses sldns.
5646	- update pythonmod for ldns_ to sldns_ name change.
5647
56483 Dec 2013: Wouter
5649	- Fix sldns to use sldns_ prefix for all ldns_ variables.
5650	- Fix windows compile to compile with sldns.
5651
565230 Nov 2013: Wouter
5653	- Fix sldns to make globals use sldns_ prefix.  This fixes
5654	  linking with libldns that uses global variables ldns_ .
5655
565613 Nov 2013: Wouter
5657	- Fix bug#537: compile python plugin without ldns library.
5658
565912 Nov 2013: Wouter
5660	- Fix bug#536: acl_deny_non_local and refuse_non_local added.
5661
56625 Nov 2013: Wouter
5663	- Patch from Neel Goyal to fix async id assignment if callback
5664	  is called by libunbound in the mesh attach.
5665	- Accept ip-address: as an alternative for interface: for
5666	  consistency with nsd.conf syntax.
5667
56684 Nov 2013: Wouter
5669	- Patch from Neel Goyal to fix callback in libunbound.
5670
56713 Nov 2013: Wouter
5672	- if configured --with-libunbound-only fix make install.
5673
567431 Oct 2013: Wouter
5675	- Fix #531: Set SO_REUSEADDR so that the wildcard interface and a
5676	  more specific interface port 53 can be used at the same time, and
5677	  one of the daemons is unbound.
5678	- iana portlist update.
5679	- separate ldns into core ldns inside ldns/ subdirectory.  No more
5680	  --with-ldns is needed and unbound does not rely on libldns.
5681	- portability fixes for new USE_SLDNS ldns subdir codebase.
5682
568322 Oct 2013: Wouter
5684	- Patch from Neel Goyal: Add an API call to set an event base on an
5685	  existing ub_ctx.  This basically just destroys the current worker and
5686	  sets the event base to the current.  And fix a deadlock in
5687	  ub_resolve_event – the cfglock is held when libworker_create is
5688	  called.  This ends up trying to acquire the lock again in
5689	  context_obtain_alloc in the call chain.
5690	- Fix #528: if very high logging (4 or more) segfault on allow_snoop.
5691
569226 Sep 2013: Wouter
5693	- unbound-event.h is installed if configured --with-libevent.  It
5694	  contains low-level library calls, that use libevent's event_base
5695	  and an ldns_buffer for the wire return packet to perform async
5696	  resolution in the client's eventloop.
5697
569819 Sep 2013: Wouter
5699	- 1.4.21 tag created.
5700	- trunk has 1.4.22 number inside it.
5701	- iana portlist updated.
5702	- acx_nlnetlabs.m4 to 26; improve FLTO help text.
5703
570416 Sep 2013: Wouter
5705	- Fix#524: max-udp-size not effective to non-EDNS0 queries, from
5706	  Daisuke HIGASHI.
5707
570810 Sep 2013: Wouter
5709	- MIN_TTL and MAX_TTL also in time_t.
5710	- tag 1.4.21rc1 made again.
5711
571226 Aug 2013: Wouter
5713	- More fixes for bug#519: for the threaded case test if the bg
5714	  thread has been killed, on ub_ctx_delete, to avoid hangs.
5715
571622 Aug 2013: Wouter
5717	- more fixes that I overlooked.
5718	- review fixes from Willem.
5719
572021 Aug 2013: Wouter
5721	- Fix#520: Errors found by static analysis from Tomas Hozza(redhat).
5722
572320 Aug 2013: Wouter
5724	- Fix for 2038, with time_t instead of uint32_t.
5725
572619 Aug 2013: Wouter
5727	- Fix#519 ub_ctx_delete may hang in some scenarios (libunbound).
5728
572914 Aug 2013: Wouter
5730	- Fix uninit variable in fix#516.
5731
57328 Aug 2013: Wouter
5733	- Fix#516 dnssec lameness detection for answers that are improper.
5734
573530 Jun 2013: Wouter
5736	- tag 1.4.21rc1
5737
573829 Jun 2013: Wouter
5739	- Fix#512 memleak in testcode for testbound (if it fails).
5740	- Fix#512 NSS returned arrays out of setup function to be statics.
5741
574226 Jun 2013: Wouter
5743	- max include of 100.000 files (depth and globbed at one time).
5744	  This is to preserve system memory in bug cases, or endless cases.
5745	- iana portlist updated.
5746
574719 Jun 2013: Wouter
5748	- streamtcp man page, contributed by Tomas Hozza.
5749	- iana portlist updated.
5750	- libunbound documentation on how to avoid openssl race conditions.
5751
575225 Jun 2013: Wouter
5753	- Squelch sendto-permission denied errors when the network is
5754	  not connected, to avoid spamming syslog.
5755	- configure --disable-flto option (from Robert Edmonds).
5756
575718 Jun 2013: Wouter
5758	- Fix for const string literals in C++ for libunbound, from Karel
5759	  Slany.
5760	- iana portlist updated.
5761
576217 Jun 2013: Wouter
5763	- Fixup manpage syntax.
5764
576514 Jun 2013: Wouter
5766	- get_option and set_option support for log-time-ascii, python-script
5767	  val-sig-skew-min and val-sig-skew-max.  log-time-ascii takes effect
5768	  immediately.  The others are mostly useful for libunbound users.
5769
577013 Jun 2013: Wouter
5771	- get_option, set_option, unbound-checkconf -o and libunbound
5772	  getoption and setoption support cache-min-ttl and cache-max-ttl.
5773
577410 Jun 2013: Wouter
5775	- Fix#501: forward-first does not recurse, when forward name is ".".
5776	- iana portlist update.
5777	- Max include depth is unlimited.
5778
577927 May 2013: Wouter
5780	- Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply
5781	  patch to it to not fail when -Werror is also specified, from the
5782	  autoconf-archives.
5783	- iana portlist update.
5784
578521 May 2013: Wouter
5786	- Explain bogus and secure flags in libunbound more.
5787
578816 May 2013: Wouter
5789	- Fix#499 use-after-free in out-of-memory handling code (thanks Jake
5790	  Montgomery).
5791	- Fix#500 use on non-initialised values on socket bind failures.
5792
579315 May 2013: Wouter
5794	- Fix round-robin doesn't work with some Windows clients (from Ilya
5795	  Bakulin).
5796
57973 May 2013: Wouter
5798	- update acx_nlnetlabs.m4 to v23, sleep w32 fix.
5799
580026 April 2013: Wouter
5801	- add unbound-control insecure_add and insecure_remove for the
5802	  administration of negative trust anchors.
5803
580425 April 2013: Wouter
5805	- Implement max-udp-size config option, default 4096 (thanks
5806	  Daisuke Higashi).
5807	- Robust checks on dname validity from rdata for dname compare.
5808	- updated iana portlist.
5809
581019 April 2013: Wouter
5811	- Fixup snprintf return value usage, fixed libunbound_get_option.
5812
581318 April 2013: Wouter
5814	- fix bug #491: pick program name (0th argument) as syslog identity.
5815	- own implementation of compat/snprintf.c.
5816
581715 April 2013: Wouter
5818	- Fix so that for a configuration line of include: "*.conf" it is not
5819	  an error if there are no files matching the glob pattern.
5820	- unbound-anchor review: BIO_write can return 0 successfully if it
5821	  has successfully appended a zero length string.
5822
582311 April 2013: Wouter
5824	- Fix queries leaking up for stubs and forwards, if the configured
5825	  nameservers all fail to answer.
5826
582710 April 2013: Wouter
5828	- code improve for minimal responses, small speed increase.
5829
58309 April 2013: Wouter
5831	- updated iana portlist.
5832	- Fix crash in previous private address fixup of 22 March.
5833
583428 March 2013: Wouter
5835	- Make reverse zones easier by documenting the nodefault statements
5836	  commented-out in the example config file.
5837
583826 March 2013: Wouter
5839	- more fixes to lookup3.c endianness detection.
5840
584125 March 2013: Wouter
5842	- #492: Fix endianness detection, revert to older lookup3.c detection
5843	  and put new detect lines after previous tests, to avoid regressions
5844	  but allow new detections to succeed.
5845	  And add detection for machine/endian.h to it.
5846
584722 March 2013: Wouter
5848	- Fix resolve of names that use a mix of public and private addresses.
5849	- iana portlist update.
5850	- Fix makedist for new svn for -d option.
5851	- unbound.h header file has UNBOUND_VERSION_MAJOR define.
5852	- Fix windows RSRC version for long version numbers.
5853
585421 March 2013: Wouter
5855	- release 1.4.20
5856	- trunk has 1.4.21
5857	- committed libunbound version 4:1:2 for binary API updated in 1.4.20
5858	- install copy of unbound-control.8 man page for unbound-control-setup
5859
586014 March 2013: Wouter
5861	- iana portlist update.
5862	- tag 1.4.20rc1
5863
586412 March 2013: Wouter
5865	- Fixup makedist.sh for windows compile.
5866
586711 March 2013: Wouter
5868	- iana portlist update.
5869	- testcode/ldns-testpkts.c check for makedist is informational.
5870
587115 February 2013: Wouter
5872	- fix defines in lookup3 for bigendian bsd alpha
5873
587411 February 2013: Wouter
5875	- Fixup openssl_thread init code to only run if compiled with SSL.
5876
58777 February 2013: Wouter
5878	- detect endianness in lookup3 on BSD.
5879	- add libunbound.ttl at end of result structure, version bump for
5880	  libunbound and binary backwards compatible, but 1.4.19 is not
5881	  forward compatible with 1.4.20.
5882	- update iana port list.
5883
588430 January 2013: Wouter
5885	- includes and have_ssl fixes for nss.
5886
588729 January 2013: Wouter
5888	- printout name of zone with duplicate fwd and hint errors.
5889
589028 January 2013: Wouter
5891	- updated fwd_zero for newer nc. Updated common.sh for newer netstat.
5892
589317 January 2013: Wouter
5894	- unbound-anchors checks the emailAddress of the signer of the
5895	  root.xml file, default is dnssec@iana.org.  It also checks that
5896	  the signer has the correct key usage for a digital signature.
5897	- update iana port list.
5898
58993 January 2013: Wouter
5900	- Test that unbound-control checks client credentials.
5901	- Test that unbound can handle a CNAME at an intermediate node in
5902	  the chain of trust (where it seeks a DS record).
5903	- Check the commonName of the signer of the root.xml file in
5904	  unbound-anchor, default is dnssec@iana.org.
5905
59062 January 2013: Wouter
5907	- Fix openssl lock free on exit (reported by Robert Fleischman).
5908	- iana portlist updated.
5909	- Tested that unbound implements the RFC5155 Technical Errata id 3441.
5910	  Unbound already implements insecure classification of an empty
5911	  nonterminal in NSEC3 optout zone.
5912
591320 December 2012: Wouter
5914	- Fix unbound-anchor xml parse of entity declarations for safety.
5915
591619 December 2012: Wouter
5917	- iana portlist updated.
5918
591918 December 2012: Wouter
5920	- iana portlist updated.
5921
592214 December 2012: Wouter
5923	- Change of D.ROOT-SERVERS.NET A address in default root hints.
5924
592512 December 2012: Wouter
5926	- 1.4.19 release.
5927	- trunk has 1.4.20 under development.
5928
59295 December 2012: Wouter
5930	- note support for AAAA RR type RFC.
5931
59324 December 2012: Wouter
5933	- 1.4.19rc1 tag.
5934
593530 November 2012: Wouter
5936	- bug 481: fix python example0.
5937	- iana portlist updated.
5938
593927 November 2012: Wouter
5940	- iana portlist updated.
5941
59429 November 2012: Wouter
5943	- Fix unbound-control forward disables configured stubs below it.
5944
59457 November 2012: Wouter
5946	- Fixup ldns-testpkts, identical to ldns/examples.
5947	- iana portlist updated.
5948
594930 October 2012: Wouter
5950	- Fix bug #477: unbound-anchor segfaults if EDNS is blocked.
5951
595229 October 2012: Matthijs
5953	- Fix validation for responses with both CNAME and wildcard
5954	  expanded CNAME records in answer section.
5955
59568 October 2012: Wouter
5957	- update ldns-testpkts.c to ldns 1.6.14 version.
5958	- fix build of pythonmod in objdir, for unbound.py.
5959	- make clean and makerealclean remove generated python and docs.
5960
59615 October 2012: Wouter
5962	- fix build of pythonmod in objdir (thanks Jakob Schlyter).
5963
59643 October 2012: Wouter
5965	- fix text in unbound-anchor man page.
5966
59671 October 2012: Wouter
5968	- ignore trusted-keys globs that have no files (from Paul Wouters).
5969
597027 September 2012: Wouter
5971	- include: directive in config file accepts wildcards.  Patch from
5972	  Paul Wouters.  Suggested use: include: "/etc/unbound.d/conf.d/*"
5973	- unbound-control -q option is quiet, patch from Mariano Absatz.
5974	- iana portlist updated.
5975	- updated contrib/unbound.spec, patch from Valentin Bud.
5976
597721 September 2012: Wouter
5978	- chdir to / after chroot call (suggested by Camiel Dobbelaar).
5979
598017 September 2012: Wouter
5981	- patch_rsamd5_enable.diff: this patch enables RSAMD5 validation
5982	  otherwise it is treated as insecure.  The RSAMD5 algorithm is
5983	  deprecated (RFC6725).  The MD5 hash is considered weak for some
5984	  purposes, if you want to sign your zone, then RSASHA256 is an
5985	  uncontested hash.
5986
598730 August 2012: Wouter
5988	- RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled.
5989	- iana portlist updated.
5990
599129 August 2012: Wouter
5992	- Nicer comments outgoing-port-avoid, thanks Stu (bug #465).
5993
599422 August 2012: Wouter
5995	- Fallback to 1472 and 1232, one fragment size without headers.
5996
599721 August 2012: Wouter
5998	- Fix timeouts so that when a server has been offline for a while
5999	  and is probed to see it works, it becomes fully available for
6000	  server selection again.
6001
600217 August 2012: Wouter
6003	- Add documentation to libunbound for default nonuse of resolv.conf.
6004
60052 August 2012: Wouter
6006	- trunk has 1.4.19 under development (fixes from 1 aug and 31 july
6007	are for 1.4.19).
6008	- iana portlist updated.
6009
60101 August 2012: Wouter
6011	- Fix openssl race condition, initializes openssl locks, reported
6012	  by Einar Lonn and Patrik Wallstrom.
6013
601431 July 2012: Wouter
6015	- Improved forward-first and stub-first documentation.
6016	- Fix that enables modules to register twice for the same
6017	  serviced_query, without race conditions or administration issues.
6018	  This should not happen with the current codebase, but it is robust.
6019	- Fix forward-first option where it sets the RD flag wrongly.
6020	- added manpage links for libunbound calls (Thanks Paul Wouters).
6021
602230 July 2012: Wouter
6023	- tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012).
6024
602527 July 2012: Wouter
6026	- unbound-host works with libNSS
6027	- fix bogus nodata cname chain not reported as bogus by validator,
6028	  (Thanks Peter van Dijk).
6029
603026 July 2012: Wouter
6031	- iana portlist updated.
6032	- tag 1.4.18rc1.
6033
603425 July 2012: Wouter
6035	- review fix for libnss, check hash prefix allocation size.
6036
603723 July 2012: Wouter
6038	- fix missing break for GOST DS hash function.
6039	- implemented forward_first for the root.
6040
604120 July 2012: Wouter
6042	- Fix bug#452 and another assertion failure in mesh.c, makes
6043	  assertions in mesh.c resist duplicates.  Fixes DS NS search to
6044	  not generate duplicate sub queries.
6045
604619 July 2012: Willem
6047	- Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac,
6048	  if CFLAGS is specified at configure time then '-g -O2' is not
6049	  appended to CFLAGS, so that the user can override them.
6050
605118 July 2012: Willem
6052	- Fix libunbound report of errors when in background mode.
6053
605411 July 2012: Willem
6055	- updated iana ports list.
6056
60579 July 2012: Willem
6058	- Add flush_bogus option for unbound-control
6059
60606 July 2012: Wouter
6061	- Fix validation of qtype DS queries that result in no data for
6062	  non-optout NSEC3 zones.
6063
60644 July 2012: Wouter
6065	- compile libunbound with libnss on Suse, passes regression tests.
6066
60673 July 2012: Wouter
6068	- FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.
6069
60702 July 2012: Wouter
6071	- updated iana ports list.
6072
607329 June 2012: Wouter
6074	- patch for unbound_munin_ script to handle arbitrary thread count by
6075	  Sven Ulland.
6076
607728 June 2012: Wouter
6078	- detect if openssl has FIPS_mode.
6079	- code review: return value of cache_store can be ignored for better
6080	  performance in out of memory conditions.
6081	- fix edns-buffer-size and msg-buffer-size manpage documentation.
6082	- updated iana ports list.
6083
608425 June 2012: Wouter
6085	- disable RSAMD5 if in FIPS mode (for openssl and for libnss).
6086
608722 June 2012: Wouter
6088	- implement DS records, NSEC3 and ECDSA for compile with libnss.
6089
609021 June 2012: Wouter
6091	- fix error handling of alloc failure during rrsig verification.
6092	- nss check for verification failure.
6093	- nss crypto works for RSA and DSA.
6094
609520 June 2012: Wouter
6096	- work on --with-nss build option (for now, --with-libunbound-only).
6097
609819 June 2012: Wouter
6099	- --with-libunbound-only build option, only builds the library and
6100	  not the daemon and other tools.
6101
610218 June 2012: Wouter
6103	- code review.
6104
610515 June 2012: Wouter
6106	- implement log-time-ascii on windows.
6107	- The key-cache bad key ttl is now 60 seconds.
6108	- updated iana ports list.
6109	- code review.
6110
611111 June 2012: Wouter
6112	- bug #452: fix crash on assert in mesh_state_attachment.
6113
611430 May 2012: Wouter
6115	- silence warning from swig-generated code (md set but not used in
6116	  swig initmodule, due to ifdefs in swig-generated code).
6117
611827 May 2012: Wouter
6119	- Fix debian-bugs-658021: Please enable hardened build flags.
6120
612125 May 2012: Wouter
6122	- updated iana ports list.
6123
612424 May 2012: Wouter
6125	- tag for 1.4.17 release.
6126	- trunk is 1.4.18 in development.
6127
612818 May 2012: Wouter
6129	- Review comments, removed duplicate memset to zero in delegpt.
6130
613116 May 2012: Wouter
6132	- Updated doc/FEATURES with RFCs that are implemented but not listed.
6133	- Protect if statements in val_anchor for compile without locks.
6134	- tag for 1.4.17rc1.
6135
613615 May 2012: Wouter
6137	- fix configure ECDSA support in ldns detection for windows compile.
6138	- fix possible uninitialised variable in windows pipe implementation.
6139
61409 May 2012: Wouter
6141	- Fix alignment problem in util/random on sparc64/freebsd.
6142
61438 May 2012: Wouter
6144	- Fix for accept spinning reported by OpenBSD.
6145	- iana portlist updated.
6146
61472 May 2012: Wouter
6148	- Fix validation of nodata for DS query in NSEC zones, reported by
6149	  Ondrej Mikle.
6150
615113 April 2012: Wouter
6152	- ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older
6153	  openssl.
6154
615510 April 2012: Wouter
6156	- Applied patch from Daisuke HIGASHI for rrset-roundrobin and
6157	  minimal-responses features.
6158	- iana portlist updated.
6159
61605 April 2012: Wouter
6161	- fix bug #443: --with-chroot-dir not honoured by configure.
6162	- fix bug #444: setusercontext was called too late (thanks Bjorn
6163	  Ketelaars).
6164
616527 March 2012: Wouter
6166	- fix bug #442: Fix that Makefile depends on pythonmod headers
6167	  even using --without-pythonmodule.
6168
616922 March 2012: Wouter
6170	- contrib/validation-reporter follows rotated log file (patch from
6171	  Augie Schwer).
6172
617321 March 2012: Wouter
6174	- new approach to NS fetches for DS lookup that works with
6175	  cornercases, and is more robust and considers forwarders.
6176
617719 March 2012: Wouter
6178	- iana portlist updated.
6179	- fix to locate nameservers for DS lookup with NS fetches.
6180
618116 March 2012: Wouter
6182	- Patch for access to full DNS packet data in unbound python module
6183	  from Ondrej Mikle.
6184
61859 March 2012: Wouter
6186	- Applied line-buffer patch from Augie Schwer to validation.reporter.sh.
6187
61882 March 2012: Wouter
6189	- flush_infra cleans timeouted servers from the cache too.
6190	- removed warning from --enable-ecdsa.
6191
61921 March 2012: Wouter
6193	- forward-first option.  Tries without forward if a query fails.
6194	  Also stub-first option that is similar.
6195
619628 February 2012: Wouter
6197	- Fix from code review, if EINPROGRESS not defined chain if statement
6198	  differently.
6199
620027 February 2012: Wouter
6201	- Fix bug#434: on windows check registry for config file location
6202	  for unbound-control.exe, and unbound-checkconf.exe.
6203
620423 February 2012: Wouter
6205	- Fix to squelch 'network unreachable' errors from tcp connect in
6206	  logs, high verbosity will show them.
6207
620816 February 2012: Wouter
6209	- iter_hints is now thread-owned in module env, and thus threadsafe.
6210	- Fix prefetch and sticky NS, now the prefetch works.  It picks
6211	  nameservers that 'would be valid in the future', and if this makes
6212	  the NS timeout, it updates that NS by asking delegation from the
6213	  parent again.  If child NS has longer TTL, that TTL does not get
6214	  refreshed from the lookup to the child nameserver.
6215
621615 February 2012: Wouter
6217	- Fix forward-zone memory, uses malloc and frees original root dp.
6218	- iter hints (stubs) uses malloc inside for more dynamicity.
6219	- unbound-control forward_add, forward_remove, stub_add, stub_remove
6220	  can modify stubs and forwards for running unbound (on mobile computer)
6221	  they can also add and remove domain-insecure for the zone.
6222
622314 February 2012: Wouter
6224	- Fix sticky NS (ghost domain problem) if prefetch is yes.
6225	- iter forwards uses malloc inside for more dynamicity.
6226
622713 February 2012: Wouter
6228	- RT#2955. Fix for cygwin compilation.
6229	- iana portlist updated.
6230
623110 February 2012: Wouter
6232	- Slightly smaller critical region in one case in infra cache.
6233	- Fix timeouts to keep track of query type, A, AAAA and other, if
6234	  another has caused timeout blacklist, different type can still probe.
6235	- unit test fix for nomem_cnametopos.rpl race condition.
6236
62379 February 2012: Wouter
6238	- Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h.
6239
62408 February 2012: Wouter
6241	- implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This
6242	  implementation is experimental at this time and not recommended
6243	  for use on the public internet (the protocol numbers have not
6244	  been assigned).  Needs recent ldns with --enable-ecdsa.
6245	- fix memory leak in errorcase for DSA signatures.
6246	- iana portlist updated.
6247	- workaround for openssl 0.9.8 ecdsa sha2 and evp problem.
6248
62493 February 2012: Wouter
6250	- fix for windows, rename() is not posix compliant on windows.
6251
62522 February 2012: Wouter
6253	- 1.4.16 release tag.
6254	- svn trunk is 1.4.17 in development.
6255	- iana portlist updated.
6256
62571 February 2012: Wouter
6258	- Fix validation failures (like: validation failure xx: no NSEC3
6259	  closest encloser from yy for DS zz. while building chain of trust,
6260	  because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata
6261	  for an NSEC3.  Now it does not change rdata, and fixes TTL.
6262
626330 January 2012: Wouter
6264	- Fix version-number in libtool to be version-info so it produces
6265	  libunbound.so.2 like it should.
6266
626726 January 2012: Wouter
6268	- Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release.
6269	- trunk 1.4.16; includes changes memset testcode, #424 openindiana,
6270	  and keyfile write fixup.
6271	- applied patch to support outgoing-interface with ub_ctx_set_option.
6272
627323 January 2012: Wouter
6274	- Fix memset in test code.
6275
627620 January 2012: Wouter
6277	- Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2.
6278
627919 January 2012: Wouter
6280	- Fix to write key files completely to a temporary file, and if that
6281	  succeeds, replace the real key file.  So failures leave a useful file.
6282
628318 January 2012: Wouter
6284	- tag 1.4.15rc1 created
6285	- updated libunbound/ubsyms.def and remade tag 1.4.15rc1.
6286
628717 January 2012: Wouter
6288	- Fix bug where canonical_compare of RRSIG did not downcase the
6289	  signer-name.  This is mostly harmless because RRSIGs do not have
6290	  to be sorted in canonical order, usually.
6291
629212 January 2012: Wouter
6293	- bug#428: add ub_version() call to libunbound.  API version increase,
6294	  with (binary) backwards compatibility for the previous version.
6295
629610 January 2012: Wouter
6297	- Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL
6298	  that would be permissible by the RFCs but it is not the TTL in the
6299	  cache.
6300	- iana portlist updated.
6301	- uninitialised variable in reprobe for rtt blocked domains fixed.
6302	- lintfix and new flex output.
6303
63042 January 2012: Wouter
6305	- Fix to randomize hash function, based on 28c3 congress, reported
6306	  by Peter van Dijk.
6307
630824 December 2011: Wouter
6309	- Fix for memory leak (about 20 bytes when a tcp or udp send operation
6310	  towards authority servers failed, takes about 50.000 such failures to
6311	  leak one Mb, such failures are also usually logged), reported by
6312	  Robert Fleischmann.
6313	- iana portlist updated.
6314
631519 December 2011: Wouter
6316	- Fix for VU#209659 CVE-2011-4528: Unbound denial of service
6317	  vulnerabilities from nonstandard redirection and denial of existence
6318	  http://www.unbound.net/downloads/CVE-2011-4528.txt
6319	- robust checks for next-closer NSEC3s.
6320	- tag 1.4.14 created.
6321	- trunk has 1.4.15 in development.
6322
632315 December 2011: Wouter
6324	- remove uninit warning from cachedump code.
6325	- Fix parse error on negative SOA RRSIGs if badly ordered in the packet.
6326
632713 December 2011: Wouter
6328	- iana portlist updated.
6329	- svn tag 1.4.14rc1
6330	- fix infra cache comparison.
6331	- Fix to constrain signer_name to be a parent of the lookupname.
6332
63335 December 2011: Wouter
6334	- Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc.
6335	- Fix warnings with gcc 4.6 in compat/inet_ntop.c.
6336	- Fix warning unused in compat/strptime.c.
6337	- Fix malloc detection and double definition.
6338
63392 December 2011: Wouter
6340	- configure generated with autoconf 2.68.
6341
634230 November 2011: Wouter
6343	- Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes
6344	  SERVFAILs.  Also fixed for UDP (but less likely).
6345
634628 November 2011: Wouter
6347	- Fix quartile time estimate, it was too low, (thanks Jan Komissar).
6348	- iana ports updated.
6349
635011 November 2011: Wouter
6351	- Makefile compat with SunOS make, BSD make and GNU make.
6352	- iana ports updated.
6353
635410 November 2011: Wouter
6355	- Makefile changed for BSD make compatibility.
6356
63579 November 2011: Wouter
6358	- added unit test for SSL service and SSL-upstream.
6359
63608 November 2011: Wouter
6361	- can configure ssl service to one port number, and not on others.
6362	- fixup windows compile with ssl support.
6363	- Fix double free in unbound-host, reported by Steve Grubb.
6364	- iana portlist updated.
6365
63661 November 2011: Wouter
6367	- dns over ssl support as a client, ssl-upstream yes turns it on.
6368	  It performs an SSL transaction for every DNS query (250 msec).
6369	- documentation for new options: ssl-upstream, ssl-service-key and
6370	  ssl-service.pem.
6371	- iana portlist updated.
6372	- fix -flto detection on Lion for llvm-gcc.
6373
637431 October 2011: Wouter
6375	- dns over ssl support, ssl-service-pem and ssl-service-key files
6376	  can be given and then TCP queries are serviced wrapped in SSL.
6377
637827 October 2011: Wouter
6379	- lame-ttl and lame-size options no longer exist, it is integrated
6380	  with the host info.  They are ignored (with verbose warning) if
6381	  encountered to keep the config file backwards compatible.
6382	- fix iana-update for changing gzip compression of results.
6383	- fix export-all-symbols on OSX.
6384
638526 October 2011: Wouter
6386	- iana portlist updated.
6387	- Infra cache stores information about ping and lameness per IP, zone.
6388	  This fixes bug #416.
6389	- fix iana_update target for gzipped file on iana site.
6390
639124 October 2011: Wouter
6392	- Fix resolve of partners.extranet.microsoft.com with a fix for the
6393	  server selection for choosing out of a (particular) list of bad
6394	  choices. (bug#415)
6395	- Fix make_new_space function so that the incoming query is not
6396	  overwritten if a jostled out query causes a waiting query to be
6397	  resumed that then fails and sends an error message.  (Thanks to
6398	  Matthew Lee).
6399
640021 October 2011: Wouter
6401	- fix --enable-allsymbols, fptr wlist is disabled on windows with this
6402	  option enabled because of memory layout exe vs dll.
6403
640419 October 2011: Wouter
6405	- fix unbound-anchor for broken strptime on OSX lion, detected
6406	  in configure.
6407	- Detect if GOST really works, openssl1.0 on OSX fails.
6408	- Implement ipv6%interface notation for scope_id usage.
6409
641017 October 2011: Wouter
6411	- better documentation for inform_super (Thanks Yang Zhe).
6412
641314 October 2011: Wouter
6414	- Fix for out-of-memory condition in libunbound (thanks
6415	  Robert Fleischman).
6416
641713 October 2011: Wouter
6418	- Fix --enable-allsymbols, it depended on link specifics of the
6419	  target platform, or fptr_wlist assertion failures could occur.
6420
642112 October 2011: Wouter
6422	- updated contrib/unbound_munin_ to family=auto so that it works with
6423	  munin-node-configure automatically (if installed as
6424	  /usr/local/share/munin/plugins/unbound_munin_ ).
6425
642627 September 2011: Wouter
6427	- unbound.exe -w windows option for start and stop service.
6428
642923 September 2011: Wouter
6430	- TCP-upstream calculates tcp-ping so server selection works if there
6431	  are alternatives.
6432
643320 September 2011: Wouter
6434	- Fix classification of NS set in answer section, where there is a
6435	  parent-child server, and the answer has the AA flag for dir.slb.com.
6436	  Thanks to Amanda Constant from Secure64.
6437
643816 September 2011: Wouter
6439	- fix bug #408: accept patch from Steve Snyder that comments out
6440	  unused functions in lookup3.c.
6441	- iana portlist updated.
6442	- fix EDNS1480 change memleak and TCP fallback.
6443	- fix various compiler warnings (reported by Paul Wouters).
6444	- max sent count.  EDNS1480 only for rtt < 5000.  No promiscuous
6445	  fetch if sentcount > 3, stop query if sentcount > 16.  Count is
6446	  reset when referral or CNAME happens.  This makes unbound better
6447	  at managing large NS sets, they are explored when there is continued
6448	  interest (in the form of queries).
6449
645015 September 2011: Wouter
6451	- release 1.4.13.
6452	- trunk contains 1.4.14 in development.
6453	- Unbound probes at EDNS1480 if there an EDNS0 timeout.
6454
645512 September 2011: Wouter
6456	- Reverted dns EDNS backoff fix, it did not help and needs
6457	  fragmentation fixes instead.
6458	- tag 1.4.13rc2
6459
64607 September 2011: Wouter
6461	- Fix operation in ipv6 only (do-ip4: no) mode.
6462
64636 September 2011: Wouter
6464	- fedora specfile updated.
6465
64665 September 2011: Wouter
6467	- tag 1.4.13rc1
6468
64692 September 2011: Wouter
6470	- iana portlist updated.
6471
647226 August 2011: Wouter
6473	- Fix num-threads 0 does not segfault, reported by Simon Deziel.
6474	- Fix validation failures due to EDNS backoff retries, the retry
6475	  for fetch of data has want_dnssec because the iter_indicate_dnssec
6476	  function returns true when validation failure retry happens, and
6477	  then the serviced query code does not fallback to noEDNS, even if
6478	  the cache says it has this.  This helps for DLV deployment when
6479	  the DNSSEC status is not known for sure before the lookup concludes.
6480
648124 August 2011: Wouter
6482	- Applied patch from Karel Slany that fixes a memory leak in the
6483	  unbound python module, in string conversions.
6484
648522 August 2011: Wouter
6486	- Fix validation of qtype ANY responses with CNAMEs (thanks Cathy
6487	  Zhang and Luo Ce).  Unbound responds with the RR types that are
6488	  available at the name for qtype ANY and validates those RR types.
6489	  It does not test for completeness (i.e. with NSEC or NSEC3 query),
6490	  and it does not follow the CNAME or DNAME to another name (with
6491	  even more data for the already large response).
6492	- Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
6493	- Documented the options that work with control set_option command.
6494	- tcp-upstream yes/no option (works with set_option) for tunnels.
6495
649618 August 2011: Wouter
6497	- fix autoconf call in makedist crosscompile to RC or snapshot.
6498
649917 August 2011: Wouter
6500	- Fix validation of . DS query.
6501	- new xml format at IANA, new awk for iana_update.
6502	- iana portlist updated.
6503
650410 August 2011: Wouter
6505	- Fix python site-packages path to /usr/lib64.
6506	- updated patch from Tom.
6507	- fix memory and fd leak after out-of-memory condition.
6508
65099 August 2011: Wouter
6510	- patch from Tom Hendrikx fixes load of python modules.
6511
65128 August 2011: Wouter
6513	- make clean had ldns-src reference, removed.
6514
65151 August 2011: Wouter
6516	- Fix autoconf 2.68 warnings
6517
651814 July 2011: Wouter
6519	- Unbound implements RFC6303 (since version 1.4.7).
6520	- tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
6521	  meantime, those are for 1.4.13).
6522	- iana portlist updated.
6523
652413 July 2011: Wouter
6525	- Quick fix for contrib/unbound.spec example, no ldns-builtin any more.
6526
652711 July 2011: Wouter
6528	- Fix wildcard expansion no-data reply under an optout NSEC3 zone is
6529	  validated as insecure, reported by Jia Li (lijia@cnnic.cn).
6530
65314 July 2011: Wouter
6532	- 1.4.12rc1 tag created.
6533
65341 July 2011: Wouter
6535	- version number in example config file.
6536	- fix that --enable-static-exe does not complain about it unknown.
6537
653830 June 2011: Wouter
6539	- tag relase 1.4.11, trunk is 1.4.12 development.
6540	- iana portlist updated.
6541	- fix bug#395: id bits of other query may leak out under conditions
6542	- fix replyaddr count wrong after jostled queries, which leads to
6543	  eventual starvation where the daemon has no replyaddrs left to use.
6544	- fix comment about rndc port, that referred to the old port number.
6545	- fix that the listening socket is not closed when too many remote
6546	  control connections are made at the same time.
6547	- removed ldns-src tarball inside the unbound tarball.
6548
654923 June 2011: Wouter
6550	- Changed -flto check to support clang compiler.
6551	- tag 1.4.11rc3 created.
6552
655317 June 2011: Wouter
6554	- tag 1.4.11rc1 created.
6555	- remove warning about signed/unsigned from flex (other flex version).
6556	- updated aclocal.m4 and libtool to match.
6557	- tag 1.4.11rc2 created.
6558
655916 June 2011: Wouter
6560	- log-queries: yesno option, default is no, prints querylog.
6561	- version is 1.4.11.
6562
656314 June 2011: Wouter
6564	- Use -flto compiler flag for link time optimization, if supported.
6565	- iana portlist updated.
6566
656712 June 2011: Wouter
6568	- IPv6 service address for d.root-servers.net (2001:500:2D::D).
6569
657010 June 2011: Wouter
6571	- unbound-control has version number in the header,
6572	  UBCT[version]_space_ is the header sent by the client now.
6573	- Unbound control port number is registered with IANA:
6574	  ub-dns-control  8953/tcp    unbound dns nameserver control
6575	  This is the new default for the control-port config setting.
6576	- statistics-interval prints the number of jostled queries to log.
6577
657830 May 2011: Wouter
6579	- Fix Makefile for U in environment, since wrong U is more common than
6580	  deansification necessity.
6581	- iana portlist updated.
6582	- updated ldns tarball to 1.6.10rc2 snapshot of today.
6583
658425 May 2011: Wouter
6585	- Fix assertion failure when unbound generates an empty error reply
6586	  in response to a query, CVE-2011-1922 VU#531342.
6587	- This fix is in tag 1.4.10.
6588	- defense in depth against the above bug, an error is printed to log
6589	  instead of an assertion failure.
6590
659110 May 2011: Wouter
6592	- bug#386: --enable-allsymbols option links all binaries to libunbound
6593	  and reduces install size significantly.
6594	- feature, ignore-cd-flag: yesno to provide dnssec to legacy servers.
6595	- iana portlist updated.
6596	- Fix TTL of SOA so negative TTL is separately cached from normal TTL.
6597
659814 April 2011: Wouter
6599	- configure created with newer autoconf 2.66.
6600
660112 April 2011: Wouter
6602	- bug#378: Fix that configure checks for ldns_get_random presence.
6603
66048 April 2011: Wouter
6605	- iana portlist updated.
6606	- queries with CD flag set cause DNSSEC validation, but the answer is
6607	  not withheld if it is bogus.  Thus, unbound will retry if it is bad
6608	  and curb the TTL if it is bad, thus protecting the cache for use by
6609	  downstream validators.
6610	- val-override-date: -1 ignores dates entirely, for NTP usage.
6611
661229 March 2011: Wouter
6613	- harden-below-nxdomain: changed so that it activates when the
6614	  cached nxdomain is dnssec secure.  This avoids backwards
6615	  incompatibility because those old servers do not have dnssec.
6616
661724 March 2011: Wouter
6618	- iana portlist updated.
6619	- release 1.4.9.
6620	- trunk is 1.5.0
6621
662217 March 2011: Wouter
6623	- bug#370: new unbound.spec for CentOS 5.x from Harold Jones.
6624	  Applied but did not do the --disable-gost.
6625
662610 March 2011: Wouter
6627	- tag 1.4.9 release candidate 1 created.
6628
66293 March 2011: Wouter
6630	- updated ldns to today.
6631
66321 March 2011: Wouter
6633	- Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout.
6634	- give config parse error for multiple names on a stub or forward zone.
6635	- updated ldns tarball to 1.6.9(todays snapshot).
6636
663724 February 2011: Wouter
6638	- bug #361: Fix, time.elapsed variable not reset with stats_noreset.
6639
664023 February 2011: Wouter
6641	- iana portlist updated.
6642	- common.sh to version 3.
6643
664418 February 2011: Wouter
6645	- common.sh in testdata updated to version 2.
6646
664715 February 2011: Wouter
6648	- Added explicit note on unbound-anchor usage:
6649	  Please note usage of unbound-anchor root anchor is at your own risk
6650	  and under the terms of our LICENSE (see that file in the source).
6651
665211 February 2011: Wouter
6653	- iana portlist updated.
6654	- tpkg updated with common.sh for common functionality.
6655
66567 February 2011: Wouter
6657	- Added regression test for addition of a .net DS to the root, and
6658	  cache effects with different TTL for glue and DNSKEY.
6659	- iana portlist updated.
6660
666128 January 2011: Wouter
6662	- Fix remove private address does not throw away entire response.
6663
666424 January 2011: Wouter
6665	- release 1.4.8
6666
666719 January 2011: Wouter
6668	- fix bug#349: no -L/usr for ldns.
6669
667018 January 2011: Wouter
6671	- ldns 1.6.8 tarball included.
6672	- release 1.4.8rc1.
6673
667417 January 2011: Wouter
6675	- add get and set option for harden-below-nxdomain feature.
6676	- iana portlist updated.
6677
667814 January 2011: Wouter
6679	- Fix so a changed NS RRset does not get moved name stuck on old
6680	  server, for type NS the TTL is not increased.
6681
668213 January 2011: Wouter
6683	- Fix prefetch so it does not get stuck on old server for moved names.
6684
668512 January 2011: Wouter
6686	- iana portlist updated.
6687
668811 January 2011: Wouter
6689	- Fix insecure CNAME sequence marked as secure, reported by Bert
6690	  Hubert.
6691
669210 January 2011: Wouter
6693	- faster lruhash get_mem routine.
6694
66954 January 2011: Wouter
6696	- bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root.
6697	- iana portlist updated.
6698
669923 December 2010: Wouter
6700	- Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
6701
670221 December 2010: Wouter
6703	- algorithm compromise protection using the algorithms signalled in
6704	  the DS record.  Also, trust anchors, DLV, and RFC5011 receive this,
6705	  and thus, if you have multiple algorithms in your trust-anchor-file
6706	  then it will now behave different than before.  Also, 5011 rollover
6707	  for algorithms needs to be double-signature until the old algorithm
6708	  is revoked.
6709	  It is not an option, because I see no use to turn the security off.
6710	- iana portlist updated.
6711
671217 December 2010: Wouter
6713	- squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them).
6714	- fix validation in this case: CNAME to nodata for co-hosted opt-in
6715	  NSEC3 insecure delegation, was bogus, fixed to be insecure.
6716
671716 December 2010: Wouter
6718	- Fix our 'BDS' license (typo reported by Xavier Belanger).
6719
672010 December 2010: Wouter
6721	- iana portlist updated.
6722	- review changes for unbound-anchor.
6723
67242 December 2010: Wouter
6725	- feature typetransparent localzone, does not block other RR types.
6726
67271 December 2010: Wouter
6728	- Fix bug#338: print address when socket creation fails.
6729
673030 November 2010: Wouter
6731	- Fix storage of EDNS failures in the infra cache.
6732	- iana portlist updated.
6733
673418 November 2010: Wouter
6735	- harden-below-nxdomain option, default off (because very old
6736	  software may be incompatible).  We could enable it by default in
6737	  the future.
6738
673917 November 2010: Wouter
6740	- implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN.
6741	- make test output nicer.
6742
674315 November 2010: Wouter
6744	- silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
6745	- iana portlist updated.
6746	- so-sndbuf option for very busy servers, a bit like so-rcvbuf.
6747
67489 November 2010: Wouter
6749	- unbound-anchor compiles with openssl 0.9.7.
6750
67518 November 2010: Wouter
6752	- release tag 1.4.7.
6753	- trunk is version 1.4.8.
6754	- Be lenient and accept imgw.pl malformed packet (like BIND).
6755
67565 November 2010: Wouter
6757	- do not synthesize a CNAME message from cache for qtype DS.
6758
67594 November 2010: Wouter
6760	- Use central entropy to seed threads.
6761
67623 November 2010: Wouter
6763	- Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
6764
67652 November 2010: Wouter
6766	- tag 1.4.7rc1.
6767	- code review.
6768
67691 November 2010: Wouter
6770	- GOST code enabled by default (RFC 5933).
6771
677227 October 2010: Wouter
6773	- Fix uninit value in dump_infra print.
6774	- Fix validation failure for parent and child on same server with an
6775	  insecure childzone and a CNAME from parent to child.
6776	- Configure detects libev-4.00.
6777
677826 October 2010: Wouter
6779	- dump_infra and flush_infra commands for unbound-control.
6780	- no timeout backoff if meanwhile a query succeeded.
6781	- Change of timeout code.  No more lost and backoff in blockage.
6782	  At 12sec timeout (and at least 2x lost before) one probe per IP
6783	  is allowed only.  At 120sec, the IP is blocked.  After 15min, a
6784	  120sec entry has a single retry packet.
6785
678625 October 2010: Wouter
6787	- Configure errors if ldns is not found.
6788
678922 October 2010: Wouter
6790	- Windows 7 fix for the installer.
6791
679221 October 2010: Wouter
6793	- Fix bug where fallback_tcp causes wrong roundtrip and edns
6794	  observation to be noted in cache.  Fix bug where EDNSprobe halted
6795	  exponential backoff if EDNS status unknown.
6796	- new unresponsive host method, exponentially increasing block backoff.
6797	- iana portlist updated.
6798
679920 October 2010: Wouter
6800	- interface automatic works for some people with ip6 disabled.
6801	  Therefore the error check is removed, so they can use the option.
6802
680319 October 2010: Wouter
6804	- Fix for request list growth, if a server has long timeout but the
6805	  lost counter is low, then its effective rtt is the one without
6806	  exponential backoff applied.  Because the backoff is not working.
6807	  The lost counter can then increase and the server is blacklisted,
6808	  or the lost counter does not increase and the server is working
6809	  for some queries.
6810
681118 October 2010: Wouter
6812	- iana portlist updated.
6813
681413 October 2010: Wouter
6815	- Fix TCP so it uses a random outgoing-interface.
6816	- unbound-anchor handles ADDPEND keystate.
6817
681811 October 2010: Wouter
6819	- Fix bug when DLV below a trust-anchor that uses NSEC3 optout where
6820	  the zone has a secure delegation hosted on the same server did not
6821	  verify as secure (it was insecure by mistake).
6822	- iana portlist updated.
6823	- ldns tarball updated (for reading cachedumps with bad RR data).
6824
68251 October 2010: Wouter
6826	- test for unbound-anchor. fix for reading certs.
6827	- Fix alloc_reg_release for longer uptime in out of memory conditions.
6828
682928 September 2010: Wouter
6830	- unbound-anchor working, it creates or updates a root.key file.
6831	  Use it before you start the validator (e.g. at system boot time).
6832
683327 September 2010: Wouter
6834	- iana portlist updated.
6835
683624 September 2010: Wouter
6837	- bug#329: in example.conf show correct ipv4 link-local 169.254/16.
6838
683923 September 2010: Wouter
6840	- unbound-anchor app, unbound requires libexpat (xml parser library).
6841
684222 September 2010: Wouter
6843	- compliance with draft-ietf-dnsop-default-local-zones-14, removed
6844	  reverse ipv6 orchid prefix from builtin list.
6845	- iana portlist updated.
6846
684717 September 2010: Wouter
6848	- DLV has downgrade protection again, because the RFC says so.
6849	- iana portlist updated.
6850
685116 September 2010: Wouter
6852	- Algorithm rollover operational reality intrudes, for trust-anchor,
6853	  5011-store, and DLV-anchor if one key matches it's good enough.
6854	- iana portlist updated.
6855	- Fix reported validation error in out of memory condition.
6856
685715 September 2010: Wouter
6858	- Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
6859
686014 September 2010: Wouter
6861	- increased mesh-max-activation from 1000 to 3000 for crazy domains
6862	  like _tcp.slb.com with 262 servers.
6863	- iana portlist updated.
6864
686513 September 2010: Wouter
6866	- bug#327: Fix for cannot access stub zones until the root is primed.
6867
68689 September 2010: Wouter
6869	- unresponsive servers are not completely blacklisted (because of
6870	  firewalls), but also not probed all the time (because of the request
6871	  list size it generates).  The probe rate is 1%.
6872	- iana portlist updated.
6873
687420 August 2010: Wouter
6875	- openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled.
6876	  iterator get_mem includes priv_get_mem.  delegpt nodup removed.
6877	  listen_pushback, query_info_allocqname, write_socket, send_packet,
6878	  comm_point_set_cb_arg and listen_resume removed.
6879
688019 August 2010: Wouter
6881	- Fix bug#321: resolution of rs.ripe.net artifacts with 0x20.
6882	  Delegpt structures checked for duplicates always.
6883	  No more nameserver lookups generated when depth is full anyway.
6884	- example.conf notes how to do DNSSEC validation and track the root.
6885	- iana portlist updated.
6886
688718 August 2010: Wouter
6888	- Fix bug#322: configure does not respect CFLAGS on Solaris.
6889	  Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line
6890	  if use sun-cc, but some systems need different flags.
6891
689216 August 2010: Wouter
6893	- Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP
6894	  changes, uses m4_bpatsubst now.
6895	- make test (or make check) should be more portable and run the unit
6896	  test and testbound scripts. (make longtest has special requirements).
6897
689813 August 2010: Wouter
6899	- More pleasant remote control command parsing.
6900	- documentation added for return values reported by doxygen 1.7.1.
6901	- iana portlist updated.
6902
69039 August 2010: Wouter
6904	- Fix name of rrset printed that failed validation.
6905
69065 August 2010: Wouter
6907	- Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
6908
69094 August 2010: Wouter
6910	- Fix validation in case a trust anchor enters into a zone with
6911	  unsupported algorithms.
6912
69133 August 2010: Wouter
6914	- updated ldns tarball with bugfixes.
6915	- release tag 1.4.6.
6916	- trunk becomes 1.4.7 develop.
6917	- iana portlist updated.
6918
691922 July 2010: Wouter
6920	- more error details on failed remote control connection.
6921
692215 July 2010: Wouter
6923	- rlimit adjustments for select and ulimit can happen at the same time.
6924
692514 July 2010: Wouter
6926	- Donation text added to README.
6927	- Fix integer underflow in prefetch ttl creation from cache.  This
6928	  fixes a potential negative prefetch ttl.
6929
693012 July 2010: Wouter
6931	- Changed the defaults for num-queries-per-thread/outgoing-range.
6932	  For builtin-select: 512/960, for libevent 1024/4096 and for
6933	  windows 24/48 (because of win api).  This makes the ratio this way
6934	  to improve resilience under heavy load.  For high performance, use
6935	  libevent and possibly higher numbers.
6936
693710 July 2010: Wouter
6938	- GOST enabled if SSL is recent and ldns has GOST enabled too.
6939	- ldns tarball updated.
6940
69419 July 2010: Wouter
6942	- iana portlist updated.
6943	- Fix validation of qtype DNSKEY when a key-cache entry exists but
6944	  no rr-cache entry is used (it expired or prefetch), it then goes
6945	  back up to the DS or trust-anchor to validate the DNSKEY.
6946
69477 July 2010: Wouter
6948	- Neat function prototypes, unshadowed local declarations.
6949
69506 July 2010: Wouter
6951	- failure to chown the pidfile is not fatal any more.
6952	- testbound uses UTC timezone.
6953	- ldns tarball updated (ports and works on Minix 3.1.7).  On Minix, add
6954	  /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake.
6955
69565 July 2010: Wouter
6957	- log if a server is skipped because it is on the donotquery list,
6958	  at verbosity 4, to enable diagnosis why no queries to 127.0.0.1.
6959	- added feature to print configure date, target and options with -h.
6960	- added feature to print event backend system details with -h.
6961	- wdiff is not actually required by make test, updated requirements.
6962
69631 July 2010: Wouter
6964	- Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex
6965	  must be signed with all algorithms from the DS rrset at the parent.
6966	  This is now checked and becomes bogus if not.
6967
696828 June 2010: Wouter
6969	- Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps
6970	  in overload situations to be about 5 qps for the class of shortly
6971	  serviced queries.
6972	  The capacity of the resolver is then about (numqueriesperthread / 2)
6973	  / (average time for such long queries) qps for long queries.
6974	  And about (numqueriesperthread / 2)/(jostletimeout in whole seconds)
6975	  qps for short queries, per thread.
6976	- Fix the max number of reply-address count to be applied for duplicate
6977	  queries, and not for new query list entries.  This raises the memory
6978	  usage to a max of (16+1)*numqueriesperthread reply addresses.
6979
698025 June 2010: Wouter
6981	- Fix handling of corner case reply from lame server, follows rfc2308.
6982	  It could lead to a nodata reply getting into the cache if the search
6983	  for a non-lame server turned up other misconfigured servers.
6984	- unbound.h has extern "C" statement for easier include in c++.
6985
698623 June 2010: Wouter
6987	- iana portlist updated.
6988	- makedist upgraded cross compile openssl option, like this:
6989	  ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost
6990
699122 June 2010: Wouter
6992	- Unbound reports libev or libevent correctly in logs in verbose mode.
6993	- Fix to unload gost dynamic library module for leak testing.
6994
699518 June 2010: Wouter
6996	- iana portlist updated.
6997
699817 June 2010: Wouter
6999	- Add AAAA to root hints for I.ROOT-SERVERS.NET.
7000
700116 June 2010: Wouter
7002	- Fix assertion failure reported by Kai Storbeck from XS4ALL, the
7003	  assertion was wrong.
7004	- updated ldns tarball.
7005
700615 June 2010: Wouter
7007	- tag 1.4.5 created.
7008	- trunk contains 1.4.6 in development.
7009	- Fix TCPreply on systems with no writev, if just 1 byte could be sent.
7010	- Fix to use one pointer less for iterator query state store_parent_NS.
7011	- makedist crosscompile to windows uses builtin ldns not host ldns.
7012	- Max referral count from 30 to 130, because 128 one character domains
7013	  is valid DNS.
7014	- added documentation for the histogram printout to syslog.
7015
701611 June 2010: Wouter
7017	- When retry to parent the retrycount is not wiped, so failed
7018	  nameservers are not tried again.
7019	- iana portlist updated.
7020
702110 June 2010: Wouter
7022	- Fix bug where a long loop could be entered, now cycle detection
7023	  has a loop-counter and maximum search amount.
7024
70254 June 2010: Wouter
7026	- iana portlist updated.
7027	- 1.4.5rc1 tag created.
7028
70293 June 2010: Wouter
7030	- ldns tarball updated, 1.6.5.
7031	- review comments, split dependency cycle tracking for parentside
7032	  last resort lookups for A and AAAA so there are more lookup options.
7033
70342 June 2010: Wouter
7035	- Fix compile warning if compiled without threads.
7036	- updated ldns-tarball with current ldns svn (pre 1.6.5).
7037	- GOST disabled-by-default, the algorithm number is allocated but the
7038	  RFC is still has to pass AUTH48 at the IETF.
7039
70401 June 2010: Wouter
7041	- Ignore Z flag in incoming messages too.
7042	- Fix storage of negative parent glue if that last resort fails.
7043	- libtoolize 2.2.6b, autoconf 2.65 applied to configure.
7044	- new splint flags for newer splint install.
7045
704631 May 2010: Wouter
7047	- Fix AD flag handling, it could in some cases mistakenly copy the AD
7048	  flag from upstream servers.
7049	- alloc_special_obtain out of memory is not a fatal error any more,
7050	  enabling unbound to continue longer in out of memory conditions.
7051	- parentside names are dispreferred but not said to be dnssec-lame.
7052	- parentside check for cached newname glue.
7053	- fix parentside and querytargets modulestate, for dump_requestlist.
7054	- unbound-control-setup makes keys -rw-r--- so not all users permitted.
7055	- fix parentside from cache to be marked dispreferred for bad names.
7056
705728 May 2010: Wouter
7058	- iana portlist updated.
7059	- parent-child disagreement approach altered.  Older fixes are
7060	  removed in place of a more exhaustive search for misconfigured data
7061	  available via the parent of a delegation.
7062	  This is designed to be throttled by cache entries, with TTL from the
7063	  parent if possible.  Additionally the loop-counter is used.
7064	  It also tests for NS RRset differences between parent and child.
7065	  The fetch of misconfigured data should be more reliable and thorough.
7066	  It should work reliably even with no or only partial data in cache.
7067	  Data received from the child (as always) is deemed more
7068	  authoritative than information received from the delegation parent.
7069	  The search for misconfigured data is not performed normally.
7070
707126 May 2010: Wouter
7072	- Contribution from Migiel de Vos (Surfnet): nagios patch for
7073	  unbound-host, in contrib/ (in the source tarball).  Makes
7074	  unbound-host suitable for monitoring dnssec(-chain) status.
7075
707621 May 2010: Wouter
7077	- EDNS timeout code will not fire if EDNS status already known.
7078	- EDNS failure not stored if EDNS status known to work.
7079
708019 May 2010: Wouter
7081	- Fix resolution for domains like safesvc.com.cn.  If the iterator
7082	  can not recurse further and it finds the delegation in a state
7083	  where it would otherwise have rejected it outhand if so received
7084	  from a cache lookup, then it can try to ask higherup (with loop
7085	  protection).
7086	- Fix comments in iter_utils:dp_is_useless.
7087
708818 May 2010: Wouter
7089	- Fix various compiler warnings from the clang llvm compiler.
7090	- iana portlist updated.
7091
70926 May 2010: Wouter
7093	- Fix bug#308: spelling error in variable name in parser and lexer.
7094
70954 May 2010: Wouter
7096	- Fix dnssec-missing detection that was turned off by server selection.
7097	- Conforms to draft-ietf-dnsop-default-local-zones-13.  Added default
7098	  reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa,
7099	  113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa.
7100
710129 April 2010: Wouter
7102	- Fix for dnssec lameness detection to use the key cache.
7103	- infra cache entries that are expired are wiped clean.  Previously
7104	  it was possible to not expire host data (if accessed often).
7105
710628 April 2010: Wouter
7107	- ldns tarball updated and GOST support is detected and then enabled.
7108	- iana portlist updated.
7109	- Fix detection of gost support in ldns (reported by Chris Smith).
7110
711127 April 2010: Wouter
7112	- unbound-control get_option domain-insecure shows config file items.
7113	- fix retry sequence if prime hints are recursion-lame.
7114	- autotrust anchor file can be initialized with a ZSK key as well.
7115	- harden-referral-path does not result in failures due to max-depth.
7116	  You can increase the max-depth by adding numbers (' 0') after the
7117	  target-fetch-policy, this increases the depth to which is checked.
7118
711926 April 2010: Wouter
7120	- Compile fix using Sun Studio 12 compiler on Solaris 5.9, use
7121	  CPPFLAGS during configure process.
7122	- if libev is installed on the base system (not libevent), detect
7123	  it from the event.h header file and link with -lev.
7124	- configlexer.lex gets config.h, and configyyrename.h added by make,
7125	  no more double include.
7126	- More strict scrubber (Thanks to George Barwood for the idea):
7127	  NS set must be pertinent to the query (qname subdomain nsname).
7128	- Fix bug#307: In 0x20 backoff fix fallback so the number of
7129	  outstanding queries does not become -1 and block the request.
7130	  Fixed handling of recursion-lame in combination with 0x20 fallback.
7131	  Fix so RRsets are compared canonicalized and sorted if the immediate
7132	  comparison fails, this makes it work around round-robin sites.
7133
713423 April 2010: Wouter
7135	- Squelch log message: sendto failed permission denied for
7136	  255.255.255.255, it is visible in VERB_DETAIL (verbosity 2).
7137	- Fix to fetch data as last resort more tenaciously.  When cycle
7138	  targets cause the server selection to believe there are more options
7139	  when they really are not there, the server selection is reinitiated.
7140	- Fix fetch from blacklisted dnssec lame servers as last resort.  The
7141	  server's IP address is then given in validator errors as well.
7142	- Fix local-zone type redirect that did not use the query name for
7143	  the answer rrset.
7144
714522 April 2010: Wouter
7146	- tag 1.4.4.
7147	- trunk contains 1.4.5 in development.
7148	- Fix validation failure for qtype ANY caused by a RRSIG parse failure.
7149	  The validator error message was 'no signatures from ...'.
7150
715116 April 2010: Wouter
7152	- more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
7153	- tag 1.4.4rc1.
7154
715515 April 2010: Wouter
7156	- ECC-GOST algorithm number 12 that is assigned by IANA.  New test
7157	  example key and signatures for GOST.  GOST requires openssl-1.0.0.
7158	  GOST is still disabled by default.
7159
71609 April 2010: Wouter
7161	- Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
7162	  get into an endless loop, if 0x20 was enabled, and buffers are small
7163	  or particular broken packets are received.
7164	- Fix chain of trust with CNAME at an intermediate step, for the DS
7165	  processing proof.
7166
71678 April 2010: Wouter
7168	- Fix validation of queries with wildcard names (*.example).
7169
71706 April 2010: Wouter
7171	- Fix EDNS probe for .de DNSSEC testbed failure, where the infra
7172	  cache timeout coincided with a server update, the current EDNS
7173	  backoff is less sensitive, and does not cache the backoff unless
7174	  the backoff actually works and the domain is not expecting DNSSEC.
7175	- GOST support with correct algorithm numbers.
7176
71771 April 2010: Wouter
7178	- iana portlist updated.
7179
718024 March 2010: Wouter
7181	- unbound control flushed items are not counted when flushed again.
7182
718323 March 2010: Wouter
7184	- iana portlist updated.
7185
718622 March 2010: Wouter
7187	- unbound-host disables use-syslog from config file so that the
7188	  config file for the main server can be used more easily.
7189	- fix bug#301: unbound-checkconf could not parse interface
7190	  '0.0.0.0@5353', even though unbound itself worked fine.
7191
719219 March 2010: Wouter
7193	- fix fwd_ancil test to pass if the socket options are not supported.
7194
719518 March 2010: Wouter
7196	- Fixed random numbers for port, interface and server selection.
7197	  Removed very small bias.
7198	- Refer to the listing in unbound-control man page in the extended
7199	  statistics entry in the unbound.conf man page.
7200
720116 March 2010: Wouter
7202	- Fix interface-automatic for OpenBSD: msg.controllen was too small,
7203	  also assertions on ancillary data buffer.
7204	- check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
7205	- for NSEC3 check if signatures are cached.
7206
720715 March 2010: Wouter
7208	- unit test for util/regional.c.
7209
721012 March 2010: Wouter
7211	- Reordered configure checks so fork and -lnsl -lsocket checks are
7212	  earlier, and thus later checks benefit from and do not hinder them.
7213	- iana portlist updated.
7214	- ldns tarball updated.
7215	- Fix python use when multithreaded.
7216	- Fix solaris python compile.
7217	- Include less in config.h and include per code file for ldns, ssl.
7218
721911 March 2010: Wouter
7220	- another memory allocation option: --enable-alloc-nonregional.
7221	  exposes the regional allocations to other memory purifiers.
7222	- fix for memory alignment in struct sock_list allocation.
7223	- Fix for MacPorts ldns without ssl default, unbound checks if ldns
7224	  has dnssec functionality and uses the builtin if not.
7225	- Fix daemonize on Solaris 10, it did not detach from terminal.
7226	- tag 1.4.3 created.
7227	- trunk is 1.4.4 in development.
7228	- spelling fix in validation error involving cnames.
7229
723010 March 2010: Wouter
7231	- --enable-alloc-lite works with test set.
7232	- portability in the testset: printf format conversions, prototypes.
7233
72349 March 2010: Wouter
7235	- tag 1.4.2 created.
7236	- trunk is 1.4.3 in development.
7237	- --enable-alloc-lite debug option.
7238
72398 March 2010: Wouter
7240	- iana portlist updated.
7241
72424 March 2010: Wouter
7243	- Fix crash in control channel code.
7244
72453 March 2010: Wouter
7246	- better casts in pipe code, brackets placed wrongly.
7247	- iana portlist updated.
7248
72491 March 2010: Wouter
7250	- make install depends on make all.
7251	- Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs.
7252	- --enable-checking: enables assertions but does not look nonproduction.
7253	- nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with
7254	  nxdomain and nodata distinguished.
7255	- ldns tarball updated.
7256	- --disable-rpath fixed for libtool not found errors.
7257	- new fedora specfile from Fedora13 in contrib from Paul Wouters.
7258
725926 February 2010: Wouter
7260	- Fixup prototype for lexer cleanup in daemon code.
7261	- unbound-control list_stubs, list_forwards, list_local_zones and
7262	  list_local_data.
7263
726424 February 2010: Wouter
7265	- Fix scrubber bug that potentially let NS records through.  Reported
7266	  by Amanda Constant.
7267	- Also delete potential poison references from additional.
7268	- Fix: no classification of a forwarder as lame, throw away instead.
7269
727023 February 2010: Wouter
7271	- libunbound ub_ctx_get_option() added.
7272	- unbound-control set_option and get_option commands.
7273	- iana portlist updated.
7274
727518 February 2010: Wouter
7276	- A little more strict DS scrubbing.
7277	- No more blacklisting of unresponsive servers, a 2 minute timeout
7278	  is backed off to.
7279	- RD flag not enabled for dnssec-blacklisted tries, unless necessary.
7280	- pickup ldns compile fix, libdl for libcrypto.
7281	- log 'tcp connect: connection timed out' only in high verbosity.
7282	- unbound-control log_reopen command.
7283	- moved get_option code from unbound-checkconf to util/config_file.c
7284
728517 February 2010: Wouter
7286	- Disregard DNSKEY from authority section for chain of trust.
7287	  DS records that are irrelevant to a referral scrubbed.  Anti-poison.
7288	- iana portlist updated.
7289
729016 February 2010: Wouter
7291	- Check for 'no space left on device' (or other errors) when
7292	  writing updated autotrust anchors and print errno to log.
7293
729415 February 2010: Wouter
7295	- Fixed the requery protection, the TTL was 0, it is now 900 seconds,
7296	  hardcoded.  We made the choice to send out more conservatively,
7297	  protecting against an aggregate effect more than protecting a
7298	  single user (from their own folly, perhaps in case of misconfig).
7299
730012 February 2010: Wouter
7301	- Re-query pattern changed on validation failure.  To protect troubled
7302	  authority servers, unbound caches a failure for the DNSKEY or DS
7303	  records for the entire zone, and only retries that 900 seconds later.
7304	  This implies that only a handful of packets are sent extra to the
7305	  authority if the zone fails.
7306
730711 February 2010: Wouter
7308	- ldns tarball update for long label length syntax error fix.
7309	- iana portlist updated.
7310
73119 February 2010: Wouter
7312	- Fixup in compat snprintf routine, %f 1.02 and %g support.
7313	- include math.h for testbound test compile portability.
7314
73152 February 2010: Wouter
7316	- Updated url of IANA itar, interim trust anchor repository, in script.
7317
73181 February 2010: Wouter
7319	- iana portlist updated.
7320	- configure test for memcmp portability.
7321
732227 January 2010: Wouter
7323	- removed warning on format string in validator error log statement.
7324	- iana portlist updated.
7325
732622 January 2010: Wouter
7327	- libtool finish the install of unbound python dynamic library.
7328
732921 January 2010: Wouter
7330	- acx_nlnetlabs.m4 synchronised with nsd's version.
7331
733220 January 2010: Wouter
7333	- Fixup lookup trouble for parent-child domains on the first query.
7334
733514 January 2010: Wouter
7336	- Fixup ldns detection to also check for header files.
7337
733813 January 2010: Wouter
7339	- prefetch-key option that performs DNSKEY queries earlier in the
7340	  validation process, and that could halve the latency on DNSSEC
7341	  queries.  It takes some extra processing (CPU, a cache is needed).
7342
734312 January 2010: Wouter
7344	- Fix unbound-checkconf for auto-trust-anchor-file present checks.
7345
73468 January 2010: Wouter
7347	- Fix for parent-child disagreement code which could have trouble
7348	  when (a) ipv6 was disabled and (b) the TTL for parent and child
7349	  were different.  There were two bugs, the parent-side information
7350	  is fixed to no longer block lookup of child side information and
7351	  the iterator is fixed to no longer attempt to get ipv6 when it is
7352	  not enabled and then give up in failure.
7353	- test and fixes to make prefetch actually store the answer in the
7354	  cache.  Considers some rrsets 'already expired' but does not allow
7355	  overwriting of rrsets considered more secure.
7356
73577 January 2010: Wouter
7358	- Fixup python documentation (thanks Leo Vandewoestijne).
7359	- Work on cache prefetch feature.
7360	- Stats for prefetch, in log print stats, unbound-control stats
7361	  and in unbound_munin plugin.
7362
73636 January 2010: Wouter
7364	- iana portlist updated.
7365	- bug#291: DNS wireformat max is 255. dname_valid allowed 256 length.
7366	- verbose output includes parent-side-address notion for lameness.
7367	- documented val-log-level: 2 setting in example.conf and man page.
7368	- change unbound-control-setup from 1024(sha1) to 1536(sha256).
7369
73701 January 2010: Wouter
7371	- iana portlist updated.
7372
737322 December 2009: Wouter
7374	- configure with newer libtool 2.2.6b.
7375
737617 December 2009: Wouter
7377	- review comments.
7378	- tag 1.4.1.
7379	- trunk to version 1.4.2.
7380
738115 December 2009: Wouter
7382	- Answer to qclass=ANY queries, with class IN contents.
7383	  Test that validation also works.
7384	- updated ldns snapshot tarball with latest fixes (parsing records).
7385
738611 December 2009: Wouter
7387	- on IPv4 UDP turn off DF flag.
7388
738910 December 2009: Wouter
7390	- requirements.txt updated with design choice explanations.
7391	- Reading fixes: fix to set unlame when child confirms parent glue,
7392	  and fix to avoid duplicate addresses in delegation point.
7393	- verify_rrsig routine checks expiration last.
7394
73959 December 2009: Wouter
7396	- Fix Bug#287(reopened): update of ldns tarball with fix for parse
7397	  errors generated for domain names like '.example.com'.
7398	- Fix SOA excluded from negative DS responses.  Reported by Hauke
7399	  Lampe.  The negative cache did not include proper SOA records for
7400	  negative qtype DS responses which makes BIND barf on it, such
7401	  responses are now only used internally.
7402	- Fix negative cache lookup of closestencloser check of DS type bit.
7403
74048 December 2009: Wouter
7405	- Fix for lookup of parent-child disagreement domains, where the
7406	  parent-side glue works but it does not provide proper NS, A or AAAA
7407	  for itself, fixing domains such as motorcaravanners.eu.
7408	- Feature: you can specify a port number in the interface: line, so
7409	  you can bind the same interface multiple times at different ports.
7410
74117 December 2009: Wouter
7412	- Bug#287: Fix segfault when unbound-control remove nonexistent local
7413	  data.  Added check to tests.
7414
74151 December 2009: Wouter
7416	- Fix crash with module-config "iterator".
7417	- Added unit test that has "iterator" module-config.
7418
741930 November 2009: Wouter
7420	- bug#284: fix parse of # without end-of-line at end-of-file.
7421
742226 November 2009: Wouter
7423	- updated ldns with release candidate for version 1.6.3.
7424	- tag for 1.4.0 release.
7425	- 1.4.1 version in trunk.
7426	- Fixup major libtool version to 2 because of why_bogus change.
7427	  It was 1:5:0 but should have been 2:0:0.
7428
742923 November 2009: Wouter
7430	- Patch from David Hubbard for libunbound manual page.
7431	- Fixup endless spinning in unbound-control stats reported by
7432	  Attila Nagy.  Probably caused by clock reversal.
7433
743420 November 2009: Wouter
7435	- contrib/split-itar.sh contributed by Tom Hendrikx.
7436
743719 November 2009: Wouter
7438	- better argument help for unbound-control.
7439	- iana portlist updated.
7440
744117 November 2009: Wouter
7442	- noted multiple entries for multiple domain names in example.conf.
7443	- iana portlist updated.
7444
744516 November 2009: Wouter
7446	- Fixed signer detection of CNAME responses without signatures.
7447	- Fix#282 libunbound memleak on error condition by Eric Sesterhenn.
7448	- Tests for CNAMEs to deeper trust anchors, secure and bogus.
7449	- svn tag 1.4.0rc1 made.
7450
745113 November 2009: Wouter
7452	- Fixed validation failure for CNAME to optout NSEC3 nodata answer.
7453	- unbound-host does not fail on type ANY.
7454	- Fixed wireparse failure to put RRSIGs together with data in some
7455	  long ANY mix cases, which fixes validation failures.
7456
745712 November 2009: Wouter
7458	- iana portlist updated.
7459	- fix manpage errors reported by debian lintian.
7460	- review comments.
7461	- fixup very long vallog2 level error strings.
7462
746311 November 2009: Wouter
7464	- ldns tarball updated (to 1.6.2).
7465	- review comments.
7466
746710 November 2009: Wouter
7468	- Thanks to Surfnet found bug in new dnssec-retry code that failed
7469	  to combine well when combined with DLV and a particular failure.
7470	- Fixed unbound-control -h output about argument optionality.
7471	- review comments.
7472
74735 November 2009: Wouter
7474	- lint fixes and portability tests.
7475	- better error text for multiple domain keys in one autotrust file.
7476
74772 November 2009: Wouter
7478	- Fix bug where autotrust does not work when started with a DS.
7479	- Updated GOST unit tests for unofficial algorithm number 249
7480	  and DNSKEY-format changes in draft version -01.
7481
748229 October 2009: Wouter
7483	- iana portlist updated.
7484	- edns-buffer-size option, default 4096.
7485	- fixed do-udp: no.
7486
748728 October 2009: Wouter
7488	- removed abort on prealloc failure, error still printed but softfail.
7489	- iana portlist updated.
7490	- RFC 5702: RSASHA256 and RSASHA512 support enabled by default.
7491	- ldns tarball updated (which also enables rsasha256 support).
7492
749327 October 2009: Wouter
7494	- iana portlist updated.
7495
74968 October 2009: Wouter
7497	- please doxygen
7498	- add val-log-level print to corner case (nameserver.epost.bg).
7499	- more detail to errors from insecure delegation checks.
7500	- Fix double time subtraction in negative cache reported by
7501	  Amanda Constant and Hugh Mahon.
7502	- Made new validator error string available from libunbound for
7503	  applications.  It is in result->why_bogus, a zero-terminated string.
7504	  unbound-host prints it by default if a result is bogus.
7505	  Also the errinf is public in module_qstate (for other modules).
7506
75077 October 2009: Wouter
7508	- retry for validation failure in DS and prime results. Less mem use.
7509	  unit test.  Provisioning in other tests for requeries.
7510	- retry for validation failure in DNSKEY in middle of chain of trust.
7511	  unit test.
7512	- retry for empty non terminals in chain of trust and unit test.
7513	- Fixed security bug where the signatures for NSEC3 records were not
7514	  checked when checking for absence of DS records.  This could have
7515	  enabled the substitution of an insecure delegation.
7516	- moved version number to 1.4.0 because of 1.3.4 release with only
7517	  the NSEC3 patch from the entry above.
7518	- val-log-level: 2 shows extended error information for validation
7519	  failures, but still one (longish) line per failure.  For example:
7520	  validation failure <example.com. DNSKEY IN>: signature expired from
7521	  192.0.2.4 for trust anchor example.com. while building chain of trust
7522	  validation failure <www.example.com. A IN>: no signatures from
7523	  192.0.2.6 for key example.com. while building chain of trust
7524
75256 October 2009: Wouter
7526	- Test set updated to provide additional ns lookup result.
7527	  The retry would attempt to fetch the data from other nameservers
7528	  for bogus data, and this needed to be provisioned in the tests.
7529
75305 October 2009: Wouter
7531	- first validation failure retry code.  Retries for data failures.
7532	  And unit test.
7533
75342 October 2009: Wouter
7535	- improve 5011 modularization.
7536	- fix unbound-host so -d can be given before -C.
7537	- iana portlist updated.
7538
753928 September 2009: Wouter
7540	- autotrust-anchor-file can read multiline input and $ORIGIN.
7541	- prevent integer overflow in holddown calculation. review fixes.
7542	- fixed race condition in trust point revocation. review fix.
7543	- review fixes to comments, removed unused code.
7544
754525 September 2009: Wouter
7546	- so-rcvbuf: 4m option added.  Set this on large busy servers to not
7547	  drop the occasional packet in spikes due to full socket buffers.
7548	  netstat -su keeps a counter of UDP dropped due to full buffers.
7549	- review of validator/autotrust.c, small fixes and comments.
7550
755123 September 2009: Wouter
7552	- 5011 query failed counts verification failures, not lookup failures.
7553	- 5011 probe failure handling fixup.
7554	- test unbound reading of original autotrust data.
7555	  The metadata per-key, such as key state (PENDING, MISSING, VALID) is
7556	  picked up, otherwise performs initial probe like usual.
7557
755822 September 2009: Wouter
7559	- autotrust test with algorithm rollover, new ordering of checks
7560	  assists in orderly rollover.
7561	- autotrust test with algorithm rollover to unknown algorithm.
7562	  checks if new keys are supported before adding them.
7563	- autotrust test with trust point revocation, becomes unsigned.
7564	- fix DNSSEC-missing-signature detection for minimal responses
7565	  for qtype DNSKEY (assumes DNSKEY occurs at zone apex).
7566
756718 September 2009: Wouter
7568	- autotrust tests, fix trustpoint timer deletion code.
7569	  fix count of valid anchors during missing remove.
7570	- autotrust: pick up REVOKE even if not signed with known other keys.
7571
757217 September 2009: Wouter
7573	- fix compile of unbound-host when --enable-alloc-checks.
7574	- Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis.
7575	- Manual page fixes reported by Tony Finch.
7576
757716 September 2009: Wouter
7578	- Fix memory leak reported by Tao Ma.
7579	- Fix memstats test tool for log-time-ascii log format.
7580
758115 September 2009: Wouter
7582	- iana portlist updated.
7583
758410 September 2009: Wouter
7585	- increased MAXSYSLOGLEN so .bg key can be printed in debug output.
7586	- use linebuffering for log-file: output, this can be significantly
7587	  faster than the previous fflush method and enable some class of
7588	  resolvers to use high verbosity (for short periods).
7589	  Not on windows, because line buffering does not work there.
7590
75919 September 2009: Wouter
7592	- Fix bug where DNSSEC-bogus messages were marked with too high TTL.
7593	  The RRsets would still expire at the normal time, but this would
7594	  keep messages bogus in the cache for too long.
7595	- regression test for that bug.
7596	- documented that load_cache is meant for debugging.
7597
75988 September 2009: Wouter
7599	- fixup printing errors when load_cache, they were printed to the
7600	  SSL connection which broke, now to the log.
7601	- new ldns - with fixed parse of large SOA values.
7602
76037 September 2009: Wouter
7604	- autotrust testbound scenarios.
7605	- autotrust fix that failure count is written to file.
7606	- autotrust fix that keys may become valid after add holddown time
7607	  alone, before the probe returns.
7608
76094 September 2009: Wouter
7610	- Changes to make unbound work with libevent-2.0.3 alpha. (in
7611	  configure detection due to new ssl dependency in libevent)
7612	- do not call sphinx for documentation when python is disabled.
7613	- remove EV_PERSIST from libevent timeout code to make the code
7614	  compatible with the libevent-2.0.  Works with older libevent too.
7615	- fix memory leak in python code.
7616
76173 September 2009: Wouter
7618	- Got a patch from Luca Bruno for libunbound support on windows to
7619	  pick up the system resolvconf nameservers and hosts there.
7620	- included ldns updated (enum warning fixed).
7621	- makefile fix for parallel makes.
7622	- Patch from Zdenek Vasicek and Attila Nagy for using the source IP
7623	  from python scripts.  See pythonmod/examples/resip.py.
7624	- doxygen comment fixes.
7625
76262 September 2009: Wouter
7627	- TRAFFIC keyword for testbound. Simplifies test generation.
7628	  ${range lower val upper} to check probe timeout values.
7629	- test with 5011-prepublish rollover and revocation.
7630	- fix revocation of RR for autotrust, stray exclamation mark.
7631
76321 September 2009: Wouter
7633	- testbound variable arithmetic.
7634	- autotrust probe time is randomised.
7635	- autotrust: the probe is active and does not fetch from cache.
7636
763731 August 2009: Wouter
7638	- testbound variable processing.
7639
764028 August 2009: Wouter
7641	- fixup unbound-control lookup to print forward and stub servers.
7642
764327 August 2009: Wouter
7644	- autotrust: mesh answer callback is empty.
7645
764626 August 2009: Wouter
7647	- autotrust probing.
7648	- iana portlist updated.
7649
765025 August 2009: Wouter
7651	- fixup memleak in trust anchor unsupported algorithm check.
7652	- iana portlist updated.
7653	- autotrust options: add-holddown, del-holddown, keep-missing.
7654	- autotrust store revoked status of trust points.
7655	- ctime_r compat definition.
7656	- detect yylex_destroy() in configure.
7657	- detect SSL_get_compression_methods declaration in configure.
7658	- fixup DS lookup at anchor point with unsigned parent.
7659	- fixup DLV lookup for DS queries to unsigned domains.
7660
766124 August 2009: Wouter
7662	- cleaner memory allocation on exit. autotrust test routines.
7663	- free all memory on program exit, fix for ssl and flex.
7664
766521 August 2009: Wouter
7666	- autotrust: debug routines. Read,write and conversions work.
7667
766820 August 2009: Wouter
7669	- autotrust: save and read trustpoint variables.
7670
767119 August 2009: Wouter
7672	- autotrust: state table updates.
7673	- iana portlist updated.
7674
767517 August 2009: Wouter
7676	- autotrust: process events.
7677
767817 August 2009: Wouter
7679	- Fix so that servers are only blacklisted if they fail to reply
7680	  to 16 queries in a row and the timeout gets above 2 minutes.
7681	- autotrust work, split up DS verification of DNSKEYs.
7682
768314 August 2009: Wouter
7684	- unbound-control lookup prints out infra cache information, like RTT.
7685	- Fix bug in DLV lookup reported by Amanda from Secure64.
7686	  It could sometimes wrongly classify a domain as unsigned, which
7687	  does not give the AD bit on replies.
7688
768913 August 2009: Wouter
7690	- autotrust read anchor files. locked trust anchors.
7691
769212 August 2009: Wouter
7693	- autotrust import work.
7694
769511 August 2009: Wouter
7696	- Check for openssl compatible with gost if enabled.
7697	- updated unit test for GOST=211 code.
7698	  Nicer naming of test files.
7699	- iana portlist updated.
7700
77017 August 2009: Wouter
7702	- call OPENSSL_config() in unbound and unit test so that the
7703	  operator can use openssl.cnf for configuration options.
7704	- removed small memory leak from config file reader.
7705
77066 August 2009: Wouter
7707	- configure --enable-gost for GOST support, experimental
7708	  implementation of draft-dolmatov-dnsext-dnssec-gost-01.
7709	- iana portlist updated.
7710	- ldns tarball updated (with GOST support).
7711
77125 August 2009: Wouter
7713	- trunk moved to 1.3.4.
7714
77154 August 2009: Wouter
7716	- Added test that the examples from draft rsasha256-14 verify.
7717	- iana portlist updated.
7718	- tagged 1.3.3
7719
77203 August 2009: Wouter
7721	- nicer warning when algorithm not supported, tells you to upgrade.
7722	- iana portlist updated.
7723
772427 July 2009: Wouter
7725	- Updated unbound-cacti contribution from Dmitriy Demidov, with
7726	  the queue statistics displayed in its own graph.
7727	- iana portlist updated.
7728
772922 July 2009: Wouter
7730	- Fix bug found by Michael Tokarev where unbound would try to
7731	  prime the root servers even though forwarders are configured for
7732	  the root.
7733	- tagged 1.3.3rc1
7734
773521 July 2009: Wouter
7736	- Fix server selection, so that it waits for open target queries when
7737	  faced with lameness.
7738
773920 July 2009: Wouter
7740	- Ignore transient sendto errors, no route to host, and host, net down.
7741	- contrib/update-anchor.sh has -r option for root-hints.
7742	- feature val-log-level: 1 prints validation failures so you can
7743	  keep track of them during dnssec deployment.
7744
774516 July 2009: Wouter
7746	- fix replacement malloc code.  Used in crosscompile.
7747	- makedist -w creates crosscompiled setup.exe on fedora11.
7748
774915 July 2009: Wouter
7750	- dependencies for compat items, for crosscompile.
7751	- mingw32 crosscompile changes, dependencies and zipfile creation.
7752	  and with System.dll from the windows NSIS you can make setup.exe.
7753	- package libgcc_s_sjlj exception handler for NSISdl.dll.
7754
775514 July 2009: Wouter
7756	- updated ldns tarball for solaris x64 compile assistance.
7757	- no need to define RAND_MAX from config.h.
7758	- iana portlist updated.
7759	- configure changes and ldns update for mingw32 crosscompile.
7760
776113 July 2009: Wouter
7762	- Fix for crash at start on windows.
7763	- tag for release 1.3.2.
7764	- trunk has version 1.3.3.
7765	- Fix for ID bits on windows to use all 16. RAND_MAX was not
7766	  defined like you'd expect on mingw. Reported by Mees de Roo.
7767
77689 July 2009: Wouter
7769	- tag for release 1.3.1.
7770	- trunk has version 1.3.2.
7771
77727 July 2009: Wouter
7773	- iana portlist updated.
7774
77756 July 2009: Wouter
7776	- prettier error handling in SSL setup.
7777	- makedist.sh uname fix (same as ldns).
7778	- updated fedora spec file.
7779
77803 July 2009: Wouter
7781	- fixup linking when ldnsdir is "".
7782
778330 June 2009: Wouter
7784	- more lenient truncation checks.
7785
778629 June 2009: Wouter
7787	- ldns trunk r2959 imported as tarball, because of solaris cc compile
7788	  support for c99.  r2960 for better configure.
7789	- better wrongly_truncated check.
7790	- On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to
7791	  avoid dropped packets at routers.
7792
779326 June 2009: Wouter
7794	- Fix EDNS fallback when EDNS works for short answers but long answers
7795	  are dropped.
7796
779722 June 2009: Wouter
7798	- fixup iter priv strict aliasing while preserving size of sockaddr.
7799	- iana portlist updated.  (one less port allocated, one more fraction
7800	  of a bit for security!)
7801	- updated fedora specfile in contrib from Paul Wouters.
7802
780319 June 2009: Wouter
7804	- Fixup strict aliasing warning in iter priv code.
7805	  and config_file code.
7806	- iana portlist updated.
7807	- harden-referral-path: handle cases where NS is in answer section.
7808
780918 June 2009: Wouter
7810	- Fix of message parse bug where (specifically) an NSEC and RRSIG
7811	  in the wrong order would be parsed, but put wrongly into internal
7812	  structures so that later validation would fail.
7813	- Extreme lenience for wrongly truncated replies where a positive
7814	  reply has an NS in the authority but no signatures.  They are
7815	  turned into minimal responses with only the (secure) answer.
7816	- autoconf 2.63 for configure.
7817	- python warnings suppress.  Keep python API away from header files.
7818
781917 June 2009: Wouter
7820	- CREDITS entry for cz.nic, sponsoring a 'summer of code' that was
7821	  used for the python code in unbound. (http://www.nic.cz/vip/ in cz).
7822
782316 June 2009: Wouter
7824	- Fixup opportunistic target query generation to it does not
7825	  generate queries that are known to fail.
7826	- Touchup on munin total memory report.
7827	- messages picked out of the cache by the iterator are checked
7828	  if their cname chain is still correct and if validation status
7829	  has to be reexamined.
7830
783115 June 2009: Wouter
7832	- iana portlist updated.
7833
783414 June 2009: Wouter
7835	- Fixed bug where cached responses would lose their security
7836	  status on second validation, which especially impacted dlv
7837	  lookups.  Reported by Hauke Lampe.
7838
783913 June 2009: Wouter
7840	- bug #254. removed random whitespace from example.conf.
7841
784212 June 2009: Wouter
7843	- Fixup potential wrong NSEC picked out of the cache.
7844	- If unfulfilled callbacks are deleted they are called with an error.
7845	- fptr wlist checks for mesh callbacks.
7846	- fwd above stub in configuration works.
7847
784811 June 2009: Wouter
7849	- Fix queries for type DS when forward or stub zones are there.
7850	  They are performed to higherup domains, and thus treated as if
7851	  going to higher zones when looking up the right forward or stub
7852	  server.  This makes a stub pointing to a local server that has
7853	  a local view of example.com signed with the same keys as are
7854	  publicly used work.  Reported by Johan Ihren.
7855	- Added build-unbound-localzone-from-hosts.pl to contrib, from
7856	  Dennis DeDonatis.  It converts /etc/hosts into config statements.
7857	- same thing fixed for forward-zone and DS, chain of trust from
7858	  public internet into the forward-zone works now.  Added unit test.
7859
78609 June 2009: Wouter
7861	- openssl key files are opened apache-style, when user is root and
7862	  before chrooting.  This makes permissions on remote-control key
7863	  files easier to set up.  Fixes bug #251.
7864	- flush_type and flush_name remove msg cache entries.
7865	- codereview - dp copy bogus setting fix.
7866
78678 June 2009: Wouter
7868	- Removed RFC5011 REVOKE flag support. Partial 5011 support may cause
7869	  inadvertant behaviour.
7870	- 1.3.0 tarball for release created.
7871	- 1.3.1 development in svn trunk.
7872	- iana portlist updated.
7873	- fix lint from complaining on ldns/sha.h.
7874	- help compiler figure out aliasing in priv_rrset_bad() routine.
7875	- fail to configure with python if swig is not found.
7876	- unbound_munin_ in contrib uses ps to show rss if sbrk does not work.
7877
78783 June 2009: Wouter
7879	- fixup bad free() when wrongly encoded DSA signature is seen.
7880	  Reported by Paul Wouters.
7881	- review comments from Matthijs.
7882
78832 June 2009: Wouter
7884	- --enable-sha2 option. The draft rsasha256 changed its algorithm
7885	  numbers too often.  Therefore it is more prudent to disable the
7886	  RSASHA256 and RSASHA512 support by default.
7887	- ldns trunk included as new tarball.
7888	- recreated the 1.3.0 tag in svn. rc1 tarball generated at this point.
7889
789029 May 2009: Wouter
7891	- fixup doc bug in README reported by Matthew Dempsky.
7892
789328 May 2009: Wouter
7894	- update iana port list
7895	- update ldns lib tarball
7896
789727 May 2009: Wouter
7898	- detect lack of IPv6 support on XP (with a different error code).
7899	- Fixup a crash-on-exit which was triggered by a very long queue.
7900	  Unbound would try to re-use ports that came free, but this is
7901	  of course not really possible because everything is deleted.
7902	  Most easily triggered on XP (not Vista), maybe because of the
7903	  network stack encouraging large messages backlogs.
7904	- change in debug statements.
7905	- Fixed bug that could cause a crash if root prime failed when there
7906	  were message backlogs.
7907
790826 May 2009: Wouter
7909	- Thanks again to Brett Carr, found an assertion that was not true.
7910	  Assertion checked if recursion parent query still existed.
7911
791229 April 2009: Wouter
7913	- Thanks to Brett Carr, caught windows resource leak, use
7914	  closesocket() and not close() on sockets or else the network stack
7915	  starts to leak handles.
7916	- Removed usage of windows Mutex because windows cannot handle enough
7917	  mutexes open.  Provide own mutex implementation using primitives.
7918
791928 April 2009: Wouter
7920	- created svn tag for 1.3.0.
7921
792227 April 2009: Wouter
7923	- optimised cname from cache.
7924	- ifdef windows functions in testbound.
7925
792623 April 2009: Wouter
7927	- fix for threadsafety in solaris thr_key_create() in tests.
7928	- iana portlist updated.
7929	- fix pylib test for Darwin.
7930	- fix pymod test for Darwin and a python threading bug in pymod init.
7931	- check python >= 2.4 in configure.
7932	- -ldl check for libcrypto 1.0.0beta.
7933
793421 April 2009: Wouter
7935	- fix for build outside sourcedir.
7936	- fix for configure script swig detection.
7937
793817 April 2009: Wouter
7939	- Fix reentrant in minievent handler for unix. Could have resulted
7940	  in spurious event callbacks.
7941	- timers do not take up a fd slot for winsock handler.
7942	- faster fix for winsock reentrant check.
7943	- fix rsasha512 unit test for new (interim) algorithm number.
7944	- fix test:ldns doesn't like DOS line endings in keyfiles on unix.
7945	- fix compile warning on ubuntu (configlexer fwrite return value).
7946	- move python include directives into CPPFLAGS instead of CFLAGS.
7947
794816 April 2009: Wouter
7949	- winsock event handler exit very quickly on signal, even if
7950	  under heavy load.
7951	- iana portlist updated.
7952	- fixup windows winsock handler reentrant problem.
7953
795414 April 2009: Wouter
7955	- bug #245: fix munin plugin, perform cleanup of stale lockfiles.
7956	- makedist.sh; better help text.
7957	- cache-min-ttl option and tests.
7958	- mingw detect error condition on TCP sockets (NOTCONN).
7959
79609 April 2009: Wouter
7961	- Fix for removal of RSASHA256_NSEC3 protonumber from ldns.
7962	- ldns tarball updated.
7963	- iana portlist update.
7964	- detect GOST support in openssl-1.0.0-beta1, and fix compile problem
7965	  because that openssl defines the name STRING for itself.
7966
79676 April 2009: Wouter
7968	- windows compile fix.
7969	- Detect FreeBSD jail without ipv6 addresses assigned.
7970	- python libunbound wrapper unit test.
7971	- installs the following files. Default is to not build them.
7972	  	from configure --with-pythonmodule:
7973	  /usr/lib/python2.x/site-packages/unboundmodule.py
7974	  	from configure --with-pyunbound:
7975	  /usr/lib/python2.x/site-packages/unbound.py
7976	  /usr/lib/python2.x/site-packages/_unbound.so*
7977	  The example python scripts (pythonmod/examples and
7978	  libunbound/python/examples) are not installed.
7979	- python invalidate routine respects packed rrset ids and locks.
7980	- clock skew checks in unbound, config statements.
7981	- nxdomain ttl considerations in requirements.txt
7982
79833 April 2009: Wouter
7984	- Fixed a bug that caused messages to be stored in the cache too
7985	  long.  Hard to trigger, but NXDOMAINs for nameservers or CNAME
7986	  targets have been more vulnerable to the TTL miscalculation bug.
7987	- documentation test fixed for python addition.
7988
79892 April 2009: Wouter
7990	- pyunbound (libunbound python plugin) compiles using libtool.
7991	- documentation for pythonmod and pyunbound is generated in doc/html.
7992	- iana portlist updated.
7993	- fixed bug in unbound-control flush_zone where it would not flush
7994	  every message in the target domain.  This especially impacted
7995	  NXDOMAIN messages which could remain in the cache regardless.
7996	- python module test package.
7997
79981 April 2009: Wouter
7999	- suppress errors when trying to contact authority servers that gave
8000	  ipv6 AAAA records for their nameservers with ipv4 mapped contents.
8001	  Still tries to do so, could work when deployed in intranet.
8002	  Higher verbosity shows the error.
8003	- new libunbound calls documented.
8004	- pyunbound in libunbound/python. Removed compile warnings.
8005	  Makefile to make it.
8006
800730 March 2009: Wouter
8008	- Fixup LDFLAGS from libevent sourcedir compile configure restore.
8009	- Fixup so no non-absolute rpaths are added.
8010	- Fixup validation of RRSIG queries, they are let through.
8011	- read /dev/random before chroot
8012	- checkconf fix no python checks when no python module enabled.
8013	- fix configure, pthread first, so other libs do not change outcome.
8014
801527 March 2009: Wouter
8016	- nicer -h output. report linked libraries and modules.
8017	- prints modules in intuitive order (config file friendly).
8018	- python compiles easily on BSD.
8019
802026 March 2009: Wouter
8021	- ignore swig varargs warnings with gcc.
8022	- remove duplicate example.conf text from python example configs.
8023	- outofdir compile fix for python.
8024	- pyunbound works.
8025	- print modules compiled in on -h. manpage.
8026
802725 March 2009: Wouter
8028	- initial import of the python contribution from Zdenek Vasicek and
8029	  Marek Vavrusa.
8030	- pythonmod in Makefile; changes to remove warnings/errors for 1.3.0.
8031
803224 March 2009: Wouter
8033	- more neat configure.ac. Removed duplicate config.h includes.
8034	- neater config.h.in.
8035	- iana portlist updated.
8036	- fix util/configlexer.c and solaris -std=c99 flag.
8037	- fix postcommit aclocal errors.
8038	- spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R.
8039	- swap order of host detect and libtool generation.
8040
804123 March 2009: Wouter
8042	- added launchd plist example file for MacOSX to contrib.
8043	- deprecation test for daemon(3).
8044	- moved common configure actions to m4 include, prettier Makefile.
8045
804620 March 2009: Wouter
8047	- bug #239: module-config entries order is important. Documented.
8048	- build fix for test asynclook.
8049
805019 March 2009: Wouter
8051	- winrc/README.txt dos-format text file.
8052	- iana portlist updated.
8053	- use _beginthreadex() when available (performs stack alignment).
8054	- defaults for windows baked into configure.ac (used if on mingw).
8055
805618 March 2009: Wouter
8057	- Added tests, unknown algorithms become insecure. fallback works.
8058	- Fix for and test for unknown algorithms in a trust anchor
8059	  definition.  Trust anchors with no supported algos are ignored.
8060	  This means a (higher)DS or DLV entry for them could succeed, and
8061	  otherwise they are treated as insecure.
8062	- domain-insecure: "example.com" statement added. Sets domain
8063	  insecure regardless of chain of trust DSs or DLVs. The inverse
8064	  of a trust-anchor.
8065
806617 March 2009: Wouter
8067	- unit test for unsupported algorithm in anchor warning.
8068	- fixed so queries do not fail on opportunistic target queries.
8069
807016 March 2009: Wouter
8071	- fixup diff error printout in contrib/update-itar.sh.
8072	- added contrib/unbound_cacti for statistics support in cacti,
8073	  contributed by Dmitriy Demidov.
8074
807513 March 2009: Wouter
8076	- doxygen and lex/yacc on linux.
8077	- strip update-anchor on makedist -w.
8078	- fix testbound on windows.
8079	- default log to syslog for windows.
8080	- uninstaller can stop unbound - changed text on it to reflect that.
8081	- remove debugging from windows 'cron' actions.
8082
808312 March 2009: Wouter
8084	- log to App.logs on windows prints executable identity.
8085	- fixup tests.
8086	- munin plugin fix benign locking error printout.
8087	- anchor-update for windows, called every 24 hours; unbound reloads.
8088
808911 March 2009: Wouter
8090	- winsock event handler resets WSAevents after signalled.
8091	- winsock event handler tests if signals are really signalled.
8092	- install and service with log to file works on XP and Vista on
8093	  default install location.
8094	- on windows logging to the Application logbook works (as a service).
8095	- fix RUN_DIR on windows compile setting in makedist.
8096	- windows registry has Software\Unbound\ConfigFile element.
8097	  If does not exist, the default is used. The -c switch overrides it.
8098	- fix makedist version cleanup function.
8099
810010 March 2009: Wouter
8101	- makedist -w strips out old rc.. and snapshot info from version.
8102	- setup.exe starts and stops unbound after install, before uninstall.
8103	- unbound-checkconf recognizes absolute pathnames on windows (C:...).
8104
81059 March 2009: Wouter
8106	- Nullsoft NSIS installer creation script.
8107
81085 March 2009: Wouter
8109	- fixup memory leak introduced on 18feb in mesh reentrant fix.
8110
81113 March 2009: Wouter
8112	- combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8).
8113	- service works on xp/vista, no config necessary (using defaults).
8114	- windows registry settings.
8115
81162 March 2009: Wouter
8117	- fixup --export-symbols to be -export-symbls for libtool.
8118	  This should fix extraneous symbols exported from libunbound.
8119	  Thanks to Ondrej Sury and Robert Edmonds for finding it.
8120	- iana portlist updated.
8121	- document FAQ entry on stub/forward zones and default blocking.
8122	- fix asynclook test app for libunbound not exporting symbols.
8123	- service install and remove utils that work with vista UAC.
8124
812527 February 2009: Wouter
8126	- Fixup lexer, to not give warnings about fwrite. Appeared in
8127	  new lexer features.
8128	- makedistro functionality for mingw. Has RC support.
8129	- support spaces and backslashes in configured defaults paths.
8130	- register, deregister in service control manager.
8131
813225 February 2009: Wouter
8133	- windres usage for application resources.
8134
813524 February 2009: Wouter
8136	- isc moved their dlv key download location.
8137	- fixup warning on vista/mingw.
8138	- makedist -w for window zip distribution first version.
8139
814020 February 2009: Wouter
8141	- Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped.
8142	  Nicer script layout.  Added url to site in -h output.
8143
814419 February 2009: Wouter
8145	- unbound-checkconf and unbound print warnings when trust anchors
8146	  have unsupported algorithms.
8147	- added contrib/update-itar.sh  This script is similar to
8148	  update-anchor.sh, and updates from the IANA ITAR repository.
8149	  You can provide your own PGP key and trust repo, or can use the
8150	  builtin.  The program uses wget and gpg to work.
8151	- iana portlist updated.
8152	- update-itar.sh: using ftp:// urls because https godaddy certificate
8153	  is not available everywhere and then gives fatal errors.  The
8154	  security is provided by pgp signature.
8155
815618 February 2009: Wouter
8157	- more cycle detection. Also for target queries.
8158	- fixup bug where during deletion of the mesh queries the callbacks
8159	  that were reentrant caused assertion failures. Keep the mesh in
8160	  a reentrant safe state.  Affects libunbound, reload of server,
8161	  on quit and flush_requestlist.
8162	- iana portlist updated.
8163
816413 February 2009: Wouter
8165	- forwarder information now per-thread duplicated.
8166	  This keeps it read only for speed, with no locking necessary.
8167	- forward command for unbound control to change forwarders to use
8168	  on the fly.
8169	- document that unbound-host reads no config file by default.
8170	- updated iana portlist.
8171
817212 February 2009: Wouter
8173	- call setusercontext if available (on BSD).
8174	- small refactor of stats clearing.
8175	- #227: flush_stats feature for unbound-control.
8176	- stats_noreset feature for unbound-control.
8177	- flush_requestlist feature for unbound-control.
8178	- libunbound version upped API (was changed 5 feb).
8179	- unbound-control status shows if root forwarding is in use.
8180	- slightly nicer memory management in iter-fwd code.
8181
818210 February 2009: Wouter
8183	- keys with rfc5011 REVOKE flag are skipped and not considered when
8184	  validating data.
8185	- iana portlist updated
8186	- #226: dump_requestlist feature for unbound-control.
8187
81886 February 2009: Wouter
8189	- contrib contains specfile for fedora 1.2.1 (from Paul Wouters).
8190	- iana portlist updated.
8191	- fixup EOL in include directive (reported by Paul Wouters).
8192	  You can no longer specify newlines in the names of included files.
8193	- config parser changed. Gives some syntax errors closer to where they
8194	  occurred. Does not enforce a space after keyword anymore.
8195	  Does not allow literal newlines inside quoted strings anymore.
8196	- verbosity level 5 logs customer IP for new requestlist entries.
8197	- test fix, lexer and cancel test.
8198	- new option log-time-ascii: yes  if you enable it prints timestamps
8199	  in the log file as Feb 06 13:45:26 (like syslog does).
8200	- detect event_base_new in libevent-1.4.1 and later and use it.
8201	- #231 unbound-checkconf -o option prints that value from config file.
8202	  Useful for scripting in management scripts and the like.
8203
82045 February 2009: Wouter
8205	- ldns 1.5.0 rc as tarball included.
8206	- 1.3.0 development continues:
8207	  change in libunbound API: ub_cancel can return an error, that
8208	  the async_id did not exist, or that it was already delivered.
8209	  The result could have been delivered just before the cancel
8210	  routine managed to acquire the lock, so a caller may get the
8211	  result at the same time they call cancel.  For this case,
8212	  ub_cancel tries to return an error code.
8213	  Fixes race condition in ub_cancel() libunbound function.
8214	- MacOSX Leopard cleaner text output from configure.
8215	- initgroups(3) is called to drop secondary group permissions, if
8216	  applicable.
8217	- configure option --with-ldns-builtin forces the use of the
8218	  inluded ldns package with the unbound source.  The -I include
8219	  is put before the others, so it avoids bad include files from
8220	  an older ldns install.
8221	- daemon(3) posix call is used when available.
8222	- testbound test for older fix added.
8223
82244 February 2009: Wouter
8225	- tag for release 1.2.1.
8226	- trunk setup for 1.3.0 development.
8227
82283 February 2009: Wouter
8229	- noted feature requests in doc/TODO.
8230	- printout more detailed errors on ssl certificate loading failures.
8231	- updated IANA portlist.
8232
823316 January 2009: Wouter
8234	- more quiet about ipv6 network failures, i.e. when ipv6 is not
8235	  available (network unreachable). Debug still printed on high
8236	  verbosity.
8237	- unbound-host -4 and -6 options. Stops annoying ipv6 errors when
8238	  debugging with unbound-host -4 -d ...
8239	- more cycle detection for NS-check, addr-check, root-prime and
8240	  stub-prime queries in the iterator.  Avoids possible deadlock
8241	  when priming fails.
8242
824315 January 2009: Wouter
8244	- bug #229: fixup configure checks for compilation with Solaris
8245	  Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc
8246	- fixup suncc warnings.
8247	- fix bug where unbound could crash using libevent 1.3 and older.
8248	- update testset for recent retry change.
8249
825014 January 2009: Wouter
8251	- 1.2.1 feature: negative caching for failed queries.
8252	  Queries that failed are cached for 5 seconds (NORR_TTL).
8253	  If the failure is local, like out of memory, it is not cached.
8254	- the TTL comparison for the cache used different comparisons,
8255	  causing many cache responses that used the iterator and validator
8256	  state machines unnecessarily.
8257	- retry from 4 to 5 so that EDNS drop retry is part of the first
8258	  query resolve attempt, and cached error does not stop EDNS fallback.
8259	- remove debug prints that protect against bad referrals.
8260	- honor QUIET=no on make commandline (or QUIET=yes ).
8261
826213 January 2009: Wouter
8263	- fixed bug in lameness marking, removed printouts.
8264	- find NS rrset more cleanly for qtype NS.
8265	- Moved changes to 1.2.0 for release. Thanks to Mark Zealey for
8266	  reporting and logs.
8267	- 1.2.1 feature: stops resolving AAAAs promiscuously when they
8268	  are in the negative cache.
8269
827012 January 2009: Wouter
8271	- fixed bug in infrastructure lameness cache, did not lowercase
8272	  name of zone to hash when setting lame.
8273	- lameness debugging printouts.
8274
82759 January 2009: Wouter
8276	- created svn tag for 1.2.0 release.
8277	- svn trunk contains 1.2.1 version number.
8278	- iana portlist updated for todays list.
8279	- removed debug print.
8280
82818 January 2009: Wouter
8282	- new version of ldns-trunk (today) included as tarball, fixed
8283	  bug #224, building with -j race condition.
8284	- remove possible race condition in the test for race conditions.
8285
82867 January 2009: Wouter
8287	- version 1.2.0 in preparation.
8288	- feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file
8289	  statements. (Adapted from patch by Paul Wouters).
8290	- typo fix and iana portlist updated.
8291	- porting testsuite; unused var warning, and type fixup.
8292
82936 January 2009: Wouter
8294	- fixup packet-of-death when compiled with --enable-debug.
8295	  A malformed packet could cause an internal assertion failure.
8296	- added test for HINFO canonicalisation behaviour.
8297	- fixup reported problem with transparent local-zone data where
8298	  queries with different type could get nxdomain. Now queries
8299	  with a different name get resolved normally, with different type
8300	  get a correct NOERROR/NODATA answer.
8301	- HINFO no longer downcased for validation, making unbound compatible
8302	  with bind and ldns.
8303	- fix reading included config files when chrooted.
8304	  Give full path names for include files.
8305	  Relative path names work if the start dir equals the working dir.
8306	- fix libunbound message transport when no packet buffer is available.
8307
83085 January 2009: Wouter
8309	- fixup getaddrinfo failure handling for remote control port.
8310	- added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints.
8311	- fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/
8312	- comm_timer_set performs base_set operation after event_add.
8313
831418 December 2008: Wouter
8315	- fixed bug reported by Duane Wessels: error in DLV lookup, would make
8316	  some zones that had correct DLV keys as insecure.
8317	- follows -rc makedist from ldns changes (no _rc).
8318	- ldns tarball updated with 1.4.1rc for DLV unit test.
8319	- verbose prints about recursion lame detection and server selection.
8320	- fixup BSD port for infra host storage. It hashed wrongly.
8321	- fixup makedist snapshot name generation.
8322	- do not reopen syslog to avoid dev/log dependency.
8323
832417 December 2008: Wouter
8325	- follows ldns makedist.sh. -rc option. autom4te dir removed.
8326	- unbound-control status command.
8327	- extended statistics has a number of ipv6 queries counter.
8328	  contrib/unbound_munin_ was updated to draw ipv6 in the hits graph.
8329
833016 December 2008: Wouter
8331	- follow makedist improvements from ldns, for maintainers prereleases.
8332	- snapshot version uses _ not - to help rpm distinguish the
8333	  version number.
8334
833511 December 2008: Wouter
8336	- better fix for bug #219: use LOG_NDELAY with openlog() call.
8337	  Thanks to Tamas Tevesz.
8338
83399 December 2008: Wouter
8340	- bug #221 fixed: unbound checkconf checks if key files exist if
8341	  remote control is enabled. Also fixed NULL printf when not chrooted.
8342	- iana portlist updated.
8343
83443 December 2008: Wouter
8345	- Fix problem reported by Jaco Engelbrecht where unbound-control stats
8346	  freezes up unbound if this was compiled without threading, and
8347	  was using multiple processes.
8348	- iana portlist updated.
8349	- test for remote control with interprocess communication.
8350	- created command distribution mechanism so that remote control
8351	  commands other than 'stats' work on all processes in a nonthreaded
8352	  compiled version. dump/load cache work, on the first process.
8353	- fixup remote control local_data addition memory corruption bug.
8354
83551 December 2008: Wouter
8356	- SElinux policy files in contrib/selinux for the unbound daemon,
8357	  by Paul Wouters and Adam Tkac.
8358
835925 November 2008: Wouter
8360	- configure complains when --without-ssl is given (bug #220).
8361	- skip unsupported feature tests on vista/mingw.
8362	- fixup testcode/streamtcp to work on vista/mingw.
8363	- root-hints test checks version of dig required.
8364	- blacklisted servers are polled at a low rate (1%) to see if they
8365	  come back up. But not if there is some other working server.
8366
836724 November 2008: Wouter
8368	- document that the user of the server daemon needs read privileges
8369	  on the keys and certificates generated by unbound-control-setup.
8370	  This is different per system or distribution, usually, running the
8371	  script under the same username as the server uses suffices.
8372	  i.e.  sudo -u unbound unbound-control-setup
8373	- testset port to vista/mingw.
8374	- tcp_sigpipe to freebsd port.
8375
837621 November 2008: Wouter
8377	- fixed tcp accept, errors were printed when they should not.
8378	- unbound-control-setup.sh removes read/write permissions other
8379	  from the keys it creates (as suggested by Dmitriy Demidov).
8380
838120 November 2008: Wouter
8382	- fixup fatal error due to faulty error checking after tcp accept.
8383	- add check in rlimit to avoid integer underflow.
8384	- rlimit check with new formula; better estimate for number interfaces
8385	- nicer comments in rlimit check.
8386	- tag 1.1.1 created in svn.
8387	- trunk label is 1.1.2
8388
838919 November 2008: Wouter
8390	- bug #219: fixed so that syslog which delays opening until the first
8391	  log line is written, gets a log line while not chroot'ed yet.
8392
839318 November 2008: Wouter
8394	- iana portlist updated.
8395	- removed cast in unit test debug print that was not 64bit safe.
8396	- trunk back to 1.1.0; copied to tags 1.1.0 release.
8397	- trunk to has version number 1.1.1 again.
8398	- in 1.1.1; make clean nicer. grammar in manpage.
8399
840017 November 2008: Wouter
8401	- theoretical fix for problems reported on mailing list.
8402	  If a delegation point has no A but only AAAA and do-ip6 is no,
8403	  resolution would fail. Fixed to ask for the A and AAAA records.
8404	  It has to ask for both always, so that it can fail quietly, from
8405	  TLD perspective, when a zone is only reachable on one transport.
8406	- test for above, only AAAA and doip6 is no. Fix causes A record
8407	  for nameserver to be fetched.
8408	- fixup address duplication on cache fillup for delegation points.
8409	- testset updated for new query answer requirements.
8410
841114 November 2008: Wouter
8412	- created 1.1.0 release tag in svn.
8413	- trunk moved to 1.1.1
8414	- fixup unittest-neg for locking.
8415
841613 November 2008: Wouter
8417	- added fedora init and specfile to contrib (by Paul Wouters).
8418	- added configure check for ldns 1.4.0 (using its compat funcs).
8419	- neater comments in worker.h.
8420	- removed doc/plan and updated doc/TODO.
8421	- silenced EHOSTDOWN (verbosity 2 or higher to see it).
8422	- review comments from Jelte, Matthijs. Neater code.
8423
842412 November 2008: Wouter
8425	- add unbound-control manpage to makedist replace list.
8426
842711 November 2008: Wouter
8428	- unit test for negative cache, stress tests the refcounting.
8429	- fix for refcounting error that could cause fptr_wlist fatal exit
8430	  in the negative cache rbtree (upcoming 1.1 feature). (Thanks to
8431	  Attila Nagy for testing).
8432	- nicer comments in cachedump about failed RR to string conversion.
8433	- fix 32bit wrap around when printing large (4G and more) mem usage
8434	  for extended statistics.
8435
843610 November 2008: Wouter
8437	- fixup the getaddrinfo compat code rename.
8438
84398 November 2008: Wouter
8440	- added configure check for eee build warning.
8441
84427 November 2008: Wouter
8443	- fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4.
8444	- detect nonblocking problems in network stack in configure script.
8445
84466 November 2008: Wouter
8447	- dname_priv must decompress the name before comparison.
8448	- iana portlist updated.
8449
84505 November 2008: Wouter
8451	- fixed possible memory leak in key_entry_key deletion.
8452	  Would leak a couple bytes when trust anchors were replaced.
8453	- if query and reply qname overlap, the bytes are skipped not copied.
8454	- fixed file descriptor leak when messages were jostled out that
8455	  had outstanding (TCP) replies.
8456	- DNAMEs used from cache have their synthesized CNAMEs initialized
8457	  properly.
8458	- fixed file descriptor leak for localzone type deny (for TCP).
8459	- fixed memleak at exit for nsec3 negative cached zones.
8460	- fixed memleak for the keyword 'nodefault' when reading config.
8461	- made verbosity of 'edns incapable peer' warning higher, so you
8462	  do not get spammed by it.
8463	- caught elusive Bad file descriptor error bug, that would print the
8464	  error while unnecessarily try to listen to a closed fd. Fixed.
8465
84664 November 2008: Wouter
8467	- fixed -Wwrite-strings warnings that result in better code.
8468
84693 November 2008: Wouter
8470	- fixup build process for Mac OSX linker, use ldns b32 compat funcs.
8471	- generated configure with autoconf-2.61.
8472	- iana portlist updated.
8473	- detect if libssl needs libdl.  For static linking with libssl.
8474	- changed to use new algorithm identifiers for sha256/sha512
8475	  from ldns 1.4.0 (need very latest version).
8476	- updated the included ldns tarball.
8477	- proper detection of SHA256 and SHA512 functions (not just sizes).
8478
847923 October 2008: Wouter
8480	- a little more debug info for failure on signer names. prints names.
8481
848222 October 2008: Wouter
8483	- CFLAGS are picked up by configure from the environment.
8484	- iana portlist updated.
8485	- updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too.
8486	- new stub-prime: yesno option. Default is off, so it does not prime.
8487	  can be turned on to get same behaviour as previous unbound release.
8488	- made automated test that checks if builtin root hints are uptodate.
8489	- finished draft-wijngaards-dnsext-resolver-side-mitigation
8490	  implementation. The unwanted-reply-threshold can be set.
8491	- fixup so fptr_whitelist test in alloc.c works.
8492
849321 October 2008: Wouter
8494	- fix update-anchors.sh, so it does not report different RR order
8495	  as an update.  Sorts the keys in the file.  Updated copyright.
8496	- fixup testbound on windows, the command control pipe doesn't exist.
8497	- skip 08hostlib test on windows, no fork() available.
8498	- made unbound-remote work on windows.
8499
850020 October 2008: Wouter
8501	- quench a log message that is debug only.
8502	- iana portlist updated.
8503	- do not query bogus nameservers.  It is like nameservers that have
8504	  the NS or A or AAAA record bogus are listed as donotquery.
8505	- if server selection is faced with only bad choices, it will
8506	  attempt to get more options to be fetched.
8507	- changed bogus-ttl default value from 900 to 60 seconds.
8508	  In anticipation that operator caused failures are more likely than
8509	  actual attacks at this time.  And thus repeated validation helps
8510	  the operators get the problem fixed sooner.  It makes validation
8511	  failures go away sooner (60 seconds after the zone is fixed).
8512	  Also it is likely to try different nameserver targets every minute,
8513	  so that if a zone is bad on one server but not another, it is
8514	  likely to pick up the 'correct' one after a couple minutes,
8515	  and if the TTL is big enough that solves validation for the zone.
8516	- fixup unbound-control compilation on windows.
8517
851817 October 2008: Wouter
8519	- port Leopard/G5: fixup type conversion size_t/uint32.
8520	  please ranlib, stop file without symbols warning.
8521	- harden referral path now also validates the root after priming.
8522	  It looks up the root NS authoritatively as well as the root servers
8523	  and attemps to validate the entries.
8524
852516 October 2008: Wouter
8526	- Fixup negative TTL values appearing (reported by Attila Nagy).
8527
852815 October 2008: Wouter
8529	- better documentation for 0x20; remove fallback TODO, it is done.
8530	- harden-referral-path feature includes A, AAAA queries for glue,
8531	  as well as very careful NS caching (only when doing NS query).
8532	  A, AAAA use the delegation from the NS-query.
8533
853414 October 2008: Wouter
8535	- fwd_three.tpkg test was flaky.  If the three requests hit the
8536	  wrong threads by chance (or bad OS) then the test would fail.
8537	  Made less flaky by increasing number of retries.
8538	- stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs.
8539	- ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014).
8540	  Which includes the ldns_dname_absolute fix.
8541	- fwd_three test remains flaky now that unbound does not stop
8542	  listening when full.  Thus, removed timeout problem.
8543	  It may be serviced by three threads, or maybe by one.
8544	  Mostly only useful for lock-check testing now.
8545
854613 October 2008: Wouter
8547	- fixed recursion servers deployed as authoritative detection, so
8548	  that as a last resort, a +RD query is sent there to get the
8549	  correct answer.
8550	- iana port list update.
8551	- ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013).
8552
855310 October 2008: Wouter
8554	- fixup tests - the negative cache contained the correct NSEC3s for
8555	  two tests that are supposed to fail to validate.
8556
85579 October 2008: Wouter
8558	- negative cache caps max iterations of NSEC3 done.
8559	- NSEC3 negative cache for qtype DS works.
8560
85618 October 2008: Wouter
8562	- NSEC negative cache for DS.
8563
85646 October 2008: Wouter
8565	- jostle-timeout option, so you can config for slow links.
8566	- 0x20 fallback code.  Tries 3xnumber of nameserver addresses
8567	  queries that must all be the same.  Sent to random nameservers.
8568	- documented choices for DoS, EDNS, 0x20.
8569
85702 October 2008: Wouter
8571	- fixup unlink of pidfile.
8572	- fixup SHA256 algorithm collation code.
8573	- contrib/update-anchor.sh does not overwrite anchors if not needed.
8574	  exits 0 when a restart is needed, other values if not.
8575	  so,  update-anchor.sh -d mydir && /etc/rc.d/unbound restart
8576	  can restart unbound exactly when needed.
8577
857830 September 2008: Wouter
8579	- fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1.
8580	- tests for sha256 support and downgrade resistance.
8581	- RSASHA256 and RSASHA512 support (using the draft in dnsext),
8582	  using the drafted protocol numbers.
8583	- when using stub on localhost (127.0.0.1@10053) unbound works.
8584	  Like when running NSD to host a local zone, on the same machine.
8585	  The noprime feature. manpages more explanation. Added a test for it.
8586	- shorthand for reverse PTR,  local-data-ptr: "1.2.3.4 www.ex.com"
8587
858829 September 2008: Wouter
8589	- EDNS lameness detection, if EDNS packets are dropped this is
8590	  detected, eventually.
8591	- multiple query timeout rtt backoff does not backoff too much.
8592
859326 September 2008: Wouter
8594	- tests for remote-control.
8595	- small memory leak in exception during remote control fixed.
8596	- fixup for lock checking but not unchecking in remote control.
8597	- iana portlist updated.
8598
859923 September 2008: Wouter
8600	- Msg cache is loaded. A cache load enables cache responses.
8601	- unbound-control flush [name], flush_type and flush_zone.
8602
860322 September 2008: Wouter
8604	- dump_cache and load_cache statements in unbound-control.
8605	  RRsets are dumped and loaded correctly.
8606	  Msg cache is dumped.
8607
860819 September 2008: Wouter
8609	- locking on the localdata structure.
8610	- add and remove local zone and data with unbound-control.
8611	- ldns trunk snapshot updated, make tests work again.
8612
861318 September 2008: Wouter
8614	- fixup error in time calculation.
8615	- munin plugin improvements.
8616	- nicer abbreviations for high query types values (ixfr, axfr, any...)
8617	- documented the statistics output in unbound-control man page.
8618	- extended statistics prints out histogram, over unbound-control.
8619
862017 September 2008: Wouter
8621	- locking for threadsafe bogus rrset counter.
8622	- ldns trunk no longer exports b32 functions, provide compat.
8623	- ldns tarball updated.
8624	- testcode/ldns-testpkts.c const fixups.
8625	- fixed rcode stat printout.
8626	- munin plugin in contrib.
8627	- stats always printout uptime, because stats plugins need it.
8628
862916 September 2008: Wouter
8630	- extended-statistics: yesno config option.
8631	- unwanted replies spoof nearmiss detector.
8632	- iana portlist updated.
8633
863415 September 2008: Wouter
8635	- working start, stop, reload commands for unbound-control.
8636	- test for unbound-control working; better exit value for control.
8637	- verbosity control via unbound-control.
8638	- unbound-control stats.
8639
864012 September 2008: Wouter
8641	- removed browser control mentions. Proto speccy.
8642
864311 September 2008: Wouter
8644	- set nonblocking on new TCP streams, because linux does not inherit
8645	  the socket options to the accepted socket.
8646	- fix TCP timeouts.
8647	- SSL protected connection between server and unbound-control.
8648
864910 September 2008: Wouter
8650	- remove memleak in privacy addresses on reloads and quits.
8651	- remote control work.
8652
86539 September 2008: Wouter
8654	- smallapp/unbound-control-setup.sh script to set up certificates.
8655
86564 September 2008: Wouter
8657	- scrubber scrubs away private addresses.
8658	- test for private addresses. man page entry.
8659	- code refactored for name and address tree lookups.
8660
86613 September 2008: Wouter
8662	- options for 'DNS Rebinding' protection: private-address and
8663	  private-domain.
8664	- dnstree for reuse of routines that help with domain, addr lookups.
8665	- private-address and private-domain config option read, stored.
8666
86672 September 2008: Wouter
8668	- DoS protection features. Queries are jostled out to make room.
8669	- testbound can pass time, increasing the internal timer.
8670	- do not mark unsigned additionals bogus, leave unchecked, which
8671	  is removed too.
8672
86731 September 2008: Wouter
8674	- disallow nonrecursive queries for cache snooping by default.
8675	  You can allow is using access-control: <subnet> allow_snoop.
8676	  The defaults do allow access no authoritative data without RD bit.
8677	- two tests for it and fixups of tests for nonrec refused.
8678
867929 August 2008: Wouter
8680	- version 1.1 number in trunk.
8681	- harden-referral-path option for query for NS records.
8682	  Default turns off expensive, experimental option.
8683
868428 August 2008: Wouter
8685	- fixup logfile handling; it is created with correct permissions
8686	  again. (from bugfix#199).
8687	  Some errors are not written to logfile (pidfile writing, forking),
8688	  and these are only visible by using the -d commandline flag.
8689
869027 August 2008: Wouter
8691	- daemon(3) is causing problems for people. Reverting the patch.
8692	  bug#200, and 199 and 203 contain sideline discussion on it.
8693	- bug#199 fixed: pidfile can be outside chroot. openlog is done before
8694	  chroot and drop permissions.
8695	- config option to set size of aggressive negative cache,
8696	  neg-cache-size.
8697	- bug#203 fixed: dlv has been implemented.
8698
869926 August 2008: Wouter
8700	- test for insecure zone when DLV is in use, also does negative cache.
8701	- test for trustanchor when DLV is in use (the anchor works).
8702	- test for DLV used for a zone below a trustanchor.
8703	- added scrub filter for overreaching NSEC records and unit test.
8704	- iana portlist update
8705	- use of setresuid or setreuid when available.
8706	- use daemon(3) if available.
8707
870825 August 2008: Wouter
8709	- realclean patch from Robert Edmonds.
8710
871122 August 2008: Wouter
8712	- nicer debuglogging of DLV.
8713	- test with secure delegation inside the DLV repository.
8714
871521 August 2008: Wouter
8716	- negative cache code linked into validator, for DLV use.
8717	  negative cache works for DLV.
8718	- iana portlist update.
8719	- dlv-anchor option for unit tests.
8720	- fixup NSEC_AT_APEX classification for short typemaps.
8721	- ldns-testns has subdomain checks, for unit tests.
8722
872320 August 2008: Wouter
8724	- negative cache code, reviewed.
8725
872618 August 2008: Wouter
8727	- changes info: in logfile to notice: info: or debug: depending on
8728	  the verbosity of the statements.  Better logfile message
8729	  classification.
8730	- bug #208: extra rc.d unbound flexibility for freebsd/nanobsd.
8731
873215 August 2008: Wouter
8733	- DLV nsec code fixed for better detection of closest existing
8734	  enclosers from NSEC responses.
8735	- DLV works, straight to the dlv repository, so not for production.
8736	- Iana port update.
8737
873814 August 2008: Wouter
8739	- synthesize DLV messages from the rrset cache, like done for DS.
8740
874113 August 2008: Wouter
8742	- bug #203: nicer do-auto log message when user sets incompatible
8743	  options.
8744	- bug #204: variable name ameliorated in log.c.
8745	- bug #206: in iana_update, no egrep, but awk use.
8746	- ldns snapshot r2699 taken (includes DLV type).
8747	- DLV work, config file element, trust anchor read in.
8748
874912 August 2008: Wouter
8750	- finished adjusting testset to provide qtype NS answers.
8751
875211 August 2008: Wouter
8753	- Fixup rrset security updates overwriting 2181 trust status.
8754	  This makes validated to be insecure data just as worthless as
8755	  nonvalidated data, and 2181 rules prevent cache overwrites to them.
8756	- Fix assertion fail on bogus key handling.
8757	- dnssec lameness detection works on first query at trust apex.
8758	- NS queries get proper cache and dnssec lameness treatment.
8759	- fixup compilation without pthreads on linux.
8760
87618 August 2008: Wouter
8762	- NS queries are done after every referral.
8763	  validator is used on those NS records (if anchors enabled).
8764
87657 August 2008: Wouter
8766	- Scrubber more strict. CNAME chains, DNAMEs from cache, other
8767	  irrelevant rrsets removed.
8768	- 1.0.2 released from 1.0 support branch.
8769	- fixup update-anchor.sh to work both in BSD shell and bash.
8770
87715 August 2008: Wouter
8772	- fixup DS test so apex nodata works again.
8773
87744 August 2008: Wouter
8775	- iana port update.
8776	- TODO update.
8777	- fix bug 201: null ptr deref on cleanup while udp pkts wait for port.
8778	- added explanatory text for outgoing-port-permit in manpage.
8779
878030 July 2008: Wouter
8781	- fixup bug qtype DS for unsigned zone and signed parent validation.
8782
878325 July 2008: Wouter
8784	- added original copyright statement of OpenBSD arc4random code.
8785	- created tube signaling solution on windows, as a pipe replacement.
8786	  this makes background asynchronous resolution work on windows.
8787	- removed very insecure socketpair compat code. It also did not
8788	  work with event_waiting. Solved by pipe replacement.
8789	- unbound -h prints openssl version number as well.
8790
879122 July 2008: Wouter
8792	- moved pipe actions to util/tube.c. easier porting and shared code.
8793	- check _raw() commpoint callbacks with fptr_wlist.
8794	- iana port update.
8795
879621 July 2008: Wouter
8797	- #198: nicer entropy warning message. manpage OS hints.
8798
879919 July 2008: Wouter
8800	- #198: fixup man page to suggest chroot entropy fix.
8801
880218 July 2008: Wouter
8803	- branch for 1.0 support.
8804	- trunk work on tube.c.
8805
880617 July 2008: Wouter
8807	- fix bug #196, compile outside source tree.
8808	- fix bug #195, add --with-username=user configure option.
8809	- print error and exit if started with config that requires more
8810	  fds than the builtin minievent can handle.
8811
881216 July 2008: Wouter
8813	- made svn tag 1.0.1, trunk now 1.0.2
8814	- sha256 checksums enabled in makedist.sh
8815
881615 July 2008: Wouter
8817	- Follow draft-ietf-dnsop-default-local-zones-06 added reverse
8818	  IPv6 example prefix to AS112 default blocklist.
8819	- fixup lookup of DS records by client with trustanchor for same.
8820	- libunbound ub_resolve, fix handling of error condition during setup.
8821	- lowered log_hex blocksize to fit through BSD syslog linesize.
8822	- no useless initialisation if getpwnam not available.
8823	- iana, ldns snapshot updated.
8824
88253 July 2008: Wouter
8826	- Matthijs fixed memory leaks in root hints file reading.
8827
882826 June 2008: Wouter
8829	- fixup streamtcp bounds setting for udp mode, in the test framework.
8830	- contrib item for updating trust anchors.
8831
883225 June 2008: Wouter
8833	- fixup fwd_ancil test typos.
8834	- Fix for newegg lameness : ok for qtype=A, but lame for others.
8835	- fixup unit test for infra cache, test lame merging.
8836	- porting to mingw, bind, listen, getsockopt and setsockopt error
8837	  handling.
8838
883924 June 2008: Wouter
8840	- removed testcode/checklocks from production code compilation path.
8841	- streamtcp can use UDP mode (connected UDP socket), for testing IPv6
8842	  on windows.
8843	- fwd_ancil test fails if platform support is lacking.
8844
884523 June 2008: Wouter
8846	- fixup minitpkg to cleanup on windows with its file locking troubles.
8847	- minitpkg shows skipped tests in report.
8848	- skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not
8849	  ipv6 connectivity).
8850	- winsock event handler keeps track of sticky TCP events, that have
8851	  not been fully handled yet. when interest in the event(s) resumes,
8852	  they are sent again. When WOULDBLOCK is returned events are cleared.
8853	- skip tests that need signals when testing on mingw.
8854
885518 June 2008: Wouter
8856	- open testbound replay files in binary mode, because fseek/ftell
8857	  do not work in ascii-mode on windows. The b does nothing on unix.
8858	  unittest and testbound tests work on windows (xp too).
8859	- ioctlsocket prints nicer error message.
8860	- fixed up some TCP porting for winsock.
8861	- lack of IPv6 gives a warning, no fatal error.
8862	- use WSAGetLastError() on windows instead of errno for some errors.
8863
886417 June 2008: Wouter
8865	- outgoing num fds 32 by default on windows ; it supports less
8866	  fds for waiting on than unixes.
8867	- winsock_event minievent handler for windows. (you could also
8868	  attempt to link with libevent/libev ports for windows).
8869	- neater crypto check and gdi32 detection.
8870	- unbound.exe works to resolve and validate www.nlnetlabs.nl on vista.
8871
887216 June 2008: Wouter
8873	- on windows, use windows threads, mutex and thread-local-storage(Tls).
8874	- detect if openssl needs gdi32.
8875	- if no threading, THREADS_DISABLED is defined for use in the code.
8876	- sets USE_WINSOCK if using ws2_32 on windows.
8877	- wsa_strerror() function for more readable errors.
8878	- WSA Startup and Cleanup called in unbound.exe.
8879
888013 June 2008: Wouter
8881	- port mingw32, more signal ifdefs, detect sleep, usleep,
8882	  random, srandom (used inside the tests).
8883	- signed or unsigned FD_SET is cast.
8884
888510 June 2008: Wouter
8886	- fixup warnings compiling on eeepc xandros linux.
8887
88889 June 2008: Wouter
8889	- in iteration response type code
8890	  * first check for SOA record (negative answer) before NS record
8891	    and lameness.
8892	  * check if no AA bit for non-forwarder, and thus lame zone.
8893	    In response to error report by Richard Doty for mail.opusnet.com.
8894	- fixup unput warning from lexer on freeBSD.
8895	- bug#183. pidfile, rundir, and chroot configure options. Also the
8896	  example.conf and manual pages get the configured defaults.
8897	  You can use: (or accept the defaults to /usr/local/etc/unbound/)
8898	  --with-conf-file=filename
8899	  --with-pidfile=filename
8900	  --with-run-dir=path
8901	  --with-chroot-dir=path
8902
89038 June 2008: Wouter
8904	- if multiple CNAMEs, use the first one. Fixup akamai CNAME bug.
8905	  Reported by Robert Edmonds.
8906	- iana port updated.
8907
89084 June 2008: Wouter
8909	- updated libtool files with newer version.
8910	- iana portlist updated.
8911
89123 June 2008: Wouter
8913	- fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the
8914	  trailing dot is not used during comparison.
8915
89162 June 2008: Wouter
8917	- Jelte fixed bugs in my absence
8918	  - bug 178: fixed unportable shell usage in configure (relied on
8919	    bash shell).
8920	  - bug 180: fixed buffer overflow in unbound-checkconf use of strncat.
8921	  - bug 181: fixed buffer overflow in ldns (called by unbound to parse
8922	    config file parts).
8923	- fixes by Wouter
8924	  - bug 177: fixed compilation failure on opensuse, the
8925	    --disable-static configure flag caused problems.  (Patch from
8926	    Klaus Singvogel)
8927	  - bug 179: same fix as 177.
8928	  - bug 185: --disable-shared not passed along to ldns included with
8929	    unbound. Fixed so that configure parameters are passed to the
8930	    subdir configure script.
8931	    fixed that ./libtool is used always, you can still override
8932	    manually with ./configure libtool=mylibtool or set $libtool in
8933	    the environment.
8934	- update of the ldns tarball to current ldns svn version (fix 181).
8935	- bug 184: -r option for unbound-host, read resolv.conf for
8936	  forwarder. (Note that forwarder must support DNSSEC for validation
8937	  to succeed).
8938
893923 May 2008: Wouter
8940	- mingw32 porting.
8941	  - test for sys/wait.h
8942	  - WSAEWOULDBLOCK test after nonblocking TCP connect.
8943	  - write_iov_buffer removed: unused and no struct iov on windows.
8944	  - signed/unsigned warning fixup mini_event.
8945	  - use ioctlsocket to set nonblocking I/O if fnctl is unavailable.
8946	  - skip signals that are not defined
8947	  - detect pwd.h.
8948	  - detect getpwnam, getrlimit, setsid, sbrk, chroot.
8949	  - default config has no chroot if chroot() unavailable.
8950	  - if no kill() then no pidfile is read or written.
8951	  - gmtime_r is replaced by nonthreadsafe alternative if unavail.
8952	    used in rrsig time validation errors.
8953
895422 May 2008: Wouter
8955	- contrib unbound.spec from Patrick Vande Walle.
8956	- fixup bug#175: call tzset before chroot to have correct timestamps
8957	  in system log.
8958	- do not generate lex input and lex unput functions.
8959	- mingw port. replacement functions labelled _unbound.
8960	- fix bug 174 - check for tcp_sigpipe that ldns-testns is installed.
8961
896219 May 2008: Wouter
8963	- fedora 9, check in6_pktinfo define in configure.
8964	- CREDITS fixup of history.
8965	- ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative.
8966
896716 May 2008: Wouter
8968	- fixup for MacOSX hosts file reading (reported by John Dickinson).
8969	- created 1.0.0 svn tag.
8970	- trunk version 1.0.1.
8971
897214 May 2008: Wouter
8973	- accepted patch from Ondrej Sury for library version libtool option.
8974	- configure --disable-rpath fixes up libtool for rpath trouble.
8975	  Adapted from debian package patch file.
8976
897713 May 2008: Wouter
8978	- Added root ipv6 addresses to builtin root hints.
8979	- TODO modified for post 1.0 plans.
8980	- trunk version set to 1.0.0.
8981	- no unnecessary linking with librt (only when libevent/libev used).
8982
89837 May 2008: Wouter
8984	- fixup no-ip4 problem with error callback in outside network.
8985
898625 April 2008: Wouter
8987	- DESTDIR is honored by the Makefile for rpms.
8988	- contrib files unbound.spec and unbound.init, builds working RPM
8989	  on FC7 Linux, a chrooted caching resolver, and libunbound.
8990	- iana ports update.
8991
899224 April 2008: Wouter
8993	- chroot checks improved. working directory relative to chroot.
8994	  checks if config file path is inside chroot. Documentation on it.
8995	- nicer example.conf text.
8996	- created 0.11 tag.
8997
899823 April 2008: Wouter
8999	- parseunbound.pl contrib update from Kai Storbeck for threads.
9000	- iana ports update
9001
900222 April 2008: Wouter
9003	- ignore SIGPIPE.
9004	- unit test for SIGPIPE ignore.
9005
900621 April 2008: Wouter
9007	- FEATURES document.
9008	- fixup reread of config file if it was given as a full path
9009	  and chroot was used.
9010
901116 April 2008: Wouter
9012	- requirements doc, updated clean query returns.
9013	- parseunbound.pl update from Kai Storbeck.
9014	- sunos4 porting changes.
9015
901615 April 2008: Wouter
9017	- fixup default rc.d pidfile location to /usr/local/etc.
9018	- iana ports updated.
9019	- copyright updated in ldns-testpkts to keep same as in ldns.
9020	- fixup checkconf chroot tests a bit more, chdir must be inside
9021	  chroot dir.
9022	- documented 'gcc: unrecognized -KPIC option' errors on Solaris.
9023	- example.conf values changed to /usr/local/etc/unbound
9024	- DSA test work.
9025	- DSA signatures: unbound is compatible with both encodings found.
9026	  It will detect and convert when necessary.
9027
902814 April 2008: Wouter
9029	- got update for parseunbound.pl statistics script from Kai Storbeck.
9030	- tpkg tests for udp wait list.
9031	- documented 0x20 status.
9032	- fixup chroot and checkconf, it is much smarter now.
9033	- fixup DSA EVP signature decoding. Solution that Jelte found copied.
9034	- and check first sig byte for the encoding type.
9035
903611 April 2008: Wouter
9037	- random port selection out of the configged ports.
9038	- fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
9039	- removed base_port.
9040	- created 256-port ephemeral space for the OS, 59802 available.
9041	- fixup consistency of port_if out array during heavy use.
9042
904310 April 2008: Wouter
9044	- --with-libevent works with latest libevent 1.4.99-trunk.
9045	- added log file statistics perl script to contrib.
9046	- automatic iana ports update from makefile. 60058 available.
9047
90489 April 2008: Wouter
9049	- configure can detect libev(from its build directory) when passed
9050	  --with-libevent=/home/wouter/libev-3.2
9051	  libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
9052	- unused commpoints not listed in epoll list.
9053	- statistics-cumulative option so that the values are not reset.
9054	- config creates array of available ports, 61841 available,
9055	  it excludes <1024 and iana assigned numbers.
9056	  config statements to modify the available port numbers.
9057
90588 April 2008: Wouter
9059	- unbound tries to set the ulimit fds when started as server.
9060	  if that does not work, it will scale back its requirements.
9061
906227 March 2008: Wouter
9063	- documented /dev/random symlink from chrootdir as FAQ entry.
9064
906526 March 2008: Wouter
9066	- implemented AD bit signaling. If a query sets AD bit (but not DO)
9067	  then the AD bit is set in the reply if the answer validated.
9068	  Without including DNSSEC signatures. Useful if you have a trusted
9069	  path from the client to the resolver. Follows dnssec-updates draft.
9070
907125 March 2008: Wouter
9072	- implemented check that for NXDOMAIN and NOERROR answers a query
9073	  section must be present in the reply (by the scrubber). And it must
9074	  be equal to the question sent, at least lowercase folded.
9075	  Previously this feature happened because the cache code refused
9076	  to store such messages. However blocking by the scrubber makes
9077	  sure nothing gets into the RRset cache. Also, this looks like a
9078	  timeout (instead of an allocation failure) and this retries are
9079	  done (which is useful in a spoofing situation).
9080	- RTT banding. Band size 400 msec, this makes band around zero (fast)
9081	  include unknown servers. This makes unbound explore unknown servers.
9082
90837 March 2008: Wouter
9084	- -C config feature for harvest program.
9085	- harvest handles CNAMEs too.
9086
90875 March 2008: Wouter
9088	- patch from Hugo Koji Kobayashi for iterator logs spelling.
9089
90904 March 2008: Wouter
9091	- From report by Jinmei Tatuya, rfc2181 trust value for remainder
9092	  of a cname trust chain is lower; not full answer_AA.
9093	- test for this fix.
9094	- default config file location is /usr/local/etc/unbound.
9095	  Thus prefix is used to determine the location. This is also the
9096	  chroot and pidfile default location.
9097
90983 March 2008: Wouter
9099	- Create 0.10 svn tag.
9100	- 0.11 version in trunk.
9101	- indentation nicer.
9102
910329 February 2008: Wouter
9104	- documentation update.
9105	- fixup port to Solaris of perf test tool.
9106	- updated ldns-tarball with decl-after-statement fixes.
9107
910828 February 2008: Wouter
9109	- fixed memory leaks in libunbound (during cancellation and wait).
9110	- libunbound returns the answer packet in full.
9111	- snprintf compat update.
9112	- harvest performs lookup.
9113	- ldns-tarball update with fix for ldns_dname_label.
9114	- installs to sbin by default.
9115	- install all manual pages (unbound-host and libunbound too).
9116
911727 February 2008: Wouter
9118	- option to use caps for id randomness.
9119	- config file option use-caps-for-id: yes
9120	- harvest debug tool
9121
912226 February 2008: Wouter
9123	- delay utility delays TCP as well. If the server that is forwarded
9124	  to has a TCP error, the delay utility closes the connection.
9125	- delay does REUSE_ADDR, and can handle a server that closes its end.
9126	- answers use casing from query.
9127
912825 February 2008: Wouter
9129	- delay utility works. Gets decent thoughput too (>20000).
9130
913122 February 2008: Wouter
9132	- +2% for recursions, if identical queries (except for destination
9133	  and query ID) in the reply list, avoid re-encoding the answer.
9134	- removed TODO items for optimizations that do not show up in
9135	  profile reports.
9136	- default is now minievent - not libevent. As its faster and
9137	  not needed for regular installs, only for very large port ranges.
9138	- loop check different speedup pkt-dname-reading, 1% faster for
9139	  nocache-recursion check.
9140	- less hashing during msg parse, 4% for recursion.
9141	- small speed fix for dname_count_size_labels, +1 or +2% recursion.
9142	- some speed results noted:
9143	  optimization resulted in +40% for recursion (cache miss) and
9144	  +70 to +80 for cache hits, and +96% for version.bind.
9145	  zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4
9146	  www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
9147	  www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
9148	  So, unbound can be about equal qps to NSD in cache hits.
9149	  And about 3.4x faster than BIND in cache performance.
9150	- delay utility for testing.
9151
915221 February 2008: Wouter
9153	- speedup of root-delegation message encoding by 15%.
9154	- minor speedup of compress tree_lookup, maybe 1%.
9155	- speedup of dname_lab_cmp and memlowercmp - the top functions in
9156	  profiler output, maybe a couple percent when it matters.
9157
915820 February 2008: Wouter
9159	- setup speec_cache for need-ldns-testns in dotests.
9160	- check number of queued replies on incoming queries to avoid overload
9161	  on that account.
9162	- fptr whitelist checks are not disabled in optimize mode.
9163	- do-daemonize config file option.
9164	- minievent time share initializes time at start.
9165	- updated testdata for nsec3 new algorithm numbers (6, 7).
9166	- small performance test of packet encoding (root delegation).
9167
916819 February 2008: Wouter
9169	- applied patch to unbound-host man page from Jan-Piet Mens.
9170	- fix donotquery-localhost: yes default (it erroneously was switched
9171	  to default 'no').
9172	- time is only gotten once and the value is shared across unbound.
9173	- unittest cleans up crypto, so that it has no memory leaks.
9174	- mini_event shares the time value with unbound this results in
9175	  +3% speed for cache responses and +9% for recursions.
9176	- ldns tarball update with new NSEC3 sign code numbers.
9177	- perform several reads per UDP operation. This improves performance
9178	  in DoS conditions, and costs very little in normal conditions.
9179	  improves cache response +50%, and recursions +10%.
9180	- modified asynclook test. because the callback from async is not
9181	  in any sort of lock (and thus can use all library functions freely),
9182	  this causes a tiny race condition window when the last lock is
9183	  released for a callback and a new cancel() for that callback.
9184	  The only way to remove this is by putting callbacks into some
9185	  lock window. I'd rather have the small possibility of a callback
9186	  for a cancelled function then no use of library functions in
9187	  callbacks. Could be possible to only outlaw process(), wait(),
9188	  cancel() from callbacks, by adding another lock, but I'd rather not.
9189
919018 February 2008: Wouter
9191	- patch to unbound-host from Jan-Piet Mens.
9192	- unbound host prints errors if fails to configure context.
9193	- fixup perf to resend faster, so that long waiting requests do
9194	  not hold up the queue, they become lost packets or SERVFAILs,
9195	  or can be sent a little while later (i.e. processing time may
9196	  take long, but throughput has to be high).
9197	- fixup iterator operating in no cache conditions (RD flag unset
9198	  after a CNAME).
9199	- streamlined code for RD flag setting.
9200	- profiled code and changed dname compares to be faster.
9201	  The speedup is about +3% to +8% (depending on the test).
9202	- minievent tests for eintr and eagain.
9203
920415 February 2008: Wouter
9205	- added FreeBSD rc.d script to contrib.
9206	- --prefix option for configure also changes directory: pidfile:
9207	  and chroot: defaults in config file.
9208	- added cache speed test, for cache size OK and cache too small.
9209
921014 February 2008: Wouter
9211	- start without a config file (will complain, but start with
9212	  defaults).
9213	- perf test program works.
9214
921513 February 2008: Wouter
9216	- 0.9 released.
9217	- 1.0 development. Printout ldns version on unbound -h.
9218	- start of perf tool.
9219	- bugfix to read empty lines from /etc/hosts.
9220
922112 February 2008: Wouter
9222	- fixup problem with configure calling itself if ldns-src tarball
9223	  is not present.
9224
922511 February 2008: Wouter
9226	- changed library to use ub_ instead of ub_val_ as prefix.
9227	- statistics output text nice.
9228	- etc/hosts handling.
9229	- library function to put logging to a stream.
9230	- set any option interface.
9231
92328 February 2008: Wouter
9233	- test program for multiple queries over a TCP channel.
9234	- tpkg test for stream tcp queries.
9235	- unbound replies to multiple TCP queries on a TCP channel.
9236	- fixup misclassification of root referral with NS in answer
9237	  when validating a nonrec query.
9238	- tag 0.9
9239	- layout of manpages, spelling fix in header, manpages process by
9240	  makedist, list asynclook and tcpstream tests as ldns-testns
9241	  required.
9242
92437 February 2008: Wouter
9244	- moved up all current level 2 to be level 3. And 3 to 4.
9245	  to make room for new debug level 2 for detailed information
9246	  for operators.
9247	- verbosity level 2. Describes recursion and validation.
9248	- cleaner configure script and fixes for libevent solaris.
9249	- signedness for log output memory sizes in high verbosity.
9250
92516 February 2008: Wouter
9252	- clearer explanation of threading configure options.
9253	- fixup asynclook test for nothreading (it creates only one process
9254	  to do the extended test).
9255	- changed name of ub_val_result_free to ub_val_resolve_free.
9256	- removes warning message during library linking, renamed
9257	  libunbound/unbound.c -> libunbound.c and worker to libworker.
9258	- fallback without EDNS if result is NOTIMPL as well as on FORMERR.
9259
92605 February 2008: Wouter
9261	- statistics-interval: seconds option added.
9262	- test for statistics option
9263	- ignore errors making directories, these can occur in parallel builds
9264	- fixup Makefile strip command and libunbound docs typo.
9265
926631 January 2008: Wouter
9267	- bg thread/process reads and writes the pipe nonblocking all the time
9268	  so that even if the pipe is buffered or so, the bg thread does not
9269	  block, and services both pipes and queries.
9270
927130 January 2008: Wouter
9272	- check trailing / on chrootdir in checkconf.
9273	- check if root hints and anchor files are in chrootdir.
9274	- no route to host tcp error is verbosity level 2.
9275	- removed unused send_reply_iov. and its configure check.
9276	- added prints of 'remote address is 1.2.3.4 port 53' to errors
9277	  from netevent; the basic socket errors.
9278
927928 January 2008: Wouter
9280	- fixup uninit use of buffer by libunbound (query id, flags) for
9281	  local_zone answers.
9282	- fixup uninit warning from random.c; also seems to fix sporadic
9283	  sigFPE coming out of openssl.
9284	- made openssl entropy warning more silent for library use. Needs
9285	  verbosity 1 now.
9286	- fixup forgotten locks for rbtree_searches on ctx->query tree.
9287	- random generator cleanup - RND_STATE_SIZE removed, and instead
9288	  a super-rnd can be passed at init to chain init random states.
9289	- test also does lock checks if available.
9290	- protect config access in libworker_setup().
9291	- libevent doesn't like comm_base_exit outside of runloop.
9292	- close fds after removing commpoints only (for epoll, kqueue).
9293
929425 January 2008: Wouter
9295	- added tpkg for asynclook and library use.
9296	- allows localhost to be queried when as a library.
9297	- fixup race condition between cancel and answer (in case of
9298	  really fast answers that beat the cancel).
9299	- please doxygen, put doxygen comment in one place.
9300	- asynclook -b blocking mode and test.
9301	- refactor asynclook, nicer code.
9302	- fixup race problems from opensll in rand init from library, with
9303	  a mutex around the rand init.
9304	- fix pass async_id=NULL to _async resolve().
9305	- rewrote _wait() routine, so that it is threadsafe.
9306	- cancelation is threadsafe.
9307	- asynclook extended test in tpkg.
9308	- fixed two races where forked bg process waits for (somehow shared?)
9309	  locks, so does not service the query pipe on the bg side.
9310	  Now those locks are only held for fg_threads and for bg_as_a_thread.
9311
931224 January 2008: Wouter
9313	- tested the cancel() function.
9314	- asynclook -c (cancel) feature.
9315	- fix fail to allocate context actions.
9316	- make pipe nonblocking at start.
9317	- update plane for retry mode with caution to limit bandwidth.
9318	- fix Makefile for concurrent make of unbound-host.
9319	- renamed ub_val_ctx_wait/poll/process/fd to ub_val*.
9320	- new calls to set forwarding added to header and docs.
9321
932223 January 2008: Wouter
9323	- removed debug prints from if-auto, verb-algo enables some.
9324	- libunbound QUIT setup, remove memory leaks, when using threads
9325	  will share memory for passing results instead of writing it over
9326	  the pipe, only writes ID number over the pipe (towards the handler
9327	  thread that does process() ).
9328
932922 January 2008: Wouter
9330	- library code for async in libunbound/unbound.c.
9331	- fix link testbound.
9332	- fixup exit bug in mini_event.
9333	- background worker query enter and result functions.
9334	- bg query test application asynclook, it looks up multiple
9335	  hostaddresses (A records) at the same time.
9336
933721 January 2008: Wouter
9338	- libworker work, netevent raw commpoints, write_msg, serialize.
9339
934018 January 2008: Wouter
9341	- touch up of manpage for libunbound.
9342	- support for IP_RECVDSTADDR (for *BSD ip4).
9343	- fix for BSD, do not use ip4to6 mapping, make two sockets, once
9344	  ip6 and once ip4, uses socket options.
9345	- goodbye ip4to6 mapping.
9346	- update ldns-testpkts with latest version from ldns-trunk.
9347	- updated makedist for relative ldns pathnames.
9348	- library API with more information inside the result structure.
9349	- work on background resolves.
9350
935117 January 2008: Wouter
9352	- fixup configure in case -lldns is installed.
9353	- fixup a couple of doxygen warnings, about enum variables.
9354	- interface-automatic now copies the interface address from the
9355	  PKT_INFO structure as well.
9356	- manual page with library API, all on one page 'man libunbound'.
9357	- rewrite of PKTINFO structure, it also captures IP4 PKTINFO.
9358
935916 January 2008: Wouter
9360	- incoming queries to the server with TC bit on are replied FORMERR.
9361	- interface-automatic replied the wrong source address on localhost
9362	  queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying
9363	  to use ifnum=-1 to mean 'no interface, use kernel route'.
9364
936515 January 2008: Wouter
9366	- interface-automatic feature. experimental. Nice for anycast.
9367	- tpkg test for ip6 ancillary data.
9368	- removed debug prints.
9369	- porting experience, define for Solaris, test refined for BSD
9370	  compatibility. The feature probably will not work on OpenBSD.
9371	- makedist fixup for ldns-src in build-dir.
9372
937314 January 2008: Wouter
9374	- in no debug sets NDEBUG to remove asserts.
9375	- configure --enable-debug is needed for dependency generation
9376	  for assertions and for compiler warnings.
9377	- ldns.tgz updated with ldns-trunk (where buffer.h is updated).
9378	- fix lint, unit test in optimize mode.
9379	- default access control allows ::ffff:127.0.0.1 v6mapped localhost.
9380
938111 January 2008: Wouter
9382	- man page, warning removed.
9383	- added text describing the use of stub zones for private zones.
9384	- checkconf tests for bad hostnames (IP address), and for doubled
9385	  interface lines.
9386	- memory sizes can be given with 'k', 'Kb', or M or G appended.
9387
938810 January 2008: Wouter
9389	- typo in example.conf.
9390	- made using ldns-src that is included the package more portable
9391	  by linking with .lo instead of .o files in the ldns package.
9392	- nicer do-ip6: yes/no documentation.
9393	- nicer linking of libevent .o files.
9394	- man pages render correctly on solaris.
9395
93969 January 2008: Wouter
9397	- fixup openssl RAND problem, when the system is not configured to
9398	  give entropy, and the rng needs to be seeded.
9399
94008 January 2008: Wouter
9401	- print median and quartiles with extensive logging.
9402
94034 January 2008: Wouter
9404	- document misconfiguration in private network.
9405
94062 January 2008: Wouter
9407	- fixup typo in requirements.
9408	- document that 'refused' is a better choice than 'drop' for
9409	  the access control list, as refused will stop retries.
9410
94117 December 2007: Wouter
9412	- unbound-host has a -d option to show what happens. This can help
9413	  with debugging (why do I get this answer).
9414	- fixup CNAME handling, on nodata, sets and display canonname.
9415	- dot removed from CNAME display.
9416	- respect -v for NXDOMAINs.
9417	- updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes).
9418	- size_t to int for portability of the header file.
9419	- fixup bogus handling.
9420	- dependencies and lint for unbound-host.
9421
94226 December 2007: Wouter
9423	- library resolution works in foreground mode, unbound-host app
9424	  receives data.
9425	- unbound-host prints rdata using ldns.
9426	- unbound-host accepts trust anchors, and prints validation
9427	  information when you give -v.
9428
94295 December 2007: Wouter
9430	- locking in context_new() inside the function.
9431	- setup of libworker.
9432
94334 December 2007: Wouter
9434	- minor Makefile fixup.
9435	- moved module-stack code out of daemon/daemon into services/modstack,
9436	  preparing for code-reuse.
9437	- move context into own header file.
9438	- context query structure.
9439	- removed unused variable pwd from checkconf.
9440	- removed unused assignment from outside netw.
9441	- check timeval length of string.
9442	- fixup error in val_utils getsigner.
9443	- fixup same (*var) error in netblocktostr.
9444	- fixup memleak on parse error in localzone.
9445	- fixup memleak on packet parse error.
9446	- put ; after union in parser.y.
9447	- small hardening in iter_operate against iq==NULL.
9448	- hardening, if error reply with rcode=0 (noerror) send servfail.
9449	- fixup same (*var) error in find_rrset in msgparse, was harmless.
9450	- check return value of evtimer_add().
9451	- fixup lockorder in lruhash_reclaim(), building up a list of locked
9452	  entries one at a time. Instead they are removed and unlocked.
9453	- fptr_wlist for markdelfunc.
9454	- removed is_locked param from lruhash delkeyfunc.
9455	- moved bin_unlock during bin_split purely to please.
9456
94573 December 2007: Wouter
9458	- changed checkconf/ to smallapp/ to make room for more support tools.
9459	  (such as unbound-host).
9460	- install dirs created with -m 755 because they need to be accessible.
9461	- library extensive featurelist added to TODO.
9462	- please doxygen, lint.
9463	- library test application, with basic functionality.
9464	- fix for building in a subdirectory.
9465	- link lib fix for Leopard.
9466
946730 November 2007: Wouter
9468	- makefile that creates libunbound.la, basic file or libunbound.a
9469	  when creating static executables (no libtool).
9470	- more API setup.
9471
947229 November 2007: Wouter
9473	- 0.9 public API start.
9474
947528 November 2007: Wouter
9476	- Changeup plan for 0.8 - no complication needed, a simple solution
9477	  has been chosen for authoritative features.
9478	- you can use single quotes in the config file, so it is possible
9479	  to specify TXT records in local data.
9480	- fixup small memory problem in implicit transparent zone creation.
9481	- test for implicit zone creation and multiple RR RRsets local data.
9482	- local-zone nodefault test.
9483	- show testbound testlist on commit.
9484	- iterator normalizer changes CNAME chains ending in NXDOMAIN where
9485	  the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial
9486	  domain exists).
9487	- nicer verbosity: 0 and 1 levels.
9488	- lower nonRDquery chance of eliciting wrongly typed validation
9489	  requiring message from the cache.
9490	- fix for nonRDquery validation typing; nodata is detected when
9491	  SOA record in auth section (all validation-requiring nodata messages
9492	  have a SOA record in authority, so this is OK for the validator),
9493	  and NS record is needed to be a referral.
9494	- duplicate checking when adding NSECs for a CNAME, and test.
9495	- created svn tag 0.8, after completing testbed tests.
9496
949727 November 2007: Wouter
9498	- per suggestion in rfc2308, replaced default max-ttl value with 1 day.
9499	- set size of msgparse lookup table to 32, from 1024, so that its size
9500	  is below the 2048 regional large size threshold, and does not cause
9501	  a call to malloc when a message is parsed.
9502	- update of memstats tool to print number of allocation calls.
9503	  This is what is taking time (not space) and indicates the avg size
9504	  of the allocations as well. region_alloc stat is removed.
9505
950622 November 2007: Wouter
9507	- noted EDNS in-the-middle dropping trouble as a TODO.
9508	  At this point theoretical, no user trouble has been reported.
9509	- added all default AS112 zones.
9510	- answers from local zone content.
9511		* positive answer, the rrset in question
9512		* nodata answer (exist, but not that type).
9513		* nxdomain answer (domain does not exist).
9514		* empty-nonterminal answer.
9515		* But not: wildcard, nsec, referral, rrsig, cname/dname,
9516			or additional section processing, NS put in auth.
9517	- test for correct working of static and transparent and couple
9518	  of important defaults (localhost, as112, reverses).
9519	  Also checks deny and refuse settings.
9520	- fixup implicit zone generation and AA bit for NXDOMAIN on localdata.
9521
952221 November 2007: Wouter
9523	- local zone internal data setup.
9524
952520 November 2007: Wouter
9526	- 0.8 - str2list config support for double string config options.
9527	- local-zone and local-data options, config storage and documentation.
9528
952919 November 2007: Wouter
9530	- do not downcase NSEC and RRSIG for verification. Follows
9531	  draft-ietf-dnsext-dnssec-bis-updates-06.txt.
9532	- fixup leaking unbound daemons at end of tests.
9533	- README file updated.
9534	- nice libevent not found error.
9535	- README talks about gnu make.
9536	- 0.8: unit test for addr_mask and fixups for it.
9537	  and unit test for addr_in_common().
9538	- 0.8: access-control config file element.
9539	  and unit test rpl replay file.
9540	- 0.8: fixup address reporting from netevent.
9541
954216 November 2007: Wouter
9543	- privilege separation is not needed in unbound at this time.
9544	  TODO item marked as such.
9545	- created beta-0.7 branch for support.
9546	- tagged 0.7 for beta release.
9547	- moved trunk to 0.8 for 0.8(auth features) development.
9548	- 0.8: access control list setup.
9549
955015 November 2007: Wouter
9551	- review fixups from Jelte.
9552
955314 November 2007: Wouter
9554	- testbed script does not recreate configure, since its in svn now.
9555	- fixup checkconf test so that it does not test
9556	  /etc/unbound/unbound.conf.
9557	- tag 0.6.
9558
955913 November 2007: Wouter
9560	- remove debug print.
9561	- fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists.
9562
956312 November 2007: Wouter
9564	- fixup signal handling where SIGTERM could be ignored if a SIGHUP
9565	  arrives later on.
9566	- bugreports to unbound-bugs@nlnetlabs.nl
9567	- fixup testbound so it exits cleanly.
9568	- cleanup the caches on a reload, so that rrsetID numbers won't clash.
9569
95709 November 2007: Wouter
9571	- took ldns snapshot in repo.
9572	- default config file is /etc/unbound/unbound.conf.
9573	  If it doesn't exist, it is installed with the doc/example.conf file.
9574	  The file is not deleted on uninstall.
9575	- default listening is not all, but localhost interfaces.
9576
95778 November 2007: Wouter
9578	- Fixup chroot and drop user privileges.
9579	- new L root ip address in default hints.
9580
95811 November 2007: Wouter
9582	- Fixup of crash on reload, due to anchors in env not NULLed after
9583	  dealloc during deinit.
9584	- Fixup of chroot call. Happens after privileges are dropped, so
9585	  that checking the passwd entry still works.
9586	- minor touch up of clear() hashtable function.
9587	- VERB_DETAIL prints out what chdir, username, chroot is being done.
9588	- when id numbers run out, caches are cleared, as in design notes.
9589	  Tested with a mock setup with very few bits in id, it worked.
9590	- harden-dnssec-stripped: yes is now default. It insists on dnssec
9591	  data for trust anchors. Included tests for the feature.
9592
959331 October 2007: Wouter
9594	- cache-max-ttl config option.
9595	- building outside sourcedir works again.
9596	- defaults more secure:
9597		username: "unbound"
9598		chroot: "/etc/unbound"
9599	  The operator can override them to be less secure ("") if necessary.
9600	- fix horrible oversight in sorting rrset references in a message,
9601	  sort per reference key pointer, not on referencepointer itself.
9602	- pidfile: "/etc/unbound/unbound.pid" is now the default.
9603	- tests changed to reflect the updated default.
9604	- created hashtable clear() function that respects locks.
9605
960630 October 2007: Wouter
9607	- fixup assertion failure that relied on compressed names to be
9608	  smaller than uncompressed names. A packet from comrite.com was seen
9609	  to be compressed to a larger size. Added it as unit test.
9610	- quieter logging at low verbosity level for common tcp messages.
9611	- no greedy TTL update.
9612
961323 October 2007: Wouter
9614	- fixup (grand-)parent problem for dnssec-lameness detection.
9615	- fixup tests to do additional section processing for lame replies,
9616	  since the detection needs that.
9617	- no longer trust in query section in reply during dnssec lame detect.
9618	- dnssec lameness does not make the server never ever queried, but
9619	  non-preferred. If no other servers exist or answer, the dnssec lame
9620	  server is used; the fastest dnssec lame server is chosen.
9621	- added test then when trust anchor cannot be primed (nodata), the
9622	  insecure mode from unbound works.
9623	- Fixup max queries per thread, any more are dropped.
9624
962522 October 2007: Wouter
9626	- added donotquerylocalhost config option. Can be turned off for
9627	  out test cases.
9628	- ISO C compat changes.
9629	- detect RA-no-AA lameness, as LAME.
9630	- DNSSEC-lameness detection, as LAME.
9631	  See notes in requirements.txt for choices made.
9632	- tests for lameness detection.
9633	- added all to make test target; need unbound for fwd tests.
9634	- testbound does not pollute /etc/unbound.
9635
963619 October 2007: Wouter
9637	- added configure (and its files) to svn, so that the trunk is easier
9638	  to use. ./configure, config.guess, config.sub, ltmain.sh,
9639	  and config.h.in.
9640	- added yacc/lex generated files, util/configlexer.c,
9641	  util/configparser.c util/configparser.h, to svn.
9642	- without lex no attempt to use it.
9643	- unsecure response validation collated into one block.
9644	- remove warning about const cast of cfgfile name.
9645	- outgoing-interfaces can be different from service interfaces.
9646	- ldns-src configure is done during unbound configure and
9647	  ldns-src make is done during unbound make, and so inherits the
9648	  make arguments from the unbound make invocation.
9649	- nicer error when libevent problem causes instant exit on signal.
9650	- read root hints from a root hint file (like BIND does).
9651
965218 October 2007: Wouter
9653	- addresses are logged with errors.
9654	- fixup testcode fake event to remove pending before callback
9655	  since the callback may create new pending items.
9656	- tests updated because retries are now in iterator module.
9657	- ldns-testpkts code is checked for differences between unbound
9658	  and ldns by makedist.sh.
9659	- ldns trunk from today added in svn repo for fallback in case
9660	  no ldns is installed on the system.
9661	  make download_ldns refreshes the tarball with ldns svn trunk.
9662	- ldns-src.tar.gz is used if no ldns is found on the system, and
9663	  statically linked into unbound.
9664	- start of regional allocator code.
9665	- regional uses less memory and variables, simplified code.
9666	- remove of region-allocator.
9667	- alloc cache keeps a cache of recently released regional blocks,
9668	  up to a maximum.
9669	- make unit test cleanly free memory.
9670
967117 October 2007: Wouter
9672	- fixup another cycle detect and ns-addr timeout resolution bug.
9673	  This time by refusing delegations from the cache without addresses
9674	  when resolving a mandatory-glue nameserver-address for that zone.
9675	  We're going to have to ask a TLD server anyway; might as well be
9676	  the TLD server for this name. And this resolves a lot of cases where
9677	  the other nameserver names lead to cycles or are not available.
9678	- changed random generator from random(3) clone to arc4random wrapped
9679	  for thread safety. The random generator is initialised with
9680	  entropy from the system.
9681	- fix crash where failure to prime DNSKEY tried to print null pointer
9682	  in the log message.
9683	- removed some debug prints, only verb_algo (4) enables them.
9684	- fixup test; new random generator took new paths; such as one
9685	  where no scripted answer was available.
9686	- mark insecure RRs as insecure.
9687	- fixup removal of nonsecure items from the additional.
9688	- reduced timeout values to more realistic, 376 msec (262 msec has
9689	  90% of roundtrip times, 512 msec has 99% of roundtrip times.)
9690	- server selection failover to next server after timeout (376 msec).
9691
969216 October 2007: Wouter
9693	- no malloc in log_hex.
9694	- assertions around system calls.
9695	- protect against gethostname without ending zero.
9696	- ntop output is null terminated by unbound.
9697	- pidfile content null termination
9698	- various snprintf use sizeof(stringbuf) instead of fixed constant.
9699	- changed loopdetect % 8 with & 0x7 since % can become negative for
9700	  weird negative input and particular interpretation of integer math.
9701	- dname_pkt_copy checks length of result, to protect result buffers.
9702	  prints an error, this should not happen. Bad strings should have
9703	  been rejected earlier in the program.
9704	- remove a size_t underflow from msgreply size func.
9705
970615 October 2007: Wouter
9707	- nicer warning.
9708	- fix IP6 TCP, wrong definition check. With test package.
9709	- fixup the fact that the query section was not compressed to,
9710	  the code was there but was called by value instead of by reference.
9711	  And test for the case, uses xxd and nc.
9712	- more portable ip6 check for sockaddr types.
9713
97148 October 2007: Wouter
9715	- --disable-rpath option in configure for 64bit systems with
9716	  several dynamic lib dirs.
9717
97187 October 2007: Wouter
9719	- fixup tests for no AD bit in non-DO queries.
9720	- test that makes sure AD bit is not set on non-DO query.
9721
97226 October 2007: Wouter
9723	- removed logfile open early. It did not have the proper permissions;
9724	  it was opened as root instead of the user. And we cannot change user
9725	  id yet, since chroot and bind ports need to be done.
9726	- callback checks for event callbacks done from mini_event. Because
9727	  of deletions cannot do this from netevent. This means when using
9728	  libevent the protection does not work on event-callbacks.
9729	- fixup too small reply (did not zero counts).
9730	- fixup reply no longer AD bit when query without DO bit.
9731
97325 October 2007: Wouter
9733	- function pointer whitelist.
9734
97354 October 2007: Wouter
9736	- overwrite sensitive random seed value after use.
9737	- switch to logfile very soon if not -d (console attached).
9738	- error messages do not reveal the trustanchor contents.
9739	- start work on function pointer whitelists.
9740
97413 October 2007: Wouter
9742	- fix for multiple empty nonterminals, after multiple DSes in the
9743	  chain of trust.
9744	- mesh checks if modules are looping, and stops them.
9745	- refetch with CNAMEd nameserver address regression test added.
9746	- fixup line count bug in testcode, so testbound prints correct line
9747	  number with parse errors.
9748	- unit test for multiple ENT case.
9749	- fix for cname out of validated unsec zone.
9750	- fixup nasty id=0 reuse. Also added assertions to detect its
9751	  return (the assertion catches in the existing test cases).
9752
97531 October 2007: Wouter
9754	- skip F77, CXX, objC tests in configure step.
9755	- fixup crash in refetch glue after a CNAME.
9756	  and protection against similar failures (with error print).
9757
975828 September 2007: Wouter
9759	- test case for unbound-checkconf, fixed so it also checks the
9760	  interface: statements.
9761
976226 September 2007: Wouter
9763	- SIGHUP will reopen the log file.
9764	- Option to log to syslog.
9765	- please lint, fixup tests (that went to syslog on open, oops).
9766	- config check program.
9767
976825 September 2007: Wouter
9769	- tests for NSEC3. Fixup bitmap checks for NSEC3.
9770	- positive ANY response needs to check if wildcard expansion, and
9771	  check that original data did not exist.
9772	- tests for NSEC3 that wrong use of OPTOUT is bad. For insecure
9773	  delegation, for abuse of child zone apex nsec3.
9774	- create 0.5 release tag.
9775
977624 September 2007: Wouter
9777	- do not make test programs by default.
9778	- But 'make test' will perform all of the tests.
9779	- Advertise builtin select libevent alternative when no libevent
9780	  is found.
9781	- signit can generate NSEC3 hashes, for generating tests.
9782	- multiple nsec3 parameters in message test.
9783	- too high nsec3 iterations becomes insecure test.
9784
978521 September 2007: Wouter
9786	- fixup empty_DS_name allocated in wrong region (port DEC Alpha).
9787	- fixup testcode lock safety (port FreeBSD).
9788	- removes subscript has type char warnings (port Solaris 9).
9789	- fixup of field with format type to int (port MacOS/X intel).
9790	- added test for infinite loop case in nonRD answer validation.
9791	  It was a more general problem, but hard to reproduce. When an
9792	  unsigned rrset is being validated and the key fetched, the DS
9793	  sequence is followed, but if the final name has no DS, then no
9794	  proof is possible - the signature has been stripped off.
9795
979620 September 2007: Wouter
9797	- fixup and test for NSEC wildcard with empty nonterminals.
9798	- makedist.sh fixup for svn info.
9799	- acl features request in plan.
9800	- improved DS empty nonterminal handling.
9801	- compat with ANS nxdomain for empty nonterminals. Attempts the nodata
9802	  proof anyway, which succeeds in ANS failure case.
9803	- striplab protection in case it becomes -1.
9804	- plans for static and blacklist config.
9805
980619 September 2007: Wouter
9807	- comments about non-packed usage.
9808	- plan for overload support in 0.6.
9809	- added testbound tests for a failed resolution from the logs
9810	  and for failed prime when missing glue.
9811	- fixup so useless delegation points are not returned from the
9812	  cache. Also the safety belt is used if priming fails to complete.
9813	- fixup NSEC rdata not to be lowercased, bind compat.
9814
981518 September 2007: Wouter
9816	- wildcard nsec3 testcases, and fixup to get correct wildcard name.
9817	- validator prints subtype classification for debug.
9818
981917 September 2007: Wouter
9820	- NSEC3 hash cache unit test.
9821	- validator nsec3 nameerror test.
9822
982314 September 2007: Wouter
9824	- nsec3 nodata proof, nods proof, wildcard proof.
9825	- nsec3 support for cname chain ending in noerror or nodata.
9826	- validator calls nsec3 proof routines if no NSECs prove anything.
9827	- fixup iterator bug where it stored the answer to a cname under
9828	  the wrong qname into the cache. When prepending the cnames, the
9829	  qname has to be reset to the original qname.
9830
983113 September 2007: Wouter
9832	- nsec3 find matching and covering, ce proof, prove namerror msg.
9833
983412 September 2007: Wouter
9835	- fixup of manual page warnings, like for NSD bugreport.
9836	- nsec3 work, config, max iterations, filter, and hash cache.
9837
98386 September 2007: Wouter
9839	- fixup to find libevent on mac port install.
9840	- fixup size_t vs unsigned portability in validator/sigcrypt.
9841	- please compiler on different platforms, for unreachable code.
9842	- val_nsec3 file.
9843	- pthread_rwlock type is optional, in case of old pthread libs.
9844
98455 September 2007: Wouter
9846	- cname, name error validator tests.
9847	- logging of qtype ANY works.
9848	- ANY type answers get RRSIG in answer section of replies (but not
9849	  in other sections, unless DO bit is on).
9850	- testbound can replay a TCP query (set MATCH TCP in the QUERY).
9851	- DS and noDS referral validation test.
9852	- if you configure many trust anchors, parent trust anchors can
9853	  securely deny existence of child trust anchors, if validated.
9854	- not all *.name NSECs are present because a wildcard was matched,
9855	  and *.name NSECs can prove nodata for empty nonterminals.
9856	  Also, for wildcard name NSECs, check they are not from the parent
9857	  zone (for wildcarded zone cuts), and check absence of CNAME bit,
9858	  for a nodata proof.
9859	- configure option for memory allocation debugging.
9860	- port configure option for memory allocation to solaris10.
9861
98624 September 2007: Wouter
9863	- fixup of Leakage warning when serviced queries processed multiple
9864	  callbacks for the same query from the same server.
9865	- testbound removes config file from /tmp on failed exit.
9866	- fixup for referral cleanup of the additional section.
9867	- tests for cname, referral validation.
9868	- neater testbound tpkg output.
9869	- DNAMEs no longer match their apex when synthesized from the cache.
9870	- find correct signer name for DNAME responses.
9871	- wildcarded DNAME test and fixup code to detect.
9872	- prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs.
9873	  So that wildcarded CNAMEs get their NSEC with them to the answer.
9874	- test for a CNAME to a DNAME to a CNAME to an answer, all from
9875	  different domains, for key fetching and signature checking of
9876	  CNAME'd messages.
9877
98783 September 2007: Wouter
9879	- Fixed error in iterator that would cause assertion failure in
9880	  validator. CNAME to a NXDOMAIN response was collated into a response
9881	  with both a CNAME and the NXDOMAIN rcode. Added a test that the
9882	  rcode is changed to NOERROR (because of the CNAME).
9883	- timeout on tcp does not lead to spurious leakage detect.
9884	- account memory for name of lame zones, so that memory leakages does
9885	  not show lame cache growth as a leakage growth.
9886	- config setting for lameness cache expressed in bytes, instead of
9887	  number of entries.
9888	- tool too summarize allocations per code line.
9889
989031 August 2007: Wouter
9891	- can read bind trusted-keys { ... }; files, in a compatibility mode.
9892	- iterator should not detach target queries that it still could need.
9893	  the protection against multiple outstanding queries is moved to a
9894	  current_query num check.
9895	- validator nodata, positive, referral tests.
9896	- dname print can print '*' wildcard.
9897
989830 August 2007: Wouter
9899	- fixup override date config option.
9900	- config options to control memory usage.
9901	- caught bad free of un-alloced data in worker_send error case.
9902	- memory accounting for key cache (trust anchors and temporary cache).
9903	- memory accounting fixup for outside network tcp pending waits.
9904	- memory accounting fixup for outside network tcp callbacks.
9905	- memory accounting for iterator fixed storage.
9906	- key cache size and slabs config options.
9907	- lib crypto cleanups at exit.
9908
990929 August 2007: Wouter
9910	- test tool to sign rrsets for testing validator with.
9911	- added RSA and DSA test keys, public and private pairs, 512 bits.
9912	- default configuration is with validation enabled.
9913	  Only a trust-anchor needs to be configured for DNSSEC to work.
9914	- do not convert to DER for DSA signature verification.
9915	- validator replay test file, for a DS to DNSKEY DSA key prime and
9916	  positive response.
9917
991828 August 2007: Wouter
9919	- removed double use for udp buffers, that could fail,
9920	  instead performs a malloc to do the backup.
9921	- validator validates referral messages, by validating all the rrsets
9922	  and stores the rrsets in the cache. Further referral (nonRD queries)
9923	  replies are made from the rrset cache directly. Unless unchecked
9924	  rrsets are encountered, there are then validated.
9925	- enforce that signing is done by a parent domain (or same domain).
9926	- adjust TTL downwards if rrset TTL bigger than signature allows.
9927	- permissive mode feature, sets AD bit for secure, but bogus does
9928	  not give servfail (bogus is changed into indeterminate).
9929	- optimization of rrset verification. rr canonical sorting is reused,
9930	  for the same rrset. canonical rrset image in buffer is reused for
9931	  the same signature.
9932	- if the rrset is too big (64k exactly + large owner name) the
9933	  canonicalization routine will fail if it does not fit in buffer.
9934	- faster verification for large sigsets.
9935	- verb_detail mode reports validation failures, but not the entire
9936	  algorithm for validation. Key prime failures are reported as
9937	  verb_ops level.
9938
993927 August 2007: Wouter
9940	- do not garble the edns if a cache answer fails.
9941	- answer norecursive from cache if possible.
9942	- honor clean_additional setting when returning secure non-recursive
9943	  referrals.
9944	- do not store referral in msg cache for nonRD queries.
9945	- store verification status in the rrset cache to speed up future
9946	  verification.
9947	- mark rrsets indeterminate and insecure if they are found to be so.
9948	  and store this in the cache.
9949
995024 August 2007: Wouter
9951	- message is bogus if unsecure authority rrsets are present.
9952	- val-clean-additional option, so you can turn it off.
9953	- move rrset verification out of the specific proof types into one
9954	  routine. This makes the proof routines prettier.
9955	- fixup cname handling in validator, cname-to-positive and cname-to-
9956	  nodata work.
9957	- Do not synthesize DNSKEY and DS responses from the rrset cache if
9958	  the rrset is from the additional section. Signatures may have
9959	  fallen off the packet, and cause validation failure.
9960	- more verbose signature date errors (with the date attached).
9961	- increased default infrastructure cache size. It is important for
9962	  performance, and 1000 entries are only 212k (or a 400 k total cache
9963	  size). To 10000 entries (for 2M entries, 4M cache size).
9964
996523 August 2007: Wouter
9966	- CNAME handling - move needs_validation to before val_new().
9967	  val_new() setups the chase-reply to be an edited copy of the msg.
9968	  new classification, and find signer can find for it.
9969	  removal of unsigned crap from additional, and query restart for
9970	  cname.
9971	- refuse to follow wildcarded DNAMEs when validating.
9972	  But you can query for qtype ANY, or qtype DNAME and validate that.
9973
997422 August 2007: Wouter
9975	- bogus TTL.
9976	- review - use val_error().
9977
997821 August 2007: Wouter
9979	- ANY response validation.
9980	- store security status in cache.
9981	- check cache security status and either send the query to be
9982	  validated, return the query to client, or send servfail to client.
9983	  Sets AD bit on validated replies.
9984	- do not examine security status on an error reply in mesh_done.
9985	- construct DS, DNSKEY messages from rrset cache.
9986	- manual page entry for override-date.
9987
998820 August 2007: Wouter
9989	- validate and positive validation, positive wildcard NSEC validation.
9990	- nodata validation, nxdomain validation.
9991
999218 August 2007: Wouter
9993	- process DNSKEY response in FINDKEY state.
9994
999517 August 2007: Wouter
9996	- work on DS2KE routine.
9997	- val_nsec.c for validator NSEC proofs.
9998	- unit test for NSEC bitmap reading.
9999	- dname iswild and canonical_compare with unit tests.
10000
1000116 August 2007: Wouter
10002	- DS sig unit test.
10003	- latest release libevent 1.3c and 1.3d have threading fixed.
10004	- key entry fixup data pointer and ttl absolute.
10005	- This makes a key-prime succeed in validator, with DS or DNSKEY as
10006	  trust-anchor.
10007	- fixup canonical compare byfield routine, fix bug and also neater.
10008	- fixed iterator response type classification for queries of type
10009	  ANY and NS.
10010	  dig ANY gives sometimes NS rrset in AN and NS section, and parser
10011	  removes the NS section duplicate. dig NS gives sometimes the NS
10012	  in the answer section, as referral.
10013	- validator FINDKEY state.
10014
1001515 August 2007: Wouter
10016	- crypto calls to verify signatures.
10017	- unit test for rrsig verification.
10018
1001914 August 2007: Wouter
10020	- default outgoing ports changed to avoid port 2049 by default.
10021	  This port is widely blocked by firewalls.
10022	- count infra lameness cache in memory size.
10023	- accounting of memory improved
10024	- outbound entries are allocated in the query region they are for.
10025	- extensive debugging for memory allocations.
10026	- --enable-lock-checks can be used to enable lock checking.
10027	- protect undefs in config.h from autoheaders ministrations.
10028	- print all received udp packets. log hex will print on multiple
10029	  lines if needed.
10030	- fixed error in parser with backwards rrsig references.
10031	- mark cycle targets for iterator did not have CD flag so failed
10032	  its task.
10033
1003413 August 2007: Wouter
10035	- fixup makefile, if lexer is missing give nice error and do not
10036	  mess up the dependencies.
10037	- canonical compare routine updated.
10038	- canonical hinfo compare.
10039	- printout list of the queries that the mesh is working on.
10040
1004110 August 2007: Wouter
10042	- malloc and free overrides that track total allocation and frees.
10043	  for memory debugging.
10044	- work on canonical sort.
10045
100469 August 2007: Wouter
10047	- canonicalization, signature checks
10048	- dname signature label count and unit test.
10049	- added debug heap size print to memory printout.
10050	- typo fixup in worker.c
10051	- -R needed on solaris.
10052	- validator override option for date check testing.
10053
100548 August 2007: Wouter
10055	- ldns _raw routines created (in ldns trunk).
10056	- sigcrypt DS digest routines
10057	- val_utils uses sigcrypt to perform signature cryptography.
10058	- sigcrypt keyset processing
10059
100607 August 2007: Wouter
10061	- security status type.
10062	- security status is copied when rdata is equal for rrsets.
10063	- rrset id is updated to invalidate all the message cache entries
10064	  that refer to NSEC, NSEC3, DNAME rrsets that have changed.
10065	- val_util work
10066	- val_sigcrypt file for validator signature checks.
10067
100686 August 2007: Wouter
10069	- key cache for validator.
10070	- moved isroot and dellabel to own dname routines, with unit test.
10071
100723 August 2007: Wouter
10073	- replanning.
10074	- scrubber check section of lame NS set.
10075	- trust anchors can be in config file or read from zone file,
10076	  DS and DNSKEY entries.
10077	- unit test trust anchor storage.
10078	- trust anchors converted to packed rrsets.
10079	- key entry definition.
10080
100812 August 2007: Wouter
10082	- configure change for latest libevent trunk version (needs -lrt).
10083	- query_done and walk_supers are moved out of module interface.
10084	- fixup delegation point duplicates.
10085	- fixup iterator scrubber; lame NS set is let through the scrubber
10086	  so that the classification is lame.
10087	- validator module exists, and does nothing but pass through,
10088	  with calling of next module and return.
10089	- validator work.
10090
100911 August 2007: Wouter
10092	- set version to 0.5
10093	- module work for module to module interconnections.
10094	- config of modules.
10095	- detect cycle takes flags.
10096
1009731 July 2007: Wouter
10098	- updated plan
10099	- release 0.4 tag.
10100
1010130 July 2007: Wouter
10102	- changed random state init, so that sequential process IDs are not
10103	  cancelled out by sequential thread-ids in the random number seed.
10104	- the fwd_three test, which sends three queries to unbound, and
10105	  unbound is kept waiting by ldns-testns for 3 seconds, failed
10106	  because the retry timeout for default by unbound is 3 seconds too,
10107	  it would hit that timeout and fail the test. Changed so that unbound
10108	  is kept waiting for 2 seconds instead.
10109
1011027 July 2007: Wouter
10111	- removed useless -C debug option. It did not work.
10112	- text edit of documentation.
10113	- added doc/CREDITS file, referred to by the manpages.
10114	- updated planning.
10115
1011626 July 2007: Wouter
10117	- cycle detection, for query state dependencies. Will attempt to
10118	  circumvent the cycle, but if no other targets available fails.
10119	- unit test for AXFR, IXFR response.
10120	- test for cycle detection.
10121
1012225 July 2007: Wouter
10123	- testbound read ADDRESS and check it.
10124	- test for version.bind and friends.
10125	- test for iterator chaining through several referrals.
10126	- test and fixup for refetch for glue. Refetch fails if glue
10127	  is still not provided.
10128
1012924 July 2007: Wouter
10130	- Example section in config manual.
10131	- Addr stored for range and moment in replay.
10132
1013320 July 2007: Wouter
10134	- Check CNAME chain before returning cache entry with CNAMEs.
10135	- Option harden-glue, default is on. It will discard out of zone
10136	  data. If disabled, performance is faster, but spoofing attempts
10137	  become a possibility. Note that still normalize scrubbing is done,
10138	  and that the potentially spoofed data is used for infrastructure
10139	  and not returned to the client.
10140	- if glue times out, refetch by asking parent of delegation again.
10141	  Much like asking for DS at the parent side.
10142	- TODO items from forgery-resilience draft.
10143	  and on memory handling improvements.
10144	- renamed module_event_timeout to module_event_noreply.
10145	- memory reporting code; reports on memory usage after handling
10146	  a network packet (not on cache replies).
10147
1014819 July 2007: Wouter
10149	- shuffle NS selection when getting nameserver target addresses.
10150	- fixup of deadlock warnings, yield cpu in checklock code so that
10151	  freebsd scheduler selects correct process to run.
10152	- added identity and version config options and replies.
10153	- store cname messages complete answers.
10154
1015518 July 2007: Wouter
10156	- do not query addresses, 127.0.0.1, and ::1 by default.
10157
1015817 July 2007: Wouter
10159	- forward zone options in config file.
10160	- forward per zone in iterator. takes precedence over stubs.
10161	- fixup commithooks.
10162	- removed forward-to and forward-to-port features, subsumed by
10163	  new forward zones.
10164	- fix parser to handle absent server: clause.
10165	- change untrusted rrset test to account for scrubber that is now
10166	  applied during the test (which removes the poison, by the way).
10167	- feature, addresses can be specified with @portnumber, like nsd.conf.
10168	- test config files changed over to new forwarder syntax.
10169
1017027 June 2007: Wouter
10171	- delete of mesh does a postorder traverse of the tree.
10172	- found and fixed a memory leak. For TTL=0 messages, that would
10173	  not be cached, instead the msg-replyinfo structure was leaked.
10174	- changed server selection so it will filter out hosts that are
10175	  unresponsive. This is defined as a host with the maximum rto value.
10176	  This means that unbound tried the host for retries up to 120 secs.
10177	  The rto value will time out after host-ttl seconds from the cache.
10178	  This keeps such unresolvable queries from taking up resources.
10179	- utility for keeping histogram.
10180
1018126 June 2007: Wouter
10182	- mesh is called by worker, and iterator uses it.
10183	  This removes the hierarchical code.
10184	  QueryTargets state and Finished state are merged for iterator.
10185	- forwarder mode no longer sets AA bit on first reply.
10186	- rcode in walk_supers is not needed.
10187
1018825 June 2007: Wouter
10189	- more mesh work.
10190	- error encode routine for ease.
10191
1019222 June 2007: Wouter
10193	- removed unused _node iterator value from rbtree_t. Takes up space.
10194	- iterator can handle querytargets state without a delegation point
10195	  set, so that a priming(stub) subquery error can be handled.
10196	- iterator stores if it is priming or not.
10197	- log_query_info() neater logging.
10198	- changed iterator so that it does not alter module_qstate.qinfo
10199	  but keeps a chase query info. Also query_flags are not altered,
10200	  the iterator uses chase_flags.
10201	- fixup crash in case no ports for the family exist.
10202
1020321 June 2007: Wouter
10204	- Fixup secondary buffer in case of error callback.
10205	- cleanup slumber list of runnable states.
10206	- module_subreq_depth fails to work in slumber list.
10207	- fixup query release for cached results to sub targets.
10208	- neater error for tcp connection failure, shows addr in verbose.
10209	- rbtree_init so that it can be used with preallocated memory.
10210
1021120 June 2007: Wouter
10212	- new -C option to enable coredumps after forking away.
10213	- doc update.
10214	- fixup CNAME generation by scrubber, and memory allocation of it.
10215	- fixup deletion of serviced queries when all callbacks delete too.
10216	- set num target queries to 0 when you move them to slumber list.
10217	- typo in check caused subquery errors to be ignored, fixed.
10218	- make lint happy about rlim_t.
10219	- freeup of modules after freeup of module-states.
10220	- duplicate replies work, this uses secondary udp buffer in outnet.
10221
1022219 June 2007: Wouter
10223	- nicer layout in stats.c, review 0.3 change.
10224	- spelling improvement, review 0.3 change.
10225	- uncapped timeout for server selection, so that very fast or slow
10226	  servers will stand out from the rest.
10227	- target-fetch-policy: "3 2 1 0 0" config setting.
10228	- fixup queries answered without RD bit (for root prime results).
10229	- refuse AXFR and IXFR requests.
10230	- fixup RD flag in error reply from iterator. fixup RA flag from
10231	  worker error reply.
10232	- fixup encoding of very short edns buffer sizes, now sets TC bit.
10233	- config options harden-short-bufsize and harden-large-queries.
10234
1023518 June 2007: Wouter
10236	- same, move subqueries to slumber list when first has resolved.
10237	- fixup last fix for duplicate callbacks.
10238	- another offbyone in targetcounter. Also in Java prototype by the way.
10239
1024015 June 2007: Wouter
10241	- if a query asks to be notified of the same serviced query result
10242	  multiple times, this will succeed. Only one callback will happen;
10243	  multiple outbound-list entries result (but the double cleanup of it
10244	  will not matter).
10245	- when iterator moves on due to CNAME or referral, it will remove
10246	  the subqueries (for other targets). These are put on the slumber
10247	  list.
10248	- state module wait subq is OK with no new subqs, an old one may have
10249	  stopped, with an error, and it is still waiting for other ones.
10250	- if a query loops, halt entire query (easy way to clean up properly).
10251
1025214 June 2007: Wouter
10253	- num query targets was > 0 , not >= 0 compared, so that fetch
10254	  policy of 0 did nothing.
10255
1025613 June 2007: Wouter
10257	- debug option: configure --enable-static-exe for compile where
10258	  ldns and libevent are linked statically. Default is off.
10259	- make install and make uninstall. Works with static-exe and without.
10260	  installation of unbound binary and manual pages.
10261	- alignment problem fix on solaris 64.
10262	- fixup address in case of TCP error.
10263
1026412 June 2007: Wouter
10265	- num target queries was set to 0 at a bad time. Default it to 0 and
10266	  increase as target queries are done.
10267	- synthesize CNAME and DNAME responses from the cache.
10268	- Updated doxygen config for doxygen 1.5.
10269	- aclocal newer version.
10270	- doxygen 1.5 fixes for comments (for the strict check on docs).
10271
1027211 June 2007: Wouter
10273	- replies on TCP queries have the address field set in replyinfo,
10274	  for serviced queries, because the initiator does not know that
10275	  a TCP fallback has occured.
10276	- omit DNSSEC types from nonDO replies, except if qtype is ANY or
10277	  if qtype directly queries for the type (and then only show that
10278	  'unknown type' in the answer section).
10279	- fixed message parsing where rrsigs on their own would be put
10280	  in the signature list over the rrsig type.
10281
102827 June 2007: Wouter
10283	- fixup error in double linked list insertion for subqueries and
10284	  for outbound list of serviced queries for iterator module.
10285	- nicer printout of outgoing port selection.
10286	- fixup cname target readout.
10287	- nicer debug output.
10288	- fixup rrset counts when prepending CNAMEs to the answer.
10289	- fixup rrset TTL for prepended CNAMEs.
10290	- process better check for looping modules, and which submodule to
10291	  run next.
10292	- subreq insertion code fixup for slumber list.
10293	- VERB_DETAIL, verbosity: 2 level gives short but readable output.
10294	  VERB_ALGO, verbosity: 3 gives extensive output.
10295	- fixup RA bit in cached replies.
10296	- fixup CNAME responses from the cache no longer partial response.
10297	- error in network send handled without leakage.
10298	- enable ip6 from config, and try ip6 addresses if available,
10299	  if ip6 is not connected, skips to next server.
10300
103015 June 2007: Wouter
10302	- iterator state finished.
10303	- subrequests without parent store in cache and stop.
10304	- worker slumber list for ongoing promiscuous queries.
10305	- subrequest error handling.
10306	- priming failure returns SERVFAIL.
10307	- priming gives LAME result, returns SERVFAIL.
10308	- debug routine to print dns_msg as handled by iterator.
10309	- memleak in config file stubs fixup.
10310	- more small bugs, in scrubber, query compare no ID for lookup,
10311	  in dname validation for NS targets.
10312	- sets entry.key for new special allocs.
10313	- lognametypeclass can display unknown types and classes.
10314
103154 June 2007: Wouter
10316	- random selection of equally preferred nameserver targets.
10317	- reply info copy routine. Reuses existing code.
10318	- cache lameness in response handling.
10319	- do not touch qstate after worker_process_query because it may have
10320	  been deleted by that routine.
10321	- Prime response state.
10322	- Process target response state.
10323	- some memcmp changed to dname_compare for case preservation.
10324
103251 June 2007: Wouter
10326	- normalize incoming messages. Like unbound-java, with CNAME chain
10327	  checked, DNAME checked, CNAME's synthesized, glue checked.
10328	- sanitize incoming messages.
10329	- split msgreply encode functions into own file msgencode.c.
10330	- msg_parse to queryinfo/replyinfo conversion more versatile.
10331	- process_response, classify response, delegpt_from_message.
10332
1033331 May 2007: Wouter
10334	- querytargets state.
10335	- dname_subdomain_c() routine.
10336	- server selection, based on RTT. ip6 is filtered out if not available,
10337	  and lameness is checked too.
10338	- delegation point copy routine.
10339
1034030 May 2007: Wouter
10341	- removed FLAG_CD from message and rrset caches. This was useful for
10342	  an agnostic forwarder, but not for a sophisticated (trust value per
10343	  rrset enabled) cache.
10344	- iterator response typing.
10345	- iterator cname handle.
10346	- iterator prime start.
10347	- subquery work.
10348	- processInitRequest and processInitRequest2.
10349	- cache synthesizes referral messages, with DS and NSEC.
10350	- processInitRequest3.
10351	- if a request creates multiple subrequests these are all activated.
10352
1035329 May 2007: Wouter
10354	- routines to lock and unlock array of rrsets moved to cache/rrset.
10355	- lookup message from msg cache (and copy to region).
10356	- fixed cast error in dns msg lookup.
10357	- message with duplicate rrset does not increase its TTLs twice.
10358	- 'qnamesize' changed to 'qname_len' for similar naming scheme.
10359
1036025 May 2007: Wouter
10361	- Acknowledge use of unbound-java code in iterator. Nicer readme.
10362	- services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and
10363	  rrset cache from module environment.
10364	- packed rrset key has type and class as easily accessible struct
10365	  members. They are still kept in network format for fast msg encode.
10366	- dns cache find_delegation routine.
10367	- iterator main functions setup.
10368	- dns cache lookup setup.
10369
1037024 May 2007: Wouter
10371	- small changes to prepare for subqueries.
10372	- iterator forwarder feature separated out.
10373	- iterator hints stub code, config file stub code, so that first
10374	  testing can proceed locally.
10375	- replay tests now have config option to enable forwarding mode.
10376
1037723 May 2007: Wouter
10378	- outside network does precise timers for roundtrip estimates for rtt
10379	  and for setting timeout for UDP. Pending_udp takes milliseconds.
10380	- cleaner iterator sockaddr conversion of forwarder address.
10381	- iterator/iter_utils and iter_delegpt setup.
10382	- root hints.
10383
1038422 May 2007: Wouter
10385	- outbound query list for modules and support to callback with the
10386	  outbound entry to the module.
10387	- testbound support for new serviced queries.
10388	- test for retry to TCP cannot use testbound any longer.
10389	- testns test for EDNS fallback, test for TCP fallback already exists.
10390	- fixes for no-locking compile.
10391	- mini_event timer precision and fix for change in timeouts during
10392	  timeout callback. Fix for fwd_three tests, performed nonexit query.
10393
1039421 May 2007: Wouter
10395	- small comment on hash table locking.
10396	- outside network serviced queries, contain edns and tcp fallback,
10397	  and udp retries and rtt timing.
10398
1039916 May 2007: Wouter
10400	- lruhash_touch() would cause locking order problems. Fixup in
10401	  lock-verify in case locking cycle is found.
10402	- services/cache/rrset.c for rrset cache code.
10403	- special rrset_cache LRU updating function that uses the rrset id.
10404	- no dependencies calculation when make clean is called.
10405	- config settings for infra cache.
10406	- daemon code slightly cleaner, only creates caches once.
10407
1040815 May 2007: Wouter
10409	- host cache code.
10410	- unit test for host cache.
10411
1041214 May 2007: Wouter
10413	- Port to OS/X and Dec Alpha. Printf format and alignment fixes.
10414	- extensive lock debug report on join timeout.
10415	- proper RTT calculation, in utility code.
10416	- setup of services/cache/infra, host cache.
10417
1041811 May 2007: Wouter
10419	- iterator/iterator.c module.
10420	- fixup to pass reply_info in testcode and in netevent.
10421
1042210 May 2007: Wouter
10423	- created release-0.3 svn tag.
10424	- util/module.h
10425	- fixed compression - no longer compresses root name.
10426
104279 May 2007: Wouter
10428	- outside network cleans up waiting tcp queries on exit.
10429	- fallback to TCP.
10430	- testbound replay with retry in TCP mode.
10431	- tpkg test for retry in TCP mode, against ldns-testns server.
10432	- daemon checks max number of open files and complains if not enough.
10433	- test where data expires in the cache.
10434	- compiletests: fixed empty body ifstatements in alloc.c, in case
10435	  locks are disabled.
10436
104378 May 2007: Wouter
10438	- outgoing network keeps list of available tcp buffers for outgoing
10439	  tcp queries.
10440	- outgoing-num-tcp config option.
10441	- outgoing network keeps waiting list of queries waiting for buffer.
10442	- netevent supports outgoing tcp commpoints, nonblocking connects.
10443
104447 May 2007: Wouter
10445	- EDNS read from query, used to make reply smaller.
10446	- advertised edns value constants.
10447	- EDNS BADVERS response, if asked for too high edns version.
10448	- EDNS extended error responses once the EDNS record from the query
10449	  has successfully been parsed.
10450
104514 May 2007: Wouter
10452	- msgreply sizefunc is more accurate.
10453	- config settings for rrset cache size and slabs.
10454	- hashtable insert takes argument so that a thread can use its own
10455	  alloc cache to store released keys.
10456	- alloc cache special_release() locks if necessary.
10457	- rrset trustworthiness type added.
10458	- thread keeps a scratchpad region for handling messages.
10459	- writev used in netevent to write tcp length and data after another.
10460	  This saves a roundtrip on tcp replies.
10461	- test for one rrset updated in the cache.
10462	- test for one rrset which is not updated, as it is not deemed
10463	  trustworthy enough.
10464	- test for TTL refreshed in rrset.
10465
104663 May 2007: Wouter
10467	- fill refs. Use new parse and encode to answer queries.
10468	- stores rrsets in cache.
10469	- uses new msgreply format in cache.
10470
104712 May 2007: Wouter
10472	- dname unit tests in own file and spread out neatly in functions.
10473	- more dname unit tests.
10474	- message encoding creates truncated TC flagged messages if they do
10475	  not fit, and will leave out (whole)rrsets from additional if needed.
10476
104771 May 2007: Wouter
10478	- decompress query section, extremely lenient acceptance.
10479	  But only for answers from other servers, not for plain queries.
10480	- compression and decompression test cases.
10481	- some stats added.
10482	- example.conf interface: line is changed from 127.0.0.1 which leads
10483	  to problems if used (restricting communication to the localhost),
10484	  to a documentation and test address.
10485
1048627 April 2007: Wouter
10487	- removed iov usage, it is not good for dns message encoding.
10488	- owner name compression more optimal.
10489	- rrsig owner name compression.
10490	- rdata domain name compression.
10491
1049226 April 2007: Wouter
10493	- floating point exception fix in lock-verify.
10494	- lint uses make dependency
10495	- fixup lint in dname owner domain name compression code.
10496	- define for offset range that can be compressed to.
10497
1049825 April 2007: Wouter
10499	- prettier code; parse_rrset->type kept in host byte order.
10500	- datatype used for hashvalue of converted rrsig structure.
10501	- unit test compares edns section data too.
10502
1050324 April 2007: Wouter
10504	- ttl per RR, for RRSIG rrsets and others.
10505	- dname_print debug function.
10506	- if type is not known, size calc will skip DNAME decompression.
10507	- RRSIG parsing and storing and putting in messages.
10508	- dnssec enabled unit tests (from nlnetlabs.nl and se queries).
10509	- EDNS extraction routine.
10510
1051120 April 2007: Wouter
10512	- code comes through all of the unit tests now.
10513	- disabled warning about spurious extra data.
10514	- documented the RRSIG parse plan in msgparse.h.
10515	- rrsig reading and outputting.
10516
1051719 April 2007: Wouter
10518	- fix unit test to actually to tests.
10519	- fix write iov helper, and fakevent code.
10520	- extra builtin testcase (small packet).
10521	- ttl converted to network format in packets.
10522	- flags converted correctly
10523	- rdatalen off by 2 error fixup.
10524	- uses less iov space for header.
10525
1052618 April 2007: Wouter
10527	- review of msgparse code.
10528	- smaller test cases.
10529
1053017 April 2007: Wouter
10531	- copy and decompress dnames.
10532	- store calculated hash value too.
10533	- routine to create message out of stored information.
10534	- util/data/msgparse.c for message parsing code.
10535	- unit test, and first fixes because of test.
10536		* forgot rrset_count addition.
10537		* did & of ptr on stack for memory position calculation.
10538		* dname_pkt_copy forgot to read next label length.
10539	- test from file and fixes
10540		* double frees fixed in error conditions.
10541		* types with less than full rdata allowed by parser.
10542		  Some dynamic update packets seem to use it.
10543
1054416 April 2007: Wouter
10545	- following a small change in LDNS, parsing code calculates the
10546	  memory size to allocate for rrs.
10547	- code to handle ID creation.
10548
1054913 April 2007: Wouter
10550	- parse routines. Code that parses rrsets, rrs.
10551
1055212 April 2007: Wouter
10553	- dname compare routine that preserves case, with unit tests.
10554
1055511 April 2007: Wouter
10556	- parse work - dname packet parse, msgparse, querysection parse,
10557	  start of sectionparse.
10558
1055910 April 2007: Wouter
10560	- Improved alignment of reply_info packet, nice for 32 and 64 bit.
10561	- Put RRset counts in reply_info, because the number of RRs can change
10562	  due to RRset updates.
10563	- import of region-allocator code from nsd.
10564	- set alloc special type to ub_packed_rrset_key.
10565	  Uses lruhash entry overflow chain next pointer in alloc cache.
10566	- doxygen documentation for region-allocator.
10567	- setup for parse scratch data.
10568
105695 April 2007: Wouter
10570	- discussed packed rrset with Jelte.
10571
105724 April 2007: Wouter
10573	- moved to version 0.3.
10574	- added util/data/dname.c
10575	- layout of memory for rrsets.
10576
105773 April 2007: Wouter
10578	- detect sign of msghdr.msg_iovlen so that the cast to that type
10579	  in netevent (which is there to please lint) can be correct.
10580	  The type on several OSes ranges from int, int32, uint32, size_t.
10581	  Detects unsigned or signed using math trick.
10582	- constants for DNS flags.
10583	- compilation without locks fixup.
10584	- removed include of unportable header from lookup3.c.
10585	- more portable use of struct msghdr.
10586	- casts for printf warning portability.
10587	- tweaks to tests to port them to the testbed.
10588	- 0.2 tag created.
10589
105902 April 2007: Wouter
10591	- check sizes of udp received messages, not too short.
10592	- review changes. Some memmoves can be memcpys: 4byte aligned.
10593	  set id correctly on cached answers.
10594	- review changes msgreply.c, memleak on error condition. AA flag
10595	  clear on cached reply. Lowercase queries on hashing.
10596	  unit test on lowercasing. Test AA bit not set on cached reply.
10597	  Note that no TTLs are managed.
10598
1059929 March 2007: Wouter
10600	- writev or sendmsg used when answering from cache.
10601	  This avoids a copy of the data.
10602	- do not do useless byteswap on query id. Store reply flags in uint16
10603	  for easier access (and no repeated byteswapping).
10604	- reviewed code.
10605	- configure detects and config.h includes sys/uio.h for writev decl.
10606
1060728 March 2007: Wouter
10608	- new config option: num-queries-per-thread.
10609	- added tpkg test for answering three queries at the same time
10610	  using one thread (from the query service list).
10611
1061227 March 2007: Wouter
10613	- added test for cache and not cached answers, in testbound replays.
10614	- testbound can give config file and commandline options from the
10615	  replay file to unbound.
10616	- created test that checks if items drop out of the cache.
10617	- added word 'partitioned hash table' to documentation on slab hash.
10618	  A slab hash is a partitioned hash table.
10619	- worker can handle multiple queries at a time.
10620
1062126 March 2007: Wouter
10622	- config settings for slab hash message cache.
10623	- test for cached answer.
10624	- Fixup deleting fake answer from testbound list.
10625
1062623 March 2007: Wouter
10627	- review of yesterday's commits.
10628	- covered up memory leak of the entry locks.
10629	- answers from the cache correctly. Copies flags correctly.
10630	- sanity check for incoming query replies.
10631	- slabbed hash table. Much nicer contention, need dual cpu to see.
10632
1063322 March 2007: Wouter
10634	- AIX configure check.
10635	- lock-verify can handle references to locks that are created
10636	  in files it has not yet read in.
10637	- threaded hash table test.
10638	- unit test runs lock-verify afterwards and checks result.
10639	- need writelock to update data on hash_insert.
10640	- message cache code, msgreply code.
10641
1064221 March 2007: Wouter
10643	- unit test of hash table, fixup locking problem in table_grow().
10644	- fixup accounting of sizes for removing items from hashtable.
10645	- unit test for hash table, single threaded test of integrity.
10646	- lock-verify reports errors nicely. More quiet in operation.
10647
1064816 March 2007: Wouter
10649	- lock-verifier, checks consistent order of locking.
10650
1065114 March 2007: Wouter
10652	- hash table insert (and subroutines) and lookup implemented.
10653	- hash table remove.
10654	- unit tests for hash internal bin, lru functions.
10655
1065613 March 2007: Wouter
10657	- lock_unprotect in checklocks.
10658	- util/storage/lruhash.h for LRU hash table structure.
10659
1066012 March 2007: Wouter
10661	- configure.ac moved to 0.2.
10662	- query_info and replymsg util/data structure.
10663
106649 March 2007: Wouter
10665	- added rwlock writelock checking.
10666	  So it will keep track of the writelock, and readlocks are enforced
10667	  to not change protected memory areas.
10668	- log_hex function to dump hex strings to the logfile.
10669	- checklocks zeroes its destroyed lock after checking memory areas.
10670	- unit test for alloc.
10671	- identifier for union in checklocks to please older compilers.
10672	- created 0.1 tag.
10673
106748 March 2007: Wouter
10675	- Reviewed checklock code.
10676
106777 March 2007: Wouter
10678	- created a wrapper around thread calls that performs some basic
10679	  checking for data race and deadlock, and basic performance
10680	  contention measurement.
10681
106826 March 2007: Wouter
10683	- Testbed works with threading (different machines, different options).
10684	- alloc work, does the special type.
10685
106862 March 2007: Wouter
10687	- do not compile fork funcs unless needed. Otherwise will give
10688	  type errors as their typedefs have not been enabled.
10689	- log shows thread numbers much more nicely (and portably).
10690	- even on systems with nonthreadsafe libevent signal handling,
10691	  unbound will exit if given a signal.
10692	  Reloads will not work, and exit is not graceful.
10693	- start of alloc framework layout.
10694
106951 March 2007: Wouter
10696	- Signals, libevent and threads work well, with libevent patch and
10697	  changes to code (close after event_del).
10698	- set ipc pipes nonblocking.
10699
1070027 February 2007: Wouter
10701	- ub_thread_join portable definition.
10702	- forking is used if no threading is available.
10703	  Tested, it works, since pipes work across processes as well.
10704	  Thread_join is replaced with waitpid.
10705	- During reloads the daemon will temporarily handle signals,
10706	  so that they do not result in problems.
10707	- Also randomize the outgoing port range for tests.
10708	- If query list is full, will stop selecting listening ports for read.
10709	  This makes all threads service incoming requests, instead of one.
10710	  No memory is leaking during reloads, service of queries, etc.
10711	- test that uses ldns-testns -f to test threading. Have to answer
10712	  three queries at the same time.
10713	- with verbose=0 operates quietly.
10714
1071526 February 2007: Wouter
10716	- ub_random code used to select ID and port.
10717	- log code prints thread id.
10718	- unbound can thread itself, with reload(HUP) and quit working
10719	  correctly.
10720	- don't open pipes for #0, doesn't need it.
10721	- listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload).
10722
1072323 February 2007: Wouter
10724	- Can do reloads on sigHUP. Everything is stopped, and freed,
10725	  except the listening ports. Then the config file is reread.
10726	  And everything is started again (and listening ports if needed).
10727	- Ports for queries are shared.
10728	- config file added interface:, chroot: and username:.
10729	- config file: directory, logfile, pidfile. And they work too.
10730	- will daemonize by default now. Use -d to stay in the foreground.
10731	- got BSD random[256 state] code, made it threadsafe. util/random.
10732
1073322 February 2007: Wouter
10734	- Have a config file. Removed commandline options, moved to config.
10735	- tests use config file.
10736
1073721 February 2007: Wouter
10738	- put -c option in man page.
10739	- minievent fd array capped by FD_SETSIZE.
10740
1074120 February 2007: Wouter
10742	- Added locks code and pthread spinlock detection.
10743	- can use no locks, or solaris native thread library.
10744	- added yacc and lex configure, and config file parsing code.
10745	  also makedist.sh, and manpage.
10746	- put include errno.h in config.h
10747
1074819 February 2007: Wouter
10749	- Created 0.0 svn tag.
10750	- added acx_pthread.m4 autoconf check for pthreads from
10751	  the autoconf archive. It is GPL-with-autoconf-exception Licensed.
10752	  You can specify --with-pthreads, or --without-pthreads to configure.
10753
1075416 February 2007: Wouter
10755	- Updated testbed script, works better by using make on remote end.
10756	- removed check decls, we can compile without them.
10757	- makefile supports LIBOBJ replacements.
10758	- docs checks ignore compat code.
10759	- added util/mini-event.c and .h, a select based alternative used with
10760	  ./configure --with-libevent=no
10761	  It is limited to 1024 file descriptors, and has less features.
10762	- will not create ip6 sockets if ip6 not on the machine.
10763
1076415 February 2007: Wouter
10765	- port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64,
10766	  Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc.
10767	- malloc rndstate, so that it is aligned for access.
10768	- fixed rbtree cleanup with postorder traverse.
10769	- fixed pending messages are deleted when handled.
10770	- You can control verbosity; default is not verbose, every -v
10771	  adds more verbosity.
10772
1077314 February 2007: Wouter
10774	- Included configure.ac changes from ldns.
10775	- detect (some) headers before the standards check.
10776	- do not use isblank to test c99, since its not available on solaris9.
10777	- review of testcode.
10778		* entries in a RANGE are no longer reversed.
10779		* print name of file with replay entry parse errors.
10780	- port to OSX: cast to int for some prints of sizet.
10781	- Makefile copies ldnstestpkts.c before doing dependencies on it.
10782
1078313 February 2007: Wouter
10784	- work on fake events, first fwd replay works.
10785	- events can do timeouts and errors on queries to servers.
10786	- test package that runs replay scenarios.
10787
1078812 February 2007: Wouter
10789	- work on fake events.
10790
107919 February 2007: Wouter
10792	- replay file reading.
10793	- fake event setup, it creates fake structures, and teardowns,
10794	  added signal callbacks to reply to be able to fake those,
10795	  and main structure of event replay routines.
10796
107978 February 2007: Wouter
10798	- added tcp test.
10799	- replay storage.
10800	- testcode/fake_event work.
10801
108027 February 2007: Wouter
10803	- return answer with the same ID as query was sent with.
10804	- created udp forwarder test. I've done some effort to make it perform
10805	  quickly. After servers are created, no big sleep statements but
10806	  it checks the logfiles to see if servers have come up. Takes 0.14s.
10807	- set addrlen value when calling recvfrom.
10808	- comparison of addrs more portable.
10809	- LIBEVENT option for testbed to set libevent directory.
10810	- work on tcp input.
10811
108126 February 2007: Wouter
10813	- reviewed code and improved in places.
10814
108155 February 2007: Wouter
10816	- Picked up stdc99 and other define tests from ldns. Improved
10817	  POSIX define test to include getaddrinfo.
10818	- defined constants for netevent callback error code.
10819	- unit test for strisip6.
10820
108212 February 2007: Wouter
10822	- Created udp4 and udp6 port arrays to provide service for both
10823	  address families.
10824	- uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets.
10825	- listens on both ip4 and ip6 ports to provide correct return address.
10826	- worker fwder address filled correctly.
10827	- fixup timer code.
10828	- forwards udp queries and sends answer.
10829
108301 February 2007: Wouter
10831	- outside network more UDP work.
10832	- moved * closer to type.
10833	- comm_timer object and events.
10834
1083531 January 2007: Wouter
10836	- Added makedist.sh script to make release tarball.
10837	- Removed listen callback layer, did not add anything.
10838	- Added UDP recv to netevent, worker callback for udp.
10839	- netevent communication reply storage structure.
10840	- minimal query header sanity checking for worker.
10841	- copied over rbtree implementation from NSD (BSD licensed too).
10842	- outgoing network query service work.
10843
1084430 January 2007: Wouter
10845	- links in example/ldns-testpkts.c and .h for premade packet support.
10846	- added callback argument to listen_dnsport and daemon/worker.
10847
1084829 January 2007: Wouter
10849	- unbound.8 a short manpage.
10850
1085126 January 2007: Wouter
10852	- fixed memleak.
10853	- make lint works on BSD and Linux (openssl defines).
10854	- make tags works.
10855	- testbound program start.
10856
1085725 January 2007: Wouter
10858	- fixed lint so it may work on BSD.
10859	- put license into header of every file.
10860	- created verbosity flag.
10861	- fixed libevent configure flag.
10862	- detects event_base_free() in new libevent 1.2 version.
10863	- getopt in daemon. fatal_exit() and verbose() logging funcs.
10864	- created log_assert, that throws assertions to the logfile.
10865	- listen_dnsport service. Binds ports.
10866
1086724  January 2007: Wouter
10868	- cleaned up configure.ac.
10869
1087023  January 2007: Wouter
10871	- added libevent to configure to link with.
10872	- util/netevent setup work.
10873	- configure searches for libevent.
10874	- search for libs at end of configure (when other headers and types
10875	  have been found).
10876	- doxygen works with ATTR_UNUSED().
10877	- util/netevent implementation.
10878
1087922  January 2007: Wouter
10880	- Designed header file for network communication.
10881
1088216  January 2007: Wouter
10883	- added readme.svn and readme.tests.
10884
108854 January 2007: Wouter
10886	- Testbed script (run on multiple platforms the test set).
10887	  Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5.
10888	- added unit test tpkg.
10889
108903 January 2007: Wouter
10891	- committed first set of files into subversion repository.
10892	  svn co svn+ssh://unbound.net/svn/unbound
10893	  You need a ssh login.  There is no https access yet.
10894	- Added LICENSE, the BSD license.
10895	- Added doc/README with compile help.
10896	- main program stub and quiet makefile.
10897	- minimal logging service (to stderr).
10898	- added postcommit hook that serves emails.
10899	- added first test 00-lint. postcommit also checks if build succeeds.
10900	- 01-doc: doxygen doc target added for html docs. And stringent test
10901	  on documented files, functions and parameters.
10902
1090315 December 2006: Wouter
10904	- Created Makefile.in and configure.ac.
10905