121 March 2013: Wouter 2 - release 1.4.20 3 414 March 2013: Wouter 5 - iana portlist update. 6 - tag 1.4.20rc1 7 812 March 2013: Wouter 9 - Fixup makedist.sh for windows compile. 10 1111 March 2013: Wouter 12 - iana portlist update. 13 - testcode/ldns-testpkts.c check for makedist is informational. 14 1515 February 2013: Wouter 16 - fix defines in lookup3 for bigendian bsd alpha 17 1811 February 2013: Wouter 19 - Fixup openssl_thread init code to only run if compiled with SSL. 20 217 February 2013: Wouter 22 - detect endianness in lookup3 on BSD. 23 - add libunbound.ttl at end of result structure, version bump for 24 libunbound and binary backwards compatible, but 1.4.19 is not 25 forward compatible with 1.4.20. 26 - update iana port list. 27 2830 January 2013: Wouter 29 - includes and have_ssl fixes for nss. 30 3129 January 2013: Wouter 32 - printout name of zone with duplicate fwd and hint errors. 33 3428 January 2013: Wouter 35 - updated fwd_zero for newer nc. Updated common.sh for newer netstat. 36 3717 January 2013: Wouter 38 - unbound-anchors checks the emailAddress of the signer of the 39 root.xml file, default is dnssec@iana.org. It also checks that 40 the signer has the correct key usage for a digital signature. 41 - update iana port list. 42 433 January 2013: Wouter 44 - Test that unbound-control checks client credentials. 45 - Test that unbound can handle a CNAME at an intermediate node in 46 the chain of trust (where it seeks a DS record). 47 - Check the commonName of the signer of the root.xml file in 48 unbound-anchor, default is dnssec@iana.org. 49 502 January 2013: Wouter 51 - Fix openssl lock free on exit (reported by Robert Fleischman). 52 - iana portlist updated. 53 - Tested that unbound implements the RFC5155 Technical Errata id 3441. 54 Unbound already implements insecure classification of an empty 55 nonterminal in NSEC3 optout zone. 56 5720 December 2012: Wouter 58 - Fix unbound-anchor xml parse of entity declarations for safety. 59 6019 December 2012: Wouter 61 - iana portlist updated. 62 6318 December 2012: Wouter 64 - iana portlist updated. 65 6614 December 2012: Wouter 67 - Change of D.ROOT-SERVERS.NET A address in default root hints. 68 6912 December 2012: Wouter 70 - 1.4.19 release. 71 - trunk has 1.4.20 under development. 72 735 December 2012: Wouter 74 - note support for AAAA RR type RFC. 75 764 December 2012: Wouter 77 - 1.4.19rc1 tag. 78 7930 November 2012: Wouter 80 - bug 481: fix python example0. 81 - iana portlist updated. 82 8327 November 2012: Wouter 84 - iana portlist updated. 85 869 November 2012: Wouter 87 - Fix unbound-control forward disables configured stubs below it. 88 897 November 2012: Wouter 90 - Fixup ldns-testpkts, identical to ldns/examples. 91 - iana portlist updated. 92 9330 October 2012: Wouter 94 - Fix bug #477: unbound-anchor segfaults if EDNS is blocked. 95 9629 October 2012: Matthijs 97 - Fix validation for responses with both CNAME and wildcard 98 expanded CNAME records in answer section. 99 1008 October 2012: Wouter 101 - update ldns-testpkts.c to ldns 1.6.14 version. 102 - fix build of pythonmod in objdir, for unbound.py. 103 - make clean and makerealclean remove generated python and docs. 104 1055 October 2012: Wouter 106 - fix build of pythonmod in objdir (thanks Jakob Schlyter). 107 1083 October 2012: Wouter 109 - fix text in unbound-anchor man page. 110 1111 October 2012: Wouter 112 - ignore trusted-keys globs that have no files (from Paul Wouters). 113 11427 September 2012: Wouter 115 - include: directive in config file accepts wildcards. Patch from 116 Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*" 117 - unbound-control -q option is quiet, patch from Mariano Absatz. 118 - iana portlist updated. 119 - updated contrib/unbound.spec, patch from Valentin Bud. 120 12121 September 2012: Wouter 122 - chdir to / after chroot call (suggested by Camiel Dobbelaar). 123 12417 September 2012: Wouter 125 - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation 126 otherwise it is treated as insecure. The RSAMD5 algorithm is 127 deprecated (RFC6725). The MD5 hash is considered weak for some 128 purposes, if you want to sign your zone, then RSASHA256 is an 129 uncontested hash. 130 13130 August 2012: Wouter 132 - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled. 133 - iana portlist updated. 134 13529 August 2012: Wouter 136 - Nicer comments outgoing-port-avoid, thanks Stu (bug #465). 137 13822 August 2012: Wouter 139 - Fallback to 1472 and 1232, one fragment size without headers. 140 14121 August 2012: Wouter 142 - Fix timeouts so that when a server has been offline for a while 143 and is probed to see it works, it becomes fully available for 144 server selection again. 145 14617 August 2012: Wouter 147 - Add documentation to libunbound for default nonuse of resolv.conf. 148 1492 August 2012: Wouter 150 - trunk has 1.4.19 under development (fixes from 1 aug and 31 july 151 are for 1.4.19). 152 - iana portlist updated. 153 1541 August 2012: Wouter 155 - Fix openssl race condition, initializes openssl locks, reported 156 by Einar Lonn and Patrik Wallstrom. 157 15831 July 2012: Wouter 159 - Improved forward-first and stub-first documentation. 160 - Fix that enables modules to register twice for the same 161 serviced_query, without race conditions or administration issues. 162 This should not happen with the current codebase, but it is robust. 163 - Fix forward-first option where it sets the RD flag wrongly. 164 - added manpage links for libunbound calls (Thanks Paul Wouters). 165 16630 July 2012: Wouter 167 - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012). 168 16927 July 2012: Wouter 170 - unbound-host works with libNSS 171 - fix bogus nodata cname chain not reported as bogus by validator, 172 (Thanks Peter van Dijk). 173 17426 July 2012: Wouter 175 - iana portlist updated. 176 - tag 1.4.18rc1. 177 17825 July 2012: Wouter 179 - review fix for libnss, check hash prefix allocation size. 180 18123 July 2012: Wouter 182 - fix missing break for GOST DS hash function. 183 - implemented forward_first for the root. 184 18520 July 2012: Wouter 186 - Fix bug#452 and another assertion failure in mesh.c, makes 187 assertions in mesh.c resist duplicates. Fixes DS NS search to 188 not generate duplicate sub queries. 189 19019 July 2012: Willem 191 - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac, 192 if CFLAGS is specified at configure time then '-g -O2' is not 193 appended to CFLAGS, so that the user can override them. 194 19518 July 2012: Willem 196 - Fix libunbound report of errors when in background mode. 197 19811 July 2012: Willem 199 - updated iana ports list. 200 2019 July 2012: Willem 202 - Add flush_bogus option for unbound-control 203 2046 July 2012: Wouter 205 - Fix validation of qtype DS queries that result in no data for 206 non-optout NSEC3 zones. 207 2084 July 2012: Wouter 209 - compile libunbound with libnss on Suse, passes regression tests. 210 2113 July 2012: Wouter 212 - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes. 213 2142 July 2012: Wouter 215 - updated iana ports list. 216 21729 June 2012: Wouter 218 - patch for unbound_munin_ script to handle arbitrary thread count by 219 Sven Ulland. 220 22128 June 2012: Wouter 222 - detect if openssl has FIPS_mode. 223 - code review: return value of cache_store can be ignored for better 224 performance in out of memory conditions. 225 - fix edns-buffer-size and msg-buffer-size manpage documentation. 226 - updated iana ports list. 227 22825 June 2012: Wouter 229 - disable RSAMD5 if in FIPS mode (for openssl and for libnss). 230 23122 June 2012: Wouter 232 - implement DS records, NSEC3 and ECDSA for compile with libnss. 233 23421 June 2012: Wouter 235 - fix error handling of alloc failure during rrsig verification. 236 - nss check for verification failure. 237 - nss crypto works for RSA and DSA. 238 23920 June 2012: Wouter 240 - work on --with-nss build option (for now, --with-libunbound-only). 241 24219 June 2012: Wouter 243 - --with-libunbound-only build option, only builds the library and 244 not the daemon and other tools. 245 24618 June 2012: Wouter 247 - code review. 248 24915 June 2012: Wouter 250 - implement log-time-ascii on windows. 251 - The key-cache bad key ttl is now 60 seconds. 252 - updated iana ports list. 253 - code review. 254 25511 June 2012: Wouter 256 - bug #452: fix crash on assert in mesh_state_attachment. 257 25830 May 2012: Wouter 259 - silence warning from swig-generated code (md set but not used in 260 swig initmodule, due to ifdefs in swig-generated code). 261 26227 May 2012: Wouter 263 - Fix debian-bugs-658021: Please enable hardened build flags. 264 26525 May 2012: Wouter 266 - updated iana ports list. 267 26824 May 2012: Wouter 269 - tag for 1.4.17 release. 270 - trunk is 1.4.18 in development. 271 27218 May 2012: Wouter 273 - Review comments, removed duplicate memset to zero in delegpt. 274 27516 May 2012: Wouter 276 - Updated doc/FEATURES with RFCs that are implemented but not listed. 277 - Protect if statements in val_anchor for compile without locks. 278 - tag for 1.4.17rc1. 279 28015 May 2012: Wouter 281 - fix configure ECDSA support in ldns detection for windows compile. 282 - fix possible uninitialised variable in windows pipe implementation. 283 2849 May 2012: Wouter 285 - Fix alignment problem in util/random on sparc64/freebsd. 286 2878 May 2012: Wouter 288 - Fix for accept spinning reported by OpenBSD. 289 - iana portlist updated. 290 2912 May 2012: Wouter 292 - Fix validation of nodata for DS query in NSEC zones, reported by 293 Ondrej Mikle. 294 29513 April 2012: Wouter 296 - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older 297 openssl. 298 29910 April 2012: Wouter 300 - Applied patch from Daisuke HIGASHI for rrset-roundrobin and 301 minimal-responses features. 302 - iana portlist updated. 303 3045 April 2012: Wouter 305 - fix bug #443: --with-chroot-dir not honoured by configure. 306 - fix bug #444: setusercontext was called too late (thanks Bjorn 307 Ketelaars). 308 30927 March 2012: Wouter 310 - fix bug #442: Fix that Makefile depends on pythonmod headers 311 even using --without-pythonmodule. 312 31322 March 2012: Wouter 314 - contrib/validation-reporter follows rotated log file (patch from 315 Augie Schwer). 316 31721 March 2012: Wouter 318 - new approach to NS fetches for DS lookup that works with 319 cornercases, and is more robust and considers forwarders. 320 32119 March 2012: Wouter 322 - iana portlist updated. 323 - fix to locate nameservers for DS lookup with NS fetches. 324 32516 March 2012: Wouter 326 - Patch for access to full DNS packet data in unbound python module 327 from Ondrej Mikle. 328 3299 March 2012: Wouter 330 - Applied line-buffer patch from Augie Schwer to validation.reporter.sh. 331 3322 March 2012: Wouter 333 - flush_infra cleans timeouted servers from the cache too. 334 - removed warning from --enable-ecdsa. 335 3361 March 2012: Wouter 337 - forward-first option. Tries without forward if a query fails. 338 Also stub-first option that is similar. 339 34028 February 2012: Wouter 341 - Fix from code review, if EINPROGRESS not defined chain if statement 342 differently. 343 34427 February 2012: Wouter 345 - Fix bug#434: on windows check registry for config file location 346 for unbound-control.exe, and unbound-checkconf.exe. 347 34823 February 2012: Wouter 349 - Fix to squelch 'network unreachable' errors from tcp connect in 350 logs, high verbosity will show them. 351 35216 February 2012: Wouter 353 - iter_hints is now thread-owned in module env, and thus threadsafe. 354 - Fix prefetch and sticky NS, now the prefetch works. It picks 355 nameservers that 'would be valid in the future', and if this makes 356 the NS timeout, it updates that NS by asking delegation from the 357 parent again. If child NS has longer TTL, that TTL does not get 358 refreshed from the lookup to the child nameserver. 359 36015 February 2012: Wouter 361 - Fix forward-zone memory, uses malloc and frees original root dp. 362 - iter hints (stubs) uses malloc inside for more dynamicity. 363 - unbound-control forward_add, forward_remove, stub_add, stub_remove 364 can modify stubs and forwards for running unbound (on mobile computer) 365 they can also add and remove domain-insecure for the zone. 366 36714 February 2012: Wouter 368 - Fix sticky NS (ghost domain problem) if prefetch is yes. 369 - iter forwards uses malloc inside for more dynamicity. 370 37113 February 2012: Wouter 372 - RT#2955. Fix for cygwin compilation. 373 - iana portlist updated. 374 37510 February 2012: Wouter 376 - Slightly smaller critical region in one case in infra cache. 377 - Fix timeouts to keep track of query type, A, AAAA and other, if 378 another has caused timeout blacklist, different type can still probe. 379 - unit test fix for nomem_cnametopos.rpl race condition. 380 3819 February 2012: Wouter 382 - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h. 383 3848 February 2012: Wouter 385 - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This 386 implementation is experimental at this time and not recommended 387 for use on the public internet (the protocol numbers have not 388 been assigned). Needs recent ldns with --enable-ecdsa. 389 - fix memory leak in errorcase for DSA signatures. 390 - iana portlist updated. 391 - workaround for openssl 0.9.8 ecdsa sha2 and evp problem. 392 3933 February 2012: Wouter 394 - fix for windows, rename() is not posix compliant on windows. 395 3962 February 2012: Wouter 397 - 1.4.16 release tag. 398 - svn trunk is 1.4.17 in development. 399 - iana portlist updated. 400 4011 February 2012: Wouter 402 - Fix validation failures (like: validation failure xx: no NSEC3 403 closest encloser from yy for DS zz. while building chain of trust, 404 because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata 405 for an NSEC3. Now it does not change rdata, and fixes TTL. 406 40730 January 2012: Wouter 408 - Fix version-number in libtool to be version-info so it produces 409 libunbound.so.2 like it should. 410 41126 January 2012: Wouter 412 - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release. 413 - trunk 1.4.16; includes changes memset testcode, #424 openindiana, 414 and keyfile write fixup. 415 - applied patch to support outgoing-interface with ub_ctx_set_option. 416 41723 January 2012: Wouter 418 - Fix memset in test code. 419 42020 January 2012: Wouter 421 - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2. 422 42319 January 2012: Wouter 424 - Fix to write key files completely to a temporary file, and if that 425 succeeds, replace the real key file. So failures leave a useful file. 426 42718 January 2012: Wouter 428 - tag 1.4.15rc1 created 429 - updated libunbound/ubsyms.def and remade tag 1.4.15rc1. 430 43117 January 2012: Wouter 432 - Fix bug where canonical_compare of RRSIG did not downcase the 433 signer-name. This is mostly harmless because RRSIGs do not have 434 to be sorted in canonical order, usually. 435 43612 January 2012: Wouter 437 - bug#428: add ub_version() call to libunbound. API version increase, 438 with (binary) backwards compatibility for the previous version. 439 44010 January 2012: Wouter 441 - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL 442 that would be permissible by the RFCs but it is not the TTL in the 443 cache. 444 - iana portlist updated. 445 - uninitialised variable in reprobe for rtt blocked domains fixed. 446 - lintfix and new flex output. 447 4482 January 2012: Wouter 449 - Fix to randomize hash function, based on 28c3 congress, reported 450 by Peter van Dijk. 451 45224 December 2011: Wouter 453 - Fix for memory leak (about 20 bytes when a tcp or udp send operation 454 towards authority servers failed, takes about 50.000 such failures to 455 leak one Mb, such failures are also usually logged), reported by 456 Robert Fleischmann. 457 - iana portlist updated. 458 45919 December 2011: Wouter 460 - Fix for VU#209659 CVE-2011-4528: Unbound denial of service 461 vulnerabilities from nonstandard redirection and denial of existence 462 http://www.unbound.net/downloads/CVE-2011-4528.txt 463 - robust checks for next-closer NSEC3s. 464 - tag 1.4.14 created. 465 - trunk has 1.4.15 in development. 466 46715 December 2011: Wouter 468 - remove uninit warning from cachedump code. 469 - Fix parse error on negative SOA RRSIGs if badly ordered in the packet. 470 47113 December 2011: Wouter 472 - iana portlist updated. 473 - svn tag 1.4.14rc1 474 - fix infra cache comparison. 475 - Fix to constrain signer_name to be a parent of the lookupname. 476 4775 December 2011: Wouter 478 - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc. 479 - Fix warnings with gcc 4.6 in compat/inet_ntop.c. 480 - Fix warning unused in compat/strptime.c. 481 - Fix malloc detection and double defintion. 482 4832 December 2011: Wouter 484 - configure generated with autoconf 2.68. 485 48630 November 2011: Wouter 487 - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes 488 SERVFAILs. Also fixed for UDP (but less likely). 489 49028 November 2011: Wouter 491 - Fix quartile time estimate, it was too low, (thanks Jan Komissar). 492 - iana ports updated. 493 49411 November 2011: Wouter 495 - Makefile compat with SunOS make, BSD make and GNU make. 496 - iana ports updated. 497 49810 November 2011: Wouter 499 - Makefile changed for BSD make compatibility. 500 5019 November 2011: Wouter 502 - added unit test for SSL service and SSL-upstream. 503 5048 November 2011: Wouter 505 - can configure ssl service to one port number, and not on others. 506 - fixup windows compile with ssl support. 507 - Fix double free in unbound-host, reported by Steve Grubb. 508 - iana portlist updated. 509 5101 November 2011: Wouter 511 - dns over ssl support as a client, ssl-upstream yes turns it on. 512 It performs an SSL transaction for every DNS query (250 msec). 513 - documentation for new options: ssl-upstream, ssl-service-key and 514 ssl-service.pem. 515 - iana portlist updated. 516 - fix -flto detection on Lion for llvm-gcc. 517 51831 October 2011: Wouter 519 - dns over ssl support, ssl-service-pem and ssl-service-key files 520 can be given and then TCP queries are serviced wrapped in SSL. 521 52227 October 2011: Wouter 523 - lame-ttl and lame-size options no longer exist, it is integrated 524 with the host info. They are ignored (with verbose warning) if 525 encountered to keep the config file backwards compatible. 526 - fix iana-update for changing gzip compression of results. 527 - fix export-all-symbols on OSX. 528 52926 October 2011: Wouter 530 - iana portlist updated. 531 - Infra cache stores information about ping and lameness per IP, zone. 532 This fixes bug #416. 533 - fix iana_update target for gzipped file on iana site. 534 53524 October 2011: Wouter 536 - Fix resolve of partners.extranet.microsoft.com with a fix for the 537 server selection for choosing out of a (particular) list of bad 538 choices. (bug#415) 539 - Fix make_new_space function so that the incoming query is not 540 overwritten if a jostled out query causes a waiting query to be 541 resumed that then fails and sends an error message. (Thanks to 542 Matthew Lee). 543 54421 October 2011: Wouter 545 - fix --enable-allsymbols, fptr wlist is disabled on windows with this 546 option enabled because of memory layout exe vs dll. 547 54819 October 2011: Wouter 549 - fix unbound-anchor for broken strptime on OSX lion, detected 550 in configure. 551 - Detect if GOST really works, openssl1.0 on OSX fails. 552 - Implement ipv6%interface notation for scope_id usage. 553 55417 October 2011: Wouter 555 - better documentation for inform_super (Thanks Yang Zhe). 556 55714 October 2011: Wouter 558 - Fix for out-of-memory condition in libunbound (thanks 559 Robert Fleischman). 560 56113 October 2011: Wouter 562 - Fix --enable-allsymbols, it depended on link specifics of the 563 target platform, or fptr_wlist assertion failures could occur. 564 56512 October 2011: Wouter 566 - updated contrib/unbound_munin_ to family=auto so that it works with 567 munin-node-configure automatically (if installed as 568 /usr/local/share/munin/plugins/unbound_munin_ ). 569 57027 September 2011: Wouter 571 - unbound.exe -w windows option for start and stop service. 572 57323 September 2011: Wouter 574 - TCP-upstream calculates tcp-ping so server selection works if there 575 are alternatives. 576 57720 September 2011: Wouter 578 - Fix classification of NS set in answer section, where there is a 579 parent-child server, and the answer has the AA flag for dir.slb.com. 580 Thanks to Amanda Constant from Secure64. 581 58216 September 2011: Wouter 583 - fix bug #408: accept patch from Steve Snyder that comments out 584 unused functions in lookup3.c. 585 - iana portlist updated. 586 - fix EDNS1480 change memleak and TCP fallback. 587 - fix various compiler warnings (reported by Paul Wouters). 588 - max sent count. EDNS1480 only for rtt < 5000. No promiscuous 589 fetch if sentcount > 3, stop query if sentcount > 16. Count is 590 reset when referral or CNAME happens. This makes unbound better 591 at managing large NS sets, they are explored when there is continued 592 interest (in the form of queries). 593 59415 September 2011: Wouter 595 - release 1.4.13. 596 - trunk contains 1.4.14 in development. 597 - Unbound probes at EDNS1480 if there an EDNS0 timeout. 598 59912 September 2011: Wouter 600 - Reverted dns EDNS backoff fix, it did not help and needs 601 fragmentation fixes instead. 602 - tag 1.4.13rc2 603 6047 September 2011: Wouter 605 - Fix operation in ipv6 only (do-ip4: no) mode. 606 6076 September 2011: Wouter 608 - fedora specfile updated. 609 6105 September 2011: Wouter 611 - tag 1.4.13rc1 612 6132 September 2011: Wouter 614 - iana portlist updated. 615 61626 August 2011: Wouter 617 - Fix num-threads 0 does not segfault, reported by Simon Deziel. 618 - Fix validation failures due to EDNS backoff retries, the retry 619 for fetch of data has want_dnssec because the iter_indicate_dnssec 620 function returns true when validation failure retry happens, and 621 then the serviced query code does not fallback to noEDNS, even if 622 the cache says it has this. This helps for DLV deployment when 623 the DNSSEC status is not known for sure before the lookup concludes. 624 62524 August 2011: Wouter 626 - Applied patch from Karel Slany that fixes a memory leak in the 627 unbound python module, in string conversions. 628 62922 August 2011: Wouter 630 - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy 631 Zhang and Luo Ce). Unbound responds with the RR types that are 632 available at the name for qtype ANY and validates those RR types. 633 It does not test for completeness (i.e. with NSEC or NSEC3 query), 634 and it does not follow the CNAME or DNAME to another name (with 635 even more data for the already large response). 636 - Fix that internally, CNAMEs with NXDOMAIN have that as rcode. 637 - Documented the options that work with control set_option command. 638 - tcp-upstream yes/no option (works with set_option) for tunnels. 639 64018 August 2011: Wouter 641 - fix autoconf call in makedist crosscompile to RC or snapshot. 642 64317 August 2011: Wouter 644 - Fix validation of . DS query. 645 - new xml format at IANA, new awk for iana_update. 646 - iana portlist updated. 647 64810 August 2011: Wouter 649 - Fix python site-packages path to /usr/lib64. 650 - updated patch from Tom. 651 - fix memory and fd leak after out-of-memory condition. 652 6539 August 2011: Wouter 654 - patch from Tom Hendrikx fixes load of python modules. 655 6568 August 2011: Wouter 657 - make clean had ldns-src reference, removed. 658 6591 August 2011: Wouter 660 - Fix autoconf 2.68 warnings 661 66214 July 2011: Wouter 663 - Unbound implements RFC6303 (since version 1.4.7). 664 - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the 665 meantime, those are for 1.4.13). 666 - iana portlist updated. 667 66813 July 2011: Wouter 669 - Quick fix for contrib/unbound.spec example, no ldns-builtin any more. 670 67111 July 2011: Wouter 672 - Fix wildcard expansion no-data reply under an optout NSEC3 zone is 673 validated as insecure, reported by Jia Li (lijia@cnnic.cn). 674 6754 July 2011: Wouter 676 - 1.4.12rc1 tag created. 677 6781 July 2011: Wouter 679 - version number in example config file. 680 - fix that --enable-static-exe does not complain about it unknown. 681 68230 June 2011: Wouter 683 - tag relase 1.4.11, trunk is 1.4.12 development. 684 - iana portlist updated. 685 - fix bug#395: id bits of other query may leak out under conditions 686 - fix replyaddr count wrong after jostled queries, which leads to 687 eventual starvation where the daemon has no replyaddrs left to use. 688 - fix comment about rndc port, that referred to the old port number. 689 - fix that the listening socket is not closed when too many remote 690 control connections are made at the same time. 691 - removed ldns-src tarball inside the unbound tarball. 692 69323 June 2011: Wouter 694 - Changed -flto check to support clang compiler. 695 - tag 1.4.11rc3 created. 696 69717 June 2011: Wouter 698 - tag 1.4.11rc1 created. 699 - remove warning about signed/unsigned from flex (other flex version). 700 - updated aclocal.m4 and libtool to match. 701 - tag 1.4.11rc2 created. 702 70316 June 2011: Wouter 704 - log-queries: yesno option, default is no, prints querylog. 705 - version is 1.4.11. 706 70714 June 2011: Wouter 708 - Use -flto compiler flag for link time optimization, if supported. 709 - iana portlist updated. 710 71112 June 2011: Wouter 712 - IPv6 service address for d.root-servers.net (2001:500:2D::D). 713 71410 June 2011: Wouter 715 - unbound-control has version number in the header, 716 UBCT[version]_space_ is the header sent by the client now. 717 - Unbound control port number is registered with IANA: 718 ub-dns-control 8953/tcp unbound dns nameserver control 719 This is the new default for the control-port config setting. 720 - statistics-interval prints the number of jostled queries to log. 721 72230 May 2011: Wouter 723 - Fix Makefile for U in environment, since wrong U is more common than 724 deansification necessity. 725 - iana portlist updated. 726 - updated ldns tarball to 1.6.10rc2 snapshot of today. 727 72825 May 2011: Wouter 729 - Fix assertion failure when unbound generates an empty error reply 730 in response to a query, CVE-2011-1922 VU#531342. 731 - This fix is in tag 1.4.10. 732 - defense in depth against the above bug, an error is printed to log 733 instead of an assertion failure. 734 73510 May 2011: Wouter 736 - bug#386: --enable-allsymbols option links all binaries to libunbound 737 and reduces install size significantly. 738 - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers. 739 - iana portlist updated. 740 - Fix TTL of SOA so negative TTL is separately cached from normal TTL. 741 74214 April 2011: Wouter 743 - configure created with newer autoconf 2.66. 744 74512 April 2011: Wouter 746 - bug#378: Fix that configure checks for ldns_get_random presence. 747 7488 April 2011: Wouter 749 - iana portlist updated. 750 - queries with CD flag set cause DNSSEC validation, but the answer is 751 not withheld if it is bogus. Thus, unbound will retry if it is bad 752 and curb the TTL if it is bad, thus protecting the cache for use by 753 downstream validators. 754 - val-override-date: -1 ignores dates entirely, for NTP usage. 755 75629 March 2011: Wouter 757 - harden-below-nxdomain: changed so that it activates when the 758 cached nxdomain is dnssec secure. This avoids backwards 759 incompatibility because those old servers do not have dnssec. 760 76124 March 2011: Wouter 762 - iana portlist updated. 763 - release 1.4.9. 764 - trunk is 1.5.0 765 76617 March 2011: Wouter 767 - bug#370: new unbound.spec for CentOS 5.x from Harold Jones. 768 Applied but did not do the --disable-gost. 769 77010 March 2011: Wouter 771 - tag 1.4.9 release candidate 1 created. 772 7733 March 2011: Wouter 774 - updated ldns to today. 775 7761 March 2011: Wouter 777 - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout. 778 - give config parse error for multiple names on a stub or forward zone. 779 - updated ldns tarball to 1.6.9(todays snapshot). 780 78124 February 2011: Wouter 782 - bug #361: Fix, time.elapsed variable not reset with stats_noreset. 783 78423 February 2011: Wouter 785 - iana portlist updated. 786 - common.sh to version 3. 787 78818 February 2011: Wouter 789 - common.sh in testdata updated to version 2. 790 79115 February 2011: Wouter 792 - Added explicit note on unbound-anchor usage: 793 Please note usage of unbound-anchor root anchor is at your own risk 794 and under the terms of our LICENSE (see that file in the source). 795 79611 February 2011: Wouter 797 - iana portlist updated. 798 - tpkg updated with common.sh for common functionality. 799 8007 February 2011: Wouter 801 - Added regression test for addition of a .net DS to the root, and 802 cache effects with different TTL for glue and DNSKEY. 803 - iana portlist updated. 804 80528 January 2011: Wouter 806 - Fix remove private address does not throw away entire response. 807 80824 January 2011: Wouter 809 - release 1.4.8 810 81119 January 2011: Wouter 812 - fix bug#349: no -L/usr for ldns. 813 81418 January 2011: Wouter 815 - ldns 1.6.8 tarball included. 816 - release 1.4.8rc1. 817 81817 January 2011: Wouter 819 - add get and set option for harden-below-nxdomain feature. 820 - iana portlist updated. 821 82214 January 2011: Wouter 823 - Fix so a changed NS RRset does not get moved name stuck on old 824 server, for type NS the TTL is not increased. 825 82613 January 2011: Wouter 827 - Fix prefetch so it does not get stuck on old server for moved names. 828 82912 January 2011: Wouter 830 - iana portlist updated. 831 83211 January 2011: Wouter 833 - Fix insecure CNAME sequence marked as secure, reported by Bert 834 Hubert. 835 83610 January 2011: Wouter 837 - faster lruhash get_mem routine. 838 8394 January 2011: Wouter 840 - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root. 841 - iana portlist updated. 842 84323 December 2010: Wouter 844 - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept. 845 84621 December 2010: Wouter 847 - algorithm compromise protection using the algorithms signalled in 848 the DS record. Also, trust anchors, DLV, and RFC5011 receive this, 849 and thus, if you have multiple algorithms in your trust-anchor-file 850 then it will now behave different than before. Also, 5011 rollover 851 for algorithms needs to be double-signature until the old algorithm 852 is revoked. 853 It is not an option, because I see no use to turn the security off. 854 - iana portlist updated. 855 85617 December 2010: Wouter 857 - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them). 858 - fix validation in this case: CNAME to nodata for co-hosted opt-in 859 NSEC3 insecure delegation, was bogus, fixed to be insecure. 860 86116 December 2010: Wouter 862 - Fix our 'BDS' license (typo reported by Xavier Belanger). 863 86410 December 2010: Wouter 865 - iana portlist updated. 866 - review changes for unbound-anchor. 867 8682 December 2010: Wouter 869 - feature typetransparent localzone, does not block other RR types. 870 8711 December 2010: Wouter 872 - Fix bug#338: print address when socket creation fails. 873 87430 November 2010: Wouter 875 - Fix storage of EDNS failures in the infra cache. 876 - iana portlist updated. 877 87818 November 2010: Wouter 879 - harden-below-nxdomain option, default off (because very old 880 software may be incompatible). We could enable it by default in 881 the future. 882 88317 November 2010: Wouter 884 - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN. 885 - make test output nicer. 886 88715 November 2010: Wouter 888 - silence 'tcp connect: broken pipe' and 'net down' at low verbosity. 889 - iana portlist updated. 890 - so-sndbuf option for very busy servers, a bit like so-rcvbuf. 891 8929 November 2010: Wouter 893 - unbound-anchor compiles with openssl 0.9.7. 894 8958 November 2010: Wouter 896 - release tag 1.4.7. 897 - trunk is version 1.4.8. 898 - Be lenient and accept imgw.pl malformed packet (like BIND). 899 9005 November 2010: Wouter 901 - do not synthesize a CNAME message from cache for qtype DS. 902 9034 November 2010: Wouter 904 - Use central entropy to seed threads. 905 9063 November 2010: Wouter 907 - Change the rtt used to probe EDNS-timeout hosts to 1000 msec. 908 9092 November 2010: Wouter 910 - tag 1.4.7rc1. 911 - code review. 912 9131 November 2010: Wouter 914 - GOST code enabled by default (RFC 5933). 915 91627 October 2010: Wouter 917 - Fix uninit value in dump_infra print. 918 - Fix validation failure for parent and child on same server with an 919 insecure childzone and a CNAME from parent to child. 920 - Configure detects libev-4.00. 921 92226 October 2010: Wouter 923 - dump_infra and flush_infra commands for unbound-control. 924 - no timeout backoff if meanwhile a query succeeded. 925 - Change of timeout code. No more lost and backoff in blockage. 926 At 12sec timeout (and at least 2x lost before) one probe per IP 927 is allowed only. At 120sec, the IP is blocked. After 15min, a 928 120sec entry has a single retry packet. 929 93025 October 2010: Wouter 931 - Configure errors if ldns is not found. 932 93322 October 2010: Wouter 934 - Windows 7 fix for the installer. 935 93621 October 2010: Wouter 937 - Fix bug where fallback_tcp causes wrong roundtrip and edns 938 observation to be noted in cache. Fix bug where EDNSprobe halted 939 exponential backoff if EDNS status unknown. 940 - new unresponsive host method, exponentially increasing block backoff. 941 - iana portlist updated. 942 94320 October 2010: Wouter 944 - interface automatic works for some people with ip6 disabled. 945 Therefore the error check is removed, so they can use the option. 946 94719 October 2010: Wouter 948 - Fix for request list growth, if a server has long timeout but the 949 lost counter is low, then its effective rtt is the one without 950 exponential backoff applied. Because the backoff is not working. 951 The lost counter can then increase and the server is blacklisted, 952 or the lost counter does not increase and the server is working 953 for some queries. 954 95518 October 2010: Wouter 956 - iana portlist updated. 957 95813 October 2010: Wouter 959 - Fix TCP so it uses a random outgoing-interface. 960 - unbound-anchor handles ADDPEND keystate. 961 96211 October 2010: Wouter 963 - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where 964 the zone has a secure delegation hosted on the same server did not 965 verify as secure (it was insecure by mistake). 966 - iana portlist updated. 967 - ldns tarball updated (for reading cachedumps with bad RR data). 968 9691 October 2010: Wouter 970 - test for unbound-anchor. fix for reading certs. 971 - Fix alloc_reg_release for longer uptime in out of memory conditions. 972 97328 September 2010: Wouter 974 - unbound-anchor working, it creates or updates a root.key file. 975 Use it before you start the validator (e.g. at system boot time). 976 97727 September 2010: Wouter 978 - iana portlist updated. 979 98024 September 2010: Wouter 981 - bug#329: in example.conf show correct ipv4 link-local 169.254/16. 982 98323 September 2010: Wouter 984 - unbound-anchor app, unbound requires libexpat (xml parser library). 985 98622 September 2010: Wouter 987 - compliance with draft-ietf-dnsop-default-local-zones-14, removed 988 reverse ipv6 orchid prefix from builtin list. 989 - iana portlist updated. 990 99117 September 2010: Wouter 992 - DLV has downgrade protection again, because the RFC says so. 993 - iana portlist updated. 994 99516 September 2010: Wouter 996 - Algorithm rollover operational reality intrudes, for trust-anchor, 997 5011-store, and DLV-anchor if one key matches it's good enough. 998 - iana portlist updated. 999 - Fix reported validation error in out of memory condition. 1000 100115 September 2010: Wouter 1002 - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout. 1003 100414 September 2010: Wouter 1005 - increased mesh-max-activation from 1000 to 3000 for crazy domains 1006 like _tcp.slb.com with 262 servers. 1007 - iana portlist updated. 1008 100913 September 2010: Wouter 1010 - bug#327: Fix for cannot access stub zones until the root is primed. 1011 10129 September 2010: Wouter 1013 - unresponsive servers are not completely blacklisted (because of 1014 firewalls), but also not probed all the time (because of the request 1015 list size it generates). The probe rate is 1%. 1016 - iana portlist updated. 1017 101820 August 2010: Wouter 1019 - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled. 1020 iterator get_mem includes priv_get_mem. delegpt nodup removed. 1021 listen_pushback, query_info_allocqname, write_socket, send_packet, 1022 comm_point_set_cb_arg and listen_resume removed. 1023 102419 August 2010: Wouter 1025 - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20. 1026 Delegpt structures checked for duplicates always. 1027 No more nameserver lookups generated when depth is full anyway. 1028 - example.conf notes how to do DNSSEC validation and track the root. 1029 - iana portlist updated. 1030 103118 August 2010: Wouter 1032 - Fix bug#322: configure does not respect CFLAGS on Solaris. 1033 Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line 1034 if use sun-cc, but some systems need different flags. 1035 103616 August 2010: Wouter 1037 - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP 1038 changes, uses m4_bpatsubst now. 1039 - make test (or make check) should be more portable and run the unit 1040 test and testbound scripts. (make longtest has special requirements). 1041 104213 August 2010: Wouter 1043 - More pleasant remote control command parsing. 1044 - documentation added for return values reported by doxygen 1.7.1. 1045 - iana portlist updated. 1046 10479 August 2010: Wouter 1048 - Fix name of rrset printed that failed validation. 1049 10505 August 2010: Wouter 1051 - Return NXDOMAIN after chain of CNAMEs ends at name-not-found. 1052 10534 August 2010: Wouter 1054 - Fix validation in case a trust anchor enters into a zone with 1055 unsupported algorithms. 1056 10573 August 2010: Wouter 1058 - updated ldns tarball with bugfixes. 1059 - release tag 1.4.6. 1060 - trunk becomes 1.4.7 develop. 1061 - iana portlist updated. 1062 106322 July 2010: Wouter 1064 - more error details on failed remote control connection. 1065 106615 July 2010: Wouter 1067 - rlimit adjustments for select and ulimit can happen at the same time. 1068 106914 July 2010: Wouter 1070 - Donation text added to README. 1071 - Fix integer underflow in prefetch ttl creation from cache. This 1072 fixes a potential negative prefetch ttl. 1073 107412 July 2010: Wouter 1075 - Changed the defaults for num-queries-per-thread/outgoing-range. 1076 For builtin-select: 512/960, for libevent 1024/4096 and for 1077 windows 24/48 (because of win api). This makes the ratio this way 1078 to improve resilience under heavy load. For high performance, use 1079 libevent and possibly higher numbers. 1080 108110 July 2010: Wouter 1082 - GOST enabled if SSL is recent and ldns has GOST enabled too. 1083 - ldns tarball updated. 1084 10859 July 2010: Wouter 1086 - iana portlist updated. 1087 - Fix validation of qtype DNSKEY when a key-cache entry exists but 1088 no rr-cache entry is used (it expired or prefetch), it then goes 1089 back up to the DS or trust-anchor to validate the DNSKEY. 1090 10917 July 2010: Wouter 1092 - Neat function prototypes, unshadowed local declarations. 1093 10946 July 2010: Wouter 1095 - failure to chown the pidfile is not fatal any more. 1096 - testbound uses UTC timezone. 1097 - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add 1098 /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake. 1099 11005 July 2010: Wouter 1101 - log if a server is skipped because it is on the donotquery list, 1102 at verbosity 4, to enable diagnosis why no queries to 127.0.0.1. 1103 - added feature to print configure date, target and options with -h. 1104 - added feature to print event backend system details with -h. 1105 - wdiff is not actually required by make test, updated requirements. 1106 11071 July 2010: Wouter 1108 - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex 1109 must be signed with all algorithms from the DS rrset at the parent. 1110 This is now checked and becomes bogus if not. 1111 111228 June 2010: Wouter 1113 - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps 1114 in overload situations to be about 5 qps for the class of shortly 1115 serviced queries. 1116 The capacity of the resolver is then about (numqueriesperthread / 2) 1117 / (average time for such long queries) qps for long queries. 1118 And about (numqueriesperthread / 2)/(jostletimeout in whole seconds) 1119 qps for short queries, per thread. 1120 - Fix the max number of reply-address count to be applied for duplicate 1121 queries, and not for new query list entries. This raises the memory 1122 usage to a max of (16+1)*numqueriesperthread reply addresses. 1123 112425 June 2010: Wouter 1125 - Fix handling of corner case reply from lame server, follows rfc2308. 1126 It could lead to a nodata reply getting into the cache if the search 1127 for a non-lame server turned up other misconfigured servers. 1128 - unbound.h has extern "C" statement for easier include in c++. 1129 113023 June 2010: Wouter 1131 - iana portlist updated. 1132 - makedist upgraded cross compile openssl option, like this: 1133 ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost 1134 113522 June 2010: Wouter 1136 - Unbound reports libev or libevent correctly in logs in verbose mode. 1137 - Fix to unload gost dynamic library module for leak testing. 1138 113918 June 2010: Wouter 1140 - iana portlist updated. 1141 114217 June 2010: Wouter 1143 - Add AAAA to root hints for I.ROOT-SERVERS.NET. 1144 114516 June 2010: Wouter 1146 - Fix assertion failure reported by Kai Storbeck from XS4ALL, the 1147 assertion was wrong. 1148 - updated ldns tarball. 1149 115015 June 2010: Wouter 1151 - tag 1.4.5 created. 1152 - trunk contains 1.4.6 in development. 1153 - Fix TCPreply on systems with no writev, if just 1 byte could be sent. 1154 - Fix to use one pointer less for iterator query state store_parent_NS. 1155 - makedist crosscompile to windows uses builtin ldns not host ldns. 1156 - Max referral count from 30 to 130, because 128 one character domains 1157 is valid DNS. 1158 - added documentation for the histogram printout to syslog. 1159 116011 June 2010: Wouter 1161 - When retry to parent the retrycount is not wiped, so failed 1162 nameservers are not tried again. 1163 - iana portlist updated. 1164 116510 June 2010: Wouter 1166 - Fix bug where a long loop could be entered, now cycle detection 1167 has a loop-counter and maximum search amount. 1168 11694 June 2010: Wouter 1170 - iana portlist updated. 1171 - 1.4.5rc1 tag created. 1172 11733 June 2010: Wouter 1174 - ldns tarball updated, 1.6.5. 1175 - review comments, split dependency cycle tracking for parentside 1176 last resort lookups for A and AAAA so there are more lookup options. 1177 11782 June 2010: Wouter 1179 - Fix compile warning if compiled without threads. 1180 - updated ldns-tarball with current ldns svn (pre 1.6.5). 1181 - GOST disabled-by-default, the algorithm number is allocated but the 1182 RFC is still has to pass AUTH48 at the IETF. 1183 11841 June 2010: Wouter 1185 - Ignore Z flag in incoming messages too. 1186 - Fix storage of negative parent glue if that last resort fails. 1187 - libtoolize 2.2.6b, autoconf 2.65 applied to configure. 1188 - new splint flags for newer splint install. 1189 119031 May 2010: Wouter 1191 - Fix AD flag handling, it could in some cases mistakenly copy the AD 1192 flag from upstream servers. 1193 - alloc_special_obtain out of memory is not a fatal error any more, 1194 enabling unbound to continue longer in out of memory conditions. 1195 - parentside names are dispreferred but not said to be dnssec-lame. 1196 - parentside check for cached newname glue. 1197 - fix parentside and querytargets modulestate, for dump_requestlist. 1198 - unbound-control-setup makes keys -rw-r--- so not all users permitted. 1199 - fix parentside from cache to be marked dispreferred for bad names. 1200 120128 May 2010: Wouter 1202 - iana portlist updated. 1203 - parent-child disagreement approach altered. Older fixes are 1204 removed in place of a more exhaustive search for misconfigured data 1205 available via the parent of a delegation. 1206 This is designed to be throttled by cache entries, with TTL from the 1207 parent if possible. Additionally the loop-counter is used. 1208 It also tests for NS RRset differences between parent and child. 1209 The fetch of misconfigured data should be more reliable and thorough. 1210 It should work reliably even with no or only partial data in cache. 1211 Data received from the child (as always) is deemed more 1212 authoritative than information received from the delegation parent. 1213 The search for misconfigured data is not performed normally. 1214 121526 May 2010: Wouter 1216 - Contribution from Migiel de Vos (Surfnet): nagios patch for 1217 unbound-host, in contrib/ (in the source tarball). Makes 1218 unbound-host suitable for monitoring dnssec(-chain) status. 1219 122021 May 2010: Wouter 1221 - EDNS timeout code will not fire if EDNS status already known. 1222 - EDNS failure not stored if EDNS status known to work. 1223 122419 May 2010: Wouter 1225 - Fix resolution for domains like safesvc.com.cn. If the iterator 1226 can not recurse further and it finds the delegation in a state 1227 where it would otherwise have rejected it outhand if so received 1228 from a cache lookup, then it can try to ask higherup (with loop 1229 protection). 1230 - Fix comments in iter_utils:dp_is_useless. 1231 123218 May 2010: Wouter 1233 - Fix various compiler warnings from the clang llvm compiler. 1234 - iana portlist updated. 1235 12366 May 2010: Wouter 1237 - Fix bug#308: spelling error in variable name in parser and lexer. 1238 12394 May 2010: Wouter 1240 - Fix dnssec-missing detection that was turned off by server selection. 1241 - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default 1242 reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa, 1243 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa. 1244 124529 April 2010: Wouter 1246 - Fix for dnssec lameness detection to use the key cache. 1247 - infra cache entries that are expired are wiped clean. Previously 1248 it was possible to not expire host data (if accessed often). 1249 125028 April 2010: Wouter 1251 - ldns tarball updated and GOST support is detected and then enabled. 1252 - iana portlist updated. 1253 - Fix detection of gost support in ldns (reported by Chris Smith). 1254 125527 April 2010: Wouter 1256 - unbound-control get_option domain-insecure shows config file items. 1257 - fix retry sequence if prime hints are recursion-lame. 1258 - autotrust anchor file can be initialized with a ZSK key as well. 1259 - harden-referral-path does not result in failures due to max-depth. 1260 You can increase the max-depth by adding numbers (' 0') after the 1261 target-fetch-policy, this increases the depth to which is checked. 1262 126326 April 2010: Wouter 1264 - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use 1265 CPPFLAGS during configure process. 1266 - if libev is installed on the base system (not libevent), detect 1267 it from the event.h header file and link with -lev. 1268 - configlexer.lex gets config.h, and configyyrename.h added by make, 1269 no more double include. 1270 - More strict scrubber (Thanks to George Barwood for the idea): 1271 NS set must be pertinent to the query (qname subdomain nsname). 1272 - Fix bug#307: In 0x20 backoff fix fallback so the number of 1273 outstanding queries does not become -1 and block the request. 1274 Fixed handling of recursion-lame in combination with 0x20 fallback. 1275 Fix so RRsets are compared canonicalized and sorted if the immediate 1276 comparison fails, this makes it work around round-robin sites. 1277 127823 April 2010: Wouter 1279 - Squelch log message: sendto failed permission denied for 1280 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2). 1281 - Fix to fetch data as last resort more tenaciously. When cycle 1282 targets cause the server selection to believe there are more options 1283 when they really are not there, the server selection is reinitiated. 1284 - Fix fetch from blacklisted dnssec lame servers as last resort. The 1285 server's IP address is then given in validator errors as well. 1286 - Fix local-zone type redirect that did not use the query name for 1287 the answer rrset. 1288 128922 April 2010: Wouter 1290 - tag 1.4.4. 1291 - trunk contains 1.4.5 in development. 1292 - Fix validation failure for qtype ANY caused by a RRSIG parse failure. 1293 The validator error message was 'no signatures from ...'. 1294 129516 April 2010: Wouter 1296 - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN. 1297 - tag 1.4.4rc1. 1298 129915 April 2010: Wouter 1300 - ECC-GOST algorithm number 12 that is assigned by IANA. New test 1301 example key and signatures for GOST. GOST requires openssl-1.0.0. 1302 GOST is still disabled by default. 1303 13049 April 2010: Wouter 1305 - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or 1306 get into an endless loop, if 0x20 was enabled, and buffers are small 1307 or particular broken packets are received. 1308 - Fix chain of trust with CNAME at an intermediate step, for the DS 1309 processing proof. 1310 13118 April 2010: Wouter 1312 - Fix validation of queries with wildcard names (*.example). 1313 13146 April 2010: Wouter 1315 - Fix EDNS probe for .de DNSSEC testbed failure, where the infra 1316 cache timeout coincided with a server update, the current EDNS 1317 backoff is less sensitive, and does not cache the backoff unless 1318 the backoff actually works and the domain is not expecting DNSSEC. 1319 - GOST support with correct algorithm numbers. 1320 13211 April 2010: Wouter 1322 - iana portlist updated. 1323 132424 March 2010: Wouter 1325 - unbound control flushed items are not counted when flushed again. 1326 132723 March 2010: Wouter 1328 - iana portlist updated. 1329 133022 March 2010: Wouter 1331 - unbound-host disables use-syslog from config file so that the 1332 config file for the main server can be used more easily. 1333 - fix bug#301: unbound-checkconf could not parse interface 1334 '0.0.0.0@5353', even though unbound itself worked fine. 1335 133619 March 2010: Wouter 1337 - fix fwd_ancil test to pass if the socket options are not supported. 1338 133918 March 2010: Wouter 1340 - Fixed random numbers for port, interface and server selection. 1341 Removed very small bias. 1342 - Refer to the listing in unbound-control man page in the extended 1343 statistics entry in the unbound.conf man page. 1344 134516 March 2010: Wouter 1346 - Fix interface-automatic for OpenBSD: msg.controllen was too small, 1347 also assertions on ancillary data buffer. 1348 - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO. 1349 - for NSEC3 check if signatures are cached. 1350 135115 March 2010: Wouter 1352 - unit test for util/regional.c. 1353 135412 March 2010: Wouter 1355 - Reordered configure checks so fork and -lnsl -lsocket checks are 1356 earlier, and thus later checks benefit from and do not hinder them. 1357 - iana portlist updated. 1358 - ldns tarball updated. 1359 - Fix python use when multithreaded. 1360 - Fix solaris python compile. 1361 - Include less in config.h and include per code file for ldns, ssl. 1362 136311 March 2010: Wouter 1364 - another memory allocation option: --enable-alloc-nonregional. 1365 exposes the regional allocations to other memory purifiers. 1366 - fix for memory alignment in struct sock_list allocation. 1367 - Fix for MacPorts ldns without ssl default, unbound checks if ldns 1368 has dnssec functionality and uses the builtin if not. 1369 - Fix daemonize on Solaris 10, it did not detach from terminal. 1370 - tag 1.4.3 created. 1371 - trunk is 1.4.4 in development. 1372 - spelling fix in validation error involving cnames. 1373 137410 March 2010: Wouter 1375 - --enable-alloc-lite works with test set. 1376 - portability in the testset: printf format conversions, prototypes. 1377 13789 March 2010: Wouter 1379 - tag 1.4.2 created. 1380 - trunk is 1.4.3 in development. 1381 - --enable-alloc-lite debug option. 1382 13838 March 2010: Wouter 1384 - iana portlist updated. 1385 13864 March 2010: Wouter 1387 - Fix crash in control channel code. 1388 13893 March 2010: Wouter 1390 - better casts in pipe code, brackets placed wrongly. 1391 - iana portlist updated. 1392 13931 March 2010: Wouter 1394 - make install depends on make all. 1395 - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs. 1396 - --enable-checking: enables assertions but does not look nonproduction. 1397 - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with 1398 nxdomain and nodata distinguished. 1399 - ldns tarball updated. 1400 - --disable-rpath fixed for libtool not found errors. 1401 - new fedora specfile from Fedora13 in contrib from Paul Wouters. 1402 140326 February 2010: Wouter 1404 - Fixup prototype for lexer cleanup in daemon code. 1405 - unbound-control list_stubs, list_forwards, list_local_zones and 1406 list_local_data. 1407 140824 February 2010: Wouter 1409 - Fix scrubber bug that potentially let NS records through. Reported 1410 by Amanda Constant. 1411 - Also delete potential poison references from additional. 1412 - Fix: no classification of a forwarder as lame, throw away instead. 1413 141423 February 2010: Wouter 1415 - libunbound ub_ctx_get_option() added. 1416 - unbound-control set_option and get_option commands. 1417 - iana portlist updated. 1418 141918 February 2010: Wouter 1420 - A little more strict DS scrubbing. 1421 - No more blacklisting of unresponsive servers, a 2 minute timeout 1422 is backed off to. 1423 - RD flag not enabled for dnssec-blacklisted tries, unless necessary. 1424 - pickup ldns compile fix, libdl for libcrypto. 1425 - log 'tcp connect: connection timed out' only in high verbosity. 1426 - unbound-control log_reopen command. 1427 - moved get_option code from unbound-checkconf to util/config_file.c 1428 142917 February 2010: Wouter 1430 - Disregard DNSKEY from authority section for chain of trust. 1431 DS records that are irrelevant to a referral scrubbed. Anti-poison. 1432 - iana portlist updated. 1433 143416 February 2010: Wouter 1435 - Check for 'no space left on device' (or other errors) when 1436 writing updated autotrust anchors and print errno to log. 1437 143815 February 2010: Wouter 1439 - Fixed the requery protection, the TTL was 0, it is now 900 seconds, 1440 hardcoded. We made the choice to send out more conservatively, 1441 protecting against an aggregate effect more than protecting a 1442 single user (from their own folly, perhaps in case of misconfig). 1443 144412 February 2010: Wouter 1445 - Re-query pattern changed on validation failure. To protect troubled 1446 authority servers, unbound caches a failure for the DNSKEY or DS 1447 records for the entire zone, and only retries that 900 seconds later. 1448 This implies that only a handful of packets are sent extra to the 1449 authority if the zone fails. 1450 145111 February 2010: Wouter 1452 - ldns tarball update for long label length syntax error fix. 1453 - iana portlist updated. 1454 14559 February 2010: Wouter 1456 - Fixup in compat snprintf routine, %f 1.02 and %g support. 1457 - include math.h for testbound test compile portability. 1458 14592 February 2010: Wouter 1460 - Updated url of IANA itar, interim trust anchor repository, in script. 1461 14621 February 2010: Wouter 1463 - iana portlist updated. 1464 - configure test for memcmp portability. 1465 146627 January 2010: Wouter 1467 - removed warning on format string in validator error log statement. 1468 - iana portlist updated. 1469 147022 January 2010: Wouter 1471 - libtool finish the install of unbound python dynamic library. 1472 147321 January 2010: Wouter 1474 - acx_nlnetlabs.m4 synchronised with nsd's version. 1475 147620 January 2010: Wouter 1477 - Fixup lookup trouble for parent-child domains on the first query. 1478 147914 January 2010: Wouter 1480 - Fixup ldns detection to also check for header files. 1481 148213 January 2010: Wouter 1483 - prefetch-key option that performs DNSKEY queries earlier in the 1484 validation process, and that could halve the latency on DNSSEC 1485 queries. It takes some extra processing (CPU, a cache is needed). 1486 148712 January 2010: Wouter 1488 - Fix unbound-checkconf for auto-trust-anchor-file present checks. 1489 14908 January 2010: Wouter 1491 - Fix for parent-child disagreement code which could have trouble 1492 when (a) ipv6 was disabled and (b) the TTL for parent and child 1493 were different. There were two bugs, the parent-side information 1494 is fixed to no longer block lookup of child side information and 1495 the iterator is fixed to no longer attempt to get ipv6 when it is 1496 not enabled and then give up in failure. 1497 - test and fixes to make prefetch actually store the answer in the 1498 cache. Considers some rrsets 'already expired' but does not allow 1499 overwriting of rrsets considered more secure. 1500 15017 January 2010: Wouter 1502 - Fixup python documentation (thanks Leo Vandewoestijne). 1503 - Work on cache prefetch feature. 1504 - Stats for prefetch, in log print stats, unbound-control stats 1505 and in unbound_munin plugin. 1506 15076 January 2010: Wouter 1508 - iana portlist updated. 1509 - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length. 1510 - verbose output includes parent-side-address notion for lameness. 1511 - documented val-log-level: 2 setting in example.conf and man page. 1512 - change unbound-control-setup from 1024(sha1) to 1536(sha256). 1513 15141 January 2010: Wouter 1515 - iana portlist updated. 1516 151722 December 2009: Wouter 1518 - configure with newer libtool 2.2.6b. 1519 152017 December 2009: Wouter 1521 - review comments. 1522 - tag 1.4.1. 1523 - trunk to version 1.4.2. 1524 152515 December 2009: Wouter 1526 - Answer to qclass=ANY queries, with class IN contents. 1527 Test that validation also works. 1528 - updated ldns snapshot tarball with latest fixes (parsing records). 1529 153011 December 2009: Wouter 1531 - on IPv4 UDP turn off DF flag. 1532 153310 December 2009: Wouter 1534 - requirements.txt updated with design choice explanations. 1535 - Reading fixes: fix to set unlame when child confirms parent glue, 1536 and fix to avoid duplicate addresses in delegation point. 1537 - verify_rrsig routine checks expiration last. 1538 15399 December 2009: Wouter 1540 - Fix Bug#287(reopened): update of ldns tarball with fix for parse 1541 errors generated for domain names like '.example.com'. 1542 - Fix SOA excluded from negative DS responses. Reported by Hauke 1543 Lampe. The negative cache did not include proper SOA records for 1544 negative qtype DS responses which makes BIND barf on it, such 1545 responses are now only used internally. 1546 - Fix negative cache lookup of closestencloser check of DS type bit. 1547 15488 December 2009: Wouter 1549 - Fix for lookup of parent-child disagreement domains, where the 1550 parent-side glue works but it does not provide proper NS, A or AAAA 1551 for itself, fixing domains such as motorcaravanners.eu. 1552 - Feature: you can specify a port number in the interface: line, so 1553 you can bind the same interface multiple times at different ports. 1554 15557 December 2009: Wouter 1556 - Bug#287: Fix segfault when unbound-control remove nonexistent local 1557 data. Added check to tests. 1558 15591 December 2009: Wouter 1560 - Fix crash with module-config "iterator". 1561 - Added unit test that has "iterator" module-config. 1562 156330 November 2009: Wouter 1564 - bug#284: fix parse of # without end-of-line at end-of-file. 1565 156626 November 2009: Wouter 1567 - updated ldns with release candidate for version 1.6.3. 1568 - tag for 1.4.0 release. 1569 - 1.4.1 version in trunk. 1570 - Fixup major libtool version to 2 because of why_bogus change. 1571 It was 1:5:0 but should have been 2:0:0. 1572 157323 November 2009: Wouter 1574 - Patch from David Hubbard for libunbound manual page. 1575 - Fixup endless spinning in unbound-control stats reported by 1576 Attila Nagy. Probably caused by clock reversal. 1577 157820 November 2009: Wouter 1579 - contrib/split-itar.sh contributed by Tom Hendrikx. 1580 158119 November 2009: Wouter 1582 - better argument help for unbound-control. 1583 - iana portlist updated. 1584 158517 November 2009: Wouter 1586 - noted multiple entries for multiple domain names in example.conf. 1587 - iana portlist updated. 1588 158916 November 2009: Wouter 1590 - Fixed signer detection of CNAME responses without signatures. 1591 - Fix#282 libunbound memleak on error condition by Eric Sesterhenn. 1592 - Tests for CNAMEs to deeper trust anchors, secure and bogus. 1593 - svn tag 1.4.0rc1 made. 1594 159513 November 2009: Wouter 1596 - Fixed validation failure for CNAME to optout NSEC3 nodata answer. 1597 - unbound-host does not fail on type ANY. 1598 - Fixed wireparse failure to put RRSIGs together with data in some 1599 long ANY mix cases, which fixes validation failures. 1600 160112 November 2009: Wouter 1602 - iana portlist updated. 1603 - fix manpage errors reported by debian lintian. 1604 - review comments. 1605 - fixup very long vallog2 level error strings. 1606 160711 November 2009: Wouter 1608 - ldns tarball updated (to 1.6.2). 1609 - review comments. 1610 161110 November 2009: Wouter 1612 - Thanks to Surfnet found bug in new dnssec-retry code that failed 1613 to combine well when combined with DLV and a particular failure. 1614 - Fixed unbound-control -h output about argument optionality. 1615 - review comments. 1616 16175 November 2009: Wouter 1618 - lint fixes and portability tests. 1619 - better error text for multiple domain keys in one autotrust file. 1620 16212 November 2009: Wouter 1622 - Fix bug where autotrust does not work when started with a DS. 1623 - Updated GOST unit tests for unofficial algorithm number 249 1624 and DNSKEY-format changes in draft version -01. 1625 162629 October 2009: Wouter 1627 - iana portlist updated. 1628 - edns-buffer-size option, default 4096. 1629 - fixed do-udp: no. 1630 163128 October 2009: Wouter 1632 - removed abort on prealloc failure, error still printed but softfail. 1633 - iana portlist updated. 1634 - RFC 5702: RSASHA256 and RSASHA512 support enabled by default. 1635 - ldns tarball updated (which also enables rsasha256 support). 1636 163727 October 2009: Wouter 1638 - iana portlist updated. 1639 16408 October 2009: Wouter 1641 - please doxygen 1642 - add val-log-level print to corner case (nameserver.epost.bg). 1643 - more detail to errors from insecure delegation checks. 1644 - Fix double time subtraction in negative cache reported by 1645 Amanda Constant and Hugh Mahon. 1646 - Made new validator error string available from libunbound for 1647 applications. It is in result->why_bogus, a zero-terminated string. 1648 unbound-host prints it by default if a result is bogus. 1649 Also the errinf is public in module_qstate (for other modules). 1650 16517 October 2009: Wouter 1652 - retry for validation failure in DS and prime results. Less mem use. 1653 unit test. Provisioning in other tests for requeries. 1654 - retry for validation failure in DNSKEY in middle of chain of trust. 1655 unit test. 1656 - retry for empty non terminals in chain of trust and unit test. 1657 - Fixed security bug where the signatures for NSEC3 records were not 1658 checked when checking for absence of DS records. This could have 1659 enabled the substitution of an insecure delegation. 1660 - moved version number to 1.4.0 because of 1.3.4 release with only 1661 the NSEC3 patch from the entry above. 1662 - val-log-level: 2 shows extended error information for validation 1663 failures, but still one (longish) line per failure. For example: 1664 validation failure <example.com. DNSKEY IN>: signature expired from 1665 192.0.2.4 for trust anchor example.com. while building chain of trust 1666 validation failure <www.example.com. A IN>: no signatures from 1667 192.0.2.6 for key example.com. while building chain of trust 1668 16696 October 2009: Wouter 1670 - Test set updated to provide additional ns lookup result. 1671 The retry would attempt to fetch the data from other nameservers 1672 for bogus data, and this needed to be provisioned in the tests. 1673 16745 October 2009: Wouter 1675 - first validation failure retry code. Retries for data failures. 1676 And unit test. 1677 16782 October 2009: Wouter 1679 - improve 5011 modularization. 1680 - fix unbound-host so -d can be given before -C. 1681 - iana portlist updated. 1682 168328 September 2009: Wouter 1684 - autotrust-anchor-file can read multiline input and $ORIGIN. 1685 - prevent integer overflow in holddown calculation. review fixes. 1686 - fixed race condition in trust point revocation. review fix. 1687 - review fixes to comments, removed unused code. 1688 168925 September 2009: Wouter 1690 - so-rcvbuf: 4m option added. Set this on large busy servers to not 1691 drop the occasional packet in spikes due to full socket buffers. 1692 netstat -su keeps a counter of UDP dropped due to full buffers. 1693 - review of validator/autotrust.c, small fixes and comments. 1694 169523 September 2009: Wouter 1696 - 5011 query failed counts verification failures, not lookup failures. 1697 - 5011 probe failure handling fixup. 1698 - test unbound reading of original autotrust data. 1699 The metadata per-key, such as key state (PENDING, MISSING, VALID) is 1700 picked up, otherwise performs initial probe like usual. 1701 170222 September 2009: Wouter 1703 - autotrust test with algorithm rollover, new ordering of checks 1704 assists in orderly rollover. 1705 - autotrust test with algorithm rollover to unknown algorithm. 1706 checks if new keys are supported before adding them. 1707 - autotrust test with trust point revocation, becomes unsigned. 1708 - fix DNSSEC-missing-signature detection for minimal responses 1709 for qtype DNSKEY (assumes DNSKEY occurs at zone apex). 1710 171118 September 2009: Wouter 1712 - autotrust tests, fix trustpoint timer deletion code. 1713 fix count of valid anchors during missing remove. 1714 - autotrust: pick up REVOKE even if not signed with known other keys. 1715 171617 September 2009: Wouter 1717 - fix compile of unbound-host when --enable-alloc-checks. 1718 - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis. 1719 - Manual page fixes reported by Tony Finch. 1720 172116 September 2009: Wouter 1722 - Fix memory leak reported by Tao Ma. 1723 - Fix memstats test tool for log-time-ascii log format. 1724 172515 September 2009: Wouter 1726 - iana portlist updated. 1727 172810 September 2009: Wouter 1729 - increased MAXSYSLOGLEN so .bg key can be printed in debug output. 1730 - use linebuffering for log-file: output, this can be significantly 1731 faster than the previous fflush method and enable some class of 1732 resolvers to use high verbosity (for short periods). 1733 Not on windows, because line buffering does not work there. 1734 17359 September 2009: Wouter 1736 - Fix bug where DNSSEC-bogus messages were marked with too high TTL. 1737 The RRsets would still expire at the normal time, but this would 1738 keep messages bogus in the cache for too long. 1739 - regression test for that bug. 1740 - documented that load_cache is meant for debugging. 1741 17428 September 2009: Wouter 1743 - fixup printing errors when load_cache, they were printed to the 1744 SSL connection which broke, now to the log. 1745 - new ldns - with fixed parse of large SOA values. 1746 17477 September 2009: Wouter 1748 - autotrust testbound scenarios. 1749 - autotrust fix that failure count is written to file. 1750 - autotrust fix that keys may become valid after add holddown time 1751 alone, before the probe returns. 1752 17534 September 2009: Wouter 1754 - Changes to make unbound work with libevent-2.0.3 alpha. (in 1755 configure detection due to new ssl dependency in libevent) 1756 - do not call sphinx for documentation when python is disabled. 1757 - remove EV_PERSIST from libevent timeout code to make the code 1758 compatible with the libevent-2.0. Works with older libevent too. 1759 - fix memory leak in python code. 1760 17613 September 2009: Wouter 1762 - Got a patch from Luca Bruno for libunbound support on windows to 1763 pick up the system resolvconf nameservers and hosts there. 1764 - included ldns updated (enum warning fixed). 1765 - makefile fix for parallel makes. 1766 - Patch from Zdenek Vasicek and Attila Nagy for using the source IP 1767 from python scripts. See pythonmod/examples/resip.py. 1768 - doxygen comment fixes. 1769 17702 September 2009: Wouter 1771 - TRAFFIC keyword for testbound. Simplifies test generation. 1772 ${range lower val upper} to check probe timeout values. 1773 - test with 5011-prepublish rollover and revocation. 1774 - fix revocation of RR for autotrust, stray exclamation mark. 1775 17761 September 2009: Wouter 1777 - testbound variable arithmetic. 1778 - autotrust probe time is randomised. 1779 - autotrust: the probe is active and does not fetch from cache. 1780 178131 August 2009: Wouter 1782 - testbound variable processing. 1783 178428 August 2009: Wouter 1785 - fixup unbound-control lookup to print forward and stub servers. 1786 178727 August 2009: Wouter 1788 - autotrust: mesh answer callback is empty. 1789 179026 August 2009: Wouter 1791 - autotrust probing. 1792 - iana portlist updated. 1793 179425 August 2009: Wouter 1795 - fixup memleak in trust anchor unsupported algorithm check. 1796 - iana portlist updated. 1797 - autotrust options: add-holddown, del-holddown, keep-missing. 1798 - autotrust store revoked status of trust points. 1799 - ctime_r compat definition. 1800 - detect yylex_destroy() in configure. 1801 - detect SSL_get_compression_methods declaration in configure. 1802 - fixup DS lookup at anchor point with unsigned parent. 1803 - fixup DLV lookup for DS queries to unsigned domains. 1804 180524 August 2009: Wouter 1806 - cleaner memory allocation on exit. autotrust test routines. 1807 - free all memory on program exit, fix for ssl and flex. 1808 180921 August 2009: Wouter 1810 - autotrust: debug routines. Read,write and conversions work. 1811 181220 August 2009: Wouter 1813 - autotrust: save and read trustpoint variables. 1814 181519 August 2009: Wouter 1816 - autotrust: state table updates. 1817 - iana portlist updated. 1818 181917 August 2009: Wouter 1820 - autotrust: process events. 1821 182217 August 2009: Wouter 1823 - Fix so that servers are only blacklisted if they fail to reply 1824 to 16 queries in a row and the timeout gets above 2 minutes. 1825 - autotrust work, split up DS verification of DNSKEYs. 1826 182714 August 2009: Wouter 1828 - unbound-control lookup prints out infra cache information, like RTT. 1829 - Fix bug in DLV lookup reported by Amanda from Secure64. 1830 It could sometimes wrongly classify a domain as unsigned, which 1831 does not give the AD bit on replies. 1832 183313 August 2009: Wouter 1834 - autotrust read anchor files. locked trust anchors. 1835 183612 August 2009: Wouter 1837 - autotrust import work. 1838 183911 August 2009: Wouter 1840 - Check for openssl compatible with gost if enabled. 1841 - updated unit test for GOST=211 code. 1842 Nicer naming of test files. 1843 - iana portlist updated. 1844 18457 August 2009: Wouter 1846 - call OPENSSL_config() in unbound and unit test so that the 1847 operator can use openssl.cnf for configuration options. 1848 - removed small memory leak from config file reader. 1849 18506 August 2009: Wouter 1851 - configure --enable-gost for GOST support, experimental 1852 implementation of draft-dolmatov-dnsext-dnssec-gost-01. 1853 - iana portlist updated. 1854 - ldns tarball updated (with GOST support). 1855 18565 August 2009: Wouter 1857 - trunk moved to 1.3.4. 1858 18594 August 2009: Wouter 1860 - Added test that the examples from draft rsasha256-14 verify. 1861 - iana portlist updated. 1862 - tagged 1.3.3 1863 18643 August 2009: Wouter 1865 - nicer warning when algorithm not supported, tells you to upgrade. 1866 - iana portlist updated. 1867 186827 July 2009: Wouter 1869 - Updated unbound-cacti contribution from Dmitriy Demidov, with 1870 the queue statistics displayed in its own graph. 1871 - iana portlist updated. 1872 187322 July 2009: Wouter 1874 - Fix bug found by Michael Tokarev where unbound would try to 1875 prime the root servers even though forwarders are configured for 1876 the root. 1877 - tagged 1.3.3rc1 1878 187921 July 2009: Wouter 1880 - Fix server selection, so that it waits for open target queries when 1881 faced with lameness. 1882 188320 July 2009: Wouter 1884 - Ignore transient sendto errors, no route to host, and host, net down. 1885 - contrib/update-anchor.sh has -r option for root-hints. 1886 - feature val-log-level: 1 prints validation failures so you can 1887 keep track of them during dnssec deployment. 1888 188916 July 2009: Wouter 1890 - fix replacement malloc code. Used in crosscompile. 1891 - makedist -w creates crosscompiled setup.exe on fedora11. 1892 189315 July 2009: Wouter 1894 - dependencies for compat items, for crosscompile. 1895 - mingw32 crosscompile changes, dependencies and zipfile creation. 1896 and with System.dll from the windows NSIS you can make setup.exe. 1897 - package libgcc_s_sjlj exception handler for NSISdl.dll. 1898 189914 July 2009: Wouter 1900 - updated ldns tarball for solaris x64 compile assistance. 1901 - no need to define RAND_MAX from config.h. 1902 - iana portlist updated. 1903 - configure changes and ldns update for mingw32 crosscompile. 1904 190513 July 2009: Wouter 1906 - Fix for crash at start on windows. 1907 - tag for release 1.3.2. 1908 - trunk has version 1.3.3. 1909 - Fix for ID bits on windows to use all 16. RAND_MAX was not 1910 defined like you'd expect on mingw. Reported by Mees de Roo. 1911 19129 July 2009: Wouter 1913 - tag for release 1.3.1. 1914 - trunk has version 1.3.2. 1915 19167 July 2009: Wouter 1917 - iana portlist updated. 1918 19196 July 2009: Wouter 1920 - prettier error handling in SSL setup. 1921 - makedist.sh uname fix (same as ldns). 1922 - updated fedora spec file. 1923 19243 July 2009: Wouter 1925 - fixup linking when ldnsdir is "". 1926 192730 June 2009: Wouter 1928 - more lenient truncation checks. 1929 193029 June 2009: Wouter 1931 - ldns trunk r2959 imported as tarball, because of solaris cc compile 1932 support for c99. r2960 for better configure. 1933 - better wrongly_truncated check. 1934 - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to 1935 avoid dropped packets at routers. 1936 193726 June 2009: Wouter 1938 - Fix EDNS fallback when EDNS works for short answers but long answers 1939 are dropped. 1940 194122 June 2009: Wouter 1942 - fixup iter priv strict aliasing while preserving size of sockaddr. 1943 - iana portlist updated. (one less port allocated, one more fraction 1944 of a bit for security!) 1945 - updated fedora specfile in contrib from Paul Wouters. 1946 194719 June 2009: Wouter 1948 - Fixup strict aliasing warning in iter priv code. 1949 and config_file code. 1950 - iana portlist updated. 1951 - harden-referral-path: handle cases where NS is in answer section. 1952 195318 June 2009: Wouter 1954 - Fix of message parse bug where (specifically) an NSEC and RRSIG 1955 in the wrong order would be parsed, but put wrongly into internal 1956 structures so that later validation would fail. 1957 - Extreme lenience for wrongly truncated replies where a positive 1958 reply has an NS in the authority but no signatures. They are 1959 turned into minimal responses with only the (secure) answer. 1960 - autoconf 2.63 for configure. 1961 - python warnings suppress. Keep python API away from header files. 1962 196317 June 2009: Wouter 1964 - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was 1965 used for the python code in unbound. (http://www.nic.cz/vip/ in cz). 1966 196716 June 2009: Wouter 1968 - Fixup opportunistic target query generation to it does not 1969 generate queries that are known to fail. 1970 - Touchup on munin total memory report. 1971 - messages picked out of the cache by the iterator are checked 1972 if their cname chain is still correct and if validation status 1973 has to be reexamined. 1974 197515 June 2009: Wouter 1976 - iana portlist updated. 1977 197814 June 2009: Wouter 1979 - Fixed bug where cached responses would lose their security 1980 status on second validation, which especially impacted dlv 1981 lookups. Reported by Hauke Lampe. 1982 198313 June 2009: Wouter 1984 - bug #254. removed random whitespace from example.conf. 1985 198612 June 2009: Wouter 1987 - Fixup potential wrong NSEC picked out of the cache. 1988 - If unfulfilled callbacks are deleted they are called with an error. 1989 - fptr wlist checks for mesh callbacks. 1990 - fwd above stub in configuration works. 1991 199211 June 2009: Wouter 1993 - Fix queries for type DS when forward or stub zones are there. 1994 They are performed to higherup domains, and thus treated as if 1995 going to higher zones when looking up the right forward or stub 1996 server. This makes a stub pointing to a local server that has 1997 a local view of example.com signed with the same keys as are 1998 publicly used work. Reported by Johan Ihren. 1999 - Added build-unbound-localzone-from-hosts.pl to contrib, from 2000 Dennis DeDonatis. It converts /etc/hosts into config statements. 2001 - same thing fixed for forward-zone and DS, chain of trust from 2002 public internet into the forward-zone works now. Added unit test. 2003 20049 June 2009: Wouter 2005 - openssl key files are opened apache-style, when user is root and 2006 before chrooting. This makes permissions on remote-control key 2007 files easier to set up. Fixes bug #251. 2008 - flush_type and flush_name remove msg cache entries. 2009 - codereview - dp copy bogus setting fix. 2010 20118 June 2009: Wouter 2012 - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause 2013 inadvertant behaviour. 2014 - 1.3.0 tarball for release created. 2015 - 1.3.1 development in svn trunk. 2016 - iana portlist updated. 2017 - fix lint from complaining on ldns/sha.h. 2018 - help compiler figure out aliasing in priv_rrset_bad() routine. 2019 - fail to configure with python if swig is not found. 2020 - unbound_munin_ in contrib uses ps to show rss if sbrk does not work. 2021 20223 June 2009: Wouter 2023 - fixup bad free() when wrongly encoded DSA signature is seen. 2024 Reported by Paul Wouters. 2025 - review comments from Matthijs. 2026 20272 June 2009: Wouter 2028 - --enable-sha2 option. The draft rsasha256 changed its algorithm 2029 numbers too often. Therefore it is more prudent to disable the 2030 RSASHA256 and RSASHA512 support by default. 2031 - ldns trunk included as new tarball. 2032 - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point. 2033 203429 May 2009: Wouter 2035 - fixup doc bug in README reported by Matthew Dempsky. 2036 203728 May 2009: Wouter 2038 - update iana port list 2039 - update ldns lib tarball 2040 204127 May 2009: Wouter 2042 - detect lack of IPv6 support on XP (with a different error code). 2043 - Fixup a crash-on-exit which was triggered by a very long queue. 2044 Unbound would try to re-use ports that came free, but this is 2045 of course not really possible because everything is deleted. 2046 Most easily triggered on XP (not Vista), maybe because of the 2047 network stack encouraging large messages backlogs. 2048 - change in debug statements. 2049 - Fixed bug that could cause a crash if root prime failed when there 2050 were message backlogs. 2051 205226 May 2009: Wouter 2053 - Thanks again to Brett Carr, found an assertion that was not true. 2054 Assertion checked if recursion parent query still existed. 2055 205629 April 2009: Wouter 2057 - Thanks to Brett Carr, caught windows resource leak, use 2058 closesocket() and not close() on sockets or else the network stack 2059 starts to leak handles. 2060 - Removed usage of windows Mutex because windows cannot handle enough 2061 mutexes open. Provide own mutex implementation using primitives. 2062 206328 April 2009: Wouter 2064 - created svn tag for 1.3.0. 2065 206627 April 2009: Wouter 2067 - optimised cname from cache. 2068 - ifdef windows functions in testbound. 2069 207023 April 2009: Wouter 2071 - fix for threadsafety in solaris thr_key_create() in tests. 2072 - iana portlist updated. 2073 - fix pylib test for Darwin. 2074 - fix pymod test for Darwin and a python threading bug in pymod init. 2075 - check python >= 2.4 in configure. 2076 - -ldl check for libcrypto 1.0.0beta. 2077 207821 April 2009: Wouter 2079 - fix for build outside sourcedir. 2080 - fix for configure script swig detection. 2081 208217 April 2009: Wouter 2083 - Fix reentrant in minievent handler for unix. Could have resulted 2084 in spurious event callbacks. 2085 - timers do not take up a fd slot for winsock handler. 2086 - faster fix for winsock reentrant check. 2087 - fix rsasha512 unit test for new (interim) algorithm number. 2088 - fix test:ldns doesn't like DOS line endings in keyfiles on unix. 2089 - fix compile warning on ubuntu (configlexer fwrite return value). 2090 - move python include directives into CPPFLAGS instead of CFLAGS. 2091 209216 April 2009: Wouter 2093 - winsock event handler exit very quickly on signal, even if 2094 under heavy load. 2095 - iana portlist updated. 2096 - fixup windows winsock handler reentrant problem. 2097 209814 April 2009: Wouter 2099 - bug #245: fix munin plugin, perform cleanup of stale lockfiles. 2100 - makedist.sh; better help text. 2101 - cache-min-ttl option and tests. 2102 - mingw detect error condition on TCP sockets (NOTCONN). 2103 21049 April 2009: Wouter 2105 - Fix for removal of RSASHA256_NSEC3 protonumber from ldns. 2106 - ldns tarball updated. 2107 - iana portlist update. 2108 - detect GOST support in openssl-1.0.0-beta1, and fix compile problem 2109 because that openssl defines the name STRING for itself. 2110 21116 April 2009: Wouter 2112 - windows compile fix. 2113 - Detect FreeBSD jail without ipv6 addresses assigned. 2114 - python libunbound wrapper unit test. 2115 - installs the following files. Default is to not build them. 2116 from configure --with-pythonmodule: 2117 /usr/lib/python2.x/site-packages/unboundmodule.py 2118 from configure --with-pyunbound: 2119 /usr/lib/python2.x/site-packages/unbound.py 2120 /usr/lib/python2.x/site-packages/_unbound.so* 2121 The example python scripts (pythonmod/examples and 2122 libunbound/python/examples) are not installed. 2123 - python invalidate routine respects packed rrset ids and locks. 2124 - clock skew checks in unbound, config statements. 2125 - nxdomain ttl considerations in requirements.txt 2126 21273 April 2009: Wouter 2128 - Fixed a bug that caused messages to be stored in the cache too 2129 long. Hard to trigger, but NXDOMAINs for nameservers or CNAME 2130 targets have been more vulnerable to the TTL miscalculation bug. 2131 - documentation test fixed for python addition. 2132 21332 April 2009: Wouter 2134 - pyunbound (libunbound python plugin) compiles using libtool. 2135 - documentation for pythonmod and pyunbound is generated in doc/html. 2136 - iana portlist updated. 2137 - fixed bug in unbound-control flush_zone where it would not flush 2138 every message in the target domain. This especially impacted 2139 NXDOMAIN messages which could remain in the cache regardless. 2140 - python module test package. 2141 21421 April 2009: Wouter 2143 - suppress errors when trying to contact authority servers that gave 2144 ipv6 AAAA records for their nameservers with ipv4 mapped contents. 2145 Still tries to do so, could work when deployed in intranet. 2146 Higher verbosity shows the error. 2147 - new libunbound calls documented. 2148 - pyunbound in libunbound/python. Removed compile warnings. 2149 Makefile to make it. 2150 215130 March 2009: Wouter 2152 - Fixup LDFLAGS from libevent sourcedir compile configure restore. 2153 - Fixup so no non-absolute rpaths are added. 2154 - Fixup validation of RRSIG queries, they are let through. 2155 - read /dev/random before chroot 2156 - checkconf fix no python checks when no python module enabled. 2157 - fix configure, pthread first, so other libs do not change outcome. 2158 215927 March 2009: Wouter 2160 - nicer -h output. report linked libraries and modules. 2161 - prints modules in intuitive order (config file friendly). 2162 - python compiles easily on BSD. 2163 216426 March 2009: Wouter 2165 - ignore swig varargs warnings with gcc. 2166 - remove duplicate example.conf text from python example configs. 2167 - outofdir compile fix for python. 2168 - pyunbound works. 2169 - print modules compiled in on -h. manpage. 2170 217125 March 2009: Wouter 2172 - initial import of the python contribution from Zdenek Vasicek and 2173 Marek Vavrusa. 2174 - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0. 2175 217624 March 2009: Wouter 2177 - more neat configure.ac. Removed duplicate config.h includes. 2178 - neater config.h.in. 2179 - iana portlist updated. 2180 - fix util/configlexer.c and solaris -std=c99 flag. 2181 - fix postcommit aclocal errors. 2182 - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R. 2183 - swap order of host detect and libtool generation. 2184 218523 March 2009: Wouter 2186 - added launchd plist example file for MacOSX to contrib. 2187 - deprecation test for daemon(3). 2188 - moved common configure actions to m4 include, prettier Makefile. 2189 219020 March 2009: Wouter 2191 - bug #239: module-config entries order is important. Documented. 2192 - build fix for test asynclook. 2193 219419 March 2009: Wouter 2195 - winrc/README.txt dos-format text file. 2196 - iana portlist updated. 2197 - use _beginthreadex() when available (performs stack alignment). 2198 - defaults for windows baked into configure.ac (used if on mingw). 2199 220018 March 2009: Wouter 2201 - Added tests, unknown algorithms become insecure. fallback works. 2202 - Fix for and test for unknown algorithms in a trust anchor 2203 definition. Trust anchors with no supported algos are ignored. 2204 This means a (higher)DS or DLV entry for them could succeed, and 2205 otherwise they are treated as insecure. 2206 - domain-insecure: "example.com" statement added. Sets domain 2207 insecure regardless of chain of trust DSs or DLVs. The inverse 2208 of a trust-anchor. 2209 221017 March 2009: Wouter 2211 - unit test for unsupported algorithm in anchor warning. 2212 - fixed so queries do not fail on opportunistic target queries. 2213 221416 March 2009: Wouter 2215 - fixup diff error printout in contrib/update-itar.sh. 2216 - added contrib/unbound_cacti for statistics support in cacti, 2217 contributed by Dmitriy Demidov. 2218 221913 March 2009: Wouter 2220 - doxygen and lex/yacc on linux. 2221 - strip update-anchor on makedist -w. 2222 - fix testbound on windows. 2223 - default log to syslog for windows. 2224 - uninstaller can stop unbound - changed text on it to reflect that. 2225 - remove debugging from windows 'cron' actions. 2226 222712 March 2009: Wouter 2228 - log to App.logs on windows prints executable identity. 2229 - fixup tests. 2230 - munin plugin fix benign locking error printout. 2231 - anchor-update for windows, called every 24 hours; unbound reloads. 2232 223311 March 2009: Wouter 2234 - winsock event handler resets WSAevents after signalled. 2235 - winsock event handler tests if signals are really signalled. 2236 - install and service with log to file works on XP and Vista on 2237 default install location. 2238 - on windows logging to the Application logbook works (as a service). 2239 - fix RUN_DIR on windows compile setting in makedist. 2240 - windows registry has Software\Unbound\ConfigFile element. 2241 If does not exist, the default is used. The -c switch overrides it. 2242 - fix makedist version cleanup function. 2243 224410 March 2009: Wouter 2245 - makedist -w strips out old rc.. and snapshot info from version. 2246 - setup.exe starts and stops unbound after install, before uninstall. 2247 - unbound-checkconf recognizes absolute pathnames on windows (C:...). 2248 22499 March 2009: Wouter 2250 - Nullsoft NSIS installer creation script. 2251 22525 March 2009: Wouter 2253 - fixup memory leak introduced on 18feb in mesh reentrant fix. 2254 22553 March 2009: Wouter 2256 - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8). 2257 - service works on xp/vista, no config necessary (using defaults). 2258 - windows registry settings. 2259 22602 March 2009: Wouter 2261 - fixup --export-symbols to be -export-symbls for libtool. 2262 This should fix extraneous symbols exported from libunbound. 2263 Thanks to Ondrej Sury and Robert Edmonds for finding it. 2264 - iana portlist updated. 2265 - document FAQ entry on stub/forward zones and default blocking. 2266 - fix asynclook test app for libunbound not exporting symbols. 2267 - service install and remove utils that work with vista UAC. 2268 226927 February 2009: Wouter 2270 - Fixup lexer, to not give warnings about fwrite. Appeared in 2271 new lexer features. 2272 - makedistro functionality for mingw. Has RC support. 2273 - support spaces and backslashes in configured defaults paths. 2274 - register, deregister in service control manager. 2275 227625 February 2009: Wouter 2277 - windres usage for application resources. 2278 227924 February 2009: Wouter 2280 - isc moved their dlv key download location. 2281 - fixup warning on vista/mingw. 2282 - makedist -w for window zip distribution first version. 2283 228420 February 2009: Wouter 2285 - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped. 2286 Nicer script layout. Added url to site in -h output. 2287 228819 February 2009: Wouter 2289 - unbound-checkconf and unbound print warnings when trust anchors 2290 have unsupported algorithms. 2291 - added contrib/update-itar.sh This script is similar to 2292 update-anchor.sh, and updates from the IANA ITAR repository. 2293 You can provide your own PGP key and trust repo, or can use the 2294 builtin. The program uses wget and gpg to work. 2295 - iana portlist updated. 2296 - update-itar.sh: using ftp:// urls because https godaddy certificate 2297 is not available everywhere and then gives fatal errors. The 2298 security is provided by pgp signature. 2299 230018 February 2009: Wouter 2301 - more cycle detection. Also for target queries. 2302 - fixup bug where during deletion of the mesh queries the callbacks 2303 that were reentrant caused assertion failures. Keep the mesh in 2304 a reentrant safe state. Affects libunbound, reload of server, 2305 on quit and flush_requestlist. 2306 - iana portlist updated. 2307 230813 February 2009: Wouter 2309 - forwarder information now per-thread duplicated. 2310 This keeps it read only for speed, with no locking necessary. 2311 - forward command for unbound control to change forwarders to use 2312 on the fly. 2313 - document that unbound-host reads no config file by default. 2314 - updated iana portlist. 2315 231612 February 2009: Wouter 2317 - call setusercontext if available (on BSD). 2318 - small refactor of stats clearing. 2319 - #227: flush_stats feature for unbound-control. 2320 - stats_noreset feature for unbound-control. 2321 - flush_requestlist feature for unbound-control. 2322 - libunbound version upped API (was changed 5 feb). 2323 - unbound-control status shows if root forwarding is in use. 2324 - slightly nicer memory management in iter-fwd code. 2325 232610 February 2009: Wouter 2327 - keys with rfc5011 REVOKE flag are skipped and not considered when 2328 validating data. 2329 - iana portlist updated 2330 - #226: dump_requestlist feature for unbound-control. 2331 23326 February 2009: Wouter 2333 - contrib contains specfile for fedora 1.2.1 (from Paul Wouters). 2334 - iana portlist updated. 2335 - fixup EOL in include directive (reported by Paul Wouters). 2336 You can no longer specify newlines in the names of included files. 2337 - config parser changed. Gives some syntax errors closer to where they 2338 occurred. Does not enforce a space after keyword anymore. 2339 Does not allow literal newlines inside quoted strings anymore. 2340 - verbosity level 5 logs customer IP for new requestlist entries. 2341 - test fix, lexer and cancel test. 2342 - new option log-time-ascii: yes if you enable it prints timestamps 2343 in the log file as Feb 06 13:45:26 (like syslog does). 2344 - detect event_base_new in libevent-1.4.1 and later and use it. 2345 - #231 unbound-checkconf -o option prints that value from config file. 2346 Useful for scripting in management scripts and the like. 2347 23485 February 2009: Wouter 2349 - ldns 1.5.0 rc as tarball included. 2350 - 1.3.0 development continues: 2351 change in libunbound API: ub_cancel can return an error, that 2352 the async_id did not exist, or that it was already delivered. 2353 The result could have been delivered just before the cancel 2354 routine managed to acquire the lock, so a caller may get the 2355 result at the same time they call cancel. For this case, 2356 ub_cancel tries to return an error code. 2357 Fixes race condition in ub_cancel() libunbound function. 2358 - MacOSX Leopard cleaner text output from configure. 2359 - initgroups(3) is called to drop secondary group permissions, if 2360 applicable. 2361 - configure option --with-ldns-builtin forces the use of the 2362 inluded ldns package with the unbound source. The -I include 2363 is put before the others, so it avoids bad include files from 2364 an older ldns install. 2365 - daemon(3) posix call is used when available. 2366 - testbound test for older fix added. 2367 23684 February 2009: Wouter 2369 - tag for release 1.2.1. 2370 - trunk setup for 1.3.0 development. 2371 23723 February 2009: Wouter 2373 - noted feature requests in doc/TODO. 2374 - printout more detailed errors on ssl certificate loading failures. 2375 - updated IANA portlist. 2376 237716 January 2009: Wouter 2378 - more quiet about ipv6 network failures, i.e. when ipv6 is not 2379 available (network unreachable). Debug still printed on high 2380 verbosity. 2381 - unbound-host -4 and -6 options. Stops annoying ipv6 errors when 2382 debugging with unbound-host -4 -d ... 2383 - more cycle detection for NS-check, addr-check, root-prime and 2384 stub-prime queries in the iterator. Avoids possible deadlock 2385 when priming fails. 2386 238715 January 2009: Wouter 2388 - bug #229: fixup configure checks for compilation with Solaris 2389 Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc 2390 - fixup suncc warnings. 2391 - fix bug where unbound could crash using libevent 1.3 and older. 2392 - update testset for recent retry change. 2393 239414 January 2009: Wouter 2395 - 1.2.1 feature: negative caching for failed queries. 2396 Queries that failed are cached for 5 seconds (NORR_TTL). 2397 If the failure is local, like out of memory, it is not cached. 2398 - the TTL comparison for the cache used different comparisons, 2399 causing many cache responses that used the iterator and validator 2400 state machines unnecessarily. 2401 - retry from 4 to 5 so that EDNS drop retry is part of the first 2402 query resolve attempt, and cached error does not stop EDNS fallback. 2403 - remove debug prints that protect against bad referrals. 2404 - honor QUIET=no on make commandline (or QUIET=yes ). 2405 240613 January 2009: Wouter 2407 - fixed bug in lameness marking, removed printouts. 2408 - find NS rrset more cleanly for qtype NS. 2409 - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for 2410 reporting and logs. 2411 - 1.2.1 feature: stops resolving AAAAs promiscuously when they 2412 are in the negative cache. 2413 241412 January 2009: Wouter 2415 - fixed bug in infrastructure lameness cache, did not lowercase 2416 name of zone to hash when setting lame. 2417 - lameness debugging printouts. 2418 24199 January 2009: Wouter 2420 - created svn tag for 1.2.0 release. 2421 - svn trunk contains 1.2.1 version number. 2422 - iana portlist updated for todays list. 2423 - removed debug print. 2424 24258 January 2009: Wouter 2426 - new version of ldns-trunk (today) included as tarball, fixed 2427 bug #224, building with -j race condition. 2428 - remove possible race condition in the test for race conditions. 2429 24307 January 2009: Wouter 2431 - version 1.2.0 in preparation. 2432 - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file 2433 statements. (Adapted from patch by Paul Wouters). 2434 - typo fix and iana portlist updated. 2435 - porting testsuite; unused var warning, and type fixup. 2436 24376 January 2009: Wouter 2438 - fixup packet-of-death when compiled with --enable-debug. 2439 A malformed packet could cause an internal assertion failure. 2440 - added test for HINFO canonicalisation behaviour. 2441 - fixup reported problem with transparent local-zone data where 2442 queries with different type could get nxdomain. Now queries 2443 with a different name get resolved normally, with different type 2444 get a correct NOERROR/NODATA answer. 2445 - HINFO no longer downcased for validation, making unbound compatible 2446 with bind and ldns. 2447 - fix reading included config files when chrooted. 2448 Give full path names for include files. 2449 Relative path names work if the start dir equals the working dir. 2450 - fix libunbound message transport when no packet buffer is available. 2451 24525 January 2009: Wouter 2453 - fixup getaddrinfo failure handling for remote control port. 2454 - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints. 2455 - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/ 2456 - comm_timer_set performs base_set operation after event_add. 2457 245818 December 2008: Wouter 2459 - fixed bug reported by Duane Wessels: error in DLV lookup, would make 2460 some zones that had correct DLV keys as insecure. 2461 - follows -rc makedist from ldns changes (no _rc). 2462 - ldns tarball updated with 1.4.1rc for DLV unit test. 2463 - verbose prints about recursion lame detection and server selection. 2464 - fixup BSD port for infra host storage. It hashed wrongly. 2465 - fixup makedist snapshot name generation. 2466 - do not reopen syslog to avoid dev/log dependency. 2467 246817 December 2008: Wouter 2469 - follows ldns makedist.sh. -rc option. autom4te dir removed. 2470 - unbound-control status command. 2471 - extended statistics has a number of ipv6 queries counter. 2472 contrib/unbound_munin_ was updated to draw ipv6 in the hits graph. 2473 247416 December 2008: Wouter 2475 - follow makedist improvements from ldns, for maintainers prereleases. 2476 - snapshot version uses _ not - to help rpm distinguish the 2477 version number. 2478 247911 December 2008: Wouter 2480 - better fix for bug #219: use LOG_NDELAY with openlog() call. 2481 Thanks to Tamas Tevesz. 2482 24839 December 2008: Wouter 2484 - bug #221 fixed: unbound checkconf checks if key files exist if 2485 remote control is enabled. Also fixed NULL printf when not chrooted. 2486 - iana portlist updated. 2487 24883 December 2008: Wouter 2489 - Fix problem reported by Jaco Engelbrecht where unbound-control stats 2490 freezes up unbound if this was compiled without threading, and 2491 was using multiple processes. 2492 - iana portlist updated. 2493 - test for remote control with interprocess communication. 2494 - created command distribution mechanism so that remote control 2495 commands other than 'stats' work on all processes in a nonthreaded 2496 compiled version. dump/load cache work, on the first process. 2497 - fixup remote control local_data addition memory corruption bug. 2498 24991 December 2008: Wouter 2500 - SElinux policy files in contrib/selinux for the unbound daemon, 2501 by Paul Wouters and Adam Tkac. 2502 250325 November 2008: Wouter 2504 - configure complains when --without-ssl is given (bug #220). 2505 - skip unsupported feature tests on vista/mingw. 2506 - fixup testcode/streamtcp to work on vista/mingw. 2507 - root-hints test checks version of dig required. 2508 - blacklisted servers are polled at a low rate (1%) to see if they 2509 come back up. But not if there is some other working server. 2510 251124 November 2008: Wouter 2512 - document that the user of the server daemon needs read privileges 2513 on the keys and certificates generated by unbound-control-setup. 2514 This is different per system or distribution, usually, running the 2515 script under the same username as the server uses suffices. 2516 i.e. sudo -u unbound unbound-control-setup 2517 - testset port to vista/mingw. 2518 - tcp_sigpipe to freebsd port. 2519 252021 November 2008: Wouter 2521 - fixed tcp accept, errors were printed when they should not. 2522 - unbound-control-setup.sh removes read/write permissions other 2523 from the keys it creates (as suggested by Dmitriy Demidov). 2524 252520 November 2008: Wouter 2526 - fixup fatal error due to faulty error checking after tcp accept. 2527 - add check in rlimit to avoid integer underflow. 2528 - rlimit check with new formula; better estimate for number interfaces 2529 - nicer comments in rlimit check. 2530 - tag 1.1.1 created in svn. 2531 - trunk label is 1.1.2 2532 253319 November 2008: Wouter 2534 - bug #219: fixed so that syslog which delays opening until the first 2535 log line is written, gets a log line while not chroot'ed yet. 2536 253718 November 2008: Wouter 2538 - iana portlist updated. 2539 - removed cast in unit test debug print that was not 64bit safe. 2540 - trunk back to 1.1.0; copied to tags 1.1.0 release. 2541 - trunk to has version number 1.1.1 again. 2542 - in 1.1.1; make clean nicer. grammar in manpage. 2543 254417 November 2008: Wouter 2545 - theoretical fix for problems reported on mailing list. 2546 If a delegation point has no A but only AAAA and do-ip6 is no, 2547 resolution would fail. Fixed to ask for the A and AAAA records. 2548 It has to ask for both always, so that it can fail quietly, from 2549 TLD perspective, when a zone is only reachable on one transport. 2550 - test for above, only AAAA and doip6 is no. Fix causes A record 2551 for nameserver to be fetched. 2552 - fixup address duplication on cache fillup for delegation points. 2553 - testset updated for new query answer requirements. 2554 255514 November 2008: Wouter 2556 - created 1.1.0 release tag in svn. 2557 - trunk moved to 1.1.1 2558 - fixup unittest-neg for locking. 2559 256013 November 2008: Wouter 2561 - added fedora init and specfile to contrib (by Paul Wouters). 2562 - added configure check for ldns 1.4.0 (using its compat funcs). 2563 - neater comments in worker.h. 2564 - removed doc/plan and updated doc/TODO. 2565 - silenced EHOSTDOWN (verbosity 2 or higher to see it). 2566 - review comments from Jelte, Matthijs. Neater code. 2567 256812 November 2008: Wouter 2569 - add unbound-control manpage to makedist replace list. 2570 257111 November 2008: Wouter 2572 - unit test for negative cache, stress tests the refcounting. 2573 - fix for refcounting error that could cause fptr_wlist fatal exit 2574 in the negative cache rbtree (upcoming 1.1 feature). (Thanks to 2575 Attila Nagy for testing). 2576 - nicer comments in cachedump about failed RR to string conversion. 2577 - fix 32bit wrap around when printing large (4G and more) mem usage 2578 for extended statistics. 2579 258010 November 2008: Wouter 2581 - fixup the getaddrinfo compat code rename. 2582 25838 November 2008: Wouter 2584 - added configure check for eee build warning. 2585 25867 November 2008: Wouter 2587 - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4. 2588 - detect nonblocking problems in network stack in configure script. 2589 25906 November 2008: Wouter 2591 - dname_priv must decompress the name before comparison. 2592 - iana portlist updated. 2593 25945 November 2008: Wouter 2595 - fixed possible memory leak in key_entry_key deletion. 2596 Would leak a couple bytes when trust anchors were replaced. 2597 - if query and reply qname overlap, the bytes are skipped not copied. 2598 - fixed file descriptor leak when messages were jostled out that 2599 had outstanding (TCP) replies. 2600 - DNAMEs used from cache have their synthesized CNAMEs initialized 2601 properly. 2602 - fixed file descriptor leak for localzone type deny (for TCP). 2603 - fixed memleak at exit for nsec3 negative cached zones. 2604 - fixed memleak for the keyword 'nodefault' when reading config. 2605 - made verbosity of 'edns incapable peer' warning higher, so you 2606 do not get spammed by it. 2607 - caught elusive Bad file descriptor error bug, that would print the 2608 error while unnecessarily try to listen to a closed fd. Fixed. 2609 26104 November 2008: Wouter 2611 - fixed -Wwrite-strings warnings that result in better code. 2612 26133 November 2008: Wouter 2614 - fixup build process for Mac OSX linker, use ldns b32 compat funcs. 2615 - generated configure with autoconf-2.61. 2616 - iana portlist updated. 2617 - detect if libssl needs libdl. For static linking with libssl. 2618 - changed to use new algorithm identifiers for sha256/sha512 2619 from ldns 1.4.0 (need very latest version). 2620 - updated the included ldns tarball. 2621 - proper detection of SHA256 and SHA512 functions (not just sizes). 2622 262323 October 2008: Wouter 2624 - a little more debug info for failure on signer names. prints names. 2625 262622 October 2008: Wouter 2627 - CFLAGS are picked up by configure from the environment. 2628 - iana portlist updated. 2629 - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too. 2630 - new stub-prime: yesno option. Default is off, so it does not prime. 2631 can be turned on to get same behaviour as previous unbound release. 2632 - made automated test that checks if builtin root hints are uptodate. 2633 - finished draft-wijngaards-dnsext-resolver-side-mitigation 2634 implementation. The unwanted-reply-threshold can be set. 2635 - fixup so fptr_whitelist test in alloc.c works. 2636 263721 October 2008: Wouter 2638 - fix update-anchors.sh, so it does not report different RR order 2639 as an update. Sorts the keys in the file. Updated copyright. 2640 - fixup testbound on windows, the command control pipe doesn't exist. 2641 - skip 08hostlib test on windows, no fork() available. 2642 - made unbound-remote work on windows. 2643 264420 October 2008: Wouter 2645 - quench a log message that is debug only. 2646 - iana portlist updated. 2647 - do not query bogus nameservers. It is like nameservers that have 2648 the NS or A or AAAA record bogus are listed as donotquery. 2649 - if server selection is faced with only bad choices, it will 2650 attempt to get more options to be fetched. 2651 - changed bogus-ttl default value from 900 to 60 seconds. 2652 In anticipation that operator caused failures are more likely than 2653 actual attacks at this time. And thus repeated validation helps 2654 the operators get the problem fixed sooner. It makes validation 2655 failures go away sooner (60 seconds after the zone is fixed). 2656 Also it is likely to try different nameserver targets every minute, 2657 so that if a zone is bad on one server but not another, it is 2658 likely to pick up the 'correct' one after a couple minutes, 2659 and if the TTL is big enough that solves validation for the zone. 2660 - fixup unbound-control compilation on windows. 2661 266217 October 2008: Wouter 2663 - port Leopard/G5: fixup type conversion size_t/uint32. 2664 please ranlib, stop file without symbols warning. 2665 - harden referral path now also validates the root after priming. 2666 It looks up the root NS authoritatively as well as the root servers 2667 and attemps to validate the entries. 2668 266916 October 2008: Wouter 2670 - Fixup negative TTL values appearing (reported by Attila Nagy). 2671 267215 October 2008: Wouter 2673 - better documentation for 0x20; remove fallback TODO, it is done. 2674 - harden-referral-path feature includes A, AAAA queries for glue, 2675 as well as very careful NS caching (only when doing NS query). 2676 A, AAAA use the delegation from the NS-query. 2677 267814 October 2008: Wouter 2679 - fwd_three.tpkg test was flaky. If the three requests hit the 2680 wrong threads by chance (or bad OS) then the test would fail. 2681 Made less flaky by increasing number of retries. 2682 - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs. 2683 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014). 2684 Which includes the ldns_dname_absolute fix. 2685 - fwd_three test remains flaky now that unbound does not stop 2686 listening when full. Thus, removed timeout problem. 2687 It may be serviced by three threads, or maybe by one. 2688 Mostly only useful for lock-check testing now. 2689 269013 October 2008: Wouter 2691 - fixed recursion servers deployed as authoritative detection, so 2692 that as a last resort, a +RD query is sent there to get the 2693 correct answer. 2694 - iana port list update. 2695 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013). 2696 269710 October 2008: Wouter 2698 - fixup tests - the negative cache contained the correct NSEC3s for 2699 two tests that are supposed to fail to validate. 2700 27019 October 2008: Wouter 2702 - negative cache caps max iterations of NSEC3 done. 2703 - NSEC3 negative cache for qtype DS works. 2704 27058 October 2008: Wouter 2706 - NSEC negative cache for DS. 2707 27086 October 2008: Wouter 2709 - jostle-timeout option, so you can config for slow links. 2710 - 0x20 fallback code. Tries 3xnumber of nameserver addresses 2711 queries that must all be the same. Sent to random nameservers. 2712 - documented choices for DoS, EDNS, 0x20. 2713 27142 October 2008: Wouter 2715 - fixup unlink of pidfile. 2716 - fixup SHA256 algorithm collation code. 2717 - contrib/update-anchor.sh does not overwrite anchors if not needed. 2718 exits 0 when a restart is needed, other values if not. 2719 so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart 2720 can restart unbound exactly when needed. 2721 272230 September 2008: Wouter 2723 - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1. 2724 - tests for sha256 support and downgrade resistance. 2725 - RSASHA256 and RSASHA512 support (using the draft in dnsext), 2726 using the drafted protocol numbers. 2727 - when using stub on localhost (127.0.0.1@10053) unbound works. 2728 Like when running NSD to host a local zone, on the same machine. 2729 The noprime feature. manpages more explanation. Added a test for it. 2730 - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com" 2731 273229 September 2008: Wouter 2733 - EDNS lameness detection, if EDNS packets are dropped this is 2734 detected, eventually. 2735 - multiple query timeout rtt backoff does not backoff too much. 2736 273726 September 2008: Wouter 2738 - tests for remote-control. 2739 - small memory leak in exception during remote control fixed. 2740 - fixup for lock checking but not unchecking in remote control. 2741 - iana portlist updated. 2742 274323 September 2008: Wouter 2744 - Msg cache is loaded. A cache load enables cache responses. 2745 - unbound-control flush [name], flush_type and flush_zone. 2746 274722 September 2008: Wouter 2748 - dump_cache and load_cache statements in unbound-control. 2749 RRsets are dumped and loaded correctly. 2750 Msg cache is dumped. 2751 275219 September 2008: Wouter 2753 - locking on the localdata structure. 2754 - add and remove local zone and data with unbound-control. 2755 - ldns trunk snapshot updated, make tests work again. 2756 275718 September 2008: Wouter 2758 - fixup error in time calculation. 2759 - munin plugin improvements. 2760 - nicer abbreviations for high query types values (ixfr, axfr, any...) 2761 - documented the statistics output in unbound-control man page. 2762 - extended statistics prints out histogram, over unbound-control. 2763 276417 September 2008: Wouter 2765 - locking for threadsafe bogus rrset counter. 2766 - ldns trunk no longer exports b32 functions, provide compat. 2767 - ldns tarball updated. 2768 - testcode/ldns-testpkts.c const fixups. 2769 - fixed rcode stat printout. 2770 - munin plugin in contrib. 2771 - stats always printout uptime, because stats plugins need it. 2772 277316 September 2008: Wouter 2774 - extended-statistics: yesno config option. 2775 - unwanted replies spoof nearmiss detector. 2776 - iana portlist updated. 2777 277815 September 2008: Wouter 2779 - working start, stop, reload commands for unbound-control. 2780 - test for unbound-control working; better exit value for control. 2781 - verbosity control via unbound-control. 2782 - unbound-control stats. 2783 278412 September 2008: Wouter 2785 - removed browser control mentions. Proto speccy. 2786 278711 September 2008: Wouter 2788 - set nonblocking on new TCP streams, because linux does not inherit 2789 the socket options to the accepted socket. 2790 - fix TCP timeouts. 2791 - SSL protected connection between server and unbound-control. 2792 279310 September 2008: Wouter 2794 - remove memleak in privacy addresses on reloads and quits. 2795 - remote control work. 2796 27979 September 2008: Wouter 2798 - smallapp/unbound-control-setup.sh script to set up certificates. 2799 28004 September 2008: Wouter 2801 - scrubber scrubs away private addresses. 2802 - test for private addresses. man page entry. 2803 - code refactored for name and address tree lookups. 2804 28053 September 2008: Wouter 2806 - options for 'DNS Rebinding' protection: private-address and 2807 private-domain. 2808 - dnstree for reuse of routines that help with domain, addr lookups. 2809 - private-address and private-domain config option read, stored. 2810 28112 September 2008: Wouter 2812 - DoS protection features. Queries are jostled out to make room. 2813 - testbound can pass time, increasing the internal timer. 2814 - do not mark unsigned additionals bogus, leave unchecked, which 2815 is removed too. 2816 28171 September 2008: Wouter 2818 - disallow nonrecursive queries for cache snooping by default. 2819 You can allow is using access-control: <subnet> allow_snoop. 2820 The defaults do allow access no authoritative data without RD bit. 2821 - two tests for it and fixups of tests for nonrec refused. 2822 282329 August 2008: Wouter 2824 - version 1.1 number in trunk. 2825 - harden-referral-path option for query for NS records. 2826 Default turns off expensive, experimental option. 2827 282828 August 2008: Wouter 2829 - fixup logfile handling; it is created with correct permissions 2830 again. (from bugfix#199). 2831 Some errors are not written to logfile (pidfile writing, forking), 2832 and these are only visible by using the -d commandline flag. 2833 283427 August 2008: Wouter 2835 - daemon(3) is causing problems for people. Reverting the patch. 2836 bug#200, and 199 and 203 contain sideline discussion on it. 2837 - bug#199 fixed: pidfile can be outside chroot. openlog is done before 2838 chroot and drop permissions. 2839 - config option to set size of aggressive negative cache, 2840 neg-cache-size. 2841 - bug#203 fixed: dlv has been implemented. 2842 284326 August 2008: Wouter 2844 - test for insecure zone when DLV is in use, also does negative cache. 2845 - test for trustanchor when DLV is in use (the anchor works). 2846 - test for DLV used for a zone below a trustanchor. 2847 - added scrub filter for overreaching NSEC records and unit test. 2848 - iana portlist update 2849 - use of setresuid or setreuid when available. 2850 - use daemon(3) if available. 2851 285225 August 2008: Wouter 2853 - realclean patch from Robert Edmonds. 2854 285522 August 2008: Wouter 2856 - nicer debuglogging of DLV. 2857 - test with secure delegation inside the DLV repository. 2858 285921 August 2008: Wouter 2860 - negative cache code linked into validator, for DLV use. 2861 negative cache works for DLV. 2862 - iana portlist update. 2863 - dlv-anchor option for unit tests. 2864 - fixup NSEC_AT_APEX classification for short typemaps. 2865 - ldns-testns has subdomain checks, for unit tests. 2866 286720 August 2008: Wouter 2868 - negative cache code, reviewed. 2869 287018 August 2008: Wouter 2871 - changes info: in logfile to notice: info: or debug: depending on 2872 the verbosity of the statements. Better logfile message 2873 classification. 2874 - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd. 2875 287615 August 2008: Wouter 2877 - DLV nsec code fixed for better detection of closest existing 2878 enclosers from NSEC responses. 2879 - DLV works, straight to the dlv repository, so not for production. 2880 - Iana port update. 2881 288214 August 2008: Wouter 2883 - synthesize DLV messages from the rrset cache, like done for DS. 2884 288513 August 2008: Wouter 2886 - bug #203: nicer do-auto log message when user sets incompatible 2887 options. 2888 - bug #204: variable name ameliorated in log.c. 2889 - bug #206: in iana_update, no egrep, but awk use. 2890 - ldns snapshot r2699 taken (includes DLV type). 2891 - DLV work, config file element, trust anchor read in. 2892 289312 August 2008: Wouter 2894 - finished adjusting testset to provide qtype NS answers. 2895 289611 August 2008: Wouter 2897 - Fixup rrset security updates overwriting 2181 trust status. 2898 This makes validated to be insecure data just as worthless as 2899 nonvalidated data, and 2181 rules prevent cache overwrites to them. 2900 - Fix assertion fail on bogus key handling. 2901 - dnssec lameness detection works on first query at trust apex. 2902 - NS queries get proper cache and dnssec lameness treatment. 2903 - fixup compilation without pthreads on linux. 2904 29058 August 2008: Wouter 2906 - NS queries are done after every referral. 2907 validator is used on those NS records (if anchors enabled). 2908 29097 August 2008: Wouter 2910 - Scrubber more strict. CNAME chains, DNAMEs from cache, other 2911 irrelevant rrsets removed. 2912 - 1.0.2 released from 1.0 support branch. 2913 - fixup update-anchor.sh to work both in BSD shell and bash. 2914 29155 August 2008: Wouter 2916 - fixup DS test so apex nodata works again. 2917 29184 August 2008: Wouter 2919 - iana port update. 2920 - TODO update. 2921 - fix bug 201: null ptr deref on cleanup while udp pkts wait for port. 2922 - added explanatory text for outgoing-port-permit in manpage. 2923 292430 July 2008: Wouter 2925 - fixup bug qtype DS for unsigned zone and signed parent validation. 2926 292725 July 2008: Wouter 2928 - added original copyright statement of OpenBSD arc4random code. 2929 - created tube signaling solution on windows, as a pipe replacement. 2930 this makes background asynchronous resolution work on windows. 2931 - removed very insecure socketpair compat code. It also did not 2932 work with event_waiting. Solved by pipe replacement. 2933 - unbound -h prints openssl version number as well. 2934 293522 July 2008: Wouter 2936 - moved pipe actions to util/tube.c. easier porting and shared code. 2937 - check _raw() commpoint callbacks with fptr_wlist. 2938 - iana port update. 2939 294021 July 2008: Wouter 2941 - #198: nicer entropy warning message. manpage OS hints. 2942 294319 July 2008: Wouter 2944 - #198: fixup man page to suggest chroot entropy fix. 2945 294618 July 2008: Wouter 2947 - branch for 1.0 support. 2948 - trunk work on tube.c. 2949 295017 July 2008: Wouter 2951 - fix bug #196, compile outside source tree. 2952 - fix bug #195, add --with-username=user configure option. 2953 - print error and exit if started with config that requires more 2954 fds than the builtin minievent can handle. 2955 295616 July 2008: Wouter 2957 - made svn tag 1.0.1, trunk now 1.0.2 2958 - sha256 checksums enabled in makedist.sh 2959 296015 July 2008: Wouter 2961 - Follow draft-ietf-dnsop-default-local-zones-06 added reverse 2962 IPv6 example prefix to AS112 default blocklist. 2963 - fixup lookup of DS records by client with trustanchor for same. 2964 - libunbound ub_resolve, fix handling of error condition during setup. 2965 - lowered log_hex blocksize to fit through BSD syslog linesize. 2966 - no useless initialisation if getpwnam not available. 2967 - iana, ldns snapshot updated. 2968 29693 July 2008: Wouter 2970 - Matthijs fixed memory leaks in root hints file reading. 2971 297226 June 2008: Wouter 2973 - fixup streamtcp bounds setting for udp mode, in the test framework. 2974 - contrib item for updating trust anchors. 2975 297625 June 2008: Wouter 2977 - fixup fwd_ancil test typos. 2978 - Fix for newegg lameness : ok for qtype=A, but lame for others. 2979 - fixup unit test for infra cache, test lame merging. 2980 - porting to mingw, bind, listen, getsockopt and setsockopt error 2981 handling. 2982 298324 June 2008: Wouter 2984 - removed testcode/checklocks from production code compilation path. 2985 - streamtcp can use UDP mode (connected UDP socket), for testing IPv6 2986 on windows. 2987 - fwd_ancil test fails if platform support is lacking. 2988 298923 June 2008: Wouter 2990 - fixup minitpkg to cleanup on windows with its file locking troubles. 2991 - minitpkg shows skipped tests in report. 2992 - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not 2993 ipv6 connectivity). 2994 - winsock event handler keeps track of sticky TCP events, that have 2995 not been fully handled yet. when interest in the event(s) resumes, 2996 they are sent again. When WOULDBLOCK is returned events are cleared. 2997 - skip tests that need signals when testing on mingw. 2998 299918 June 2008: Wouter 3000 - open testbound replay files in binary mode, because fseek/ftell 3001 do not work in ascii-mode on windows. The b does nothing on unix. 3002 unittest and testbound tests work on windows (xp too). 3003 - ioctlsocket prints nicer error message. 3004 - fixed up some TCP porting for winsock. 3005 - lack of IPv6 gives a warning, no fatal error. 3006 - use WSAGetLastError() on windows instead of errno for some errors. 3007 300817 June 2008: Wouter 3009 - outgoing num fds 32 by default on windows ; it supports less 3010 fds for waiting on than unixes. 3011 - winsock_event minievent handler for windows. (you could also 3012 attempt to link with libevent/libev ports for windows). 3013 - neater crypto check and gdi32 detection. 3014 - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista. 3015 301616 June 2008: Wouter 3017 - on windows, use windows threads, mutex and thread-local-storage(Tls). 3018 - detect if openssl needs gdi32. 3019 - if no threading, THREADS_DISABLED is defined for use in the code. 3020 - sets USE_WINSOCK if using ws2_32 on windows. 3021 - wsa_strerror() function for more readable errors. 3022 - WSA Startup and Cleanup called in unbound.exe. 3023 302413 June 2008: Wouter 3025 - port mingw32, more signal ifdefs, detect sleep, usleep, 3026 random, srandom (used inside the tests). 3027 - signed or unsigned FD_SET is cast. 3028 302910 June 2008: Wouter 3030 - fixup warnings compiling on eeepc xandros linux. 3031 30329 June 2008: Wouter 3033 - in iteration response type code 3034 * first check for SOA record (negative answer) before NS record 3035 and lameness. 3036 * check if no AA bit for non-forwarder, and thus lame zone. 3037 In response to error report by Richard Doty for mail.opusnet.com. 3038 - fixup unput warning from lexer on freeBSD. 3039 - bug#183. pidfile, rundir, and chroot configure options. Also the 3040 example.conf and manual pages get the configured defaults. 3041 You can use: (or accept the defaults to /usr/local/etc/unbound/) 3042 --with-conf-file=filename 3043 --with-pidfile=filename 3044 --with-run-dir=path 3045 --with-chroot-dir=path 3046 30478 June 2008: Wouter 3048 - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug. 3049 Reported by Robert Edmonds. 3050 - iana port updated. 3051 30524 June 2008: Wouter 3053 - updated libtool files with newer version. 3054 - iana portlist updated. 3055 30563 June 2008: Wouter 3057 - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the 3058 trailing dot is not used during comparison. 3059 30602 June 2008: Wouter 3061 - Jelte fixed bugs in my absence 3062 - bug 178: fixed unportable shell usage in configure (relied on 3063 bash shell). 3064 - bug 180: fixed buffer overflow in unbound-checkconf use of strncat. 3065 - bug 181: fixed buffer overflow in ldns (called by unbound to parse 3066 config file parts). 3067 - fixes by Wouter 3068 - bug 177: fixed compilation failure on opensuse, the 3069 --disable-static configure flag caused problems. (Patch from 3070 Klaus Singvogel) 3071 - bug 179: same fix as 177. 3072 - bug 185: --disable-shared not passed along to ldns included with 3073 unbound. Fixed so that configure parameters are passed to the 3074 subdir configure script. 3075 fixed that ./libtool is used always, you can still override 3076 manually with ./configure libtool=mylibtool or set $libtool in 3077 the environment. 3078 - update of the ldns tarball to current ldns svn version (fix 181). 3079 - bug 184: -r option for unbound-host, read resolv.conf for 3080 forwarder. (Note that forwarder must support DNSSEC for validation 3081 to succeed). 3082 308323 May 2008: Wouter 3084 - mingw32 porting. 3085 - test for sys/wait.h 3086 - WSAEWOULDBLOCK test after nonblocking TCP connect. 3087 - write_iov_buffer removed: unused and no struct iov on windows. 3088 - signed/unsigned warning fixup mini_event. 3089 - use ioctlsocket to set nonblocking I/O if fnctl is unavailable. 3090 - skip signals that are not defined 3091 - detect pwd.h. 3092 - detect getpwnam, getrlimit, setsid, sbrk, chroot. 3093 - default config has no chroot if chroot() unavailable. 3094 - if no kill() then no pidfile is read or written. 3095 - gmtime_r is replaced by nonthreadsafe alternative if unavail. 3096 used in rrsig time validation errors. 3097 309822 May 2008: Wouter 3099 - contrib unbound.spec from Patrick Vande Walle. 3100 - fixup bug#175: call tzset before chroot to have correct timestamps 3101 in system log. 3102 - do not generate lex input and lex unput functions. 3103 - mingw port. replacement functions labelled _unbound. 3104 - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed. 3105 310619 May 2008: Wouter 3107 - fedora 9, check in6_pktinfo define in configure. 3108 - CREDITS fixup of history. 3109 - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative. 3110 311116 May 2008: Wouter 3112 - fixup for MacOSX hosts file reading (reported by John Dickinson). 3113 - created 1.0.0 svn tag. 3114 - trunk version 1.0.1. 3115 311614 May 2008: Wouter 3117 - accepted patch from Ondrej Sury for library version libtool option. 3118 - configure --disable-rpath fixes up libtool for rpath trouble. 3119 Adapted from debian package patch file. 3120 312113 May 2008: Wouter 3122 - Added root ipv6 addresses to builtin root hints. 3123 - TODO modified for post 1.0 plans. 3124 - trunk version set to 1.0.0. 3125 - no unnecessary linking with librt (only when libevent/libev used). 3126 31277 May 2008: Wouter 3128 - fixup no-ip4 problem with error callback in outside network. 3129 313025 April 2008: Wouter 3131 - DESTDIR is honored by the Makefile for rpms. 3132 - contrib files unbound.spec and unbound.init, builds working RPM 3133 on FC7 Linux, a chrooted caching resolver, and libunbound. 3134 - iana ports update. 3135 313624 April 2008: Wouter 3137 - chroot checks improved. working directory relative to chroot. 3138 checks if config file path is inside chroot. Documentation on it. 3139 - nicer example.conf text. 3140 - created 0.11 tag. 3141 314223 April 2008: Wouter 3143 - parseunbound.pl contrib update from Kai Storbeck for threads. 3144 - iana ports update 3145 314622 April 2008: Wouter 3147 - ignore SIGPIPE. 3148 - unit test for SIGPIPE ignore. 3149 315021 April 2008: Wouter 3151 - FEATURES document. 3152 - fixup reread of config file if it was given as a full path 3153 and chroot was used. 3154 315516 April 2008: Wouter 3156 - requirements doc, updated clean query returns. 3157 - parseunbound.pl update from Kai Storbeck. 3158 - sunos4 porting changes. 3159 316015 April 2008: Wouter 3161 - fixup default rc.d pidfile location to /usr/local/etc. 3162 - iana ports updated. 3163 - copyright updated in ldns-testpkts to keep same as in ldns. 3164 - fixup checkconf chroot tests a bit more, chdir must be inside 3165 chroot dir. 3166 - documented 'gcc: unrecognized -KPIC option' errors on Solaris. 3167 - example.conf values changed to /usr/local/etc/unbound 3168 - DSA test work. 3169 - DSA signatures: unbound is compatible with both encodings found. 3170 It will detect and convert when necessary. 3171 317214 April 2008: Wouter 3173 - got update for parseunbound.pl statistics script from Kai Storbeck. 3174 - tpkg tests for udp wait list. 3175 - documented 0x20 status. 3176 - fixup chroot and checkconf, it is much smarter now. 3177 - fixup DSA EVP signature decoding. Solution that Jelte found copied. 3178 - and check first sig byte for the encoding type. 3179 318011 April 2008: Wouter 3181 - random port selection out of the configged ports. 3182 - fixup threadsafety for libevent-1.4.3+ (event_base_get_method). 3183 - removed base_port. 3184 - created 256-port ephemeral space for the OS, 59802 available. 3185 - fixup consistency of port_if out array during heavy use. 3186 318710 April 2008: Wouter 3188 - --with-libevent works with latest libevent 1.4.99-trunk. 3189 - added log file statistics perl script to contrib. 3190 - automatic iana ports update from makefile. 60058 available. 3191 31929 April 2008: Wouter 3193 - configure can detect libev(from its build directory) when passed 3194 --with-libevent=/home/wouter/libev-3.2 3195 libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%). 3196 - unused commpoints not listed in epoll list. 3197 - statistics-cumulative option so that the values are not reset. 3198 - config creates array of available ports, 61841 available, 3199 it excludes <1024 and iana assigned numbers. 3200 config statements to modify the available port numbers. 3201 32028 April 2008: Wouter 3203 - unbound tries to set the ulimit fds when started as server. 3204 if that does not work, it will scale back its requirements. 3205 320627 March 2008: Wouter 3207 - documented /dev/random symlink from chrootdir as FAQ entry. 3208 320926 March 2008: Wouter 3210 - implemented AD bit signaling. If a query sets AD bit (but not DO) 3211 then the AD bit is set in the reply if the answer validated. 3212 Without including DNSSEC signatures. Useful if you have a trusted 3213 path from the client to the resolver. Follows dnssec-updates draft. 3214 321525 March 2008: Wouter 3216 - implemented check that for NXDOMAIN and NOERROR answers a query 3217 section must be present in the reply (by the scrubber). And it must 3218 be equal to the question sent, at least lowercase folded. 3219 Previously this feature happened because the cache code refused 3220 to store such messages. However blocking by the scrubber makes 3221 sure nothing gets into the RRset cache. Also, this looks like a 3222 timeout (instead of an allocation failure) and this retries are 3223 done (which is useful in a spoofing situation). 3224 - RTT banding. Band size 400 msec, this makes band around zero (fast) 3225 include unknown servers. This makes unbound explore unknown servers. 3226 32277 March 2008: Wouter 3228 - -C config feature for harvest program. 3229 - harvest handles CNAMEs too. 3230 32315 March 2008: Wouter 3232 - patch from Hugo Koji Kobayashi for iterator logs spelling. 3233 32344 March 2008: Wouter 3235 - From report by Jinmei Tatuya, rfc2181 trust value for remainder 3236 of a cname trust chain is lower; not full answer_AA. 3237 - test for this fix. 3238 - default config file location is /usr/local/etc/unbound. 3239 Thus prefix is used to determine the location. This is also the 3240 chroot and pidfile default location. 3241 32423 March 2008: Wouter 3243 - Create 0.10 svn tag. 3244 - 0.11 version in trunk. 3245 - indentation nicer. 3246 324729 February 2008: Wouter 3248 - documentation update. 3249 - fixup port to Solaris of perf test tool. 3250 - updated ldns-tarball with decl-after-statement fixes. 3251 325228 February 2008: Wouter 3253 - fixed memory leaks in libunbound (during cancellation and wait). 3254 - libunbound returns the answer packet in full. 3255 - snprintf compat update. 3256 - harvest performs lookup. 3257 - ldns-tarball update with fix for ldns_dname_label. 3258 - installs to sbin by default. 3259 - install all manual pages (unbound-host and libunbound too). 3260 326127 February 2008: Wouter 3262 - option to use caps for id randomness. 3263 - config file option use-caps-for-id: yes 3264 - harvest debug tool 3265 326626 February 2008: Wouter 3267 - delay utility delays TCP as well. If the server that is forwarded 3268 to has a TCP error, the delay utility closes the connection. 3269 - delay does REUSE_ADDR, and can handle a server that closes its end. 3270 - answers use casing from query. 3271 327225 February 2008: Wouter 3273 - delay utility works. Gets decent thoughput too (>20000). 3274 327522 February 2008: Wouter 3276 - +2% for recursions, if identical queries (except for destination 3277 and query ID) in the reply list, avoid re-encoding the answer. 3278 - removed TODO items for optimizations that do not show up in 3279 profile reports. 3280 - default is now minievent - not libevent. As its faster and 3281 not needed for regular installs, only for very large port ranges. 3282 - loop check different speedup pkt-dname-reading, 1% faster for 3283 nocache-recursion check. 3284 - less hashing during msg parse, 4% for recursion. 3285 - small speed fix for dname_count_size_labels, +1 or +2% recursion. 3286 - some speed results noted: 3287 optimization resulted in +40% for recursion (cache miss) and 3288 +70 to +80 for cache hits, and +96% for version.bind. 3289 zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4 3290 www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3 3291 www with DO bit set : BIND 8269.31 Ub 28735.6 qps. 3292 So, unbound can be about equal qps to NSD in cache hits. 3293 And about 3.4x faster than BIND in cache performance. 3294 - delay utility for testing. 3295 329621 February 2008: Wouter 3297 - speedup of root-delegation message encoding by 15%. 3298 - minor speedup of compress tree_lookup, maybe 1%. 3299 - speedup of dname_lab_cmp and memlowercmp - the top functions in 3300 profiler output, maybe a couple percent when it matters. 3301 330220 February 2008: Wouter 3303 - setup speec_cache for need-ldns-testns in dotests. 3304 - check number of queued replies on incoming queries to avoid overload 3305 on that account. 3306 - fptr whitelist checks are not disabled in optimize mode. 3307 - do-daemonize config file option. 3308 - minievent time share initializes time at start. 3309 - updated testdata for nsec3 new algorithm numbers (6, 7). 3310 - small performance test of packet encoding (root delegation). 3311 331219 February 2008: Wouter 3313 - applied patch to unbound-host man page from Jan-Piet Mens. 3314 - fix donotquery-localhost: yes default (it erroneously was switched 3315 to default 'no'). 3316 - time is only gotten once and the value is shared across unbound. 3317 - unittest cleans up crypto, so that it has no memory leaks. 3318 - mini_event shares the time value with unbound this results in 3319 +3% speed for cache responses and +9% for recursions. 3320 - ldns tarball update with new NSEC3 sign code numbers. 3321 - perform several reads per UDP operation. This improves performance 3322 in DoS conditions, and costs very little in normal conditions. 3323 improves cache response +50%, and recursions +10%. 3324 - modified asynclook test. because the callback from async is not 3325 in any sort of lock (and thus can use all library functions freely), 3326 this causes a tiny race condition window when the last lock is 3327 released for a callback and a new cancel() for that callback. 3328 The only way to remove this is by putting callbacks into some 3329 lock window. I'd rather have the small possibility of a callback 3330 for a cancelled function then no use of library functions in 3331 callbacks. Could be possible to only outlaw process(), wait(), 3332 cancel() from callbacks, by adding another lock, but I'd rather not. 3333 333418 February 2008: Wouter 3335 - patch to unbound-host from Jan-Piet Mens. 3336 - unbound host prints errors if fails to configure context. 3337 - fixup perf to resend faster, so that long waiting requests do 3338 not hold up the queue, they become lost packets or SERVFAILs, 3339 or can be sent a little while later (i.e. processing time may 3340 take long, but throughput has to be high). 3341 - fixup iterator operating in no cache conditions (RD flag unset 3342 after a CNAME). 3343 - streamlined code for RD flag setting. 3344 - profiled code and changed dname compares to be faster. 3345 The speedup is about +3% to +8% (depending on the test). 3346 - minievent tests for eintr and eagain. 3347 334815 February 2008: Wouter 3349 - added FreeBSD rc.d script to contrib. 3350 - --prefix option for configure also changes directory: pidfile: 3351 and chroot: defaults in config file. 3352 - added cache speed test, for cache size OK and cache too small. 3353 335414 February 2008: Wouter 3355 - start without a config file (will complain, but start with 3356 defaults). 3357 - perf test program works. 3358 335913 February 2008: Wouter 3360 - 0.9 released. 3361 - 1.0 development. Printout ldns version on unbound -h. 3362 - start of perf tool. 3363 - bugfix to read empty lines from /etc/hosts. 3364 336512 February 2008: Wouter 3366 - fixup problem with configure calling itself if ldns-src tarball 3367 is not present. 3368 336911 February 2008: Wouter 3370 - changed library to use ub_ instead of ub_val_ as prefix. 3371 - statistics output text nice. 3372 - etc/hosts handling. 3373 - library function to put logging to a stream. 3374 - set any option interface. 3375 33768 February 2008: Wouter 3377 - test program for multiple queries over a TCP channel. 3378 - tpkg test for stream tcp queries. 3379 - unbound replies to multiple TCP queries on a TCP channel. 3380 - fixup misclassification of root referral with NS in answer 3381 when validating a nonrec query. 3382 - tag 0.9 3383 - layout of manpages, spelling fix in header, manpages process by 3384 makedist, list asynclook and tcpstream tests as ldns-testns 3385 required. 3386 33877 February 2008: Wouter 3388 - moved up all current level 2 to be level 3. And 3 to 4. 3389 to make room for new debug level 2 for detailed information 3390 for operators. 3391 - verbosity level 2. Describes recursion and validation. 3392 - cleaner configure script and fixes for libevent solaris. 3393 - signedness for log output memory sizes in high verbosity. 3394 33956 February 2008: Wouter 3396 - clearer explanation of threading configure options. 3397 - fixup asynclook test for nothreading (it creates only one process 3398 to do the extended test). 3399 - changed name of ub_val_result_free to ub_val_resolve_free. 3400 - removes warning message during library linking, renamed 3401 libunbound/unbound.c -> libunbound.c and worker to libworker. 3402 - fallback without EDNS if result is NOTIMPL as well as on FORMERR. 3403 34045 February 2008: Wouter 3405 - statistics-interval: seconds option added. 3406 - test for statistics option 3407 - ignore errors making directories, these can occur in parallel builds 3408 - fixup Makefile strip command and libunbound docs typo. 3409 341031 January 2008: Wouter 3411 - bg thread/process reads and writes the pipe nonblocking all the time 3412 so that even if the pipe is buffered or so, the bg thread does not 3413 block, and services both pipes and queries. 3414 341530 January 2008: Wouter 3416 - check trailing / on chrootdir in checkconf. 3417 - check if root hints and anchor files are in chrootdir. 3418 - no route to host tcp error is verbosity level 2. 3419 - removed unused send_reply_iov. and its configure check. 3420 - added prints of 'remote address is 1.2.3.4 port 53' to errors 3421 from netevent; the basic socket errors. 3422 342328 January 2008: Wouter 3424 - fixup uninit use of buffer by libunbound (query id, flags) for 3425 local_zone answers. 3426 - fixup uninit warning from random.c; also seems to fix sporadic 3427 sigFPE coming out of openssl. 3428 - made openssl entropy warning more silent for library use. Needs 3429 verbosity 1 now. 3430 - fixup forgotten locks for rbtree_searches on ctx->query tree. 3431 - random generator cleanup - RND_STATE_SIZE removed, and instead 3432 a super-rnd can be passed at init to chain init random states. 3433 - test also does lock checks if available. 3434 - protect config access in libworker_setup(). 3435 - libevent doesn't like comm_base_exit outside of runloop. 3436 - close fds after removing commpoints only (for epoll, kqueue). 3437 343825 January 2008: Wouter 3439 - added tpkg for asynclook and library use. 3440 - allows localhost to be queried when as a library. 3441 - fixup race condition between cancel and answer (in case of 3442 really fast answers that beat the cancel). 3443 - please doxygen, put doxygen comment in one place. 3444 - asynclook -b blocking mode and test. 3445 - refactor asynclook, nicer code. 3446 - fixup race problems from opensll in rand init from library, with 3447 a mutex around the rand init. 3448 - fix pass async_id=NULL to _async resolve(). 3449 - rewrote _wait() routine, so that it is threadsafe. 3450 - cancelation is threadsafe. 3451 - asynclook extended test in tpkg. 3452 - fixed two races where forked bg process waits for (somehow shared?) 3453 locks, so does not service the query pipe on the bg side. 3454 Now those locks are only held for fg_threads and for bg_as_a_thread. 3455 345624 January 2008: Wouter 3457 - tested the cancel() function. 3458 - asynclook -c (cancel) feature. 3459 - fix fail to allocate context actions. 3460 - make pipe nonblocking at start. 3461 - update plane for retry mode with caution to limit bandwidth. 3462 - fix Makefile for concurrent make of unbound-host. 3463 - renamed ub_val_ctx_wait/poll/process/fd to ub_val*. 3464 - new calls to set forwarding added to header and docs. 3465 346623 January 2008: Wouter 3467 - removed debug prints from if-auto, verb-algo enables some. 3468 - libunbound QUIT setup, remove memory leaks, when using threads 3469 will share memory for passing results instead of writing it over 3470 the pipe, only writes ID number over the pipe (towards the handler 3471 thread that does process() ). 3472 347322 January 2008: Wouter 3474 - library code for async in libunbound/unbound.c. 3475 - fix link testbound. 3476 - fixup exit bug in mini_event. 3477 - background worker query enter and result functions. 3478 - bg query test application asynclook, it looks up multiple 3479 hostaddresses (A records) at the same time. 3480 348121 January 2008: Wouter 3482 - libworker work, netevent raw commpoints, write_msg, serialize. 3483 348418 January 2008: Wouter 3485 - touch up of manpage for libunbound. 3486 - support for IP_RECVDSTADDR (for *BSD ip4). 3487 - fix for BSD, do not use ip4to6 mapping, make two sockets, once 3488 ip6 and once ip4, uses socket options. 3489 - goodbye ip4to6 mapping. 3490 - update ldns-testpkts with latest version from ldns-trunk. 3491 - updated makedist for relative ldns pathnames. 3492 - library API with more information inside the result structure. 3493 - work on background resolves. 3494 349517 January 2008: Wouter 3496 - fixup configure in case -lldns is installed. 3497 - fixup a couple of doxygen warnings, about enum variables. 3498 - interface-automatic now copies the interface address from the 3499 PKT_INFO structure as well. 3500 - manual page with library API, all on one page 'man libunbound'. 3501 - rewrite of PKTINFO structure, it also captures IP4 PKTINFO. 3502 350316 January 2008: Wouter 3504 - incoming queries to the server with TC bit on are replied FORMERR. 3505 - interface-automatic replied the wrong source address on localhost 3506 queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying 3507 to use ifnum=-1 to mean 'no interface, use kernel route'. 3508 350915 January 2008: Wouter 3510 - interface-automatic feature. experimental. Nice for anycast. 3511 - tpkg test for ip6 ancillary data. 3512 - removed debug prints. 3513 - porting experience, define for Solaris, test refined for BSD 3514 compatibility. The feature probably will not work on OpenBSD. 3515 - makedist fixup for ldns-src in build-dir. 3516 351714 January 2008: Wouter 3518 - in no debug sets NDEBUG to remove asserts. 3519 - configure --enable-debug is needed for dependency generation 3520 for assertions and for compiler warnings. 3521 - ldns.tgz updated with ldns-trunk (where buffer.h is updated). 3522 - fix lint, unit test in optimize mode. 3523 - default access control allows ::ffff:127.0.0.1 v6mapped localhost. 3524 352511 January 2008: Wouter 3526 - man page, warning removed. 3527 - added text describing the use of stub zones for private zones. 3528 - checkconf tests for bad hostnames (IP address), and for doubled 3529 interface lines. 3530 - memory sizes can be given with 'k', 'Kb', or M or G appended. 3531 353210 January 2008: Wouter 3533 - typo in example.conf. 3534 - made using ldns-src that is included the package more portable 3535 by linking with .lo instead of .o files in the ldns package. 3536 - nicer do-ip6: yes/no documentation. 3537 - nicer linking of libevent .o files. 3538 - man pages render correctly on solaris. 3539 35409 January 2008: Wouter 3541 - fixup openssl RAND problem, when the system is not configured to 3542 give entropy, and the rng needs to be seeded. 3543 35448 January 2008: Wouter 3545 - print median and quartiles with extensive logging. 3546 35474 January 2008: Wouter 3548 - document misconfiguration in private network. 3549 35502 January 2008: Wouter 3551 - fixup typo in requirements. 3552 - document that 'refused' is a better choice than 'drop' for 3553 the access control list, as refused will stop retries. 3554 35557 December 2007: Wouter 3556 - unbound-host has a -d option to show what happens. This can help 3557 with debugging (why do I get this answer). 3558 - fixup CNAME handling, on nodata, sets and display canonname. 3559 - dot removed from CNAME display. 3560 - respect -v for NXDOMAINs. 3561 - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes). 3562 - size_t to int for portability of the header file. 3563 - fixup bogus handling. 3564 - dependencies and lint for unbound-host. 3565 35666 December 2007: Wouter 3567 - library resolution works in foreground mode, unbound-host app 3568 receives data. 3569 - unbound-host prints rdata using ldns. 3570 - unbound-host accepts trust anchors, and prints validation 3571 information when you give -v. 3572 35735 December 2007: Wouter 3574 - locking in context_new() inside the function. 3575 - setup of libworker. 3576 35774 December 2007: Wouter 3578 - minor Makefile fixup. 3579 - moved module-stack code out of daemon/daemon into services/modstack, 3580 preparing for code-reuse. 3581 - move context into own header file. 3582 - context query structure. 3583 - removed unused variable pwd from checkconf. 3584 - removed unused assignment from outside netw. 3585 - check timeval length of string. 3586 - fixup error in val_utils getsigner. 3587 - fixup same (*var) error in netblocktostr. 3588 - fixup memleak on parse error in localzone. 3589 - fixup memleak on packet parse error. 3590 - put ; after union in parser.y. 3591 - small hardening in iter_operate against iq==NULL. 3592 - hardening, if error reply with rcode=0 (noerror) send servfail. 3593 - fixup same (*var) error in find_rrset in msgparse, was harmless. 3594 - check return value of evtimer_add(). 3595 - fixup lockorder in lruhash_reclaim(), building up a list of locked 3596 entries one at a time. Instead they are removed and unlocked. 3597 - fptr_wlist for markdelfunc. 3598 - removed is_locked param from lruhash delkeyfunc. 3599 - moved bin_unlock during bin_split purely to please. 3600 36013 December 2007: Wouter 3602 - changed checkconf/ to smallapp/ to make room for more support tools. 3603 (such as unbound-host). 3604 - install dirs created with -m 755 because they need to be accessible. 3605 - library extensive featurelist added to TODO. 3606 - please doxygen, lint. 3607 - library test application, with basic functionality. 3608 - fix for building in a subdirectory. 3609 - link lib fix for Leopard. 3610 361130 November 2007: Wouter 3612 - makefile that creates libunbound.la, basic file or libunbound.a 3613 when creating static executables (no libtool). 3614 - more API setup. 3615 361629 November 2007: Wouter 3617 - 0.9 public API start. 3618 361928 November 2007: Wouter 3620 - Changeup plan for 0.8 - no complication needed, a simple solution 3621 has been chosen for authoritative features. 3622 - you can use single quotes in the config file, so it is possible 3623 to specify TXT records in local data. 3624 - fixup small memory problem in implicit transparent zone creation. 3625 - test for implicit zone creation and multiple RR RRsets local data. 3626 - local-zone nodefault test. 3627 - show testbound testlist on commit. 3628 - iterator normalizer changes CNAME chains ending in NXDOMAIN where 3629 the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial 3630 domain exists). 3631 - nicer verbosity: 0 and 1 levels. 3632 - lower nonRDquery chance of eliciting wrongly typed validation 3633 requiring message from the cache. 3634 - fix for nonRDquery validation typing; nodata is detected when 3635 SOA record in auth section (all validation-requiring nodata messages 3636 have a SOA record in authority, so this is OK for the validator), 3637 and NS record is needed to be a referral. 3638 - duplicate checking when adding NSECs for a CNAME, and test. 3639 - created svn tag 0.8, after completing testbed tests. 3640 364127 November 2007: Wouter 3642 - per suggestion in rfc2308, replaced default max-ttl value with 1 day. 3643 - set size of msgparse lookup table to 32, from 1024, so that its size 3644 is below the 2048 regional large size threshold, and does not cause 3645 a call to malloc when a message is parsed. 3646 - update of memstats tool to print number of allocation calls. 3647 This is what is taking time (not space) and indicates the avg size 3648 of the allocations as well. region_alloc stat is removed. 3649 365022 November 2007: Wouter 3651 - noted EDNS in-the-middle dropping trouble as a TODO. 3652 At this point theoretical, no user trouble has been reported. 3653 - added all default AS112 zones. 3654 - answers from local zone content. 3655 * positive answer, the rrset in question 3656 * nodata answer (exist, but not that type). 3657 * nxdomain answer (domain does not exist). 3658 * empty-nonterminal answer. 3659 * But not: wildcard, nsec, referral, rrsig, cname/dname, 3660 or additional section processing, NS put in auth. 3661 - test for correct working of static and transparent and couple 3662 of important defaults (localhost, as112, reverses). 3663 Also checks deny and refuse settings. 3664 - fixup implicit zone generation and AA bit for NXDOMAIN on localdata. 3665 366621 November 2007: Wouter 3667 - local zone internal data setup. 3668 366920 November 2007: Wouter 3670 - 0.8 - str2list config support for double string config options. 3671 - local-zone and local-data options, config storage and documentation. 3672 367319 November 2007: Wouter 3674 - do not downcase NSEC and RRSIG for verification. Follows 3675 draft-ietf-dnsext-dnssec-bis-updates-06.txt. 3676 - fixup leaking unbound daemons at end of tests. 3677 - README file updated. 3678 - nice libevent not found error. 3679 - README talks about gnu make. 3680 - 0.8: unit test for addr_mask and fixups for it. 3681 and unit test for addr_in_common(). 3682 - 0.8: access-control config file element. 3683 and unit test rpl replay file. 3684 - 0.8: fixup address reporting from netevent. 3685 368616 November 2007: Wouter 3687 - privilege separation is not needed in unbound at this time. 3688 TODO item marked as such. 3689 - created beta-0.7 branch for support. 3690 - tagged 0.7 for beta release. 3691 - moved trunk to 0.8 for 0.8(auth features) development. 3692 - 0.8: access control list setup. 3693 369415 November 2007: Wouter 3695 - review fixups from Jelte. 3696 369714 November 2007: Wouter 3698 - testbed script does not recreate configure, since its in svn now. 3699 - fixup checkconf test so that it does not test 3700 /etc/unbound/unbound.conf. 3701 - tag 0.6. 3702 370313 November 2007: Wouter 3704 - remove debug print. 3705 - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists. 3706 370712 November 2007: Wouter 3708 - fixup signal handling where SIGTERM could be ignored if a SIGHUP 3709 arrives later on. 3710 - bugreports to unbound-bugs@nlnetlabs.nl 3711 - fixup testbound so it exits cleanly. 3712 - cleanup the caches on a reload, so that rrsetID numbers won't clash. 3713 37149 November 2007: Wouter 3715 - took ldns snapshot in repo. 3716 - default config file is /etc/unbound/unbound.conf. 3717 If it doesn't exist, it is installed with the doc/example.conf file. 3718 The file is not deleted on uninstall. 3719 - default listening is not all, but localhost interfaces. 3720 37218 November 2007: Wouter 3722 - Fixup chroot and drop user privileges. 3723 - new L root ip address in default hints. 3724 37251 November 2007: Wouter 3726 - Fixup of crash on reload, due to anchors in env not NULLed after 3727 dealloc during deinit. 3728 - Fixup of chroot call. Happens after privileges are dropped, so 3729 that checking the passwd entry still works. 3730 - minor touch up of clear() hashtable function. 3731 - VERB_DETAIL prints out what chdir, username, chroot is being done. 3732 - when id numbers run out, caches are cleared, as in design notes. 3733 Tested with a mock setup with very few bits in id, it worked. 3734 - harden-dnssec-stripped: yes is now default. It insists on dnssec 3735 data for trust anchors. Included tests for the feature. 3736 373731 October 2007: Wouter 3738 - cache-max-ttl config option. 3739 - building outside sourcedir works again. 3740 - defaults more secure: 3741 username: "unbound" 3742 chroot: "/etc/unbound" 3743 The operator can override them to be less secure ("") if necessary. 3744 - fix horrible oversight in sorting rrset references in a message, 3745 sort per reference key pointer, not on referencepointer itself. 3746 - pidfile: "/etc/unbound/unbound.pid" is now the default. 3747 - tests changed to reflect the updated default. 3748 - created hashtable clear() function that respects locks. 3749 375030 October 2007: Wouter 3751 - fixup assertion failure that relied on compressed names to be 3752 smaller than uncompressed names. A packet from comrite.com was seen 3753 to be compressed to a larger size. Added it as unit test. 3754 - quieter logging at low verbosity level for common tcp messages. 3755 - no greedy TTL update. 3756 375723 October 2007: Wouter 3758 - fixup (grand-)parent problem for dnssec-lameness detection. 3759 - fixup tests to do additional section processing for lame replies, 3760 since the detection needs that. 3761 - no longer trust in query section in reply during dnssec lame detect. 3762 - dnssec lameness does not make the server never ever queried, but 3763 non-preferred. If no other servers exist or answer, the dnssec lame 3764 server is used; the fastest dnssec lame server is chosen. 3765 - added test then when trust anchor cannot be primed (nodata), the 3766 insecure mode from unbound works. 3767 - Fixup max queries per thread, any more are dropped. 3768 376922 October 2007: Wouter 3770 - added donotquerylocalhost config option. Can be turned off for 3771 out test cases. 3772 - ISO C compat changes. 3773 - detect RA-no-AA lameness, as LAME. 3774 - DNSSEC-lameness detection, as LAME. 3775 See notes in requirements.txt for choices made. 3776 - tests for lameness detection. 3777 - added all to make test target; need unbound for fwd tests. 3778 - testbound does not pollute /etc/unbound. 3779 378019 October 2007: Wouter 3781 - added configure (and its files) to svn, so that the trunk is easier 3782 to use. ./configure, config.guess, config.sub, ltmain.sh, 3783 and config.h.in. 3784 - added yacc/lex generated files, util/configlexer.c, 3785 util/configparser.c util/configparser.h, to svn. 3786 - without lex no attempt to use it. 3787 - unsecure response validation collated into one block. 3788 - remove warning about const cast of cfgfile name. 3789 - outgoing-interfaces can be different from service interfaces. 3790 - ldns-src configure is done during unbound configure and 3791 ldns-src make is done during unbound make, and so inherits the 3792 make arguments from the unbound make invocation. 3793 - nicer error when libevent problem causes instant exit on signal. 3794 - read root hints from a root hint file (like BIND does). 3795 379618 October 2007: Wouter 3797 - addresses are logged with errors. 3798 - fixup testcode fake event to remove pending before callback 3799 since the callback may create new pending items. 3800 - tests updated because retries are now in iterator module. 3801 - ldns-testpkts code is checked for differences between unbound 3802 and ldns by makedist.sh. 3803 - ldns trunk from today added in svn repo for fallback in case 3804 no ldns is installed on the system. 3805 make download_ldns refreshes the tarball with ldns svn trunk. 3806 - ldns-src.tar.gz is used if no ldns is found on the system, and 3807 statically linked into unbound. 3808 - start of regional allocator code. 3809 - regional uses less memory and variables, simplified code. 3810 - remove of region-allocator. 3811 - alloc cache keeps a cache of recently released regional blocks, 3812 up to a maximum. 3813 - make unit test cleanly free memory. 3814 381517 October 2007: Wouter 3816 - fixup another cycle detect and ns-addr timeout resolution bug. 3817 This time by refusing delegations from the cache without addresses 3818 when resolving a mandatory-glue nameserver-address for that zone. 3819 We're going to have to ask a TLD server anyway; might as well be 3820 the TLD server for this name. And this resolves a lot of cases where 3821 the other nameserver names lead to cycles or are not available. 3822 - changed random generator from random(3) clone to arc4random wrapped 3823 for thread safety. The random generator is initialised with 3824 entropy from the system. 3825 - fix crash where failure to prime DNSKEY tried to print null pointer 3826 in the log message. 3827 - removed some debug prints, only verb_algo (4) enables them. 3828 - fixup test; new random generator took new paths; such as one 3829 where no scripted answer was available. 3830 - mark insecure RRs as insecure. 3831 - fixup removal of nonsecure items from the additional. 3832 - reduced timeout values to more realistic, 376 msec (262 msec has 3833 90% of roundtrip times, 512 msec has 99% of roundtrip times.) 3834 - server selection failover to next server after timeout (376 msec). 3835 383616 October 2007: Wouter 3837 - no malloc in log_hex. 3838 - assertions around system calls. 3839 - protect against gethostname without ending zero. 3840 - ntop output is null terminated by unbound. 3841 - pidfile content null termination 3842 - various snprintf use sizeof(stringbuf) instead of fixed constant. 3843 - changed loopdetect % 8 with & 0x7 since % can become negative for 3844 weird negative input and particular interpretation of integer math. 3845 - dname_pkt_copy checks length of result, to protect result buffers. 3846 prints an error, this should not happen. Bad strings should have 3847 been rejected earlier in the program. 3848 - remove a size_t underflow from msgreply size func. 3849 385015 October 2007: Wouter 3851 - nicer warning. 3852 - fix IP6 TCP, wrong definition check. With test package. 3853 - fixup the fact that the query section was not compressed to, 3854 the code was there but was called by value instead of by reference. 3855 And test for the case, uses xxd and nc. 3856 - more portable ip6 check for sockaddr types. 3857 38588 October 2007: Wouter 3859 - --disable-rpath option in configure for 64bit systems with 3860 several dynamic lib dirs. 3861 38627 October 2007: Wouter 3863 - fixup tests for no AD bit in non-DO queries. 3864 - test that makes sure AD bit is not set on non-DO query. 3865 38666 October 2007: Wouter 3867 - removed logfile open early. It did not have the proper permissions; 3868 it was opened as root instead of the user. And we cannot change user 3869 id yet, since chroot and bind ports need to be done. 3870 - callback checks for event callbacks done from mini_event. Because 3871 of deletions cannot do this from netevent. This means when using 3872 libevent the protection does not work on event-callbacks. 3873 - fixup too small reply (did not zero counts). 3874 - fixup reply no longer AD bit when query without DO bit. 3875 38765 October 2007: Wouter 3877 - function pointer whitelist. 3878 38794 October 2007: Wouter 3880 - overwrite sensitive random seed value after use. 3881 - switch to logfile very soon if not -d (console attached). 3882 - error messages do not reveal the trustanchor contents. 3883 - start work on function pointer whitelists. 3884 38853 October 2007: Wouter 3886 - fix for multiple empty nonterminals, after multiple DSes in the 3887 chain of trust. 3888 - mesh checks if modules are looping, and stops them. 3889 - refetch with CNAMEd nameserver address regression test added. 3890 - fixup line count bug in testcode, so testbound prints correct line 3891 number with parse errors. 3892 - unit test for multiple ENT case. 3893 - fix for cname out of validated unsec zone. 3894 - fixup nasty id=0 reuse. Also added assertions to detect its 3895 return (the assertion catches in the existing test cases). 3896 38971 October 2007: Wouter 3898 - skip F77, CXX, objC tests in configure step. 3899 - fixup crash in refetch glue after a CNAME. 3900 and protection against similar failures (with error print). 3901 390228 September 2007: Wouter 3903 - test case for unbound-checkconf, fixed so it also checks the 3904 interface: statements. 3905 390626 September 2007: Wouter 3907 - SIGHUP will reopen the log file. 3908 - Option to log to syslog. 3909 - please lint, fixup tests (that went to syslog on open, oops). 3910 - config check program. 3911 391225 September 2007: Wouter 3913 - tests for NSEC3. Fixup bitmap checks for NSEC3. 3914 - positive ANY response needs to check if wildcard expansion, and 3915 check that original data did not exist. 3916 - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure 3917 delegation, for abuse of child zone apex nsec3. 3918 - create 0.5 release tag. 3919 392024 September 2007: Wouter 3921 - do not make test programs by default. 3922 - But 'make test' will perform all of the tests. 3923 - Advertise builtin select libevent alternative when no libevent 3924 is found. 3925 - signit can generate NSEC3 hashes, for generating tests. 3926 - multiple nsec3 paramaters in message test. 3927 - too high nsec3 iterations becomes insecure test. 3928 392921 September 2007: Wouter 3930 - fixup empty_DS_name allocated in wrong region (port DEC Alpha). 3931 - fixup testcode lock safety (port FreeBSD). 3932 - removes subscript has type char warnings (port Solaris 9). 3933 - fixup of field with format type to int (port MacOS/X intel). 3934 - added test for infinite loop case in nonRD answer validation. 3935 It was a more general problem, but hard to reproduce. When an 3936 unsigned rrset is being validated and the key fetched, the DS 3937 sequence is followed, but if the final name has no DS, then no 3938 proof is possible - the signature has been stripped off. 3939 394020 September 2007: Wouter 3941 - fixup and test for NSEC wildcard with empty nonterminals. 3942 - makedist.sh fixup for svn info. 3943 - acl features request in plan. 3944 - improved DS empty nonterminal handling. 3945 - compat with ANS nxdomain for empty nonterminals. Attempts the nodata 3946 proof anyway, which succeeds in ANS failure case. 3947 - striplab protection in case it becomes -1. 3948 - plans for static and blacklist config. 3949 395019 September 2007: Wouter 3951 - comments about non-packed usage. 3952 - plan for overload support in 0.6. 3953 - added testbound tests for a failed resolution from the logs 3954 and for failed prime when missing glue. 3955 - fixup so useless delegation points are not returned from the 3956 cache. Also the safety belt is used if priming fails to complete. 3957 - fixup NSEC rdata not to be lowercased, bind compat. 3958 395918 September 2007: Wouter 3960 - wildcard nsec3 testcases, and fixup to get correct wildcard name. 3961 - validator prints subtype classification for debug. 3962 396317 September 2007: Wouter 3964 - NSEC3 hash cache unit test. 3965 - validator nsec3 nameerror test. 3966 396714 September 2007: Wouter 3968 - nsec3 nodata proof, nods proof, wildcard proof. 3969 - nsec3 support for cname chain ending in noerror or nodata. 3970 - validator calls nsec3 proof routines if no NSECs prove anything. 3971 - fixup iterator bug where it stored the answer to a cname under 3972 the wrong qname into the cache. When prepending the cnames, the 3973 qname has to be reset to the original qname. 3974 397513 September 2007: Wouter 3976 - nsec3 find matching and covering, ce proof, prove namerror msg. 3977 397812 September 2007: Wouter 3979 - fixup of manual page warnings, like for NSD bugreport. 3980 - nsec3 work, config, max iterations, filter, and hash cache. 3981 39826 September 2007: Wouter 3983 - fixup to find libevent on mac port install. 3984 - fixup size_t vs unsigned portability in validator/sigcrypt. 3985 - please compiler on different platforms, for unreachable code. 3986 - val_nsec3 file. 3987 - pthread_rwlock type is optional, in case of old pthread libs. 3988 39895 September 2007: Wouter 3990 - cname, name error validator tests. 3991 - logging of qtype ANY works. 3992 - ANY type answers get RRSIG in answer section of replies (but not 3993 in other sections, unless DO bit is on). 3994 - testbound can replay a TCP query (set MATCH TCP in the QUERY). 3995 - DS and noDS referral validation test. 3996 - if you configure many trust anchors, parent trust anchors can 3997 securely deny existance of child trust anchors, if validated. 3998 - not all *.name NSECs are present because a wildcard was matched, 3999 and *.name NSECs can prove nodata for empty nonterminals. 4000 Also, for wildcard name NSECs, check they are not from the parent 4001 zone (for wildcarded zone cuts), and check absence of CNAME bit, 4002 for a nodata proof. 4003 - configure option for memory allocation debugging. 4004 - port configure option for memory allocation to solaris10. 4005 40064 September 2007: Wouter 4007 - fixup of Leakage warning when serviced queries processed multiple 4008 callbacks for the same query from the same server. 4009 - testbound removes config file from /tmp on failed exit. 4010 - fixup for referral cleanup of the additional section. 4011 - tests for cname, referral validation. 4012 - neater testbound tpkg output. 4013 - DNAMEs no longer match their apex when synthesized from the cache. 4014 - find correct signer name for DNAME responses. 4015 - wildcarded DNAME test and fixup code to detect. 4016 - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs. 4017 So that wildcarded CNAMEs get their NSEC with them to the answer. 4018 - test for a CNAME to a DNAME to a CNAME to an answer, all from 4019 different domains, for key fetching and signature checking of 4020 CNAME'd messages. 4021 40223 September 2007: Wouter 4023 - Fixed error in iterator that would cause assertion failure in 4024 validator. CNAME to a NXDOMAIN response was collated into a response 4025 with both a CNAME and the NXDOMAIN rcode. Added a test that the 4026 rcode is changed to NOERROR (because of the CNAME). 4027 - timeout on tcp does not lead to spurious leakage detect. 4028 - account memory for name of lame zones, so that memory leakages does 4029 not show lame cache growth as a leakage growth. 4030 - config setting for lameness cache expressed in bytes, instead of 4031 number of entries. 4032 - tool too summarize allocations per code line. 4033 403431 August 2007: Wouter 4035 - can read bind trusted-keys { ... }; files, in a compatibility mode. 4036 - iterator should not detach target queries that it still could need. 4037 the protection against multiple outstanding queries is moved to a 4038 current_query num check. 4039 - validator nodata, positive, referral tests. 4040 - dname print can print '*' wildcard. 4041 404230 August 2007: Wouter 4043 - fixup override date config option. 4044 - config options to control memory usage. 4045 - caught bad free of un-alloced data in worker_send error case. 4046 - memory accounting for key cache (trust anchors and temporary cache). 4047 - memory accounting fixup for outside network tcp pending waits. 4048 - memory accounting fixup for outside network tcp callbacks. 4049 - memory accounting for iterator fixed storage. 4050 - key cache size and slabs config options. 4051 - lib crypto cleanups at exit. 4052 405329 August 2007: Wouter 4054 - test tool to sign rrsets for testing validator with. 4055 - added RSA and DSA test keys, public and private pairs, 512 bits. 4056 - default configuration is with validation enabled. 4057 Only a trust-anchor needs to be configured for DNSSEC to work. 4058 - do not convert to DER for DSA signature verification. 4059 - validator replay test file, for a DS to DNSKEY DSA key prime and 4060 positive response. 4061 406228 August 2007: Wouter 4063 - removed double use for udp buffers, that could fail, 4064 instead performs a malloc to do the backup. 4065 - validator validates referral messages, by validating all the rrsets 4066 and stores the rrsets in the cache. Further referral (nonRD queries) 4067 replies are made from the rrset cache directly. Unless unchecked 4068 rrsets are encountered, there are then validated. 4069 - enforce that signing is done by a parent domain (or same domain). 4070 - adjust TTL downwards if rrset TTL bigger than signature allows. 4071 - permissive mode feature, sets AD bit for secure, but bogus does 4072 not give servfail (bogus is changed into indeterminate). 4073 - optimization of rrset verification. rr canonical sorting is reused, 4074 for the same rrset. canonical rrset image in buffer is reused for 4075 the same signature. 4076 - if the rrset is too big (64k exactly + large owner name) the 4077 canonicalization routine will fail if it does not fit in buffer. 4078 - faster verification for large sigsets. 4079 - verb_detail mode reports validation failures, but not the entire 4080 algorithm for validation. Key prime failures are reported as 4081 verb_ops level. 4082 408327 August 2007: Wouter 4084 - do not garble the edns if a cache answer fails. 4085 - answer norecursive from cache if possible. 4086 - honor clean_additional setting when returning secure non-recursive 4087 referrals. 4088 - do not store referral in msg cache for nonRD queries. 4089 - store verification status in the rrset cache to speed up future 4090 verification. 4091 - mark rrsets indeterminate and insecure if they are found to be so. 4092 and store this in the cache. 4093 409424 August 2007: Wouter 4095 - message is bogus if unsecure authority rrsets are present. 4096 - val-clean-additional option, so you can turn it off. 4097 - move rrset verification out of the specific proof types into one 4098 routine. This makes the proof routines prettier. 4099 - fixup cname handling in validator, cname-to-positive and cname-to- 4100 nodata work. 4101 - Do not synthesize DNSKEY and DS responses from the rrset cache if 4102 the rrset is from the additional section. Signatures may have 4103 fallen off the packet, and cause validation failure. 4104 - more verbose signature date errors (with the date attached). 4105 - increased default infrastructure cache size. It is important for 4106 performance, and 1000 entries are only 212k (or a 400 k total cache 4107 size). To 10000 entries (for 2M entries, 4M cache size). 4108 410923 August 2007: Wouter 4110 - CNAME handling - move needs_validation to before val_new(). 4111 val_new() setups the chase-reply to be an edited copy of the msg. 4112 new classification, and find signer can find for it. 4113 removal of unsigned crap from additional, and query restart for 4114 cname. 4115 - refuse to follow wildcarded DNAMEs when validating. 4116 But you can query for qtype ANY, or qtype DNAME and validate that. 4117 411822 August 2007: Wouter 4119 - bogus TTL. 4120 - review - use val_error(). 4121 412221 August 2007: Wouter 4123 - ANY response validation. 4124 - store security status in cache. 4125 - check cache security status and either send the query to be 4126 validated, return the query to client, or send servfail to client. 4127 Sets AD bit on validated replies. 4128 - do not examine security status on an error reply in mesh_done. 4129 - construct DS, DNSKEY messages from rrset cache. 4130 - manual page entry for override-date. 4131 413220 August 2007: Wouter 4133 - validate and positive validation, positive wildcard NSEC validation. 4134 - nodata validation, nxdomain validation. 4135 413618 August 2007: Wouter 4137 - process DNSKEY response in FINDKEY state. 4138 413917 August 2007: Wouter 4140 - work on DS2KE routine. 4141 - val_nsec.c for validator NSEC proofs. 4142 - unit test for NSEC bitmap reading. 4143 - dname iswild and canonical_compare with unit tests. 4144 414516 August 2007: Wouter 4146 - DS sig unit test. 4147 - latest release libevent 1.3c and 1.3d have threading fixed. 4148 - key entry fixup data pointer and ttl absolute. 4149 - This makes a key-prime succeed in validator, with DS or DNSKEY as 4150 trust-anchor. 4151 - fixup canonical compare byfield routine, fix bug and also neater. 4152 - fixed iterator response type classification for queries of type 4153 ANY and NS. 4154 dig ANY gives sometimes NS rrset in AN and NS section, and parser 4155 removes the NS section duplicate. dig NS gives sometimes the NS 4156 in the answer section, as referral. 4157 - validator FINDKEY state. 4158 415915 August 2007: Wouter 4160 - crypto calls to verify signatures. 4161 - unit test for rrsig verification. 4162 416314 August 2007: Wouter 4164 - default outgoing ports changed to avoid port 2049 by default. 4165 This port is widely blocked by firewalls. 4166 - count infra lameness cache in memory size. 4167 - accounting of memory improved 4168 - outbound entries are allocated in the query region they are for. 4169 - extensive debugging for memory allocations. 4170 - --enable-lock-checks can be used to enable lock checking. 4171 - protect undefs in config.h from autoheaders ministrations. 4172 - print all received udp packets. log hex will print on multiple 4173 lines if needed. 4174 - fixed error in parser with backwards rrsig references. 4175 - mark cycle targets for iterator did not have CD flag so failed 4176 its task. 4177 417813 August 2007: Wouter 4179 - fixup makefile, if lexer is missing give nice error and do not 4180 mess up the dependencies. 4181 - canonical compare routine updated. 4182 - canonical hinfo compare. 4183 - printout list of the queries that the mesh is working on. 4184 418510 August 2007: Wouter 4186 - malloc and free overrides that track total allocation and frees. 4187 for memory debugging. 4188 - work on canonical sort. 4189 41909 August 2007: Wouter 4191 - canonicalization, signature checks 4192 - dname signature label count and unit test. 4193 - added debug heap size print to memory printout. 4194 - typo fixup in worker.c 4195 - -R needed on solaris. 4196 - validator override option for date check testing. 4197 41988 August 2007: Wouter 4199 - ldns _raw routines created (in ldns trunk). 4200 - sigcrypt DS digest routines 4201 - val_utils uses sigcrypt to perform signature cryptography. 4202 - sigcrypt keyset processing 4203 42047 August 2007: Wouter 4205 - security status type. 4206 - security status is copied when rdata is equal for rrsets. 4207 - rrset id is updated to invalidate all the message cache entries 4208 that refer to NSEC, NSEC3, DNAME rrsets that have changed. 4209 - val_util work 4210 - val_sigcrypt file for validator signature checks. 4211 42126 August 2007: Wouter 4213 - key cache for validator. 4214 - moved isroot and dellabel to own dname routines, with unit test. 4215 42163 August 2007: Wouter 4217 - replanning. 4218 - scrubber check section of lame NS set. 4219 - trust anchors can be in config file or read from zone file, 4220 DS and DNSKEY entries. 4221 - unit test trust anchor storage. 4222 - trust anchors converted to packed rrsets. 4223 - key entry definition. 4224 42252 August 2007: Wouter 4226 - configure change for latest libevent trunk version (needs -lrt). 4227 - query_done and walk_supers are moved out of module interface. 4228 - fixup delegation point duplicates. 4229 - fixup iterator scrubber; lame NS set is let through the scrubber 4230 so that the classification is lame. 4231 - validator module exists, and does nothing but pass through, 4232 with calling of next module and return. 4233 - validator work. 4234 42351 August 2007: Wouter 4236 - set version to 0.5 4237 - module work for module to module interconnections. 4238 - config of modules. 4239 - detect cycle takes flags. 4240 424131 July 2007: Wouter 4242 - updated plan 4243 - release 0.4 tag. 4244 424530 July 2007: Wouter 4246 - changed random state init, so that sequential process IDs are not 4247 cancelled out by sequential thread-ids in the random number seed. 4248 - the fwd_three test, which sends three queries to unbound, and 4249 unbound is kept waiting by ldns-testns for 3 seconds, failed 4250 because the retry timeout for default by unbound is 3 seconds too, 4251 it would hit that timeout and fail the test. Changed so that unbound 4252 is kept waiting for 2 seconds instead. 4253 425427 July 2007: Wouter 4255 - removed useless -C debug option. It did not work. 4256 - text edit of documentation. 4257 - added doc/CREDITS file, referred to by the manpages. 4258 - updated planning. 4259 426026 July 2007: Wouter 4261 - cycle detection, for query state dependencies. Will attempt to 4262 circumvent the cycle, but if no other targets available fails. 4263 - unit test for AXFR, IXFR response. 4264 - test for cycle detection. 4265 426625 July 2007: Wouter 4267 - testbound read ADDRESS and check it. 4268 - test for version.bind and friends. 4269 - test for iterator chaining through several referrals. 4270 - test and fixup for refetch for glue. Refetch fails if glue 4271 is still not provided. 4272 427324 July 2007: Wouter 4274 - Example section in config manual. 4275 - Addr stored for range and moment in replay. 4276 427720 July 2007: Wouter 4278 - Check CNAME chain before returning cache entry with CNAMEs. 4279 - Option harden-glue, default is on. It will discard out of zone 4280 data. If disabled, performance is faster, but spoofing attempts 4281 become a possibility. Note that still normalize scrubbing is done, 4282 and that the potentially spoofed data is used for infrastructure 4283 and not returned to the client. 4284 - if glue times out, refetch by asking parent of delegation again. 4285 Much like asking for DS at the parent side. 4286 - TODO items from forgery-resilience draft. 4287 and on memory handling improvements. 4288 - renamed module_event_timeout to module_event_noreply. 4289 - memory reporting code; reports on memory usage after handling 4290 a network packet (not on cache replies). 4291 429219 July 2007: Wouter 4293 - shuffle NS selection when getting nameserver target addresses. 4294 - fixup of deadlock warnings, yield cpu in checklock code so that 4295 freebsd scheduler selects correct process to run. 4296 - added identity and version config options and replies. 4297 - store cname messages complete answers. 4298 429918 July 2007: Wouter 4300 - do not query addresses, 127.0.0.1, and ::1 by default. 4301 430217 July 2007: Wouter 4303 - forward zone options in config file. 4304 - forward per zone in iterator. takes precendence over stubs. 4305 - fixup commithooks. 4306 - removed forward-to and forward-to-port features, subsumed by 4307 new forward zones. 4308 - fix parser to handle absent server: clause. 4309 - change untrusted rrset test to account for scrubber that is now 4310 applied during the test (which removes the poison, by the way). 4311 - feature, addresses can be specified with @portnumber, like nsd.conf. 4312 - test config files changed over to new forwarder syntax. 4313 431427 June 2007: Wouter 4315 - delete of mesh does a postorder traverse of the tree. 4316 - found and fixed a memory leak. For TTL=0 messages, that would 4317 not be cached, instead the msg-replyinfo structure was leaked. 4318 - changed server selection so it will filter out hosts that are 4319 unresponsive. This is defined as a host with the maximum rto value. 4320 This means that unbound tried the host for retries up to 120 secs. 4321 The rto value will time out after host-ttl seconds from the cache. 4322 This keeps such unresolvable queries from taking up resources. 4323 - utility for keeping histogram. 4324 432526 June 2007: Wouter 4326 - mesh is called by worker, and iterator uses it. 4327 This removes the hierarchical code. 4328 QueryTargets state and Finished state are merged for iterator. 4329 - forwarder mode no longer sets AA bit on first reply. 4330 - rcode in walk_supers is not needed. 4331 433225 June 2007: Wouter 4333 - more mesh work. 4334 - error encode routine for ease. 4335 433622 June 2007: Wouter 4337 - removed unused _node iterator value from rbtree_t. Takes up space. 4338 - iterator can handle querytargets state without a delegation point 4339 set, so that a priming(stub) subquery error can be handled. 4340 - iterator stores if it is priming or not. 4341 - log_query_info() neater logging. 4342 - changed iterator so that it does not alter module_qstate.qinfo 4343 but keeps a chase query info. Also query_flags are not altered, 4344 the iterator uses chase_flags. 4345 - fixup crash in case no ports for the family exist. 4346 434721 June 2007: Wouter 4348 - Fixup secondary buffer in case of error callback. 4349 - cleanup slumber list of runnable states. 4350 - module_subreq_depth fails to work in slumber list. 4351 - fixup query release for cached results to sub targets. 4352 - neater error for tcp connection failure, shows addr in verbose. 4353 - rbtree_init so that it can be used with preallocated memory. 4354 435520 June 2007: Wouter 4356 - new -C option to enable coredumps after forking away. 4357 - doc update. 4358 - fixup CNAME generation by scrubber, and memory allocation of it. 4359 - fixup deletion of serviced queries when all callbacks delete too. 4360 - set num target queries to 0 when you move them to slumber list. 4361 - typo in check caused subquery errors to be ignored, fixed. 4362 - make lint happy about rlim_t. 4363 - freeup of modules after freeup of module-states. 4364 - duplicate replies work, this uses secondary udp buffer in outnet. 4365 436619 June 2007: Wouter 4367 - nicer layout in stats.c, review 0.3 change. 4368 - spelling improvement, review 0.3 change. 4369 - uncapped timeout for server selection, so that very fast or slow 4370 servers will stand out from the rest. 4371 - target-fetch-policy: "3 2 1 0 0" config setting. 4372 - fixup queries answered without RD bit (for root prime results). 4373 - refuse AXFR and IXFR requests. 4374 - fixup RD flag in error reply from iterator. fixup RA flag from 4375 worker error reply. 4376 - fixup encoding of very short edns buffer sizes, now sets TC bit. 4377 - config options harden-short-bufsize and harden-large-queries. 4378 437918 June 2007: Wouter 4380 - same, move subqueries to slumber list when first has resolved. 4381 - fixup last fix for duplicate callbacks. 4382 - another offbyone in targetcounter. Also in Java prototype by the way. 4383 438415 June 2007: Wouter 4385 - if a query asks to be notified of the same serviced query result 4386 multiple times, this will succeed. Only one callback will happen; 4387 multiple outbound-list entries result (but the double cleanup of it 4388 will not matter). 4389 - when iterator moves on due to CNAME or referral, it will remove 4390 the subqueries (for other targets). These are put on the slumber 4391 list. 4392 - state module wait subq is OK with no new subqs, an old one may have 4393 stopped, with an error, and it is still waiting for other ones. 4394 - if a query loops, halt entire query (easy way to clean up properly). 4395 439614 June 2007: Wouter 4397 - num query targets was > 0 , not >= 0 compared, so that fetch 4398 policy of 0 did nothing. 4399 440013 June 2007: Wouter 4401 - debug option: configure --enable-static-exe for compile where 4402 ldns and libevent are linked statically. Default is off. 4403 - make install and make uninstall. Works with static-exe and without. 4404 installation of unbound binary and manual pages. 4405 - alignement problem fix on solaris 64. 4406 - fixup address in case of TCP error. 4407 440812 June 2007: Wouter 4409 - num target queries was set to 0 at a bad time. Default it to 0 and 4410 increase as target queries are done. 4411 - synthesize CNAME and DNAME responses from the cache. 4412 - Updated doxygen config for doxygen 1.5. 4413 - aclocal newer version. 4414 - doxygen 1.5 fixes for comments (for the strict check on docs). 4415 441611 June 2007: Wouter 4417 - replies on TCP queries have the address field set in replyinfo, 4418 for serviced queries, because the initiator does not know that 4419 a TCP fallback has occured. 4420 - omit DNSSEC types from nonDO replies, except if qtype is ANY or 4421 if qtype directly queries for the type (and then only show that 4422 'unknown type' in the answer section). 4423 - fixed message parsing where rrsigs on their own would be put 4424 in the signature list over the rrsig type. 4425 44267 June 2007: Wouter 4427 - fixup error in double linked list insertion for subqueries and 4428 for outbound list of serviced queries for iterator module. 4429 - nicer printout of outgoing port selection. 4430 - fixup cname target readout. 4431 - nicer debug output. 4432 - fixup rrset counts when prepending CNAMEs to the answer. 4433 - fixup rrset TTL for prepended CNAMEs. 4434 - process better check for looping modules, and which submodule to 4435 run next. 4436 - subreq insertion code fixup for slumber list. 4437 - VERB_DETAIL, verbosity: 2 level gives short but readable output. 4438 VERB_ALGO, verbosity: 3 gives extensive output. 4439 - fixup RA bit in cached replies. 4440 - fixup CNAME responses from the cache no longer partial response. 4441 - error in network send handled without leakage. 4442 - enable ip6 from config, and try ip6 addresses if available, 4443 if ip6 is not connected, skips to next server. 4444 44455 June 2007: Wouter 4446 - iterator state finished. 4447 - subrequests without parent store in cache and stop. 4448 - worker slumber list for ongoing promiscuous queries. 4449 - subrequest error handling. 4450 - priming failure returns SERVFAIL. 4451 - priming gives LAME result, returns SERVFAIL. 4452 - debug routine to print dns_msg as handled by iterator. 4453 - memleak in config file stubs fixup. 4454 - more small bugs, in scrubber, query compare no ID for lookup, 4455 in dname validation for NS targets. 4456 - sets entry.key for new special allocs. 4457 - lognametypeclass can display unknown types and classes. 4458 44594 June 2007: Wouter 4460 - random selection of equally preferred nameserver targets. 4461 - reply info copy routine. Reuses existing code. 4462 - cache lameness in response handling. 4463 - do not touch qstate after worker_process_query because it may have 4464 been deleted by that routine. 4465 - Prime response state. 4466 - Process target response state. 4467 - some memcmp changed to dname_compare for case preservation. 4468 44691 June 2007: Wouter 4470 - normalize incoming messages. Like unbound-java, with CNAME chain 4471 checked, DNAME checked, CNAME's synthesized, glue checked. 4472 - sanitize incoming messages. 4473 - split msgreply encode functions into own file msgencode.c. 4474 - msg_parse to queryinfo/replyinfo conversion more versatile. 4475 - process_response, classify response, delegpt_from_message. 4476 447731 May 2007: Wouter 4478 - querytargets state. 4479 - dname_subdomain_c() routine. 4480 - server selection, based on RTT. ip6 is filtered out if not available, 4481 and lameness is checked too. 4482 - delegation point copy routine. 4483 448430 May 2007: Wouter 4485 - removed FLAG_CD from message and rrset caches. This was useful for 4486 an agnostic forwarder, but not for a sophisticated (trust value per 4487 rrset enabled) cache. 4488 - iterator reponse typing. 4489 - iterator cname handle. 4490 - iterator prime start. 4491 - subquery work. 4492 - processInitRequest and processInitRequest2. 4493 - cache synthesizes referral messages, with DS and NSEC. 4494 - processInitRequest3. 4495 - if a request creates multiple subrequests these are all activated. 4496 449729 May 2007: Wouter 4498 - routines to lock and unlock array of rrsets moved to cache/rrset. 4499 - lookup message from msg cache (and copy to region). 4500 - fixed cast error in dns msg lookup. 4501 - message with duplicate rrset does not increase its TTLs twice. 4502 - 'qnamesize' changed to 'qname_len' for similar naming scheme. 4503 450425 May 2007: Wouter 4505 - Acknowledge use of unbound-java code in iterator. Nicer readme. 4506 - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and 4507 rrset cache from module environment. 4508 - packed rrset key has type and class as easily accessable struct 4509 members. They are still kept in network format for fast msg encode. 4510 - dns cache find_delegation routine. 4511 - iterator main functions setup. 4512 - dns cache lookup setup. 4513 451424 May 2007: Wouter 4515 - small changes to prepare for subqueries. 4516 - iterator forwarder feature separated out. 4517 - iterator hints stub code, config file stub code, so that first 4518 testing can proceed locally. 4519 - replay tests now have config option to enable forwarding mode. 4520 452123 May 2007: Wouter 4522 - outside network does precise timers for roundtrip estimates for rtt 4523 and for setting timeout for UDP. Pending_udp takes milliseconds. 4524 - cleaner iterator sockaddr conversion of forwarder address. 4525 - iterator/iter_utils and iter_delegpt setup. 4526 - root hints. 4527 452822 May 2007: Wouter 4529 - outbound query list for modules and support to callback with the 4530 outbound entry to the module. 4531 - testbound support for new serviced queries. 4532 - test for retry to TCP cannot use testbound any longer. 4533 - testns test for EDNS fallback, test for TCP fallback already exists. 4534 - fixes for no-locking compile. 4535 - mini_event timer precision and fix for change in timeouts during 4536 timeout callback. Fix for fwd_three tests, performed nonexit query. 4537 453821 May 2007: Wouter 4539 - small comment on hash table locking. 4540 - outside network serviced queries, contain edns and tcp fallback, 4541 and udp retries and rtt timing. 4542 454316 May 2007: Wouter 4544 - lruhash_touch() would cause locking order problems. Fixup in 4545 lock-verify in case locking cycle is found. 4546 - services/cache/rrset.c for rrset cache code. 4547 - special rrset_cache LRU updating function that uses the rrset id. 4548 - no dependencies calculation when make clean is called. 4549 - config settings for infra cache. 4550 - daemon code slightly cleaner, only creates caches once. 4551 455215 May 2007: Wouter 4553 - host cache code. 4554 - unit test for host cache. 4555 455614 May 2007: Wouter 4557 - Port to OS/X and Dec Alpha. Printf format and alignment fixes. 4558 - extensive lock debug report on join timeout. 4559 - proper RTT calculation, in utility code. 4560 - setup of services/cache/infra, host cache. 4561 456211 May 2007: Wouter 4563 - iterator/iterator.c module. 4564 - fixup to pass reply_info in testcode and in netevent. 4565 456610 May 2007: Wouter 4567 - created release-0.3 svn tag. 4568 - util/module.h 4569 - fixed compression - no longer compresses root name. 4570 45719 May 2007: Wouter 4572 - outside network cleans up waiting tcp queries on exit. 4573 - fallback to TCP. 4574 - testbound replay with retry in TCP mode. 4575 - tpkg test for retry in TCP mode, against ldns-testns server. 4576 - daemon checks max number of open files and complains if not enough. 4577 - test where data expires in the cache. 4578 - compiletests: fixed empty body ifstatements in alloc.c, in case 4579 locks are disabled. 4580 45818 May 2007: Wouter 4582 - outgoing network keeps list of available tcp buffers for outgoing 4583 tcp queries. 4584 - outgoing-num-tcp config option. 4585 - outgoing network keeps waiting list of queries waiting for buffer. 4586 - netevent supports outgoing tcp commpoints, nonblocking connects. 4587 45887 May 2007: Wouter 4589 - EDNS read from query, used to make reply smaller. 4590 - advertised edns value constants. 4591 - EDNS BADVERS response, if asked for too high edns version. 4592 - EDNS extended error reponses once the EDNS record from the query 4593 has successfully been parsed. 4594 45954 May 2007: Wouter 4596 - msgreply sizefunc is more accurate. 4597 - config settings for rrset cache size and slabs. 4598 - hashtable insert takes argument so that a thread can use its own 4599 alloc cache to store released keys. 4600 - alloc cache special_release() locks if necessary. 4601 - rrset trustworthiness type added. 4602 - thread keeps a scratchpad region for handling messages. 4603 - writev used in netevent to write tcp length and data after another. 4604 This saves a roundtrip on tcp replies. 4605 - test for one rrset updated in the cache. 4606 - test for one rrset which is not updated, as it is not deemed 4607 trustworthy enough. 4608 - test for TTL refreshed in rrset. 4609 46103 May 2007: Wouter 4611 - fill refs. Use new parse and encode to answer queries. 4612 - stores rrsets in cache. 4613 - uses new msgreply format in cache. 4614 46152 May 2007: Wouter 4616 - dname unit tests in own file and spread out neatly in functions. 4617 - more dname unit tests. 4618 - message encoding creates truncated TC flagged messages if they do 4619 not fit, and will leave out (whole)rrsets from additional if needed. 4620 46211 May 2007: Wouter 4622 - decompress query section, extremely lenient acceptance. 4623 But only for answers from other servers, not for plain queries. 4624 - compression and decompression test cases. 4625 - some stats added. 4626 - example.conf interface: line is changed from 127.0.0.1 which leads 4627 to problems if used (restricting communication to the localhost), 4628 to a documentation and test address. 4629 463027 April 2007: Wouter 4631 - removed iov usage, it is not good for dns message encoding. 4632 - owner name compression more optimal. 4633 - rrsig owner name compression. 4634 - rdata domain name compression. 4635 463626 April 2007: Wouter 4637 - floating point exception fix in lock-verify. 4638 - lint uses make dependency 4639 - fixup lint in dname owner domain name compression code. 4640 - define for offset range that can be compressed to. 4641 464225 April 2007: Wouter 4643 - prettier code; parse_rrset->type kept in host byte order. 4644 - datatype used for hashvalue of converted rrsig structure. 4645 - unit test compares edns section data too. 4646 464724 April 2007: Wouter 4648 - ttl per RR, for RRSIG rrsets and others. 4649 - dname_print debug function. 4650 - if type is not known, size calc will skip DNAME decompression. 4651 - RRSIG parsing and storing and putting in messages. 4652 - dnssec enabled unit tests (from nlnetlabs.nl and se queries). 4653 - EDNS extraction routine. 4654 465520 April 2007: Wouter 4656 - code comes through all of the unit tests now. 4657 - disabled warning about spurious extra data. 4658 - documented the RRSIG parse plan in msgparse.h. 4659 - rrsig reading and outputting. 4660 466119 April 2007: Wouter 4662 - fix unit test to actually to tests. 4663 - fix write iov helper, and fakevent code. 4664 - extra builtin testcase (small packet). 4665 - ttl converted to network format in packets. 4666 - flags converted correctly 4667 - rdatalen off by 2 error fixup. 4668 - uses less iov space for header. 4669 467018 April 2007: Wouter 4671 - review of msgparse code. 4672 - smaller test cases. 4673 467417 April 2007: Wouter 4675 - copy and decompress dnames. 4676 - store calculated hash value too. 4677 - routine to create message out of stored information. 4678 - util/data/msgparse.c for message parsing code. 4679 - unit test, and first fixes because of test. 4680 * forgot rrset_count addition. 4681 * did & of ptr on stack for memory position calculation. 4682 * dname_pkt_copy forgot to read next label length. 4683 - test from file and fixes 4684 * double frees fixed in error conditions. 4685 * types with less than full rdata allowed by parser. 4686 Some dynamic update packets seem to use it. 4687 468816 April 2007: Wouter 4689 - following a small change in LDNS, parsing code calculates the 4690 memory size to allocate for rrs. 4691 - code to handle ID creation. 4692 469313 April 2007: Wouter 4694 - parse routines. Code that parses rrsets, rrs. 4695 469612 April 2007: Wouter 4697 - dname compare routine that preserves case, with unit tests. 4698 469911 April 2007: Wouter 4700 - parse work - dname packet parse, msgparse, querysection parse, 4701 start of sectionparse. 4702 470310 April 2007: Wouter 4704 - Improved alignment of reply_info packet, nice for 32 and 64 bit. 4705 - Put RRset counts in reply_info, because the number of RRs can change 4706 due to RRset updates. 4707 - import of region-allocator code from nsd. 4708 - set alloc special type to ub_packed_rrset_key. 4709 Uses lruhash entry overflow chain next pointer in alloc cache. 4710 - doxygen documentation for region-allocator. 4711 - setup for parse scratch data. 4712 47135 April 2007: Wouter 4714 - discussed packed rrset with Jelte. 4715 47164 April 2007: Wouter 4717 - moved to version 0.3. 4718 - added util/data/dname.c 4719 - layout of memory for rrsets. 4720 47213 April 2007: Wouter 4722 - detect sign of msghdr.msg_iovlen so that the cast to that type 4723 in netevent (which is there to please lint) can be correct. 4724 The type on several OSes ranges from int, int32, uint32, size_t. 4725 Detects unsigned or signed using math trick. 4726 - constants for DNS flags. 4727 - compilation without locks fixup. 4728 - removed include of unportable header from lookup3.c. 4729 - more portable use of struct msghdr. 4730 - casts for printf warning portability. 4731 - tweaks to tests to port them to the testbed. 4732 - 0.2 tag created. 4733 47342 April 2007: Wouter 4735 - check sizes of udp received messages, not too short. 4736 - review changes. Some memmoves can be memcpys: 4byte aligned. 4737 set id correctly on cached answers. 4738 - review changes msgreply.c, memleak on error condition. AA flag 4739 clear on cached reply. Lowercase queries on hashing. 4740 unit test on lowercasing. Test AA bit not set on cached reply. 4741 Note that no TTLs are managed. 4742 474329 March 2007: Wouter 4744 - writev or sendmsg used when answering from cache. 4745 This avoids a copy of the data. 4746 - do not do useless byteswap on query id. Store reply flags in uint16 4747 for easier access (and no repeated byteswapping). 4748 - reviewed code. 4749 - configure detects and config.h includes sys/uio.h for writev decl. 4750 475128 March 2007: Wouter 4752 - new config option: num-queries-per-thread. 4753 - added tpkg test for answering three queries at the same time 4754 using one thread (from the query service list). 4755 475627 March 2007: Wouter 4757 - added test for cache and not cached answers, in testbound replays. 4758 - testbound can give config file and commandline options from the 4759 replay file to unbound. 4760 - created test that checks if items drop out of the cache. 4761 - added word 'partitioned hash table' to documentation on slab hash. 4762 A slab hash is a partitioned hash table. 4763 - worker can handle multiple queries at a time. 4764 476526 March 2007: Wouter 4766 - config settings for slab hash message cache. 4767 - test for cached answer. 4768 - Fixup deleting fake answer from testbound list. 4769 477023 March 2007: Wouter 4771 - review of yesterday's commits. 4772 - covered up memory leak of the entry locks. 4773 - answers from the cache correctly. Copies flags correctly. 4774 - sanity check for incoming query replies. 4775 - slabbed hash table. Much nicer contention, need dual cpu to see. 4776 477722 March 2007: Wouter 4778 - AIX configure check. 4779 - lock-verify can handle references to locks that are created 4780 in files it has not yet read in. 4781 - threaded hash table test. 4782 - unit test runs lock-verify afterwards and checks result. 4783 - need writelock to update data on hash_insert. 4784 - message cache code, msgreply code. 4785 478621 March 2007: Wouter 4787 - unit test of hash table, fixup locking problem in table_grow(). 4788 - fixup accounting of sizes for removing items from hashtable. 4789 - unit test for hash table, single threaded test of integrity. 4790 - lock-verify reports errors nicely. More quiet in operation. 4791 479216 March 2007: Wouter 4793 - lock-verifier, checks consistent order of locking. 4794 479514 March 2007: Wouter 4796 - hash table insert (and subroutines) and lookup implemented. 4797 - hash table remove. 4798 - unit tests for hash internal bin, lru functions. 4799 480013 March 2007: Wouter 4801 - lock_unprotect in checklocks. 4802 - util/storage/lruhash.h for LRU hash table structure. 4803 480412 March 2007: Wouter 4805 - configure.ac moved to 0.2. 4806 - query_info and replymsg util/data structure. 4807 48089 March 2007: Wouter 4809 - added rwlock writelock checking. 4810 So it will keep track of the writelock, and readlocks are enforced 4811 to not change protected memory areas. 4812 - log_hex function to dump hex strings to the logfile. 4813 - checklocks zeroes its destroyed lock after checking memory areas. 4814 - unit test for alloc. 4815 - identifier for union in checklocks to please older compilers. 4816 - created 0.1 tag. 4817 48188 March 2007: Wouter 4819 - Reviewed checklock code. 4820 48217 March 2007: Wouter 4822 - created a wrapper around thread calls that performs some basic 4823 checking for data race and deadlock, and basic performance 4824 contention measurement. 4825 48266 March 2007: Wouter 4827 - Testbed works with threading (different machines, different options). 4828 - alloc work, does the special type. 4829 48302 March 2007: Wouter 4831 - do not compile fork funcs unless needed. Otherwise will give 4832 type errors as their typedefs have not been enabled. 4833 - log shows thread numbers much more nicely (and portably). 4834 - even on systems with nonthreadsafe libevent signal handling, 4835 unbound will exit if given a signal. 4836 Reloads will not work, and exit is not graceful. 4837 - start of alloc framework layout. 4838 48391 March 2007: Wouter 4840 - Signals, libevent and threads work well, with libevent patch and 4841 changes to code (close after event_del). 4842 - set ipc pipes nonblocking. 4843 484427 February 2007: Wouter 4845 - ub_thread_join portable definition. 4846 - forking is used if no threading is available. 4847 Tested, it works, since pipes work across processes as well. 4848 Thread_join is replaced with waitpid. 4849 - During reloads the daemon will temporarily handle signals, 4850 so that they do not result in problems. 4851 - Also randomize the outgoing port range for tests. 4852 - If query list is full, will stop selecting listening ports for read. 4853 This makes all threads service incoming requests, instead of one. 4854 No memory is leaking during reloads, service of queries, etc. 4855 - test that uses ldns-testns -f to test threading. Have to answer 4856 three queries at the same time. 4857 - with verbose=0 operates quietly. 4858 485926 February 2007: Wouter 4860 - ub_random code used to select ID and port. 4861 - log code prints thread id. 4862 - unbound can thread itself, with reload(HUP) and quit working 4863 correctly. 4864 - don't open pipes for #0, doesn't need it. 4865 - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload). 4866 486723 February 2007: Wouter 4868 - Can do reloads on sigHUP. Everything is stopped, and freed, 4869 except the listening ports. Then the config file is reread. 4870 And everything is started again (and listening ports if needed). 4871 - Ports for queries are shared. 4872 - config file added interface:, chroot: and username:. 4873 - config file: directory, logfile, pidfile. And they work too. 4874 - will daemonize by default now. Use -d to stay in the foreground. 4875 - got BSD random[256 state] code, made it threadsafe. util/random. 4876 487722 February 2007: Wouter 4878 - Have a config file. Removed commandline options, moved to config. 4879 - tests use config file. 4880 488121 February 2007: Wouter 4882 - put -c option in man page. 4883 - minievent fd array capped by FD_SETSIZE. 4884 488520 February 2007: Wouter 4886 - Added locks code and pthread spinlock detection. 4887 - can use no locks, or solaris native thread library. 4888 - added yacc and lex configure, and config file parsing code. 4889 also makedist.sh, and manpage. 4890 - put include errno.h in config.h 4891 489219 February 2007: Wouter 4893 - Created 0.0 svn tag. 4894 - added acx_pthread.m4 autoconf check for pthreads from 4895 the autoconf archive. It is GPL-with-autoconf-exception Licensed. 4896 You can specify --with-pthreads, or --without-pthreads to configure. 4897 489816 February 2007: Wouter 4899 - Updated testbed script, works better by using make on remote end. 4900 - removed check decls, we can compile without them. 4901 - makefile supports LIBOBJ replacements. 4902 - docs checks ignore compat code. 4903 - added util/mini-event.c and .h, a select based alternative used with 4904 ./configure --with-libevent=no 4905 It is limited to 1024 file descriptors, and has less features. 4906 - will not create ip6 sockets if ip6 not on the machine. 4907 490815 February 2007: Wouter 4909 - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64, 4910 Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc. 4911 - malloc rndstate, so that it is aligned for access. 4912 - fixed rbtree cleanup with postorder traverse. 4913 - fixed pending messages are deleted when handled. 4914 - You can control verbosity; default is not verbose, every -v 4915 adds more verbosity. 4916 491714 February 2007: Wouter 4918 - Included configure.ac changes from ldns. 4919 - detect (some) headers before the standards check. 4920 - do not use isblank to test c99, since its not available on solaris9. 4921 - review of testcode. 4922 * entries in a RANGE are no longer reversed. 4923 * print name of file with replay entry parse errors. 4924 - port to OSX: cast to int for some prints of sizet. 4925 - Makefile copies ldnstestpkts.c before doing dependencies on it. 4926 492713 February 2007: Wouter 4928 - work on fake events, first fwd replay works. 4929 - events can do timeouts and errors on queries to servers. 4930 - test package that runs replay scenarios. 4931 493212 February 2007: Wouter 4933 - work on fake events. 4934 49359 February 2007: Wouter 4936 - replay file reading. 4937 - fake event setup, it creates fake structures, and teardowns, 4938 added signal callbacks to reply to be able to fake those, 4939 and main structure of event replay routines. 4940 49418 February 2007: Wouter 4942 - added tcp test. 4943 - replay storage. 4944 - testcode/fake_event work. 4945 49467 February 2007: Wouter 4947 - return answer with the same ID as query was sent with. 4948 - created udp forwarder test. I've done some effort to make it perform 4949 quickly. After servers are created, no big sleep statements but 4950 it checks the logfiles to see if servers have come up. Takes 0.14s. 4951 - set addrlen value when calling recvfrom. 4952 - comparison of addrs more portable. 4953 - LIBEVENT option for testbed to set libevent directory. 4954 - work on tcp input. 4955 49566 February 2007: Wouter 4957 - reviewed code and improved in places. 4958 49595 February 2007: Wouter 4960 - Picked up stdc99 and other define tests from ldns. Improved 4961 POSIX define test to include getaddrinfo. 4962 - defined constants for netevent callback error code. 4963 - unit test for strisip6. 4964 49652 February 2007: Wouter 4966 - Created udp4 and udp6 port arrays to provide service for both 4967 address families. 4968 - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets. 4969 - listens on both ip4 and ip6 ports to provide correct return address. 4970 - worker fwder address filled correctly. 4971 - fixup timer code. 4972 - forwards udp queries and sends answer. 4973 49741 February 2007: Wouter 4975 - outside network more UDP work. 4976 - moved * closer to type. 4977 - comm_timer object and events. 4978 497931 January 2007: Wouter 4980 - Added makedist.sh script to make release tarball. 4981 - Removed listen callback layer, did not add anything. 4982 - Added UDP recv to netevent, worker callback for udp. 4983 - netevent communication reply storage structure. 4984 - minimal query header sanity checking for worker. 4985 - copied over rbtree implementation from NSD (BSD licensed too). 4986 - outgoing network query service work. 4987 498830 January 2007: Wouter 4989 - links in example/ldns-testpkts.c and .h for premade packet support. 4990 - added callback argument to listen_dnsport and daemon/worker. 4991 499229 January 2007: Wouter 4993 - unbound.8 a short manpage. 4994 499526 January 2007: Wouter 4996 - fixed memleak. 4997 - make lint works on BSD and Linux (openssl defines). 4998 - make tags works. 4999 - testbound program start. 5000 500125 January 2007: Wouter 5002 - fixed lint so it may work on BSD. 5003 - put license into header of every file. 5004 - created verbosity flag. 5005 - fixed libevent configure flag. 5006 - detects event_base_free() in new libevent 1.2 version. 5007 - getopt in daemon. fatal_exit() and verbose() logging funcs. 5008 - created log_assert, that throws assertions to the logfile. 5009 - listen_dnsport service. Binds ports. 5010 501124 January 2007: Wouter 5012 - cleaned up configure.ac. 5013 501423 January 2007: Wouter 5015 - added libevent to configure to link with. 5016 - util/netevent setup work. 5017 - configure searches for libevent. 5018 - search for libs at end of configure (when other headers and types 5019 have been found). 5020 - doxygen works with ATTR_UNUSED(). 5021 - util/netevent implementation. 5022 502322 January 2007: Wouter 5024 - Designed header file for network communication. 5025 502616 January 2007: Wouter 5027 - added readme.svn and readme.tests. 5028 50294 January 2007: Wouter 5030 - Testbed script (run on multiple platforms the test set). 5031 Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5. 5032 - added unit test tpkg. 5033 50343 January 2007: Wouter 5035 - committed first set of files into subversion repository. 5036 svn co svn+ssh://unbound.net/svn/unbound 5037 You need a ssh login. There is no https access yet. 5038 - Added LICENSE, the BSD license. 5039 - Added doc/README with compile help. 5040 - main program stub and quiet makefile. 5041 - minimal logging service (to stderr). 5042 - added postcommit hook that serves emails. 5043 - added first test 00-lint. postcommit also checks if build succeeds. 5044 - 01-doc: doxygen doc target added for html docs. And stringent test 5045 on documented files, functions and parameters. 5046 504715 December 2006: Wouter 5048 - Created Makefile.in and configure.ac. 5049