Unbound

Recent Commits

• W.C.A. Wijngaards (16 Jun 26)

  - Fix for #1462: Fix that auth primary host name lookup allows CNAMEs.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix after malloc failure the rrset_insert_rr in localzone processing, during RPZ qname trigger processing, the RRset retains its previous data correcly. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix incorrect cleanup after an allocation failure for a delegation point in a region. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that after shared memory cannot be created, from `shm-enable`, the server does not crash. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that after malloc failure in find_tag_datas, the local_alias is cleaned up. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix incorrect cleanup after an allocation failure for a delegation point. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix for neater solution to clear log thread id after worker init failure. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that libunbound pipe functions fail with error after an event base is set. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix locking in libunbound ub_ctx_set_event call. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that dnscrypt configuration does not crash, due to inconsistency between secret and public keys. Also duplicate files are skipped. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that after malloc failure in RPZ load a half built list does not crash later. The newly created RRset is linked after creation has succeeded. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that for a zonefile only zone, if that file does not exist on server start, the server continues to start with a warning log message. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that after malloc failure a half-built local_alias does not crash the server. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that a signed wildcard NSEC, is checked before use, so it does not allow insecure DS proofs inappropriately. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that dns64 does not ignore the `forward-no-cache` and `stub-no-cache` options. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that auth-zone, and RPZ zones, do not allow out-of-zone records. These are records that are not under the zone apex. The out-of-zone records are dropped from the zone contents. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that a half-written trust anchor file does not crash the server at runtime. It unlinks a wrong file from the list. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix that when SVCB records cannot be written out, and are written in unknown format, that the zone read allows such unknown format SVCB records. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (16 Jun 26)

  - Fix to disallow $INCLUDE for secondary zones. Start up of server continues if a secondary zone fails to load. Failed loads clear the zone data, so there is no partial zone. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix that dns64 bypasses rpz-passthru rule during synthesis. This restricted more than necessary. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix misconfigured ipsecmod hook causing path name similarity with other file. The ipsecmod is changed for exec of the hook. The ipsecmod hook, if a script, has to start now with a line like `#!/bin/sh`. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix DNAME synthesis from cache that keeps use of 0TTL entries in a sliding window. It did not surpass RRSIG expiry. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix log of an aliased qname, to not use freed region memory. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix that fast_reload does not terminate the server for errors in config, for key files. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix integer overflow for very high values of `sock-queue-timeout`. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix erroneous DNS error report values after bogus AAAA query caused error information that was not cleared by a successful A subquery. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix integer overflow in infra-cache-max-rtt calculation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix for fast_reload that removes an auth zone while its lookups are in progress, for a primary name. Also after the change, it no longer picks up the old results. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix that fast_reload when a zonemd verification lookup it in progress with subnet loaded, deregisters the callback. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (15 Jun 26)

  - Fix that misconfigured `iter-scrub-ns: 0` causes request failures. Thanks to Qifan Zhang, Palo Alto Networks, for the report.