Unbound

Recent Commits

• W.C.A. Wijngaards(03 Sept 26)

  - Fix that when a partial EDNS option is in a query, the response is a more RFC conformant FORMERR, since the EDNS option is malformed. Also fix to have an EDNS size for the reply error encoding for failed EDNS parse of the query. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards(03 Sept 26)

  - Fix that when extended EDNS RCODE does not fit, at short udpsize, the reply is truncated with TC and fix for the rcode in that short reply to be a sensible rcode. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards(03 Sept 26)

  - Fix to reorder SVCB and HTTPS svcparams for unknown RR form zonefile input. If it can not be parsed it is leniently accepted, much like as a secondary it leniently accepts it. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards(03 Sept 26)

  - Remove unused .travis.yml for ci integration.

• W.C.A. Wijngaards(03 Sept 26)

  - Remove unused .travis.yml for ci integration.

• W.C.A. Wijngaards(03 Sept 26)

  - Fix to match NSEC3 hash length to the NSEC3 algorithm, this stops negative cache overdeletion. It also contrains the hash label length and checks if the NSEC nextowner is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University, AOSP Lab).

• W.C.A. Wijngaards(02 Sept 26)

  - Fix to not commit to have_zone at apply AXFR time for auth zone transfers, so that later failure rolls back to not. The have_zone value is set later when the SOA is retrieved. Also fix to clear the zone data when a transfer does not have a valid SOA record in the zone for it. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards(01 Sept 26)

  - Fix LOC RR parse to avoid double to uint32 cast overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards(01 Sept 26)

  - Fix to allow block_a and other local-zone types in a view.

• W.C.A. Wijngaards(26 Aug 26)

  - Fix notify for auth-zone during initial start up. It performs the transfer and not only lookup.

• W.C.A. Wijngaards(24 Aug 26)

  - Fix #132: Add `harden-cname-follow: yes` config option, that can be used to disable cname scrubbing. That can be useful for when the traffic is on localhost only.

• W.C.A. Wijngaards(21 Aug 26)

  - Fix to defend against double event deletion, that could cause event corruption and use after free, for comm_timer_disable.

• W.C.A. Wijngaards(11 Aug 26)

  - Fix stat_values.tdir test to have less test failures.

• W.C.A. Wijngaards(11 Aug 26)

  - Fix #1492 from zacek: Data race in log_init() on key_created/log_lock when calling ub_ctx_create() concurrently from multiple threads.

• W.C.A. Wijngaards(07 Aug 26)

  - Fix #1489 from jplesnik: Replace removed Python 2 C API macros for SWIG 4.5.0 compatibility.

• W.C.A. Wijngaards(06 Aug 26)

  Note issue number in Changlog entry.

• akhanin-dnsf(06 Aug 26)

  - Fix bounds check in packed_rr_to_string, it checked the (#1488) assembled rr length against the output string length dest_len, instead of against the size of the rr buffer it writes into. Callers in cachedump.c and remote.c pass a dest_len larger than that buffer. - Unit test for packed_rr_to_string.

• W.C.A. Wijngaards(06 Aug 26)

  - Fix #1487: regression in 1.26.0, ipsecmod is now always partly enabled.

• W.C.A. Wijngaards(06 Aug 26)

  Fix typo in Changelog.

• W.C.A. Wijngaards(06 Aug 26)

  - Fix ##1485: the list_forwards command omits port numbers. The list_forwards and list_stubs commands for unbound-control print port and tls auth name.

• W.C.A. Wijngaards(04 Aug 26)

  - Fix to set makedist.sh to not wget config.sub and config.guess from git repo. The fetch times out, and the version from libtoolize is much more recent now than that it was when the wget was added.

• W.C.A. Wijngaards(04 Aug 26)

  Note 1.26.0 release.

• W.C.A. Wijngaards(31 Jul 26)

  - For #1483: The failure reason when an NSEC NXDOMAIN is encountered when looking for an insecure delegation, is fixed to mention the NSEC records, instead of nonexistent NSEC3 records, that it attempted.

• W.C.A. Wijngaards(30 Jul 26)

  - Fix #1482: DNS-over-QUIC doesn't work with simple config. That fixes interface-automatic for use with doq service.

• W.C.A. Wijngaards(28 Jul 26)

  - Tag for 1.26.0rc1. The repo continues with version 1.26.1.

• W.C.A. Wijngaards(24 Jul 26)

  - Fix to call OPENSSL_cleanup on exit when that is defined.

• W.C.A. Wijngaards(24 Jul 26)

  Changelog note for #1479 - Merge #1479 from psumbera: Fix pthread detection on Solaris 11.4.

• Petr Sumbera(24 Jul 26)

  Fix pthread detection on Solaris 11.4 (#1479) AX_PTHREAD requires _REENTRANT to confirm that pthread support is enabled. Solaris 11.4 headers no longer use the macro, and GCC 16 therefore no longer defines it for -pthread. Detect XPG7 support in the target headers and require _REENTRANT only on older Solaris releases. The existing pthread compile and link test remains the final capability check. This follows the canonical Autoconf Archive change: https://github.com/autoconf-archive/autoconf-archive/pull/341 Regenerate configure with Autoconf 2.71. Tested on Solaris 11.4 with GCC 15.2 and GCC 16.1. The Autoconf Archive change was also tested on Solaris 11.3. Co-authored-by: Rainer Orth <[email protected]>

• W.C.A. Wijngaards(24 Jul 26)

  Changelog note for #1481. - Fix #1481: Fix to use tls-port after referral if tls-upstream is set.

• W.C.A. Wijngaards(24 Jul 26)

  - Fix to use tls-port after referral if tls-upstream is set.