NLnetLabs/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-10-12 02:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,601 Commits 29 Branches 216 Tags
auth-load-thread
Commit Graph
862 Commits
Author SHA1 Message Date
W.C.A. Wijngaards add0065c43 - auth-load-thread, write to zonefile polls for thread quit. 2026-10-06 15:07:54 +02:00
W.C.A. Wijngaards cb027ae649 Merge branch 'master' into auth-load-thread 2026-10-05 09:02:28 +02:00
W.C.A. Wijngaards 40d36cda61 - Fix to allow for large (64Kb) packets with testbound. 2026-09-28 14:47:00 +02:00
W.C.A. Wijngaards a6586ced92 Merge branch 'branch-1.26.1' 2026-09-16 10:26:54 +02:00
W.C.A. Wijngaards 13b6717f17 - Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch 
Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
  Xiang Li from Nankai University, AOSP Lab for the report. In
  addition, thanks to Qifan Zhang from Palo Alto Networks for a
  complimentary report.
 2026-09-16 09:30:25 +02:00
W.C.A. Wijngaards 3a6ba0da81 - Unit test for CVE-2026-81642 fix. 2026-09-16 09:28:11 +02:00
W.C.A. Wijngaards 3d65973d38 - Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC 
canonicalization. Thanks to Vlatko Kosturjak with Marlink Cyber,
  for the report.
 2026-09-16 09:27:17 +02:00
W.C.A. Wijngaards e619ead2db - Fix CVE-2026-80225, Possible degradation of service from continuous 
queries on the same TCP/DoT connection. Thanks to Qifan Zhang from
  Palo Alto Networks for the report.
 2026-09-16 09:16:29 +02:00
W.C.A. Wijngaards 156c00a727 Merge branch 'master' into auth-load-thread 2026-08-10 16:42:59 +02:00
akhanin-dnsf 307fc6f062 - Fix bounds check in packed_rr_to_string, it checked the (#1488) 
assembled rr length against the output string length
  dest_len, instead of against the size of the rr buffer it
  writes into. Callers in cachedump.c and remote.c pass a
  dest_len larger than that buffer.
- Unit test for packed_rr_to_string.
 2026-08-06 17:04:05 +02:00
W.C.A. Wijngaards a45da353d3 - Fix to call OPENSSL_cleanup on exit when that is defined. 2026-07-24 17:04:38 +02:00
W.C.A. Wijngaards 91ac449bcd Merge branch 'branch-1.25.2' 2026-07-22 11:33:54 +02:00
W.C.A. Wijngaards aac261cbb3 - Fix CVE-2026-55991, Remote DNS-over-QUIC (DoQ) flow-control 
assertion failure in libngtcp2. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report. In addition, thanks to Xuanchao Xie,
  for also reporting this issue.
 2026-07-22 10:19:02 +02:00
W.C.A. Wijngaards 8c702de175 - Fix CVE-2026-52863, Memory corruption could lead to crash and 
denial of service. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-07-22 10:16:03 +02:00
W.C.A. Wijngaards 804cff4c15 - Fix CVE-2026-50252, Possible cache poisoning attack by mapping 
source port population per thread. Thanks to Inbal Schussheim and
  Amit Klein, Hebrew University, for the report.
 2026-07-22 10:15:31 +02:00
W.C.A. Wijngaards f52a9e864b - Fix CVE-2026-44621, Libunbound applications configured with 
'unwanted-reply-threshold' could eventually be abruptly
  terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-07-22 10:11:26 +02:00
W.C.A. Wijngaards 27f22b8808 - Fix CVE-2026-41637, Degradation of resolution service from 
improperly accounted client-terminated DNS-over-QUIC queries. Thanks
  to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:10:24 +02:00
W.C.A. Wijngaards 0a5cde80f1 - auth-load-thread, auth-task-threads: num config option that enables and 
disables the auth load thread.
 2026-07-03 14:03:15 +02:00
W.C.A. Wijngaards 672b9659cf - Fix #1469: dohclient: DoH POST missing content-length → :status 
400 from strict resolvers (Cloudflare, Mullvad).
 2026-06-30 12:14:00 +02:00
W.C.A. Wijngaards 8f2fbd66fc - Fix that malloc failure for ngtcp2_conn_server_new 
cleans up reference that older ngtcp2 versions can leave.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:33:06 +02:00
W.C.A. Wijngaards 316b9ab4fc - Fix for #1306: configure detects specifically the call to 
SSL_set_quic_tls_early_data_enabled and
  SSL_set_quic_early_data_enabled, so the correct one is used.
 2026-06-11 11:04:50 +02:00
W.C.A. Wijngaards e7a713a525 - Fix unit test for ecs to check for malloc success. 2026-06-09 16:41:37 +02:00
W.C.A. Wijngaards 5748f518d1 - Fix that quotation and escaping works the same in auth-zone 
url content, as in the zonefile read. Thanks to Qifan Zhang,
  Palo Alto Networks for the report.
 2026-06-03 14:32:14 +02:00
W.C.A. Wijngaards d05eff4d54 - Fix parse of svcbparam ech, it had incorrect length. Thanks 
to Qifan Zhang, Palo Alto Networks for the report.
 2026-06-03 14:05:48 +02:00
W.C.A. Wijngaards 758c649611 - Fix that the ratelimit is decremented on successful 
referrals. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-05-27 12:16:23 +02:00
W.C.A. Wijngaards fe946ba4e9 - Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, 
cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:13:55 +02:00
W.C.A. Wijngaards e1d146d6b0 - Fix test with https zone for libressl. 2026-04-20 16:10:33 +02:00
W.C.A. Wijngaards 86a8be75f0 - Fix compile warnings for thread setname routine, and test compile. 2026-04-20 12:24:28 +02:00
W.C.A. Wijngaards a0ec6cd946 - Fix test code to allow empty hex answer packets from testbound. 2026-03-27 15:39:27 +01:00
W.C.A. Wijngaards 535d899bef - Fix for testcode pktview to check buffer size and log errors. 2026-03-20 15:57:46 +01:00
W.C.A. Wijngaards 8b4b2a88f7 - Fix local privilege escalation on Windows. Thanks to Hao Huang 
for the report. The OpenSSL init calls are set to not load
  the openssl.cnf file when compiled for Windows.
 2026-02-04 11:54:11 +01:00
Yorgos Thessalonikefs faf40c97fc - Eagerly remove .skip mark files in between mini_tdir.sh runs in case 
there has been a change on the environment.
 2026-02-03 15:08:59 +01:00
W.C.A. Wijngaards 9b123d1b78 - Fix http test tool petal to not print errors when there is no 
error.
 2026-01-22 14:19:35 +01:00
nnarayanamurthy fe10bc7682 QNX Porting support for unbound branch-1.24.1 (#1388) 
* qnx Porting support for version release-1.24.1

* updating __QNXNTO__ with __QNX__
 2026-01-21 13:12:13 +01:00
Petr Menšík 18e098285e Do not initialize quic_table unless it is enabled (#1381) 
* Do not initialize quic_table unless it is enabled

Fedora in FIPS mode might fail to initialize ngtcp2 library, because
some ciphers desired are not available.

Make it possible to skip initialization by setting explicitly quic_port
to 0. Unless we have some listeners for port 853 configured, skip its
initialization as well.

Related: https://pagure.io/freeipa/issue/9877

* Fix typo in logged function name
 2026-01-08 14:12:32 +01:00
Goetz Goerisch adb0374a4d Fix documentation to adhere to RFC 5952 
Update the text representations of IPv6 addresses.
 2026-01-06 16:10:37 +01:00
W.C.A. Wijngaards 5c66c48a1b - Fix to add EDNS CO flag to testbound and debug message log. 2025-12-01 15:29:41 +01:00
W.C.A. Wijngaards a75ea01a15 - Fix #1358 Enabling FIPS in OpenSSL causes unit test to fail. 2025-10-10 09:17:08 +02:00
W.C.A. Wijngaards c170ed1b30 - Fix sha1 enable environment variable in test code on windows. 2025-08-22 10:04:57 +02:00
W.C.A. Wijngaards 08d59c9a78 - Fix dname_str for printout of long names. Thanks to Jan Komissar 
for the fix.
 2025-08-07 09:45:02 +02:00
W.C.A. Wijngaards 5758427d86 - Fix testbound test program to accurately output packets from hex. 2025-08-01 10:34:12 +02:00
W.C.A. Wijngaards 9fe92d1119 - Fix detection of SSL_CTX_set_tmp_ecdh function. 2025-07-11 15:47:59 +02:00
Yorgos Thessalonikefs 4200d23882 - For #1247, replay test (added tcp_transport to 
outnet_serviced_query).
 2025-06-25 14:02:47 +02:00
W.C.A. Wijngaards a1d68cdc96 - Fix #1296: DNS over QUIC depends on a very outdated version of 
ngtcp2. Fixed so it works with ngtcp2 1.13.0 and OpenSSL 3.5.0.
 2025-06-19 14:39:45 +02:00
W.C.A. Wijngaards a8aa1dbbe1 - Fix conditional expressions with parentheses for bitwise and. 2025-06-11 16:42:43 +02:00
W.C.A. Wijngaards ff7dfd52a2 - Fix #1288: [FR] Improve fuzzing of unbound by adapting the netbound 
program.
 2025-05-21 12:41:54 +02:00
W.C.A. Wijngaards 21e3278400 - Fix #1283: Unsafe usage of atoi() while parsing the configuration 
file.
 2025-05-12 14:57:42 +02:00
Yorgos Thessalonikefs 4e23523d1a Fix auth nsec3 code (#1280) 
- Fix NSEC3 code to not break on broken auth zones that include unsigned
  out of zone (above apex) data. Could lead to hang while trying to
  prove a wildcard answer.
  Reported by Dmitrii Kuvaiskii from Amazon Web Services.

- Tests for NSEC3 auth zones with out of zone data.
 2025-05-12 14:26:47 +02:00
Yorgos ThessalonikefsandWouter Wijngaards fcc21885e4 Auto-configure '-slabs' values (#1276) 
- Auto-configure '-slabs' values to a power of 2 value close to num-threads
  by default for multi-threaded environments.

Co-authored-by: Wouter Wijngaards <[email protected]>
 2025-04-29 15:21:47 +02:00
W.C.A. Wijngaards c88fa02c18 - Fix #1272: assertion failure testcode/unitverify.c:202. 2025-04-25 11:12:28 +02:00