NLnetLabs/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-10-12 02:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,559 Commits 29 Branches 216 Tags
master
Commit Graph
69 Commits
Author SHA1 Message Date
W.C.A. Wijngaards 8d3348c71b - Fix that malloc failure during edns subnet addrtree 
insert is checked, so it does not crash later. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:55:33 +02:00
W.C.A. Wijngaards b53504049c - Fix that dns64 with subnetcache does not write ECS scoped 
answers to global cache. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-27 13:31:11 +02:00
W.C.A. Wijngaards af209a12ea - Fix subnet store of servfail to not leak memory. 2026-04-17 13:48:38 +02:00
W.C.A. Wijngaards 95083d4377 - Fix clang analyzer warning for subnetmod, when return_msg is 
NULL for update cache, like when it stores servfail status.
 2026-04-14 15:36:00 +02:00
W.C.A. Wijngaards 330d5211c9 - Fix for EDNS client subnet so that it does not store SERVFAIL in 
the global cache after a failed lookup, such as timeouts. A failure
  entry is stored in the subnet cache, for the query name, for a
  couple of seconds. Queries can continue to use the subnet cache
  during that time.
 2026-04-10 15:45:28 +02:00
W.C.A. Wijngaards bff3d762ff - Fix validator to set unchecked when validation recursion 
requests are passed. The edns subnet module checks if validation
  is needed for a cache response, and set the validator to protect
  the cache with validation for non-subnet lookups.
 2026-02-25 10:59:33 +01:00
W.C.A. Wijngaards 8546247292 - Fix edns subnet, that scope zero queries, when there is a 
subquery without subnet, and the forward-no-cache or
  stub-no-cache option is set, it is not stored in cache due to
  the forward or stub option.
 2026-01-06 09:32:21 +01:00
W.C.A. Wijngaards feeebc95f8 - Fix for #1344: Fix that respip and dns64 can be enabled at the 
same time, the client info is copied for attach_sub and add_sub
  calls. That makes respip work on dns64 synthesized answers, and
  also makes RPZ work with DNS64. The order for the modules is
  module-config: "respip dns64 validator iterator".
 2025-09-30 11:28:15 +02:00
W.C.A. Wijngaards 3ec5d78ac9 - Fix that edns-subnet failure to create a subquery errors as 
servfail, and not formerror.
 2025-08-07 16:09:47 +02:00
W.C.A. Wijngaards 305adf12bf - Fix edns subnet, so that the subquery without subnet is stored in 
global cache if the querier used 0.0.0.0/0 and the name and address
  do not receive subnet treatment. If the name and address are
  configured for subnet, it is stored in the subnet cache.
 2025-08-06 12:01:42 +02:00
W.C.A. Wijngaards ad0e0fc290 Merge branch 'branch-1.23.1' 2025-07-16 11:34:44 +02:00
W.C.A. Wijngaards 5bf82f2464 - Fix RebirthDay Attack CVE-2025-5994, reported by Xiang Li from AOSP 
Lab Nankai University.
 2025-07-16 10:02:01 +02:00
Jose Luis Duran 41c55ffac1 Fix typos (#1299) 2025-07-02 10:50:49 +02:00
Kostya d3f88d008f edns-subnet: fix NULL_AFTER_DEREF on subnetmod (#1297) 
Found by static analyzer svace.
Static analyzer message: Redundant comparison with a NULL value at subnetmod.c:236 for pointer 'sn_env->subnet_msg_cache',
which was dereferenced at slabhash.c:228 by passing as 1st parameter to function 'slabhash_setmarkdel' at subnetmod.c:235.

Moved usage of sn_env->subnet_msg_cache in slabhash_setmarkdel after checking.

Signed-off-by: Konstantin Kamanin <[email protected]>
 2025-06-19 16:24:21 +02:00
W.C.A. Wijngaards a335e601e4 ipset-pf-support, move startup and destartup to the front of the module 
func block functions, modstack call deinit function names, and detect
module change when no startup functions are needed.
 2024-07-03 13:53:44 +02:00
W.C.A. Wijngaards ff653a7ef8 Call module init init again, and new function startup and destartup. 
NULL can be used if the function is not used. Open shared ports during
reload. Deinit is called during reload.
 2024-07-01 16:10:07 +02:00
W.C.A. Wijngaards 3953f827fb Merge branch 'master' of https://github.com/madroach/unbound into ipset-pf-support 2024-07-01 14:36:33 +02:00
W.C.A. Wijngaards 7c5e765b3b - Fix cachedb with serve-expired-client-timeout disabled. The edns 
subnet module deletes global cache and cachedb cache when it
  stores a result, and serve-expired is enabled, so that the global
  reply, that is older than the ecs reply, does not return after
  the ecs reply expires.
 2024-04-26 13:32:15 +02:00
Wouter Wijngaards ced9762b14 Merge pull request #1041 from NLnetLabs/stubfwd-unshare 
Stub and Forward unshare
 2024-04-25 11:11:00 +02:00
W.C.A. Wijngaards 52aff65e35 - Fix edns subnet to sort rrset references when storing messages 
in the cache. This fixes a race condition in the rrset locks.
 2024-04-22 13:44:42 +02:00
W.C.A. Wijngaards f2fb498c69 - fast-reload, unshare forwards, making the structure locked, with an rwlock. 2024-04-03 13:55:54 +02:00
W.C.A. Wijngaards eb3e1ae24f - Fix #1032: The size of subnet_msg_cache calculation mistake cause 
memory usage increased beyond expectations.
 2024-03-27 11:45:34 +01:00
W.C.A. Wijngaards 6d0812b567 - Fix edns subnet so that queries with a source prefix of zero cause 
the recursor send no edns subnet option to the upstream.
 2023-10-09 12:21:22 +02:00
George Thessalonikefs a952ac17be Merge branch 'tilan7663-subnet_cache_prefetch' into subnet_cache_prefetch 2023-07-07 16:50:58 +02:00
George Thessalonikefs 40e47bf767 - For #664: easier code flow for subnetcache prefetching. 
- For #664: add testcase.
 2023-07-06 22:22:21 +02:00
Philip Homburg fb06364014 Fix issue #825: interaction between ECS and serve-expired. 2023-02-21 09:20:28 +01:00
George Thessalonikefs d7a9def160 - Clear documentation for interactivity between the subnet module and 
the serve-expired and prefetch configuration options.
 2022-11-30 14:45:36 +01:00
Yorgos Thessalonikefs c4e51a4cfe PROXYv2 downstream support (#760) 2022-10-03 15:29:47 +02:00
W.C.A. Wijngaards 0f08cc6d55 - Fix edns subnet so that scope 0 answers only match sourcemask 0 
queries for answers from cache if from a query with sourcemask 0.
 2022-08-02 14:13:55 +02:00
Philip Homburg 3bade62c8a Fix use after free issue with edns options (https://github.com/NLnetLabs/unbound/issues/663) 2022-06-22 15:00:28 +02:00
George Thessalonikefs 459b73018f - Fix for edns client subnet to respect not looking in its cache when 
instructed to do so (e.g., prefetch).
 2022-06-03 16:11:35 +02:00
George Thessalonikefs 91c298c901 Merge branch 'subnet_cache_prefetch' of https://github.com/tilan7663/unbound into tilan7663-subnet_cache_prefetch 2022-05-17 16:16:09 +03:00
George Thessalonikefs daf316ea1b - Fix #417: prefetch and ECS causing cache corruption when used 
together.
 2022-05-12 00:56:01 +02:00
Tian Lan 8afbc0944f Add prefetch support for subnet cache entries 
- Entries in the subnet cache should now be prefetched.

- Rename testdata subnet_*.crpl to subnet_*.rpl so they are visible to
  make test

Signed-off-by: Tian Lan <[email protected]>
 2022-04-29 11:46:05 -04:00
W.C.A. Wijngaards 7749d98a14 - Fix for edns client subnet option add fix in removal code, from review. 2022-02-28 14:51:35 +01:00
W.C.A. Wijngaards 8e8ccfe3c3 - Fix edns client subnet to add the option based on the option list, 
so that it is not state dependent, after the state fix of #605 for
  double EDNS options.
 2022-02-28 14:39:48 +01:00
Dimitris Apostolou c21d6af617 Fix typos 2021-11-13 16:56:15 +02:00
W.C.A. Wijngaards 55ba863440 - Fix that nxdomain synthesis does not happen above the stub or 
forward definition.
 2021-04-13 13:52:57 +02:00
George Thessalonikefs d69132b921 - Fix #384: (1) A minor request to improve the log (2) A minor bug in 
one log message.
 2021-02-24 12:00:11 +01:00
Christopher Zimmermann 1d23e0c920 Merge remote-tracking branch 'upstream/master' 2021-02-03 13:19:19 +01:00
Ralph Dolmans 99fd6cf711 - Cache ECS answers with longest scope of CNAME chain. 2020-05-15 13:13:49 +02:00
Christopher Zimmermann c96e4ca121 allow privileged initialisation of modules 2020-05-10 22:30:25 +02:00
gthess f7fe95ad7b Serve stale (#159) 
- Added serve-stale functionality as described in
  draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used
  to configure the behavior.
- Updated cachedb to honor `serve-expired-ttl`; Fixes #107.
- Renamed statistic `num.zero_ttl` to `num.expired` as expired replies
  come with a configurable TTL value (`serve-expired-reply-ttl`).
- Fixed stats when replying with cached, cname-aliased records.
- Added missing default values for redis cachedb backend.
 2020-02-05 14:20:27 +01:00
W.C.A. Wijngaards e3453711e5 - Fix edns-subnet locks, in error cases the lock was not unlocked. 2019-05-07 16:10:22 +02:00
Wouter Wijngaards 0ff5c52657 - Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work. 
git-svn-id: file:///svn/unbound/trunk@4981 be551aaa-1e26-0410-a405-d3ace91eadb9
 2018-11-27 10:29:14 +00:00
Ralph Dolmans 640d1cf929 - Bugfix min-client-subnet-ipv6 
git-svn-id: file:///svn/unbound/trunk@4958 be551aaa-1e26-0410-a405-d3ace91eadb9
 2018-11-06 09:44:10 +00:00
Ralph Dolmans 6021341118 - Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options. 
git-svn-id: file:///svn/unbound/trunk@4951 be551aaa-1e26-0410-a405-d3ace91eadb9
 2018-10-25 08:53:50 +00:00
Ralph Dolmans 140a165ab2 - Add markdel function to ECS slabhash. 
- Limit ECS scope returned to client to the scope used for caching.      
 - Make lint like previous #4154 fix. 


git-svn-id: file:///svn/unbound/trunk@4946 be551aaa-1e26-0410-a405-d3ace91eadb9
 2018-10-24 13:50:18 +00:00
Wouter Wijngaards 5fec1c8b1f - Fix #4154: make ECS_MAX_TREESIZE configurable, with 
the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options.


git-svn-id: file:///svn/unbound/trunk@4945 be551aaa-1e26-0410-a405-d3ace91eadb9
 2018-10-22 14:54:28 +00:00
Wouter Wijngaards 8893735a2d edns-subnet retain rcode when no return_msg, for log-servfail. 
git-svn-id: file:///svn/unbound/trunk@4868 be551aaa-1e26-0410-a405-d3ace91eadb9
 2018-08-21 14:25:07 +00:00