NLnetLabs/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-10-11 22:19:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,559 Commits 29 Branches 216 Tags
master
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
W.C.A. Wijngaards 40d36cda61 - Fix to allow for large (64Kb) packets with testbound. 2026-09-28 14:47:00 +02:00
W.C.A. Wijngaards 8cf2202c52 Changelog note and remove hash call assertion. 
- Merge #1518 from nshopik: rrset: rehash copies after
  changing the key.
 2026-09-28 11:56:09 +02:00
W.C.A. Wijngaards 97c001f9dd - Fix to log the errno for trust anchor write close fail. 2026-09-28 09:40:44 +02:00
W.C.A. Wijngaards a7fc80d8c5 - Unit test for CVE-2026-85501. 2026-09-16 10:47:44 +02:00
W.C.A. Wijngaards 5d89e0c2a7 - Unit test for CVE-2026-82717. 2026-09-16 10:44:49 +02:00
W.C.A. Wijngaards b45c8b4b53 - The code repository continues with 1.26.2 under development, 
that includes the changes from before the 1.26.1 commits.
 2026-09-16 10:34:06 +02:00
W.C.A. Wijngaards a6586ced92 Merge branch 'branch-1.26.1' 2026-09-16 10:26:54 +02:00
W.C.A. Wijngaards 13b6717f17 - Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch 
Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
  Xiang Li from Nankai University, AOSP Lab for the report. In
  addition, thanks to Qifan Zhang from Palo Alto Networks for a
  complimentary report.
 2026-09-16 09:30:25 +02:00
W.C.A. Wijngaards 0d4a6a63dd - Fix CVE-2026-82717, CNAME synthesis could lead to heap corruption. 
Thanks to Ben Morris from Anthropic for the report.
 2026-09-16 09:29:32 +02:00
W.C.A. Wijngaards bd71e3b8a6 - Fix CVE-2026-77860, 'serve-expired' can bypass Unbound 'wait-limit'. 
Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the
  University of Science and Technology of China (USTC) for the
  report.
 2026-09-16 09:29:04 +02:00
W.C.A. Wijngaards 3a6ba0da81 - Unit test for CVE-2026-81642 fix. 2026-09-16 09:28:11 +02:00
W.C.A. Wijngaards 3d65973d38 - Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC 
canonicalization. Thanks to Vlatko Kosturjak with Marlink Cyber,
  for the report.
 2026-09-16 09:27:17 +02:00
W.C.A. Wijngaards 565651cd02 - Fix CVE-2026-77955, Possible ZONEMD verification bypass window. 
Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
  for the report. In addition, thanks to Qifan Zhang from Palo Alto
  Networks for also reporting this issue.
 2026-09-16 09:26:00 +02:00
W.C.A. Wijngaards 7914901915 - Fix CVE-2026-78227, Use-after-free in DoQ stream output buffer on 
reset re-transmission. Thanks to Yuqi Qiu and Xiang Li from Nankai
  University, AOSP Lab for the report.
 2026-09-16 09:25:05 +02:00
W.C.A. Wijngaards eba3d35ad4 - Fix CVE-2026-82720, Use-after-free in DoH stream cleanup code path. 
Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
  for the report.
 2026-09-16 09:24:29 +02:00
W.C.A. Wijngaards 8c2e0fd6cc - Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code 
Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang Li
  from Nankai University, AOSP Lab for the report.
 2026-09-16 09:18:49 +02:00
W.C.A. Wijngaards e619ead2db - Fix CVE-2026-80225, Possible degradation of service from continuous 
queries on the same TCP/DoT connection. Thanks to Qifan Zhang from
  Palo Alto Networks for the report.
 2026-09-16 09:16:29 +02:00
W.C.A. Wijngaards eb86d9bc50 Set version to 1.26.1 2026-09-16 09:11:14 +02:00
W.C.A. Wijngaards 3ad9b6aade - For #1507: TOCTOU race in store_rrsets() can return a 
CNAME chain whose target owns no address.
 2026-09-15 13:03:24 +02:00
W.C.A. Wijngaards 5ccee67af2 - Fix to error on missing close parenthesis for zone file 
read and for url content read. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-09-10 16:12:49 +02:00
W.C.A. Wijngaards b8577a9c04 - Fix to construct the delegation point during DS NS find 
as a child side delegation point if that was the response.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-10 11:09:39 +02:00
W.C.A. Wijngaards 18d9a5519e - Fix to elevate the diagnostic for no matches for a wildcard 
trusted-keys-file, make it more descriptive, and more man
  page content for it. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-09-08 16:01:08 +02:00
W.C.A. Wijngaards 2df646e05f - Fix to not change the action override in rpz_config, before 
the cname override has succeeded.
 2026-09-04 17:20:15 +02:00
W.C.A. Wijngaards bdfa4d4c5d - Fix to make rpz_config leave the rpz with correct set up 
on failure. The struct is not half configured on exit.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-04 17:06:34 +02:00
W.C.A. Wijngaards bd210d124b - Fix that when a partial EDNS option is in a query, the 
response is a more RFC conformant FORMERR, since the EDNS
  option is malformed. Also fix to have an EDNS size for
  the reply error encoding for failed EDNS parse of the query.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 17:20:35 +02:00
W.C.A. Wijngaards 11900cc2b0 - Fix that when extended EDNS RCODE does not fit, at short 
udpsize, the reply is truncated with TC and fix for the
  rcode in that short reply to be a sensible rcode.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 15:27:10 +02:00
W.C.A. Wijngaards c04a5efb07 - Fix to reorder SVCB and HTTPS svcparams for unknown RR form 
zonefile input. If it can not be parsed it is leniently
  accepted, much like as a secondary it leniently accepts it.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-03 10:59:08 +02:00
W.C.A. Wijngaards 1060760650 - Remove unused .travis.yml for ci integration. 2026-09-03 10:25:31 +02:00
W.C.A. Wijngaards f251a1157b - Remove unused .travis.yml for ci integration. 2026-09-03 10:24:51 +02:00
W.C.A. Wijngaards 292cf6526b - Fix to match NSEC3 hash length to the NSEC3 algorithm, 
this stops negative cache overdeletion. It also contrains
  the hash label length and checks if the NSEC nextowner
  is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University,
  AOSP Lab).
 2026-09-03 08:38:46 +02:00
W.C.A. Wijngaards ac935b9144 - Fix to not commit to have_zone at apply AXFR time for auth 
zone transfers, so that later failure rolls back to not.
  The have_zone value is set later when the SOA is retrieved.
  Also fix to clear the zone data when a transfer does not
  have a valid SOA record in the zone for it.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-02 11:42:31 +02:00
W.C.A. Wijngaards 9dd370ba04 - Fix LOC RR parse to avoid double to uint32 cast overflow. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-09-01 17:21:45 +02:00
W.C.A. Wijngaards a6ccb2f74d - Fix to allow block_a and other local-zone types in a view. 2026-09-01 08:48:27 +02:00
W.C.A. Wijngaards 32ff948a5b - Fix notify for auth-zone during initial start up. It 
performs the transfer and not only lookup.
 2026-08-26 16:50:33 +02:00
W.C.A. Wijngaards 2ec2afd6b0 - Fix #132: Add harden-cname-follow: yes config option, that 
can be used to disable cname scrubbing. That can be useful
  for when the traffic is on localhost only.
 2026-08-24 16:06:17 +02:00
W.C.A. Wijngaards 7fb79b0677 - Fix to defend against double event deletion, that could cause 
event corruption and use after free, for comm_timer_disable.
 2026-08-21 10:29:58 +02:00
W.C.A. Wijngaards 8ee0bca833 - Fix stat_values.tdir test to have less test failures. 2026-08-11 10:07:38 +02:00
W.C.A. Wijngaards c58e6add2b - Fix #1492 from zacek: Data race in log_init() on 
key_created/log_lock when calling ub_ctx_create()
  concurrently from multiple threads.
 2026-08-11 09:42:30 +02:00
W.C.A. Wijngaards 93a56205cf - Fix #1489 from jplesnik: Replace removed Python 2 C API 
macros for SWIG 4.5.0 compatibility.
 2026-08-07 08:57:32 +02:00
W.C.A. Wijngaards 709f622658 Note issue number in Changlog entry. 2026-08-06 17:15:55 +02:00
W.C.A. Wijngaards 8b33c5d7ff - Fix #1487: regression in 1.26.0, ipsecmod is now always 
partly enabled.
 2026-08-06 09:46:18 +02:00
W.C.A. Wijngaards 36bd52afb9 Fix typo in Changelog. 2026-08-06 09:08:33 +02:00
W.C.A. Wijngaards b7d13ff12b - Fix ##1485: the list_forwards command omits port numbers. 
The list_forwards and list_stubs commands for
  unbound-control print port and tls auth name.
 2026-08-06 09:08:17 +02:00
W.C.A. Wijngaards bdfcfb861f - Fix to set makedist.sh to not wget config.sub and 
config.guess from git repo. The fetch times out, and the
  version from libtoolize is much more recent now than
  that it was when the wget was added.
 2026-08-04 10:04:34 +02:00
W.C.A. Wijngaards b444deffd2 Note 1.26.0 release. 2026-08-04 10:01:59 +02:00
W.C.A. Wijngaards ff28b7e5cf - For #1483: The failure reason when an NSEC NXDOMAIN is 
encountered when looking for an insecure delegation, is
  fixed to mention the NSEC records, instead of nonexistent
  NSEC3 records, that it attempted.
 2026-07-31 09:53:47 +02:00
W.C.A. Wijngaards 79b84bbc91 - Fix #1482: DNS-over-QUIC doesn't work with simple config. 
That fixes interface-automatic for use with doq service.
 2026-07-30 08:24:42 +02:00
W.C.A. Wijngaards cbfc3b0342 - Tag for 1.26.0rc1. The repo continues with version 1.26.1. 2026-07-28 09:45:59 +02:00
W.C.A. Wijngaards a45da353d3 - Fix to call OPENSSL_cleanup on exit when that is defined. 2026-07-24 17:04:38 +02:00
W.C.A. Wijngaards c21e3ee929 Changelog note for #1479 
- Merge #1479 from psumbera: Fix pthread detection on
  Solaris 11.4.
 2026-07-24 15:35:55 +02:00
W.C.A. Wijngaards 7cc7a43ff6 Changelog note for #1481. 
- Fix #1481: Fix to use tls-port after referral if
  tls-upstream is set.
 2026-07-24 15:32:20 +02:00
W.C.A. Wijngaards 9bd8df0149 - Fix to use tls-port after referral if tls-upstream is set. 2026-07-24 15:31:06 +02:00
W.C.A. Wijngaards 8f7411057f - Fix sign of comparison warning in shared ports setup. 2026-07-24 14:44:44 +02:00
W.C.A. Wijngaards ca1fe4f82a - Fix to guard access to shared ports interface array during 
set up, for analyzer.
 2026-07-24 14:38:46 +02:00
W.C.A. Wijngaards e183c2c506 - Fix unused variable warnings in shared_ports_fetch_random 
and shared_ports_return_port when compiled without threads.
 2026-07-24 14:37:17 +02:00
W.C.A. Wijngaards 52b18fc6f5 Changelog entry for #1480 
- Merge #1480 from petrvaganoff: authzone: fix memory leak in
  xfer_set_masters() error path.
 2026-07-24 12:25:34 +02:00
W.C.A. Wijngaards e597711824 - Fix lock test protect for auth zone change. 
- Fix to lock shared_ports structure during initialisation.
- Fix to lock anchor structure when file is set for it in
 2026-07-24 12:13:09 +02:00
W.C.A. Wijngaards e1e646c6fc - Fix to allow test fake sha1 on systems with possible sha1 
support.
- Fix to use sha256 for unbound-anchor unit test.
- Fix unbound-anchor check for return value of
  X509_NAME_get_text_by_NID of the emailaddress.
 2026-07-24 11:50:15 +02:00
W.C.A. Wijngaards fc3b5b4f63 - Update generated man pages. 2026-07-24 10:03:41 +02:00
W.C.A. Wijngaards 1e904a3ce5 - set code repository version to 1.26.0. 2026-07-24 09:45:49 +02:00
W.C.A. Wijngaards 79e100a7fb - Fix #1477: respip + dns64: dns64 uses A records modified by 
respip instead of original A records. Adds local-zone types
  block_a_wdata and block_aaaa_wdata, that are like block_a
  and block_aaaa, and uses local-data if present.
 2026-07-24 09:29:17 +02:00
W.C.A. Wijngaards a65d3d7283 - Unit test for block_a and block_aaaa. 2026-07-24 09:03:45 +02:00
W.C.A. Wijngaards 3b8766aa43 Changelog note for #1433 
- Merge #1433 from jisakiel: Add new static zone type
  block_aaaa to suppress AAAA queries.
 2026-07-24 08:53:30 +02:00
W.C.A. Wijngaards a05d460e66 - Fix mesh cycle detection for configuration with respip CNAME 
loop and tagged clients. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-23 16:28:45 +02:00
W.C.A. Wijngaards 5eb362a6c0 - Fix that the aggressive negative cache does not insert NSEC 
records with overreaching next owner name. Also the result
  is not above the trust anchor's bailiwick. Also RRSIGS are
  not considered valid when an NSEC next owner name is not
  under the signer zone name. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-07-23 16:17:59 +02:00
W.C.A. Wijngaards 0735cb28d1 - Fix that for NSEC3 proofs the NSEC3 zone, as the b32.name is 
checked to be the same as the signer name. Also RRSIGs are
  not considered valid when an NSEC3 is not b32.signerzone.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-23 15:54:59 +02:00
W.C.A. Wijngaards 737c28e836 Changelog entry for #1478 
- Merge #1478 from petrvaganoff: pythonmod: add check return
  value after ftell().
 2026-07-23 10:22:53 +02:00
W.C.A. Wijngaards 22e2c5b6d1 - Updated credits for Xuanchao Xie in 22 july changelog. 2026-07-23 10:01:10 +02:00
W.C.A. Wijngaards 914dbfea4e - iana portlist update. 2026-07-22 14:12:34 +02:00
W.C.A. Wijngaards cf5e6e89a5 - Fix error in log printout in fix for CVE-2026-50248, when the 
primary name is bogus.
 2026-07-22 12:16:49 +02:00
W.C.A. Wijngaards 4941edf275 - Unit test for CVE-2026-56416. 2026-07-22 12:06:00 +02:00
W.C.A. Wijngaards b08723ef97 - Unit test for CVE-2026-55973. 2026-07-22 12:04:35 +02:00
W.C.A. Wijngaards c163fbc505 - Unit test for CVE-2026-55717. 2026-07-22 12:03:48 +02:00
W.C.A. Wijngaards eed3f1ab38 - Unit test for CVE-2026-50248. 2026-07-22 12:00:19 +02:00
W.C.A. Wijngaards 63501f51bb - Unit test for CVE-2026-50243. 2026-07-22 11:59:36 +02:00
W.C.A. Wijngaards 1ae2570bda - Unit test for CVE-2026-46582. 2026-07-22 11:58:18 +02:00
W.C.A. Wijngaards 9ad825b267 - Unit test for CVE-2026-50045. 2026-07-22 11:57:13 +02:00
W.C.A. Wijngaards 3d5e6c0692 - Unit test for CVE-2026-44690. 2026-07-22 11:56:08 +02:00
W.C.A. Wijngaards 23e19ca6fc - Unit test for CVE-2026-44687. 2026-07-22 11:55:09 +02:00
W.C.A. Wijngaards 9f757aa9f3 - Unit test for CVE-2026-42955. 2026-07-22 11:54:00 +02:00
W.C.A. Wijngaards 1df6c170ff Changelog entry for 1.25.2. 
- Set the repository to 1.25.3, it continues with the previous
  changes.
 2026-07-22 11:38:48 +02:00
W.C.A. Wijngaards 7a95bedc26 Fix conflict merge fixup. 2026-07-22 11:36:06 +02:00
W.C.A. Wijngaards ae685bc33d Move repo to version 1.25.3. 2026-07-22 11:34:48 +02:00
W.C.A. Wijngaards 91ac449bcd Merge branch 'branch-1.25.2' 2026-07-22 11:33:54 +02:00
W.C.A. Wijngaards c33ad1b1a2 rerun autoconf. 2026-07-22 10:21:21 +02:00
W.C.A. Wijngaards 84d9682dd0 - Fix CVE-2026-56444, Degradation of resolution service when 
'discard-timeout' and 'serve-expired-client-timeout' are combined in
  unusual configuration. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report. In addition, thanks to Xin Wang, Jiapeng Li,
  and Jiajia Liu, Northwestern Polytechnical University, for also
  reporting this issue. In addition, thanks to Haruki Oyama (Waseda
  University), for also reporting this issue.
 2026-07-22 10:19:50 +02:00
W.C.A. Wijngaards 4b1635e194 - Fix CVE-2026-56416, Possible heap buffer overflow when validator 
canonicalizes RDATA that contains domain name. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:19:28 +02:00
W.C.A. Wijngaards aac261cbb3 - Fix CVE-2026-55991, Remote DNS-over-QUIC (DoQ) flow-control 
assertion failure in libngtcp2. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report. In addition, thanks to Xuanchao Xie,
  for also reporting this issue.
 2026-07-22 10:19:02 +02:00
W.C.A. Wijngaards ae1b3810cc - Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured 
Unbound. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:18:41 +02:00
W.C.A. Wijngaards 96f8755520 - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer 
overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:18:16 +02:00
W.C.A. Wijngaards 2ce2ca3691 - Fix CVE-2026-55717, 'serve-expired-client-timeout' and 'response-ip' 
CNAME redirect could lead to a crash. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report. In addition, thanks to Xin Wang,
  Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University,
  for also reporting this issue.
 2026-07-22 10:17:32 +02:00
W.C.A. Wijngaards c29ff70f6a - Fix CVE-2026-55708, Privacy/configuration issue when adding local 
data in views through 'unbound-control'. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-07-22 10:17:10 +02:00
W.C.A. Wijngaards 8a15ffee62 - Fix CVE-2026-54478, DNS Cookie bypass when combined with 
proxy-protocol use. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-07-22 10:16:42 +02:00
W.C.A. Wijngaards 8c702de175 - Fix CVE-2026-52863, Memory corruption could lead to crash and 
denial of service. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-07-22 10:16:03 +02:00
W.C.A. Wijngaards 804cff4c15 - Fix CVE-2026-50252, Possible cache poisoning attack by mapping 
source port population per thread. Thanks to Inbal Schussheim and
  Amit Klein, Hebrew University, for the report.
 2026-07-22 10:15:31 +02:00
W.C.A. Wijngaards e180b06298 - Fix CVE-2026-50251, Attacker supplied 0.0.0.0/:: glue triggers 
defensive full-cache flush. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-22 10:15:02 +02:00
W.C.A. Wijngaards 3530c81e29 - Fix CVE-2026-50248, BOGUS configured primary hostname accepted for 
XFR in auth/rpz zones. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-07-22 10:14:35 +02:00
W.C.A. Wijngaards 02b16de1ae - Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers 
instead of returning SERVFAIL. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-22 10:14:04 +02:00
W.C.A. Wijngaards 1ad8d4c395 - Fix CVE-2026-50046, Possible heap use-after-free in an error path 
when a DoT forwarded query is jostled out. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-07-22 10:13:36 +02:00
W.C.A. Wijngaards 364ac737f7 - Fix CVE-2026-50045, 'max-global-quota' reset by DNSSEC validation 
restarts. Thanks to Kunjie Shang, University of Science and
  Technology of China, for the report.
 2026-07-22 10:13:14 +02:00