-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi,
Unbound 1.5.0 is available http://www.unbound.net/downloads/unbound-1.5.0.tar.gz sha1: 6eb6d783b7376a48dc0b3dccfd8723d7074b4279 sha256: 9fde4aeb8258bc864cd5e5d6d9b8bcf8fa12a57059424fece1c6adcc6387b876 The 1.5.0 release for unbound has the usual list of bugfixes, as well as a couple of features: a DNS64 module for dns64 support and DNSTAP support (for information gathering). Additionally, it has better random number generation on many platforms with better entropy. Libunbound has a new routine ub_ctx_add_ta_autr() to add an RFC5011 tracked anchor while using the library. Statistics prints number of tcp outgoing traffic. Unbound-control can flush_negative all error and nonexist responses for use when a validating-end-host changes networks. Unbound.conf has unblock-lan-zones for use when unbound is running in a LAN. The libunbound API version is incremented, it is binary compatible with the previous one (an extra function is available in the dynamic library). Features - - This release has DNS64, DNSTAP, better random numbers and ub_ctx_add_ta_autr(), num.query.tcpout=value, flush_negative, unblock-lan-zones conf. - - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root hints (patch from Anand Buddhdev). - - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation option for DNS fragmentation defense. - - unbound-control stats prints num.query.tcpout with number of TCP outgoing queries made in the previous statistics interval. - - Patch from Jeremie Courreges-Anglas to use arc4random_uniform if available on the OS, it gets entropy from the OS. - - Add unbound-control flush_negative that flushed nxdomains, nodata, and errors from the cache. For dnssec-trigger and NetworkManager, fixes cases where network changes have localdata that was already negatively cached from the previous network. - - Contrib windows scripts from Yuri Voinov added to src/contrib: create_unbound_ad_servers.cmd: enters anti-ad server lists. unbound_cache.cmd: saves and loads the cache. Also warmup.cmd (and .sh): warm up the DNS cache with your MRU domains. - - Added unbound-control-setup.cmd from Yuri Voinov to the windows unbound distribution set. It requires openssl installed in %PATH%. - - Implement draft-ietf-dnsop-rfc6598-rfc6303-01. - - Feature, unblock-lan-zones: yesno that you can use to make unbound perform 10.0.0.0/8 and other reverse lookups normally, for use if unbound is running service for localhost on localhost. - - unbound-host -D enabled dnssec and reads root trust anchor from the default root key file that was compiled in. - - Add AAAA for B root server to default root hints. - - unbound-control status reports if so-reuseport was successful. - - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X. - - arc4random in compat/ and getentropy, explicit_bzero, chacha for dependencies, from OpenBSD. arc4_lock and sha512 in compat. This makes arc4random available on all platforms, except when compiled with LIBNSS (it uses libNSS crypto random). - - Patch from Dag-Erling Smorgrav that implements that: unbound -dd does not fork in the background and also logs to stderr. - - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault. Initial commit of the patch from the FreeBSD base (with its fixes). This adds a module (for module-config in unbound.conf) dns64 that performs DNS64 processing, see README.DNS64. - - Patch add msg, rrset, infra and key cache sizes to stats command from Maciej Soltysiak. - - DNSTAP support, with a patch from Farsight Security, written by Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c. It is BSD licensed (see dnstap/dnstap.c). Also --with-libfstrm and - --with-protobuf-c configure options. - - type CDS and CDNSKEY types. - - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue is longer and more tcp connections can be handled. - - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically tracked trust anchor to libunbound. Bug Fixes - - Fix print filename of encompassing config file on read failure. - - Patch from Stuart Henderson to build unbound-host man from .1.in. - - [bugzilla: 569 ] Fix do_tcp is do-tcp in unbound.conf man page. - - [bugzilla: 572 ] Fix unit test failure for systems with different /etc/services. - - iana portlist updated. - - [bugzilla: 574 ] Fix make test fails on Ubuntu 14.04. Disabled remote-control in testbound scripts. - - Documented that dump_requestlist only prints queries from thread 0. - - [bugzilla: 567 ] Fix unbound lists if forward zone is secure or insecure with +i annotation in output of list_forwards, also for list_stubs (for NetworkManager integration). And remove ':' from output of stub and forward lists, this is easier to parse. - - [bugzilla: 554 ] Fix use unsigned long to print 64bit statistics counters on 64bit systems. - - [bugzilla: 558 ] Fix failed prefetch lookup does not remove cached response but delays next prefetch (in lieu of caching a SERVFAIL). - - [bugzilla: 545 ] Fix improved logging, the ip address of the error is printed on the same log-line as the error. - - [bugzilla: 502 ] Fix explain that do-ip6 disable does not stop AAAA lookups, but it stops the use of the ipv6 transport layer for DNS traffic. - - Fix compile with libevent2 on FreeBSD. - - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier. - - Fixup out-of-directory compile with unbound-control-setup.sh.in. - - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue fixes from FreeBSD's copy of Unbound, he notes: Generate unbound-control-setup.sh at build time so it respects prefix and sysconfdir from the configure script. Also fix the umask to match the comment, and the comment to match the umask. Add const and static where needed. Use unions instead of playing pointer poker. Move declarations that are needed in multiple source files into a shared header. Move sldns_bgetc() from parse.c to buffer.c where it belongs. Introduce a new header file, worker.h, which declares the callbacks that all workers must define. Remove those declarations from libworker.h. Include the correct headers in the correct places. Fix a few dummy callbacks that don't match their prototype. Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. Remove a useless printf which breaks reproducible builds. Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're no longer used. Add unbound-control-setup.sh to the list of generated files. The prototype for libworker_event_done_cb() needs to be moved from libunbound/libworker.h to libunbound/worker.h. - - Fix caps-for-id fallback, and added fallback attempt when servers drop 0x20 perturbed queries. - - [bugzilla: 593 ] Fix segfault or crash upon rotating logfile. - - fake-rfc2553 patch (thanks Benjamin Baier). - - LibreSSL provides compat items, check for that in configure. - - [bugzilla: 596 ] Bail out of unbound-control list_local_zones when ssl write fails. - - Fix endian.h include for OpenBSD. - - [bugzilla: 603 ] Fix unbound-checkconf -o option should skip verification checks. - - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings. - - Update unbound manpage with more explanation (from Florian Obser). - - Fix tcp timer waiting list removal code. - - patches to also build with Python 3.x (from Pavel Simerda). - - improve python configuration detection to build on Fedora 22. - - Fix swig and python examples for Python 3.x. - - Fix for mingw compile with openssl-1.0.1i. - - [bugzilla: 612 ] Fix create service with service.conf in present directory and auto load it. - - [bugzilla: 613 ] Allow tab ws in var length last rdfs (in ldns str2wire). - - [bugzilla: 614 ] Fix man page variable substitution bug. - - Whitespaces after $ORIGIN are not part of the origin dname (ldns). - - $TTL's value starts at position 5 (ldns). - - Fix unbound-checkconf check for module config with dns64 module. - - Fix unbound capsforid fallback, it ignores TTLs in comparison. - - [bugzilla: 617 ] Fix in ldns in unbound, lowercase WKS services. - - Fix ctype invocation casts. - - Disabled use of SSLv3 in remote-control and ssl-upstream. - - Redefine internal minievent symbols to unique symbols that helps linking on platforms where the linker leaks names across modules. - - Fix bug where forward or stub addresses with same address but different port number were not tried. Best regards, Wouter -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJUawxtAAoJEJ9vHC1+BF+NwdYP/0wc6Wc7wks1q22302vH7C2a 4VKSU8cgMaiPfKWRU9z2EGDTu3xXe4JQOmubLjTlpC+XNINOZBLFGr1UCeMy3Yvz jN9EVxlUFD/6cZ+Qc6oVD57R6po+bqClhJZA+oF8LLNHse53uG0r5fUCQjajPd0j wNn0AiQdRmm0U4YzqdTc9AaOjZ1Mvq6G+JKmb20/YJcssgQ6TCuZIesDUSZ4kY60 6hiOcVadWg9mZp6+BgilhzZ39e0kz3snqUMtpy30DNKmHnzKAQclUXQ5Pk60nEk+ V1YwP9tDo+y+0FKpe/uJ5Monl+fKuGGC/5oYStxFugjlhBHu+JddxdZeg3MJ/nPc U3hfoOeLurFlPDek1OgvTI/1D3mOs1EUNcVnxO+j0xcBuf39qPv4VVHkNNzn/xav fYjL89A3GM36IlNLFUHAZWd3qMGFyeHKDd1tExPRXcZIYMHwSS/FzBE8fYbJvn7z bgbKN04KnvO78sDRBvbWbJRRNWMG9qWKnakB+jp4OQ9UKiDtuqk6BjkKViJISWZB W1zb5SCltk+wtpigklyK6n7wCBrgs7kW9GE796/rjUQMJ2OinVBdYkca7hURfMTX NZLP5+/XtsoBaET5s2JYCpshaOwwUmAbMWuOGlQ0w0TcX8irU7CvqY3Ga/kVuTi5 7CsNo6zed14Clkd1SmLR =Y3VD -----END PGP SIGNATURE----- _______________________________________________ Unbound-users mailing list [email protected] http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users
