unbound-1.9.0

[Bruce Dubbs]

New minor version.

[Bruce Dubbs]

• Fix tls-ciphers spelling in example.conf
• ub_ctx_set_tls call for libunbound that enables DoT for the machines set with ub_ctx_set_fwd. Patch from Florian Obser.
• Set build system for added call in the libunbound API.
• List example config for root zone copy locally hosted with auth-zone as suggested from draft-ietf-dnsop-7706-bis-02. But with updated B root address.
• set version to 1.9.0 for release.
• Fix that tcp for auth zone and outgoing does not remove and then gets the ssl read again applied to the deleted commpoint.
• updated contrib/fastrpz.patch to cleanly diff.
• no lock when threads disabled in tcp request buffer count.
• remove compile warnings from libnettle compile.
• output of newer lex 2.6.1 and bison 3.0.5.
• Newer aclocal and libtoolize used for generating configure scripts, aclocal 1.16.1 and libtoolize 2.4.6.
• Fix unit test for python 3.7 new keyword 'async'.
• clang analysis fixes, assert arc4random buffer in init, no check for already checked delegation pointer in iterator, in testcode check for NULL packet matches, in perf do not copy from NULL start list when growing capacity. Adjust host and file only when present in test header read to please checker. In testcode for unknown macro operand give zero result. Initialise the passed argv array in test code. In test code add EDNS data segment copy only when nonempty.
• Patch from Florian Obser fixes some compiler warnings: include mini_event.h to have a prototype for mini_ev_cmp include edns.h to have a prototype for apply_edns_options sldns_wire2str_edns_keepalive_print is only called in the wire2str, module declare it static to get rid of compiler warning: no previous prototype for function infra_find_ip_ratedata() is only called in the infra module, declare it static to get rid of compiler warning: no previous prototype for function do not shadow local variable buf in authzone auth_chunks_delete and az_nsec3_findnode are only called in the authzone module, declare them static to get rid of compiler warning: no previous prototype for function... copy_rrset() is only called in the respip module, declare it static to get rid of compiler warning: no previous prototype for function 'copy_rrset' no need for another variable "r"; gets rid of compiler warning: declaration shadows a local variable in libunbound.c no need for another variable "ns"; gets rid of compiler warning: declaration shadows a local variable in iterator.c
• Moved includes and make depend.
• Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites options for unbound.conf.
• Fixes for the patch, and man page entry.
• Fix configure to detect SSL_CTX_set_ciphersuites, for better library compatibility when compiling.
• Patch for TLS session resumption from Manabu Sonoda, enable with tls-session-ticket-keys in unbound.conf.
• Fixes for patch (includes, declarations, warnings). Free at end and keep config options in order read from file to keep the first one as the first one.
• Fix for IXFR fallback to reset counter when IXFR does not timeout.
• Fix space calculation for tcp req buffer size.
• Doc for stream-wait-size and unit test.
• unbound-control stats has mem.streamwait that counts TCP and TLS waiting result buffers.
• Fix for #4219: secondaries not updated after serial change, unbound falls back to AXFR after IXFR gives several timeout failures.
• Fix that auth zone after IXFR fallback tries the same master.
• Fix tcp idle timeout test, for difference in the tcp reply code.
• Unit test for tcp request reorder and timeouts.
• Unit tests for ssl out of order processing.
• Fix that multiple dns fragments can be carried in one TLS frame.
• Add stream-wait-size: 4m config option to limit the maximum memory used by waiting tcp and tls stream replies. This avoids a denial of service where these replies use up all of the memory.
• For caps-for-id fallback, use the whitelist to avoid timeout starting a fallback sequence for it.
• increase mesh max activation count for capsforid long fetches.
• Get ready for the DNS flag day: remove EDNS lame procedure, do not re-query without EDNS after timeout.
• In the out of order processing, reset byte count for (potential) partial read.
• Review fixes in out of order processing.
• streamtcp option -a send queries consecutively and prints answers as they arrive.
• Fix for out of order processing administration quit cleanup.
• unit test for tcp out of order processing.
• Initial commit for out-of-order processing for TCP and TLS.
• Log query name for looping module errors.
• Fix syntax in comment of local alias processing.
• Fix NSEC3 record that is returned in wildcard replies from auth-zone zones with NSEC3 and wildcards.
• Log query name for looping module errors.
• Fix syntax in comment of local alias processing.
• Fix NSEC3 record that is returned in wildcard replies from auth-zone zones with NSEC3 and wildcards.
• On FreeBSD warn if systcl settings do not allow server TCP FASTOPEN, and server tcp fastopen is enabled at compile time.
• Document interaction between the tls-upstream option in the server section and forward-tls-upstream option in the forward-zone sections.
• Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews, the patch adds a program used for fuzzing.
• Fix for crash in dns64 module if response is null.
• Fix config parser memory leaks.
• ip-ratelimit-factor of 1 allows all traffic through, instead of the previous blocking everything.
• Fix for FreeBSD port make with dnscrypt and dnstap enabled.
• Fix #4206: support openssl 1.0.2 for TLS hostname verification, alongside the 1.1.0 and later support that is already there.
• Fixup openssl 1.0.2 compile

[Bruce Dubbs]

Fixed at revision 21092.