File libunbound-devel-mini.changes of Package unbound

Overview Repositories Revisions Requests Users Attributes Meta

File libunbound-devel-mini.changes of Package unbound (Revision e47261b772ac2ddec4fc9f3df869bd43)

Currently displaying revision e47261b772ac2ddec4fc9f3df869bd43 , Show latest

-------------------------------------------------------------------
Thu Jun 21 09:19:02 UTC 2018 - michael@stroeder.com

- update to 1.7.3

Features
- #4102 for NSD, but for Unbound.  Named unix pipes do not use
  certificate and key files, access can be restricted with file and
  directory permissions.  The option control-use-cert is no longer
  used, and ignored if found in unbound.conf.
- Rename tls-additional-ports to tls-additional-port, because every
  line adds one port.

Bug Fixes
- Don't count CNAME response types received during qname minimisation
  as query restart.
- #4100: Fix stub reprime when it becomes useless.
- Fix crash if ratelimit taken into use with unbound-control
  instead of with unbound.conf.
- Patch to fix openwrt for mac os build darwin detection in configure.
- #4103: Fix that auth-zone does not insist on SOA record first in
  file for url downloads.
- Fix that first control-interface determines if TLS is used.  Warn
  when IP address interfaces are used without TLS.
- Fix that control-use-cert: no works for 127.0.0.1 to disable certs.
- Fix unbound-checkconf for control-use-cert.
- Fix for unbound-control on Windows and set TCP socket parameters
  more closely.
- Fix windows unbound-control no cert bad file descriptor error.

-------------------------------------------------------------------
Mon Jun 11 13:05:51 UTC 2018 - michael@stroeder.com

- update to 1.7.2
  * This release fixes bugs in DNS-over-TLS for windows, and adds the option
    for windows users to use the CA certificates from the Windows cert
    stores, tls-win-cert: yes in unbound.conf.
  * The code has been updated with a speed up that improves performance for
    large numbers of incoming TCP and TLS connections.
  * There is an option to allow to ignore an unset RD bit for access control
    subnets and always allow recursion to the request.

-------------------------------------------------------------------
Thu May  3 16:38:07 UTC 2018 - michael@stroeder.com

- update to 1.7.1

Features
- Add --with-libhiredis, unbound support for a new cachedb
  backend that uses a Redis server as the storage.  This
  implementation depends on the hiredis client library
  (https://redislabs.com/lp/hiredis/).
  And unbound should be built with both --enable-cachedb and
  --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h
  should exist).  Patch from Jinmei Tatuya (Infoblox).
- Create additional tls service interfaces by opening them on other
  portnumbers and listing the portnumbers as additional-tls-port: nr.
- ED448 support.
- num.query.authzone.up and num.query.authzone.down statistics counters.
- Accept both option names with and without colon for get_option
  and set_option.
- low-rtt and low-rtt-pct in unbound.conf enable the server selection
  of fast servers for some percentage of the time.
- num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN
  statistics counters.
- allow-notify: config statement for auth-zones.
- Can set tls authentication with forward-addr: IP#tls.auth.name
  And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem".
  such as forward-addr: 9.9.9.9@853#dns.quad9.net or
  1.1.1.1@853#cloudflare-dns.com
- list_auth_zones unbound-control command.
- Added root-key-sentinel support

Bug Fixes
- Fix #3727: Protocol name is TLS, options have been renamed but
  documentation is not consistent.
- Check IXFR start serial.
- Fix typo in documentation.
- Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually
  flushed with serve-expired on.
- Fix #3817: core dump happens in libunbound delete, when queued
  servfail hits deleted message queue.
- corrected a minor typo in the changelog.
- move htobe64/be64toh portability code to cachedb.c.
- iana port update.
- Do not use cached NSEC records to generate negative answers for
  domains under DNSSEC Negative Trust Anchors.
- Fix unbound-control get_option aggressive-nsec
- Check "result" in dup_all(), by Florian Obser.
- Fix #4043: make test fails due to v6 presentation issue in macOS.
- Fix unable to resolve after new WLAN connection, due to auth-zone
  failing with a forwarder set.  Now, auth-zone is only used for
  answers (not referrals) when a forwarder is set.
- Combine write of tcp length and tcp query for dns over tls.
- nitpick fixes in example.conf.
- Fix above stub queries for type NS and useless delegation point.
- Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3
  tls_choose_sigalg routine does not allow the ciphers for the pipe,
  so use TLSv1.2.
- Fix that flush_zone sets prefetch ttl expired, so that with
  serve-expired enabled it'll start prefetching those entries.
- Fix downstream auth zone, only fallback when auth zone fails to
  answer and fallback is enabled.
- Fix for max include depth for authzones.
- Fix memory free on fail for $INCLUDE in authzone.
- Fix that an internal error to look up the wrong rr type for
  auth zone gets stopped, before trying to send there.
- Fix auth zone target lookup iterator.
- Fix auth-zone retry timer to be on schedule with retry timeout,
  with backoff.  Also time a refresh at the zone expiry.
- Fix #658: unbound using TLS in a forwarding configuration does not
  verify the server's certificate (RFC 8310 support).
- For addr with #authname and no @port notation, the default is 853.
- man page documentation for dns-over-tls forward-addr '#' notation.
- removed free from failed parse case.
- Fix #4091: Fix that reload of auth-zone does not merge the zonefile
  with the previous contents.
- Delete auth zone when removed from config.
- makedist uses bz2 for expat code, instead of tar.gz.
- Fix #4092: libunbound: use-caps-for-id lacks colon in
  config_set_option.
- auth zone http download stores exact copy of downloaded file,
  including comments in the file.
- Fix sldns parse failure for CDS alternate delete syntax empty hex.
- Attempt for auth zone fix; add of callback in mesh gets from
  callback does not skip callback of result.
- Fix cname classification with qname minimisation enabled.
- Fix contrib/fastrpz.patch for this release.
- Fix auth https for libev.
- Fix memory leak when caching wildcard records for aggressive NSEC use
- Fix for crash in daemon_cleanup with dnstap during reload,
  from Saksham Manchanda.
- Also that for dnscrypt.

-------------------------------------------------------------------
Sun Apr 22 19:26:03 UTC 2018 - michael@stroeder.com

- Commented configuration directive dlv-anchor-file: in unbound.conf
  (see bsc#1055060). The DLV key file is deliberately still
  shipped in the package so users could easily re-enable this.

-------------------------------------------------------------------
Wed Apr  4 11:54:01 UTC 2018 - michael@stroeder.com

- update to 1.7.0

Features
- auth-zone provides a way to configure RFC7706 from unbound.conf,
  eg. with auth-zone: name: "." for-downstream: no for-upstream: yes
  fallback-enabled: yes and masters or a zonefile with data.
- Aggressive use of NSEC implementation. Use cached NSEC records to
  generate NXDOMAIN, NODATA and positive wildcard answers.
- Accept tls-upstream in unbound.conf, the ssl-upstream keyword is
  also recognized and means the same.  Also for tls-port,
  tls-service-key, tls-service-pem, stub-tls-upstream and
  forward-tls-upstream.
- [dnscrypt] introduce dnscrypt-provider-cert-rotated option,
  from Manu Bretelle.
  This option allows handling multiple cert/key pairs while only
  distributing some of them.
  In order to reliably match a client magic with a given key without
  strong assumption as to how those were generated, we need both key and
  cert. Likewise, in order to know which ES version should be used.
  On the other hand, when rotating a cert, it can be desirable to only
  serve the new cert but still be able to handle clients that are still
  using the old certs's public key.
  The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not
  publish the cert as part of the DNS's provider_name's TXT answer.
- Update B root ipv4 address.
- make ip-transparent option work on OpenBSD.
- Fix #2801: Install libunbound.pc.
- ltrace.conf file for libunbound in contrib.
- Fix #3598: Fix swig build issue on rhel6 based system.
  configure --disable-swig-version-check stops the swig version check.

Bug Fixes
- Fix #1749: With harden-referral-path: performance drops, due to
  circular dependency in NS and DS lookups.
- [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert
  duplicates
- Better documentation for cache-max-negative-ttl.
- Fixed libunbound manual typo.
- Fix #1949: [dnscrypt] make provider name mismatch more obvious.
- Fix #2031: Double included headers
- Document that errno is left informative on libunbound config read
  fail.
- iana port update.
- Fix #1913: ub_ctx_config is under circumstances thread-safe.
- Fix #2362: TLS1.3/openssl-1.1.1 not working.
- Fix #2034 - Autoconf and -flto.
- Fix #2141 - for libsodium detect lack of entropy in chroot, print
  a message and exit.
- Fix #2492: Documentation libunbound.
- Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is
  set for stub zone.  It no longer searches for DNSSEC information.
- Fix #3299 - forward CNAME daisy chain is not working
- Fix link failure on OmniOS.
- Check whether --with-libunbound-only is set when using --with-nettle
  or --with-nss.
- Fix qname-minimisation documentation (A QTYPE, not NS)
- Fix that DS queries with referral replies are answered straight
  away, without a repeat query picking the DS from cache.
  The correct reply should have been an answer, the reply is fixed
  by the scrubber to have the answer in the answer section.
- Fix that expiration date checks don't fail with clang -O2.
- Fix queries being leaked above stub when refetching glue.
- Copy query and correctly set flags on REFUSED answers when cache
  snooping is not allowed.
- make depend: code dependencies updated in Makefile.
- Fix #3397: Fix that cachedb could return a partial CNAME chain.
- Fix #3397: Fix that when the cache contains an unsigned DNAME in
  the middle of a cname chain, a result without the DNAME could
  be returned.
- Fix that unbound-checkconf -f flag works with auto-trust-anchor-file
  for startup scripts to get the full pathname(s) of anchor file(s).
- Print fatal errors about remote control setup before log init,
  so that it is printed to console.
- Use NSEC with longest ce to prove wildcard absence.
- Only use *.ce to prove wildcard absence, no longer names.
- Fix unfreed locks in log and arc4random at exit of unbound.
- Fix lock race condition in dns cache dname synthesis.
- Fix #3451: dnstap not building when you have a separate build dir.
  And removed protoc warning, set dnstap.proto syntax to proto2.
- Added tests with wildcard expanded NSEC records (CVE-2017-15105 test)
- Unit test for auth zone https url download.
- tls-cert-bundle option in unbound.conf enables TLS authentication.
- Fixes for clang static analyzer, the missing ; in
  edns-subnet/addrtree.c after the assert made clang analyzer
  produce a failure to analyze it.
- Fix #3505: Documentation for default local zones references
  wrong RFC.
- Fix #3494: local-zone noview can be used to break out of the view
  to the global local zone contents, for queries for that zone.
- Fix for more maintainable code in localzone.
- more robust cachedump rrset routine.
- Save wildcard RRset from answer with original owner for use in
  aggressive NSEC.
- Fixup contrib/fastrpz.patch so that it applies.
- Fix compile without threads, and remove unused variable.
- Fix compile with staticexe and python module.
- Fix nettle compile.
- Fix to check define of DSA for when openssl is without deprecated.
- iana port update.
- Fix #3582: Squelch address already in use log when reuseaddr option
  causes same port to be used twice for tcp connections.
- Reverted fix for #3512, this may not be the best way forward;
  although it could be changed at a later time, to stay similar to
  other implementations.
- Fix for windows compile.
- Fixed contrib/fastrpz.patch, even though this already applied
  cleanly for me, now also for others.
- patch to log creates keytag queries, from A. Schulze.
- patch suggested by Debian lintian: allow to -> allow one to, from
  A. Schulze.
- Attempt to remove warning about trailing whitespace.
- Added documentation for aggressive-nsec: yes.

-------------------------------------------------------------------
Fri Jan 19 10:34:41 UTC 2018 - michael@stroeder.com

- update to 1.6.8
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.
  
-------------------------------------------------------------------
Tue Oct 10 08:20:16 UTC 2017 - michael@stroeder.com

- update to 1.6.7

Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.

Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
   (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.

-------------------------------------------------------------------
Mon Sep  4 16:17:44 UTC 2017 - michael@stroeder.com

- update to 1.6.6

Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.

Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf

-------------------------------------------------------------------
Mon Aug 21 10:38:49 UTC 2017 - michael@stroeder.com

- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.

-------------------------------------------------------------------
Tue Aug  8 19:02:38 UTC 2017 - jengelh@inai.de

- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.

-------------------------------------------------------------------
Tue Jun 27 11:13:31 UTC 2017 - michael@stroeder.com

- update to 1.6.4

Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib

Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.

-------------------------------------------------------------------
Wed Jun 14 10:22:38 UTC 2017 - michael@stroeder.com

- update to 1.6.3

Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.

-------------------------------------------------------------------
Mon Apr 24 15:54:02 UTC 2017 - michael@stroeder.com

- update to 1.6.2

Features
- Add trustanchor.unbound CH TXT that gets a response with a number
  of TXT RRs with a string like "example.com. 2345 1234" with
  the trust anchors and their keytags.
- Patch for view functionality for local-data-ptr from Björn Ketelaars.
- Response actions based on IP address from Jinmei Tatuya (Infoblox).
- Patch from Luiz Fernando Softov for Stats Shared Memory.
- unbound-control stats_shm command prints stats using shared memory,
  which uses less cpu.
- --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and
  DS records.  NSEC3 is not disabled.
- #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then
  enabled in the config file from Manu Bretelle.
- Merge EDNS Client subnet implementation from feature branch into main
  branch, using new EDNS processing framework.
- harden-algo-downgrade: no also makes unbound more lenient about
  digest algorithms in DS records.

Bug fixes
- sldns has ED25519 and ED448 algorithm number and name for display.
- sldns updated for vfixed and buffer resize indication from getdns.
- iana portlist update
- Fix #1224: Fix that defaults should not fall back to "Program Files
  (x86) if Unbound is 64bit by default on windows.
- Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to
  redirect.
- make depend, autoconf, doxygen and lint fixed up.
- include sys/time.h for new shm code on NetBSD.
- Fix #1227: Fix that Unbound control allows weak ciphersuits.
- Fix #1226: provide official 32bit binary for windows.
- For #1227: if we have sha256, set the cipher list to have no
  known vulns.
- Fix testpkts.c, check if DO bit is set, not only if there is an OPT
  record.
- Fix #1229: Systemd service sandboxing in contrib/unbound.service.
- Fix #1230: swig version 2.0.1 is required for pythonmod, with
  1.3.40 it crashes when running repeatly unbound-control reload.
- fix enum conversion warnings
- fake-sha1 test option; print warning if used.  To make unit tests.
- unbound-control list local zone and data commands listed in the
  help output.
- Fix #1234: shortening DNAME loop produces duplicate DNAME records
  in ANSWER section.
- testbound understands Deckard MATCH rcode question answer commands.
- Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead
  of YXDOMAIN + query loop, reported by Petr Spacek.
- Fix that SHM is not inited if not enabled.
- Fix that looped DNAMEs do not cause unbound to spend effort.
- trustanchor tags are sorted.  reusable routine to fetch taglist.
- Fix #1237 - Wrong resolving in chain, for norec queries that get
  SERVFAIL returned.
- make depend, autoconf, remove warnings about statement before var.
- lru_demote and lruhash_insert_or_retrieve functions for getdns.
- fixup for lruhash (whitespace and header file comment).
- dnscrypt tests.
- Fix doxygen for dnscrypt files.
- Fix #1238: segmentation fault when adding through the remote
  interface a per-view local zone to a view with no previous
  (configured) local zones.
- Fix #1229: Systemd service sandboxing, options in wrong sections.
- Fix #1239: configure fails to find python distutils if python
  prints warning.
- Fix to prevent non-referal query from being cached as referal when the
  no_cache_store flag was set.
- Remove (now unused) event2 include from dnscrypt code.
- Fix #1217: Add metrics to unbound-control interface showing
  crypted, cert request, plaintext and malformed queries (from
  Manu Bretelle).
- Do not add current time twice to TTL before ECS cache store.
- Do not touch rrset cache after ECS cache message generation.
- Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode.
- Fix #1244: document that use of chroot requires trust anchor file to
  be under chroot.
- Small fixup for documentation.
- Fix respip for braces when locks arent used.
- Fix pythonmod for cb changes.
- Generalise inplace callback (de)registration
- (de)register inplace callbacks for module id
- No unbound-control set_option for ECS options
- Deprecated client-subnet-opcode config option
- Introduced client-subnet-always-forward config option
- Changed max-client-subnet-ipv6 default to 56 (as in RFC)
- Removed extern ECS config options
- module_restart_next now calls clear on all following modules
- Also create ECS module qstate on module_event_pass event
- remove malloc from inplace_cb_register
- Unlock view in respip unit test
- Some whitespace fixup.
- Remove ECS option after REFUSED answer.
- Fix small memory leak in edns_opt_copy_alloc.
- Respip dereference after NULL check.
- Zero initialize addrtree allocation.
- Use correct identifier for SHM destroy.
- Display ECS module memory usage.
- Fix #1247: unbound does not shorten source prefix length when
  forwarding ECS.
- Properly check for allocation failure in local_data_find_tag_datas.
- Fix #1249: unbound doesn't return FORMERR to bogus ECS.
- Set SHM ECS memory usage to 0 when module not loaded.
- subnet mem value is available in shm, also when not enabled,
  to make the struct easier to memmap by other applications,
  independent of the configuration of unbound.
- Fix #1250: inconsistent indentation in services/listen_dnsport.c.

-------------------------------------------------------------------
Tue Feb 21 21:34:22 UTC 2017 - michael@stroeder.com

- update to 1.6.1

Features
  * configure --enable-systemd and lets unbound use systemd sockets if you
    enable use-systemd: yes in unbound.conf. Also there are
    contrib/unbound.socket and contrib/unbound.service: systemd files for
    unbound, install them in /usr/lib/systemd/system. Contributed by Sami
    Kerola and Pavel Odintsov.
  * [bugzilla: 1185 ]
    Source IP rate limiting, patch from Larissa Feng.
  * [bugzilla: 1184 ]
    Log DNS replies. This includes the same logging information that DNS
    queries and response code and response size, patch from Larissa Feng.
  * Include root trust anchor id 20326 in unbound-anchor.
  * 64bit is default for windows builds.

Bug Fixes
  * [bugzilla: 1176 ]
    Fix stack size too small for Alpine Linux.
  * Fix unbound-control and ipv6 only.
    [bugzilla: 1182 ]
  * Fix Resource leak (socket), at startup.
    [bugzilla: 1178 ]
  * Fix attempt to fix setup error at end, pop result values at end of
    install.
  * iana portlist update
  * Fix inet_ntop and inet_pton warnings in windows compile.
  * [bugzilla: 1191 ]
    Fix remove comment about view deletion.
  * [bugzilla: 1188 ]
    Fix unresolved symbol 'fake_dsa' in libunbound.so when built with Nettle
  * [bugzilla: 1190 ]
    Fix to not echo back EDNS options in local-zone error response.
  * [bugzilla: 1194 ]
    Fix if cross build fails when $host isn't `uname` for getentropy.
  * Fix reload chdir failure when also chrooted to that directory.
  * Fix to return formerr for queries for meta-types, to avoid packet
    amplification if this meta-type is sent on to upstream.
  * [bugzilla: 1201 ]
    Fix missing unlock in answer_from_cache error condition.
  * [bugzilla: 1202 ]
    Fix code comment that packed_rrset_data is not always 'packed'.
  * Fix to also block meta types 128 through to 248 with formerr.
  * [bugzilla: 1206 ]
    Fix that some view-related commands are missing from 'unbound-control -h'
  * Fix to rename ub_callback_t to ub_callback_type, because POSIX
    reserves _t typedefs.
  * Fix to rename internally used types from _t to _type, because _t type
    names are reserved by POSIX.
  * Increase MAX_MODULE to 16.
  * [bugzilla: 1211 ]
    Fix can't enable interface-automatic if no IPv6 with more helpful
    error message.
  * fix root_anchor test for updated icannbundle.pem lower certificates.
  * Fix compile on solaris of the fix to use $host detect.
  * Fix for type name change and fix warning on windows compile.
  * Fix pythonmod for typedef changes.
  * Fix dnstap for warning of set but not used.
  * Fix autoconf of systemd check for lack of pkg-config.

-------------------------------------------------------------------
Thu Dec 15 16:28:44 UTC 2016 - michael@stroeder.com

- update to 1.6.0

Features
  * Added generic EDNS code for registering known EDNS option codes,
    bypassing the cache response stage and uniquifying mesh states. Four
    EDNS option lists were added to module_qstate
    (module_qstate.edns_opts_*) to store EDNS options from/to front/back side.
  * Added two flags to module_qstate (no_cache_lookup, no_cache_store)
    that control the modules' cache interactions.
  * Added code for registering inplace callback functions. The registered
    functions can be called just before replying with local data or Chaos,
    replying from cache, replying with SERVFAIL, replying with a resolved
    query, sending a query to a nameserver. The functions can inspect the
    available data and maybe change response/query related data (i.e. append
    EDNS options).
  * Updated Python module for the above.
  * Updated Python documentation.
  * Added views functionality.
  * Added qname-minimisation-strict config option.
  * Patch that resolves CNAMEs entered in local-data conf statements that
    point to data on the internet, from Jinmei Tatuya (Infoblox).
  * serve-expired config option: serve expired responses with TTL 0.
  * .gitattributes line for githubs code language display.
  * log-identity: config option to set sys log identity, patch from "Robin
    H. Johnson" (robbat2@gentoo.org).
  * Added stub-ssl-upstream and forward-ssl-upstream options.
  * Added local-zones and local-data bulk addition and removal
    functionality in unbound-control (local_zones, local_zones_remove,
    local_datas and local_datas_remove).
  * g.root-servers.net has AAAA address.

Bug Fixes
  * Fix #836: unbound could echo back EDNS options in an error response.
  * Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX.
  * Fix #839: Memory grows unexpectedly with large RPZ files.
  * Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile.
  * Fix #841: big local-zone's make it consume large amounts of memory.
  * Fix dnstap relaying "random" messages instead of resolver/forwarder
    responses, from Nikolay Edigaryev.
  * Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav.
  * Fix #1117: spelling errors, from Robert Edmonds.
  * iana portlist update.
  * fix memoryleak logfile when in debug mode.
  * Re-fix #839 from view commit overwrite.
  * Fixup const void cast warning.
  * Removed patch comments from acllist.c and msgencode.c
  * Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, from
    Jinmei Tatuya (Infoblox).
  * Fix #1125: unbound could reuse an answer packet incorrectly for
    clients with different EDNS parameters, from Jinmei Tatuya.
  * Fix #1118: libunbound.pc sets strange Libs, Libs.private values.
  * Added Requires line to libunbound.pc
  * Fix #1130: whitespace in example.conf.in more consistent.
  * suppress compile warning in lex files.
  * init lzt variable, for older gcc compiler warnings.
  * fix --enable-dsa to work, instead of copying ecdsa enable.
  * Fix DNSSEC validation of query type ANY with DNAME answers.
  * Fixup query_info local_alias init.
  * Ported tests for local_cname unit test to testbound framework.
  * Fix #1134: unbound-control set_option -- val-override-date: -1 works
    immediately to ignore datetime, or back to 0 to enable it again. The --
    is to ignore the '-1' as an option flag.
  * Patch for server.num.zero_ttl stats for count of expired replies, from
    Pavel Odintsov.
  * Fix failure to build on arm64 with no sbrk.
  * Set OpenSSL security level to 0 when using aNULL ciphers.
  * configure detects ssl security level API function in the autoconf
    manner. Every function on its own, so that other libraries (eg.
    LibreSSL) can develop their API without hindrance.
  * Fix #1154: segfault when reading config with duplicate zones.
  * Note that for harden-below-nxdomain the nxdomain must be secure, this
    means nsec3 with optout is insufficient.
  * Fix #1155: test status code of unbound-control in 04-checkconf, not
    the status code from the tee command.
  * Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing
    Underneath" for the harden-below-nxdomain option.
  * patch from Dag-Erling Smorgrav that removes code that relies on sbrk().
  * Make access-control-tag-data RDATA absolute. This makes the RDATA
    origin consistent between local-data and access-control-tag-data.
  * Fix NSEC ENT wildcard check. Matching wildcard does not have to be a
    subdomain of the NSEC owner.
  * QNAME minimisation uses QTYPE=A, therefore always check cache for this
    type in harden-below-nxdomain functionality.
  * Added unit test for QNAME minimisation + harden below nxdomain synergy.
  * Fix that with openssl 1.1 control-use-cert: no uses less cpu, by using
    no encryption over the unix socket.
  * hyphen as minus fix, by Andreas Schulze
  * Fix #1170: document that 'inform' local-zone uses local-data.
  * Fix #1173: differ local-zone type deny from unset tag_actions element.
  * Add DSA support for OpenSSL 1.1.0
  * Fix remote control without cert for LibreSSL
  * Fix downcast warnings from visual studio in sldns code.

-------------------------------------------------------------------
Tue Sep 27 12:41:57 UTC 2016 - michael@stroeder.com

- update to 1.5.10

Features
  * Create a pkg-config file for libunbound in contrib.
  * TCP Fast open patch from Sara Dickinson.
  * Finegrained localzone control with define-tag, access-control-tag,
    access-control-tag-action, access-control-tag-data, local-zone-tag, and
    local-zone-override. And added types always_transparent, always_refuse,
    always_nxdomain with that.
  * If more than half of tcp connections are in use, a shorter timeout
    is used (200 msec, vs 2 minutes) to pressure tcp for new connects.
  * [bugzilla: 787 ] Fix #787: outgoing-interface netblock/64 ipv6
    option to use linux freebind to use 64bits of entropy for every query
    with random local part.
  * For #787: prefer-ip6 option for unbound.conf prefers to send
    upstream queries to ipv6 servers.
  * Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e.
  * keep debug symbols in windows build.

Bug Fixes
  * [bugzilla: 778 ] Fix unbound 1.5.9: -h segfault (null deref).
  * Fix unbound-anchor.exe file location defaults to Program Files with
    (x86) appended.
  * Fix to not ignore return value of chown() in daemon startup.
  * Better help text from -h (from Ray Griffith).
  * [bugzilla: 773 ] Fix Non-standard Python location build failure with
    pyunbound.
  * Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures.
  * Revert fix for NetworkService account on windows due to breakage it
    causes.
  * Fix that windows install will not overwrite existing service.conf
    file (and ignore gui config choices if it exists).
  * And delete service.conf.shipped on uninstall.
  * In unbound.conf directory: dir immediately changes to that
    directory, so that include: file below that is relative to that
    directory. With chroot, make the directory an absolute path inside chroot.
  * do not delete service.conf on windows uninstall.
  * document directory immediate fix and allow EXECUTABLE syntax in it
    on windows.
  * Fix directory: fix for unbound-checkconf, it restores cwd.
  * Use QTYPE=A for QNAME minimisation.
  * Keep track of number of time-outs when performing QNAME
    minimisation. Stop minimising when number of time-outs for a QNAME/QTYPE
    pair is more than three.
  * [bugzilla: 775 ] Fix unbound-host and unbound-anchor crash on
    windows, ignore null delete for wsaevent.
  * Fix spelling in freebind option man page text.
  * Fix windows link of ssl with crypt32.
  * [bugzilla: 779 ] Fix Union casting is non-portable.
  * [bugzilla: 780 ] Fix MAP_ANON not defined in HP-UX 11.31.
  * [bugzilla: 781 ] Fix prealloc() is an HP-UX system library call.
  * Decrease dp attempts at each QNAME minimisation iteration
  * [bugzilla: 784 ] Fix Build configure assumess that having getpwnam
    means there is endpwent function available.
  * Updated repository with newer flex and bison output.
  * Fix static compile on windows missing gdi32.
  * Fix dynamic link of anchor-update.exe on windows.
  * Fix detect of mingw for MXE package build.
  * Fixes for 64bit windows compile.
  * [bugzilla: 788 ] Fix for nettle 3.0: Failed to build with Nettle >=
    3.0 and --with-libunbound-only --with-nettle.
  * Fixed unbound.doxygen for 1.8.11.
  * [bugzilla: 798 ] Fix Client-side TCP fast open fails (Linux).
  * [bugzilla: 801 ] Fix missing error condition handling in
    daemon_create_workers().
  * [bugzilla: 802 ] Fix workaround for function parameters that are
    "unused" without log_assert.
  * [bugzilla: 803 ] Fix confusing (and incorrect) code comment in
    daemon_cleanup().
  * [bugzilla: 806 ] Fix wrong comment removed.
  * use sendmsg instead of sendto for TFO.
  * [bugzilla: 807 ] Fix workaround for possible some "unused" function
    parameters in test code, from Jinmei Tatuya.
  * Note that OPENPGPKEY type is RFC 7929.
  * [bugzilla: 804 ] Fix #804: unbound stops responding after outage.
    Fixes queries that attempt to wait for an empty list of subqueries.
  * Fix for #804: lower num_target_queries for iterator also for failed
    lookups.
  * [bugzilla: 820 ] Fix set sldns_str2wire_rr_buf() dual meaning len
    parameter in each iteration in find_tag_datas().
  * [bugzilla: 777 ] Fix OpenSSL 1.1.0 compatibility, patch from
    Sebastian A. Siewior.
  * RFC 7958 is now out, updated docs for unbound-anchor.
  * Fix for compile without warnings with openssl 1.1.0.
  * [bugzilla: 826 ] Fix refuse_non_local could result in a broken response.
  * iana portlist update.
  * Fix compile with openssl 1.1.0 with api=1.1.0.
  * [bugzilla: 829 ] Fix doc of sldns_wire2str_rdata_buf() return value
    has an off-by-one typo, from Jinmei Tatuya (Infoblox).
  * Fix incomplete prototypes reported by Dag-Erling Smørgrav.
  * [bugzilla: 828 ] Fix missing type in access-control-tag-action
    redirect results in NXDOMAIN.
  * Take configured minimum TTL into consideration when reducing TTL to
    original TTL from RRSIG.
  * [bugzilla: 831 ] Fix workaround for spurious fread_chk warning
    against petal.c
  * Silenced flex-generated sign-unsigned warning print with gcc
    diagnostic pragma.
  * Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len.
  * fix potential memory leak in daemon/remote.c and nullpointer
    dereference in validator/autotrust.
  * [bugzilla: 883 ] Fix error for duplicate local zone entry.
  * [bugzilla: 835 ] Fix --disable-dsa with nettle verify.

-------------------------------------------------------------------
Sat Jun  4 14:26:35 UTC 2016 - michael@stroeder.com

- update to 1.5.9

Features
  * generic edns option parse and store code.
  * Updated L root IPv6 address.
  * User defined pluggable event API for libunbound
  * ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for binding 
    to an IP address while the interface or address is down.
  * OpenSSL 1.1.0 portability, --disable-dsa configure option.
  * disable-dnssec-lame-check config option from Charles Walker.

Bug Fixes
  * [bugzilla: 745 ]
  * Fix unbound.py - idn2dname throws UnicodeError when idnname contains
    trailing dot.
  * configure tests for the weak attribute support by the compiler.
  * [bugzilla: 747 ]
  * Fix assert in outnet_serviced_query_stop.
  * Updated configure and ltmain.sh.
  * Fixup of compile fix for pluggable event API from P.Y. Adi Prasaja.
  * Fixup backend2str for libev.
  * Fix libev usage of dispatch return value.
  * No side effects in tolower() call, in case it is a macro.
  * Fix warnings in ifdef corner case, older or unknown libevent.
  * Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma.
  * Fix ip-transparent for tcp on freebsd.
  * [bugzilla: 746 ]
  * Fix unbound sets CD bit on all forwards. If no trust anchors, it'll not 
    set CD bit when forwarding to another server. If a trust anchor, no CD 
    bit on the first attempt to a forwarder, but CD bit thereafter on 
    repeated attempts to get DNSSEC.
  * Limit number of QNAME minimisation iterations.
  * Validate QNAME minimised NXDOMAIN responses.
  * If QNAME minimisation is enabled, do cache lookup for QTYPE NS in 
    harden-below-nxdomain.
  * Fix compile of getentropy_linux for SLES11 servicepack 4.
  * Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev.
  * Fix test for openssl to use HMAC_Update for 1.1.0.
  * ERR_remove_state deprecated since openssl 1.0.0.
  * OPENSSL_config is deprecated, removing.
  * Document permit-small-holddown for 5011 debug.
  * [bugzilla: 749 ]
  * Fix unbound-checkconf gets SIGSEGV when use against a malformatted
    conf file.
  * [bugzilla: 753 ]
  * Fix document dump_requestlist is for first thread.
  * Fix some malformed reponses to edns queries get fallback to nonedns.
  * [bugzilla: 759 ]
  * Fix 0x20 capsforid no longer checks type PTR, for compatibility with 
    cisco dns guard. This lowers false positives.
  * Fix sldns with static checking fixes copied from getdns.
  * Fix memory leak in out-of-memory conditions of local zone add.
  * [bugzilla: 761 ]
  * Fix DNSSEC LAME false positive resolving nic.club.
  * [bugzilla: 766 ]
  * Fix dns64 should synthesize results on timeout/errors.
  * No QNAME minimisation fall-back for NXDOMAIN answers from
    DNSSEC signed zones.
  * [bugzilla: 767 ]
  * Fix Reference to an expired Internet-Draft in harden-below-nxdomain 
    documentation.
  * remove memory leak from lame-check patch.
  * [bugzilla: 770 ]
  * Fix Small subgroup attack on DH used in unix pipe on localhost if 
    unbound control uses a unix local named pipe.
  * Document write permission to directory of trust anchor needed.
  * [bugzilla: 768 ]
  * Fix Unbound Service Sometimes Can Not Shutdown Completely, WER Report 
    Shown Up. Close handle before closing WSA.
  * Fix time in case answer comes from cache in ub_resolve_event().
  * Fix windows service to be created run with limited rights, as a network 
    service account, from Mario Turschmann.
  * [bugzilla: 752 ]
  * Fix retry resource temporarily unavailable on control pipe.
  * iana ports fetched via https.
  * iana portlist update.

-------------------------------------------------------------------
Thu Feb 25 10:07:47 UTC 2016 - michael@stroeder.com

- update to 1.5.8

Features
  * ip-transparent option for FreeBSD with IP_BINDANY socket option.
  * insecure-lan-zones: yesno config option, patch from Dag-Erling
    Smørgrav.
  * RR Type CSYNC support RFC 7477, in debug printout and config input.
  * RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
  * [bugzilla: 731 ] tcp-mss, outgoing-tcp-mss options for unbound.conf,
      patch from Daisuke Higashi.
  * Support RFC7686: handle ".onion" Special-Use Domain. It is blocked
      by default, and can be unblocked with "nodefault" localzone config.
  * ub_ctx_set_stub() function for libunbound to config stub zones.

Bug Fixes
  * Fix that NSEC3 negative cache is used when there is no salt.
  * sorted ubsyms.def file with exported libunbound functions.
  * Print understandable debug log when unusable DS record is seen.
  * load gost algorithm if digest is seen before key algorithm.
  * Fix that "make install" fails due to "text file busy" error.
  * Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error.
  * wait for sendto to drain socket buffers when they are full.
  * Neater cmdline_verbose increment patch from Edgar Pettijohn.
  * Made netbsd sendmsg test nonfatal, in case of false positives.
  * [bugzilla: 741 ] Fix: log message for dnstap socket connection is
      more clear.
  * [bugzilla: 734 ] Fix: chown the pidfile if it resides inside the
      chroot.
  * Fix cmsg alignment for argument to sendmsg on NetBSD.
  * Fix that unbound complains about unimplemented IP_PKTINFO for
      sendmsg on NetBSD (for interface-automatic).
  * [bugzilla: 738 ] Fix: Swig should not be invoked with CPPFLAGS.
  * Squelch 'cannot assign requested address' log messages unless
      verbosity is high, it was spammed after network down.
  * Fix to simplify empty string checking from Michael McConville.
  * [bugzilla: 734 ] Fix: Do not log an error when the PID file cannot
      be chown'ed. Patch from Simon Deziel.
  * Fix test if -pthreads unused to use better grep for portability.
  * Fix mingw crosscompile for recent mingw.
  * Update aclocal, autoconf output with new versions (1.15, 2.4.6).
  * Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined,
      for Linux glibc 2.20.
  * Fixup contrib/aaaa-filter-iterator.patch for moved contents in the
      source code, so it applies cleanly again. Removed unused variable
      warnings.
  * [bugzilla: 729 ] Fix: omit use of escape sequences in echo since
      they are not portable (unbound-control-setup).
  * remove NULL-checks before free, patch from Michael McConville.
  * updated ax_pthread.m4 to version 21 with clang support, this removes
      a warning from compilation.
  * OSX portability, detect if sbrk is deprecated.
  * OSX clang, stop -pthread unused during link stage warnings.
  * OSX clang new flto check.
  * iana portlist update.

-------------------------------------------------------------------
Tue Feb 23 16:03:46 UTC 2016 - mrueckert@suse.de

- also conflict the shlib package

-------------------------------------------------------------------
Mon Feb 22 15:22:05 UTC 2016 - mrueckert@suse.de

- add libunbound-devel-mini-rpmlintrc as source

-------------------------------------------------------------------
Wed Feb 17 15:55:34 UTC 2016 - mrueckert@suse.de

- revert the previous change which would not solve the problem as
  the library package requires the unbound-anchor package
  instead introduce a libunbound-devel-mini package which holds the
  shared library and devel files with a minimal build requires.

-------------------------------------------------------------------
Thu Feb  4 13:01:35 UTC 2016 - meissner@suse.com

- split off a libunbound package with less buildrequires to
  allow shorter buildcycles when built by gnutls. bsc#964346

-------------------------------------------------------------------
Thu Dec 10 11:48:46 UTC 2015 - michael@stroeder.com

- update to 1.5.7

Features
  * Fix #594. libunbound: optionally use libnettle for crypto.
  Contributed by Luca Bruno.  Added --with-nettle for use with
  --with-libunbound-only.
  * Implemented qname minimisation

Bug Fixes
  * Fix #712: unbound-anchor appears to not fsync root.key.
  * Fix #714: Document config to block private-address for IPv4
    mapped IPv6 addresses.
  * portability, replace snprintf if return value broken
  * portability fixes.
  * detect libexpat without xml_StopParser function.
  * isblank() compat implementation.
  * patch from Doug Hogan for SSL_OP_NO_SSLvx options.
  * Fix #716: nodata proof with empty non-terminals and wildcards.
  * Fix #718: Fix unbound-control-setup with support for env
    without HEREDOC bash support.
  * ACX_SSL_CHECKS no longer adds -ldl needlessly.
  * Change example.conf: ftp.internic.net to https://www.internic.net
  * Fix for lenient accept of reverse order DNAME and CNAME.
  * spelling fixes from Igor Sobrado Delgado.
  * Fix that malformed EDNS query gets a response without malformed EDNS.
  * Added assert on rrset cache correctness.
  * Fix #720: add windows scripts to zip bundle,
    and fix unbound-control-setup windows batch file.
  * Fix for #724: conf syntax to read files from run dir (on Windows).
    And fix PCA prompt for unbound-service-install.exe.
    And add Changelog to windows binary dist.
  * .gitignore for git users.
  * iana portlist update.
  * Removed unneeded whitespace from example.conf.
  * Do not minimise forwarded requests.

-------------------------------------------------------------------
Thu Oct 15 19:31:43 UTC 2015 - michael@stroeder.com

- update to 1.5.6
  Features
  - Default for ssl-port is port 853, the temporary port assignment for
    secure domain name system traffic. If you used to rely on the older
    default of port 443, you have to put a clause in unbound.conf for
    that. The new value is likely going to be the standardised port number
    for this traffic.
  - ANY responses include DNAME records if present, as per Evan Hunt's
    remark in dnsop.

Bug Fixes
  - Fix segfault in the dns64 module in the formaterror error path.
  - Fix manpage to suggest using SIGTERM to terminate the server.
  - iana portlist update.

-------------------------------------------------------------------
Sat Oct 10 09:31:40 UTC 2015 - michael@stroeder.com

- ignore absence of the systemd-tmpfiles command

-------------------------------------------------------------------
Tue Oct  6 14:21:00 UTC 2015 - mrueckert@suse.de

- update to 1.5.5
  Features
  - Change default of harden-algo-downgrade to off. This is lenient
    for algorithm rollover.
  - Added permit-small-holddown config to debug fast 5011 rollover.
  - Allow certificate chain files to allow for intermediate
    certificates. (thanks Daniel Kahn Gillmor)
  - Enable ECDHE for servers. Where available, use
    SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations
    to enable ECDHE. Otherwise, manually offer curve p256. Client
    connections should automatically use ECDHE when available.
    (thanks Daniel Kahn Gillmor)
  - Feature --enable-pie option to that builds PIE binary.
    [bugzilla: 699 ]
  - Feature --enable-relro-now option that enables full read-only
    relocation.  [bugzilla: 700 ]
  - New IPs for for h.root-servers.net.  [bugzilla: 702 ]
  Bug Fixes
  - Fix setting forwarders with unbound-control forward implicitly
    turns on forward-first.  [bugzilla: 681 ]
  - Fix that reload fails when so-reuseport is yes after changing
    num-threads.  [bugzilla: 690 ]
  - please afl-gcc (llvm) for uninitialised variable warning.
  - Fix mktime in unbound-anchor not using UTC.
  - Fix 5011 anchor update timer after reload.
  - 5011 implementation does not insist on all algorithms, when
    harden-algo-downgrade is turned off.
  - Document in the manual more text about configuring locally
    served zones.
  - Document that local-zone nodefault matches exactly and
    transparent can be used to release a subzone.
  - Fix that configure script does not detect LibreSSL 2.2.2
    [bugzilla: 694 ]
  - Fix deadlock for local data add and zone add when
    unbound-control list_local_data printout is interrupted.
  - Fix get PY_MAJOR_VERSION failure at configure for python 2.4 to
    2.6.  [bugzilla: 697 ]
  - changed windows setup compression to be more transparent.
  - Fix config globbed include chroot treatment, this fixes reload
    of globs (patch from Dag-Erling SmÃ¸rgrav).
  - Fix ub_ctx_set_fwd() return value mishandled on windows.
    [bugzilla: 705 ]
  - Fix minor error in unbound.conf.5.in.
  - Fix unbound.conf(5) access-control description for precedence
    and default.
  - Fix unbound-control flush that does not succeed in removing
    data.
  - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution
    failures.
  - iana portlist update.
- remove manual hacks for relro,now and pie and replace them with
  official configure options.

-------------------------------------------------------------------
Fri Sep  4 13:37:38 UTC 2015 - mrueckert@suse.de

- enable event api
- enable dnstap support

-------------------------------------------------------------------
Thu Jul  9 10:16:32 UTC 2015 - michael@stroeder.com

- update to 1.5.4

Features
  - [bugzilla: 644 ] harden-algo-downgrade option, if turned off,
    fixes the reported excessive validation failure when multiple
    algorithms are present. If set to 'no', it allows the weakest
    algorithm to validate the zone.
  - stats reports tcp usage, of incoming-num-tcp buffers.
  - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
    scripts. Contributed by Yuri Voinov.
  - Add ip-transparent config option for bind to non-local addresses.
  - Synthesize ANY responses from cache. Does not search exhaustively,
    but MX,A,AAAA,SOA,NS also CNAME.
  - unbound-control list_insecure command shows the negative trust
    anchors currently configured, patch from Jelte Jansen.
  - ratelimit feature, ratelimit: 1000, can be used to turn it on. It
    ratelimits recursion effort per zone. For particular names you can
    configure exceptions in unbound.conf.
  - Ratelimit does not apply to prefetched queries, and
    ratelimit-factor is default 10. Repeated normal queries get resolved
    and with prefetch stay in the cache.
  - unbound-control ratelimit_list lists high rate domains.
  - caps-whitelist in unbound.conf allows whitelist of loadbalancers
    that cannot work with caps-for-id or its fallback.
  - RFC 7553 RR type URI support, is now enabled by default.
  - cache-max-negative-ttl config option, default 3600.
  - Add local-zone type inform_deny, that logs query and drops answer.

Bug Fixes
  - Unbound exits with a fatal error when the auto-trust-anchor-file
    fails to be writable. This is seconds after startup. You can load a
    readonly auto-trust-anchor-file with trust-anchor-file. The file has
    to be writable to notice the trust anchor change, without it, a trust
    anchor change will be unnoticed and the system will then become
    inoperable.
  - DLV is going to be decommissioned. Advice to stop using it, and
    put text in the example configuration and man page to that effect.
  - Patch from Brad Smith that syncs compat/getentropy_linux with
    OpenBSD's version (2015-03-04).
  - 0x20 fallback improved: servfail responses do not count as missing
    comparisons (except if all responses are errors), inability to find
    nameservers does not fail equality comparisons, many nameservers does
    not try to compare more than max-sent-count, parse failures start 0x20
    fallback procedure.
  - store caps_response with best response in case downgrade response
    happens to be the last one.
  - Document that incoming-num-tcp increase is good for large servers.
  - Fix lintian warning in unbound-checkconf man page (from Andreas
    Schulze).
  - Updated default keylength in unbound-control-setup to 3k.
  - Fixup compile on cygwin, more portable openssl thread id.
  - Use reallocarray for integer overflow protection, patch submitted
    by Loganaden Velvindron.
  - Fixed to add integer overflow checks on allocation (defense in depth).
  - Fix segfault on user not found at startup (from Maciej Soltysiak).
  - [bugzilla: 657 ] Fix that libunbound(3) recommends deprecated
    CRYPTO_set_id_callback.
  - If unknown trust anchor algorithm, and libressl is used, error
    message encourages upgrade of the libressl package.
  - rename ldns subdirectory to sldns to avoid name collision.
  - [bugzilla: 660 ] Fix interface-automatic broken in the presence of
    asymmetric routing.
  - Libunbound skips dos-line-endings from etc/hosts.
  - Fix crash in dnstap: Do not try to log TCP responses after timeout.
  - Fix that get_option for cache-sizes does not print double newline.
  - [bugzilla: 663 ] Fix that ssl handshake fails when using unix
    socket because dh size is too small.
  - [bugzilla: 664 ] libunbound python3 related fixes (from Tomas
    Hozza); Use print_function also for Python2. libunbound examples:
    produce sorted output. libunbound-Python: libldns is not used anymore.
    Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
  - Fix leaked dns64prefix configuration string.
  - Removed contrib/unbound_unixsock.diff, because it has been
    integrated, use control-interface: /path in unbound.conf.
  - Change syntax of particular validator error to be easier for
    machine parse, swap rrset and ip adres info so it looks like:
    validation failure <www.example.nl. TXT IN>: signature crypto failed
    from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
  - Fix that unparseable error responses are ratelimited.
  - SOA negative TTL is capped at minimumttl in its rdata section.
  - [bugzilla: 674 ] Do not free pointers given by getenv.
  - [bugzilla: 677 ] Fix CNAME corresponding to a DNAME was checked
    incorrectly and was therefore always synthesized (thanks to Valentin
    Dietrich). And fix DNAME responses from cache that failed internal
    chain test.
  - iana portlist update.

-------------------------------------------------------------------
Fri Apr 24 13:53:53 UTC 2015 - michael@stroeder.com

- update to 1.5.3
- Bug Fixes
    [bugzilla: 647 ]
    Fix #647 crash in 1.5.2 because pwd.db no longer accessible after reload.
    [bugzilla: 645 ]
    Fix #645 Portability to Solaris 10, use AF_LOCAL.
    [bugzilla: 646 ]
    Fix #646 Portability to Solaris, -lrt for getentropy_solaris.
    Use the getrandom syscall introduced in Linux 3.17 (from Heiner Kallweit).

-------------------------------------------------------------------
Thu Feb 19 23:35:58 UTC 2015 - mrueckert@suse.de

- update to 1.5.2
  - Features
    - local-zone: example.com inform makes unbound log a message
      with client IP for queries in that zone. Eg. for finding
      infected hosts.
    - patch from Stephane Lapie that adds to the python API, that
      exposes struct delegpt, and adds the find_delegation
      function.
    - Updated contrib warmup.cmd/sh to support two modes - load
      from pre-defined list of domains or (with filename as
      argument) load from user-specified list of domains, and
      updated contrib unbound_cache.sh/cmd to support
      loading/save/reload cache to/from default path or (with
      secondary argument) arbitrary path/filename, from Yuri
      Voinov.
    - patch for remote control over local sockets, from Dag-Erling
      Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and
      control-use-cert: no.
    - unbound-checkconf -f prints chroot with pidfile path.
    - infra-cache-min-rtt patch from Florian Riehm, for expected
      long uplink roundtrip times.
  - Bug Fixes
    - config.guess and config.sub update from libtoolize.
    - getauxval test for ppc64 linux compatibility.
    - make strip works for unbound-host and unbound-anchor.
    - print query name when max target count is exceeded.
    - patch from Stuart Henderson that fixes DESTDIR in
      unbound-control-setup for installs where config is not in the
      prefix location.
    - [bugzilla: 634 ] Fix #634: fix fail to start on Linux LTS
      3.14.X, ignores missing IP_MTU_DISCOVER OMIT option (fix from
      Remi Gacogne).
    - Patch from Philip Paeps to contrib/unbound_munin_ that uses
      type ABSOLUTE. Allows munin.conf: [idleserver.example.net]
      unbound_munin_hits.graph_period minute
    - Fix pyunbound ord call, portable for python 2 and 3.
    - Fix unintended use of gcc extension for incomplete enum
      types, compile with pedantic c99 compliance (from Daniel
      Dickman).
    - Fix pyunbound byte string representation for python3.
    - Fix 0x20 capsforid fallback to omit gratuitous NS and
      additional section changes.
    - Fix validation failure in case upstream forwarder (ISC BIND)
      does not have the same trust anchors and decides to insert
      unsigned NS record in authority section.
    - Fix scrubber with harden-glue turned off to reject NS (and
      other not-address) records.
    - iana portlist update.
    - [bugzilla: 643 ] Fix doc/example.conf.in: unnecessary
      whitespace.

-------------------------------------------------------------------
Mon Dec  8 16:12:23 UTC 2014 - mrueckert@suse.de

- update to 1.5.1 (boo# 908990)
  Features
  - Patch from Stephane Lapie for ASAHI Net that implements
    aaaa-filter, added to contrib/aaaa-filter-iterator.patch.
  Bug Fixes
  - Fix that CD flag disables DNS64 processing, returning the
    DNSSEC signed AAAA denial.
  - Fix compat/getentropy_win.c check if CryptGenRandom works and
    no immediate exit on windows.
  - Fix crash on multiple thread random usage on systems without
    arc4random.
  - Fix log at high verbosity and memory allocation failure.
  - Fix libunbound undefined symbol errors for main.
  - Patch from Robert Edmonds to build pyunbound python module
    differently. No versioninfo, with -shared and without $(LIBS).
  - Patch from Robert Edmonds fixes hyphens in unbound-anchor man
    page.
  - Removed 'increased limit open files' log message that is
    written to console. It is only written on verbosity 4 and
    higher. This keeps system bootup console cleaner.
  - Patch from James Raftery, always print stats for rcodes 0..5.
  - [bugzilla: 627 ] Fix SSL_CTX_load_verify_locations return code
    not properly checked.
  - Fix makefile for build from noexec source tree.
  - Add include to getentropy_linux.c, fixing debian build.
  - [bugzilla: 632 ] Fix that unbound fails to build on AArch64,
    protects getentropy compat code from calling sysctl if it is
    has been removed.
  - Fix CVE-2014-8602: denial of service by making resolver chase
    endless series of delegations.
- changes in 1.5.0
  Features
  - This release has DNS64, DNSTAP, better random numbers and
    ub_ctx_add_ta_autr(), num.query.tcpout=value, flush_negative,
    unblock-lan-zones conf.
  - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root
    hints (patch from Anand Buddhdev).
  - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation
    option for DNS fragmentation defense.
  - unbound-control stats prints num.query.tcpout with number of
    TCP outgoing queries made in the previous statistics interval.
  - Patch from Jeremie Courreges-Anglas to use arc4random_uniform
    if available on the OS, it gets entropy from the OS.
  - Add unbound-control flush_negative that flushed nxdomains,
    nodata, and errors from the cache. For dnssec-trigger and
    NetworkManager, fixes cases where network changes have
    localdata that was already negatively cached from the previous
    network.
  - Contrib windows scripts from Yuri Voinov added to src/contrib:
    create_unbound_ad_servers.cmd: enters anti-ad server lists.
    unbound_cache.cmd: saves and loads the cache. Also warmup.cmd
    (and .sh): warm up the DNS cache with your MRU domains.
  - Added unbound-control-setup.cmd from Yuri Voinov to the windows
    unbound distribution set. It requires openssl installed in
    %PATH%.
  - Implement draft-ietf-dnsop-rfc6598-rfc6303-01.
  - Feature, unblock-lan-zones: yesno that you can use to make
    unbound perform 10.0.0.0/8 and other reverse lookups normally,
    for use if unbound is running service for localhost on localhost.
  - unbound-host -D enabled dnssec and reads root trust anchor from
    the default root key file that was compiled in.
  - Add AAAA for B root server to default root hints.
  - unbound-control status reports if so-reuseport was successful.
  - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X.
  - arc4random in compat/ and getentropy, explicit_bzero, chacha
    for dependencies, from OpenBSD. arc4_lock and sha512 in compat.
    This makes arc4random available on all platforms, except when
    compiled with LIBNSS (it uses libNSS crypto random).
  - Patch from Dag-Erling Smorgrav that implements that: unbound
    -dd does not fork in the background and also logs to stderr.
  - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault.
    Initial commit of the patch from the FreeBSD base (with its
    fixes). This adds a module (for module-config in unbound.conf)
    dns64 that performs DNS64 processing, see README.DNS64.
  - Patch add msg, rrset, infra and key cache sizes to stats
    command from Maciej Soltysiak.
  - DNSTAP support, with a patch from Farsight Security, written by
    Robert Edmonds. The --enable-dnstap needs libfstrm and
    protobuf-c. It is BSD licensed (see dnstap/dnstap.c). Also
    --with-libfstrm and --with-protobuf-c configure options.
  - type CDS and CDNSKEY types.
  - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept
    queue is longer and more tcp connections can be handled.
  - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically
    tracked trust anchor to libunbound.
  Bug Fixes
  - Fix print filename of encompassing config file on read failure.
  - Patch from Stuart Henderson to build unbound-host man from
    .1.in.
  - [bugzilla: 569] Fix do_tcp is do-tcp in unbound.conf man page.
  - [bugzilla: 572] Fix unit test failure for systems with
    different /etc/ services.
  - iana portlist updated.
  - [bugzilla: 574] Fix make test fails on Ubuntu 14.04. Disabled
    remote-control in testbound scripts.
  - Documented that dump_requestlist only prints queries from
    thread 0.
  - [bugzilla: 567] Fix unbound lists if forward zone is secure or
    insecure with +i annotation in output of list_forwards, also
    for list_stubs (for NetworkManager integration). And remove ':'
    from output of stub and forward lists, this is easier to parse.
  - [bugzilla: 554] Fix use unsigned long to print 64bit statistics
    counters on 64bit systems.
  - [bugzilla: 558] Fix failed prefetch lookup does not remove
    cached response but delays next prefetch (in lieu of caching a
    SERVFAIL).
  - [bugzilla: 545] Fix improved logging, the ip address of the
    error is printed on the same log-line as the error.
  - [bugzilla: 502] Fix explain that do-ip6 disable does not stop
    AAAA lookups, but it stops the use of the ipv6 transport layer
    for DNS traffic.
  - Fix compile with libevent2 on FreeBSD.
  - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier.
  - Fixup out-of-directory compile with unbound-control-setup.sh.in.
  - Code cleanup patch from Dag-Erling Smorgrav, with compiler
    issue fixes from FreeBSD's copy of Unbound, he notes: Generate
    unbound-control-setup.sh at build time so it respects prefix
    and sysconfdir from the configure script.  Also fix the umask
    to match the comment, and the comment to match the umask. Add
    const and static where needed. Use unions instead of playing
    pointer poker. Move declarations that are needed in multiple
    source files into a shared header. Move sldns_bgetc() from
    parse.c to buffer.c where it belongs. Introduce a new header
    file, worker.h, which declares the callbacks that all workers
    must define. Remove those declarations from libworker.h.
    Include the correct headers in the correct places. Fix a few
    dummy callbacks that don't match their prototype. Fix some
    casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. Remove a
    useless printf which breaks reproducible builds. Get rid of
    CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're no longer
    used. Add unbound-control-setup.sh to the list of generated
    files. The prototype for libworker_event_done_cb() needs to be
    moved from libunbound/libworker.h to libunbound/worker.h.
  - Fix caps-for-id fallback, and added fallback attempt when
    servers drop 0x20 perturbed queries.
  - [bugzilla: 593] Fix segfault or crash upon rotating logfile.
  - fake-rfc2553 patch (thanks Benjamin Baier).
  - LibreSSL provides compat items, check for that in configure.
  - [bugzilla: 596] Bail out of unbound-control list_local_zones
    when ssl write fails.
  - Fix endian.h include for OpenBSD.
  - [bugzilla: 603] Fix unbound-checkconf -o option should skip
    verification checks.
  - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings.
  - Update unbound manpage with more explanation (from Florian Obser).
  - Fix tcp timer waiting list removal code.
  - patches to also build with Python 3.x (from Pavel Simerda).
  - improve python configuration detection to build on Fedora 22.
  - Fix swig and python examples for Python 3.x.
  - Fix for mingw compile with openssl-1.0.1i.
  - [bugzilla: 612] Fix create service with service.conf in present
    directory and auto load it.
  - [bugzilla: 613] Allow tab ws in var length last rdfs (in ldns
    str2wire).
  - [bugzilla: 614] Fix man page variable substitution bug.
  - Whitespaces after $ORIGIN are not part of the origin dname
    (ldns).
  - $TTL's value starts at position 5 (ldns).
  - Fix unbound-checkconf check for module config with dns64
    module.
  - Fix unbound capsforid fallback, it ignores TTLs in comparison.
  - [bugzilla: 617] Fix in ldns in unbound, lowercase WKS services.
  - Fix ctype invocation casts.
  - Disabled use of SSLv3 in remote-control and ssl-upstream.
  - Redefine internal minievent symbols to unique symbols that
    helps linking on platforms where the linker leaks names across
    modules.
  - Fix bug where forward or stub addresses with same address but
    different port number were not tried.

-------------------------------------------------------------------
Mon Nov 10 00:45:00 UTC 2014 - Led <ledest@gmail.com>

- fix bashisms in pre script

-------------------------------------------------------------------
Fri Sep  5 13:32:55 UTC 2014 - darin@darins.net

- cleanup .spec
- removed unused packes

-------------------------------------------------------------------
Tue Sep  2 13:21:55 UTC 2014 - darin@darins.net

- disable %check until https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=602 is fixed

-------------------------------------------------------------------
Wed Aug 20 13:34:00 UTC 2014 - darin@darins.net

- Added firewall service file

-------------------------------------------------------------------
Wed Aug 13 20:00:21 UTC 2014 - darin@darins.net

- upadte to 1.4.22
- use /run for pid to clear dir-or-file-in-var-run in factory

-------------------------------------------------------------------
Sat Dec 28 13:32:06 UTC 2013 - mrueckert@suse.de

- fixed the execstartpre for unbound so we actually call
  unbound-anchor now.

-------------------------------------------------------------------
Sat Dec 28 13:29:56 UTC 2013 - mrueckert@suse.de

- fixed a few rpmlint warnings
  - added unbound-rpmlintrc: files duplicate on those man page
    links
  - changed symlink to /usr/sbin/service
  - improved descriptions

-------------------------------------------------------------------
Sat Dec 28 04:02:56 UTC 2013 - mrueckert@suse.de

- update to 1.4.21
  merged lots of stuff from the fedora package
  - added python/munin/shlib/anchor subpackages
- currently the package only supports systemd

-------------------------------------------------------------------
Wed May 21 03:50:15 CEST 2008 - mrueckert@suse.de

- initial package

Places

File libunbound-devel-mini.changes of Package unbound (Revision e47261b772ac2ddec4fc9f3df869bd43)

Places