From owner-svn-ports-head@freebsd.org Wed Mar 21 17:00:25 2018 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D63A2F54689; Wed, 21 Mar 2018 17:00:24 +0000 (UTC) (envelope-from pi@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 828437AC59; Wed, 21 Mar 2018 17:00:24 +0000 (UTC) (envelope-from pi@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 794802D517; Wed, 21 Mar 2018 17:00:24 +0000 (UTC) (envelope-from pi@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w2LH0Osr059482; Wed, 21 Mar 2018 17:00:24 GMT (envelope-from pi@FreeBSD.org) Received: (from pi@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w2LH0OUR059478; Wed, 21 Mar 2018 17:00:24 GMT (envelope-from pi@FreeBSD.org) Message-Id: <201803211700.w2LH0OUR059478@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: pi set sender to pi@FreeBSD.org using -f From: Kurt Jaeger Date: Wed, 21 Mar 2018 17:00:24 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r465195 - in head/dns/unbound: . files X-SVN-Group: ports-head X-SVN-Commit-Author: pi X-SVN-Commit-Paths: in head/dns/unbound: . files X-SVN-Commit-Revision: 465195 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Mar 2018 17:00:25 -0000 Author: pi Date: Wed Mar 21 17:00:23 2018 New Revision: 465195 URL: https://svnweb.freebsd.org/changeset/ports/465195 Log: dns/unbound: upgrade 1.6.8 -> 1.7.0 Features - auth-zone provides a way to configure RFC7706 from unbound.conf, eg. with auth-zone: name: "." for-downstream: no for-upstream: yes fallback-enabled: yes and masters or a zonefile with data. - Aggressive use of NSEC implementation. Use cached NSEC records to generate NXDOMAIN, NODATA and positive wildcard answers. - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is also recognized and means the same. Also for tls-port, tls-service-key, tls-service-pem, stub-tls-upstream and forward-tls-upstream. - [dnscrypt] introduce dnscrypt-provider-cert-rotated option, from Manu Bretelle. This option allows handling multiple cert/key pairs while only distributing some of them. In order to reliably match a client magic with a given key without strong assumption as to how those were generated, we need both key and cert. Likewise, in order to know which ES version should be used. On the other hand, when rotating a cert, it can be desirable to only serve the new cert but still be able to handle clients that are still using the old certs's public key. The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not publish the cert as part of the DNS's provider_name's TXT answer. - Update B root ipv4 address. - make ip-transparent option work on OpenBSD. - Fix #2801: Install libunbound.pc. - ltrace.conf file for libunbound in contrib. - Fix #3598: Fix swig build issue on rhel6 based system. configure --disable-swig-version-check stops the swig version check. Bug Fixes - Fix #1749: With harden-referral-path: performance drops, due to circular dependency in NS and DS lookups. - [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert duplicates - Better documentation for cache-max-negative-ttl. - Fixed libunbound manual typo. - Fix #1949: [dnscrypt] make provider name mismatch more obvious. - Fix #2031: Double included headers - Document that errno is left informative on libunbound config read fail. - iana port update. - Fix #1913: ub_ctx_config is under circumstances thread-safe. - Fix #2362: TLS1.3/openssl-1.1.1 not working. - Fix #2034 - Autoconf and -flto. - Fix #2141 - for libsodium detect lack of entropy in chroot, print a message and exit. - Fix #2492: Documentation libunbound. - Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is set for stub zone. It no longer searches for DNSSEC information. - Fix #3299 - forward CNAME daisy chain is not working - Fix link failure on OmniOS. - Check whether --with-libunbound-only is set when using --with-nettle or --with-nss. - Fix qname-minimisation documentation (A QTYPE, not NS) - Fix that DS queries with referral replies are answered straight away, without a repeat query picking the DS from cache. The correct reply should have been an answer, the reply is fixed by the scrubber to have the answer in the answer section. - Fix that expiration date checks don't fail with clang -O2. - Fix queries being leaked above stub when refetching glue. - Copy query and correctly set flags on REFUSED answers when cache snooping is not allowed. - make depend: code dependencies updated in Makefile. - Fix #3397: Fix that cachedb could return a partial CNAME chain. - Fix #3397: Fix that when the cache contains an unsigned DNAME in the middle of a cname chain, a result without the DNAME could be returned. - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file for startup scripts to get the full pathname(s) of anchor file(s). - Print fatal errors about remote control setup before log init, so that it is printed to console. - Use NSEC with longest ce to prove wildcard absence. - Only use *.ce to prove wildcard absence, no longer names. - Fix unfreed locks in log and arc4random at exit of unbound. - Fix lock race condition in dns cache dname synthesis. - Fix #3451: dnstap not building when you have a separate build dir. And removed protoc warning, set dnstap.proto syntax to proto2. - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) - Unit test for auth zone https url download. - tls-cert-bundle option in unbound.conf enables TLS authentication. - Fixes for clang static analyzer, the missing ; in edns-subnet/addrtree.c after the assert made clang analyzer produce a failure to analyze it. - Fix #3505: Documentation for default local zones references wrong RFC. - Fix #3494: local-zone noview can be used to break out of the view to the global local zone contents, for queries for that zone. - Fix for more maintainable code in localzone. - more robust cachedump rrset routine. - Save wildcard RRset from answer with original owner for use in aggressive NSEC. - Fixup contrib/fastrpz.patch so that it applies. - Fix compile without threads, and remove unused variable. - Fix compile with staticexe and python module. - Fix nettle compile. - Fix to check define of DSA for when openssl is without deprecated. - iana port update. - Fix #3582: Squelch address already in use log when reuseaddr option causes same port to be used twice for tcp connections. - Reverted fix for #3512, this may not be the best way forward; although it could be changed at a later time, to stay similar to other implementations. - Fix for windows compile. - Fixed contrib/fastrpz.patch, even though this already applied cleanly for me, now also for others. - patch to log creates keytag queries, from A. Schulze. - patch suggested by Debian lintian: allow to -> allow one to, from A. Schulze. - Attempt to remove warning about trailing whitespace. - Added documentation for aggressive-nsec: yes. PR: 226822 Submitted by: jaap@NLnetLabs.nl (maintainer) Modified: head/dns/unbound/Makefile head/dns/unbound/distinfo head/dns/unbound/files/unbound.in head/dns/unbound/pkg-plist Modified: head/dns/unbound/Makefile ============================================================================== --- head/dns/unbound/Makefile Wed Mar 21 16:54:24 2018 (r465194) +++ head/dns/unbound/Makefile Wed Mar 21 17:00:23 2018 (r465195) @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= unbound -PORTVERSION= 1.6.8 -PORTREVISION= 2 +PORTVERSION= 1.7.0 CATEGORIES= dns MASTER_SITES= https://unbound.net/downloads/ \ https://distfiles.crux.guru/ Modified: head/dns/unbound/distinfo ============================================================================== --- head/dns/unbound/distinfo Wed Mar 21 16:54:24 2018 (r465194) +++ head/dns/unbound/distinfo Wed Mar 21 17:00:23 2018 (r465195) @@ -1,3 +1,3 @@ -TIMESTAMP = 1516376435 -SHA256 (unbound-1.6.8.tar.gz) = e3b428e33f56a45417107448418865fe08d58e0e7fea199b855515f60884dd49 -SIZE (unbound-1.6.8.tar.gz) = 5467536 +TIMESTAMP = 1521117536 +SHA256 (unbound-1.7.0.tar.gz) = 94dd9071fb13d8ccd122a3ac67c4524a3324d0e771fc7a8a7c49af8abfb926a2 +SIZE (unbound-1.7.0.tar.gz) = 5538228 Modified: head/dns/unbound/files/unbound.in ============================================================================== --- head/dns/unbound/files/unbound.in Wed Mar 21 16:54:24 2018 (r465194) +++ head/dns/unbound/files/unbound.in Wed Mar 21 17:00:23 2018 (r465195) @@ -27,7 +27,7 @@ reload_precmd="%%PREFIX%%/sbin/unbound-checkconf ${unb load_rc_config $name -pidfile=${unbound_pidfile:-"%%PREFIX%%/etc/unbound/unbound.pid"} +pidfile=`%%PREFIX%%/sbin/unbound-checkconf -o pidfile ${unbound_conf}` unbound_enable=${unbound_enable:-"NO"} unbound_anchorflags=${unbound_anchorflags:-""} unbound_conf=${unbound_conf:-"%%ETCDIR%%/unbound.conf"} Modified: head/dns/unbound/pkg-plist ============================================================================== --- head/dns/unbound/pkg-plist Wed Mar 21 16:54:24 2018 (r465194) +++ head/dns/unbound/pkg-plist Wed Mar 21 17:00:23 2018 (r465195) @@ -1,10 +1,11 @@ @sample %%ETCDIR%%/unbound.conf.sample include/unbound.h %%EVAPI%%include/unbound-event.h +libdata/pkgconfig/libunbound.pc lib/libunbound.a lib/libunbound.so lib/libunbound.so.2 -lib/libunbound.so.2.5.7 +lib/libunbound.so.2.5.8 %%PYTHON%%%%PYTHON_SITELIBDIR%%/_unbound.so %%PYTHON%%%%PYTHON_SITELIBDIR%%/unbound.py %%PYTHON%%%%PYTHON_SITELIBDIR%%/unboundmodule.py