From owner-freebsd-ports-bugs@freebsd.org Mon Jun 17 10:26:53 2019 Return-Path: Delivered-To: freebsd-ports-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5627F15B3BA2 for ; Mon, 17 Jun 2019 10:26:53 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id E33F289117 for ; Mon, 17 Jun 2019 10:26:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.ysv.freebsd.org (Postfix) id 9E97715B3B9D; Mon, 17 Jun 2019 10:26:52 +0000 (UTC) Delivered-To: ports-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 623EF15B3B9C for ; Mon, 17 Jun 2019 10:26:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.ysv.freebsd.org (mxrelay.ysv.freebsd.org [IPv6:2001:1900:2254:206a::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.ysv.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id F1FDF89116 for ; Mon, 17 Jun 2019 10:26:51 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.ysv.freebsd.org (Postfix) with ESMTPS id 4C012455D for ; Mon, 17 Jun 2019 10:26:51 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id x5HAQpmo039738 for ; Mon, 17 Jun 2019 10:26:51 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id x5HAQneQ039724 for ports-bugs@FreeBSD.org; Mon, 17 Jun 2019 10:26:49 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 238651] [MAINTAINER] dns/unbound Upgrade to version 1.9.2 Date: Mon, 17 Jun 2019 10:26:33 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: jaap@NLnetLabs.nl X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: ports-bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter flagtypes.name attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jun 2019 10:26:53 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D238651 Bug ID: 238651 Summary: [MAINTAINER] dns/unbound Upgrade to version 1.9.2 Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: Individual Port(s) Assignee: ports-bugs@FreeBSD.org Reporter: jaap@NLnetLabs.nl Attachment #205170 maintainer-approval+ Flags: Created attachment 205170 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D205170&action= =3Dedit patch to upgrade This release contains a number of bug fixes for crashes introduced in 1.9, session ticket code, stream pipeline code, auth zone code and it also fixes qname minimisation packet scrub failures. There is a new python module example. This is an example of a module that is loaded into unbound that changes DNS messages, and how Unbound processes them. The example resolves records in multicast DNS, with Avahi. AXFR over TLS is supported. This uses TLS to connect to the master and download the AXFR or IXFR. Enable by loading certificates (just like for other DNS over TLS), and syntax like master: "ip#authname" in unbound.conf for the auth-zone where you want to use this. Features - add type CAA to libpyunbound (accessing libunbound from python). - Fix #17: Add python module example from Jan Janak, that is a plugin for the Unbound DNS resolver to resolve DNS records in multicast DNS [RFC 6762] via Avahi. The plugin communicates with Avahi via DBus. The comment section at the beginning of the file contains detailed documentation. - travis build file. - PR #16: XoT support, AXFR over TLS, turn it on with master: # in unbound.conf. This uses TLS to download the AXFR (or IXFR). Bug Fixes - Fix for #4233: guard use of NDEBUG, so that it can be passed in CFLAGS into configure. - Add log message, at verbosity 4, that says the query is encrypted with TLS, if that is enabled for the query. - Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482. - Fix #4240: Fix whitespace cleanup in example.conf. - Fix that tls-session-ticket-keys: "" on its own in unbound.conf disables the tls session ticker key calls into the OpenSSL API. - Fix crash if tls-servic-pem not filled in when necessary. - Fix auth-zone NSEC3 response for empty nonterminals with exact atch nsec3 records. - Fix for out of bounds integers, thanks to OSTIF audit. It is in allocation debug code. - Fix for auth zone nsec3 ent fix for wildcard nodata. - Move goto label in answer_from_cache to the end of the function where it is more visible. - Fix auth-zone NSEC3 response for wildcard nodata answers, include the closest encloser in the answer. - Fix spelling error in log output for event method. - Fix to reinit event structure for accepted TCP (and TLS) sockets. - Fix to use event_assign with libevent for thread-safety. - verbose information about auth zone lookup process, also lookup start, timeout and fail. - Fix to wipe ssl ticket keys from memory with explicit_bzero, if available. - Fix that auth zone uses correct network type for sockets for SOA serial probes. This fixes that probes fail because earlier probe addresses are unreachable. - Fix that auth zone fails over to next master for timeout in tcp. - Squelch SSL read and write connection reset by peer and broken pipe messages. Verbosity 2 and higher enables them. - Update python documentation for init_standard(). - Typos. - Fix tls write event for read state change to re-call SSL_write and not resume the TLS handshake. - Better braces in if statement in TCP fastopen code. - iana portlist updated. - Scrub RRs from answer section when reusing NXDOMAIN message for subdomain answers. - For harden-below-nxdomain: do not consider a name to be non-exitent when message contains a CNAME record. - Fix wrong query name in local zone redirect answers with a CNAME, the copy of the local alias is in unpacked form. - contrib/fastrpz.patch updated for code changes, and with git diff. - Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64. - Fix #30: AddressSanitizer finding in lookup3.c. This sets the hash function to use a slower but better auditable code that does not read beyond array boundaries. This makes code better security checkable, and is better for security. It is fixed to be slower, but not read outside of the array. - Fix edns-subnet locks, in error cases the lock was not unlocked. - Fix doxygen output error on readme markdown vignettes. - Squelch log messages from tcp send about connection reset by peer. They can be enabled with verbosity at higher values for diagnosing network connectivity issues. - Attempt to fix malformed tcp response. - Fix #31: swig 4.0 and python module. - Note that so-reuseport at extreme load is better turned off, otherwise queries are not distributed evenly, on Linux 4.4.x. - Fix that spoolbuf is not used to store tcp pipelined response between mesh send and callback end. - Fix double file close in tcp pipelined response code. - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD. - Fix to guard _OPENBSD_SOURCE from redefinition. - Fix that fixes the Fix that spoolbuf is not used to store tcp pipelined response between mesh send and callback end, this fixes error cases that did not use the correct spoolbuf. - Fix another spoolbuf storage code point, in prefetch. --=20 You are receiving this mail because: You are the assignee for the bug.=