[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
pkg/42785: net/unbound -> needs updating to 1.4.1 [patch included]
>Synopsis: net/unbound -> needs updating to 1.4.1 [patch included]
>Arrival-Date: Wed Feb 10 19:00:01 +0000 2010
>Originator: Fredrik Pettai
>Release: NetBSD 5.0_STABLE
NetBSD morran 5.0_STABLE NetBSD 5.0_STABLE (MORRAN) #0: Sat Feb 6 22:28:19 CET
2010 root@morran:/usr/src/sys/arch/i386/compile/MORRAN i386
net/unbound should be updated to the current stable version.
Changelog of all bugs fixed (many memoryleaks) and new features incorporated:
* Bind the same interface multiple times at different ports. Use multiple
interface: lines with an @port suffix.
* Fix libtool version to 2 because of why_bogus change in 1.4.0.
[bugzilla: 284 ]
* fix parse of # without end-of-line at end-of-file.
* Fix crash with module-config "iterator".
[bugzilla: 287 ]
* Fix segfault when unbound-control remove nonexistent local data. And an
update of ldns tarball with fix for parse errors generated for domain names
* Fix for lookup of parent-child disagreement domains, where the parent-side
glue works but it does not provide proper NS, A or AAAA for itself, fixing
* Fix negative cache lookup of closestencloser check of DS type bit.
* Fix SOA excluded from negative DS responses. Reported by Hauke Lampe.
* Fix that verify_rrsig routine checks expiration last.
on IPv4 UDP turn off DF flag.
* Fix qclass=ANY queries, with class IN contents.
* RFC 5702: RSASHA256 and RSASHA512 support enabled by default. Please use
openssl 0.9.8 or later, that provide sha256 and sha512.
* included ldns tarball updated (which also enables rsasha256 support).
* val-log-level: 2 shows extended error information for validation failures,
one line per failure. For example: validation failure <example.com. DNSKEY IN>:
signature expired from 192.0.2.4 for trust anchor example.com. while building
chain of trust
* Made new validator error string available from libunbound for applications.
It is in result->why_bogus, a zero-terminated string. unbound-host prints it by
default if a result is bogus. Also the errinf is public in module_qstate (for
* retry on DNSSEC failures, query other servers, unbound works harder to get
valid DNSSEC data.
* so-rcvbuf: 4m option added. Set this on large busy servers to not drop the
occasional packet in spikes due to full socket buffers. netstat -su keeps a
counter of UDP dropped due to full buffers.
* auto-trust-anchor-file option with RFC5011 support, code from the NLnet Labs
autotrust project(BSD license), is incorporated. In this way unbound can
support trust anchor revocation properly, even revocation back to the unsigned
state. It can read normal anchor files or autotrust files initially, after
probing the file is written to in a format specific to unbound.
* use linebuffering for log-file: output, this can be significantly faster than
the previous fflush method and enable some class of resolvers to use high
verbosity (for short periods). Not on windows, because line buffering does not
* Patch from Zdenek Vasicek and Attila Nagy for using the source IP from python
scripts. See pythonmod/examples/resip.py.
* Got a patch from Luca Bruno for libunbound support on windows to pick up the
system resolvconf nameservers and hosts there.
* call OPENSSL_config() in unbound and unit test so that the operator can use
openssl.cnf for configuration options.
* Experimental support (disabled by default) for GOST for unofficial algorithm
number 249 of draft-dolmatov-dnsext-dnssec-gost-01, tested to work with
openssl-1.0.0beta and correct for examples in -01 draft.
* edns-buffer-size option, default 4096. Can be set to 1480 in case of DNS UDP
fragments not arriving from authority servers.
* iana portlist updated.
* contrib/split-itar.sh from Tom Hendrikx to split anchors.mf from the IANA
ITAR into individual key files that can be tracked with auto-trust-anchor-file.
* fixed do-udp: no (only TCP is used).
* removed abort on prealloc failure, error still printed but softfail.
* Fix bug where autotrust does not work when started with a DS.
* Fix double time subtraction in negative cache reported by Amanda Constant and
fix unbound-host so -d can be given before -C.
fix DNSSEC-missing-signature detection for minimal responses for qtype DNSKEY
(assumes DNSKEY occurs at zone apex).
* fix compile of unbound-host when --enable-alloc-checks.
* Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis.
* Manual page fixes reported by Tony Finch.
* Fix memory leak reported by Tao Ma.
* increased MAXSYSLOGLEN so .bg key can be printed in debug output.
* Fix bug where DNSSEC-bogus messages were marked with too high TTL. The RRsets
would still expire at the normal time, but this would keep messages bogus in
the cache for too long.
* documented that load_cache is meant for debugging.
* fixup printing errors when load_cache, they were printed to the SSL
connection which had just broken, now to the log.
* Changes to make unbound work with libevent-2.0.3 alpha. (in configure
detection due to new ssl dependency in libevent).
* do not call sphinx for documentation when python is disabled.
* remove EV_PERSIST from libevent timeout code to make the code compatible with
the libevent-2.0. Works with older libevent too.
* fix memory leak in python code.
* makefile fix for parallel makes.
* fixup unbound-control lookup to print forward and stub servers.
* fixup memleak in trust anchor unsupported algorithm check.
* free all memory on program exit, fix for ssl and flex.
* fixup DS lookup at anchor point with unsigned parent.
* fixup DLV lookup for DS queries to unsigned domains.
* Fix so that servers are only blacklisted if they fail to reply to 16 queries
in a row and the timeout gets above 2 minutes.
* unbound-control lookup prints out infra cache information, like RTT.
* Fix bug in DLV lookup reported by Amanda from Secure64. It could sometimes
wrongly classify a domain as unsigned, which does not give the AD bit on
* Thanks to Surfnet found bug in new dnssec-retry code that failed to combine
well when combined with DLV and then a validation failure.
* removed small memory leak from config file reader.
* fix manpage errors reported by debian lintian.
* Fixed validation failure for CNAME to optout NSEC3 nodata answer.
* unbound-host does not fail on type ANY.
* Fixed wireparse failure to put RRSIGs together with data in some long ANY mix
cases, which fixes validation failures.
* Fixed signer detection of CNAME responses without signatures.
[bugzilla: 282 ]
* Fixed libunbound memleak on error condition by Eric Sesterhenn.
# cvs diff -u
cvs diff: Diffing .
RCS file: /cvsroot/pkgsrc/net/unbound/Makefile,v
retrieving revision 1.6
diff -u -r1.6 Makefile
--- Makefile 17 Jan 2010 12:02:36 -0000 1.6
+++ Makefile 10 Feb 2010 18:45:07 -0000
@@ -1,7 +1,7 @@
# $NetBSD: Makefile,v 1.6 2010/01/17 12:02:36 wiz Exp $
RCS file: /cvsroot/pkgsrc/net/unbound/distinfo,v
retrieving revision 1.5
diff -u -r1.5 distinfo
--- distinfo 19 Oct 2009 17:03:33 -0000 1.5
+++ distinfo 10 Feb 2010 18:45:07 -0000
@@ -1,6 +1,6 @@
$NetBSD: distinfo,v 1.5 2009/10/19 17:03:33 joerg Exp $
-SHA1 (unbound-1.3.4.tar.gz) = 70aea0092ad0b0cd76e57adc6a5843d3fa0d2a07
-RMD160 (unbound-1.3.4.tar.gz) = ae3a920b2e5f6a31527a83e75a04ade43bfc733e
-Size (unbound-1.3.4.tar.gz) = 4039725 bytes
-SHA1 (patch-ac) = 5c4ea2a3c09b0fadd254c223d04e40d00697bc95
+SHA1 (unbound-1.4.1.tar.gz) = a7bfcc057e4d242bfced847f587a71f8eaa236d7
+RMD160 (unbound-1.4.1.tar.gz) = 2f9b1ad943347305a47a9003f520c7bbe6cd6de6
+Size (unbound-1.4.1.tar.gz) = 4191123 bytes
+SHA1 (patch-ac) = fd729998a51257bd9693971bea11d8a8b8a53176
cvs diff: Diffing files
cvs diff: Diffing patches
RCS file: /cvsroot/pkgsrc/net/unbound/patches/patch-ac,v
retrieving revision 1.4
diff -u -r1.4 patch-ac
--- patches/patch-ac 23 Aug 2009 14:17:39 -0000 1.4
+++ patches/patch-ac 10 Feb 2010 18:45:07 -0000
@@ -1,8 +1,8 @@
$NetBSD: patch-ac,v 1.4 2009/08/23 14:17:39 hasso Exp $
---- Makefile.in.orig 2009-07-15 16:08:52 +0300
-+++ Makefile.in 2009-08-23 17:11:32 +0300
-@@ -91,12 +91,11 @@ UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
+--- Makefile.in.orig 2009-09-10 16:16:19.000000000 +0200
++++ Makefile.in 2010-02-10 14:04:07.000000000 +0100
+@@ -93,12 +93,11 @@
testcode/readhex.c testcode/ldns-testpkts.c smallapp/worker_cb.c \
UNITTEST_OBJ=$(addprefix $(BUILD),$(UNITTEST_SRC:.c=.lo)) $(COMPAT_OBJ)
@@ -18,9 +18,9 @@
CONTROL_OBJ=$(addprefix $(BUILD),$(CONTROL_SRC:.c=.lo)) $(COMPAT_OBJ)
HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(COMPAT_OBJ)
-@@ -202,21 +201,21 @@ else
+@@ -205,21 +204,21 @@
+ $(INFO) Link $@
+ $Q$(LINK_LIB) -export-symbols $(srcdir)/libunbound/ubsyms.def -o $@
$(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
-unbound$(EXEEXT): $(DAEMON_OBJ) $(ldnslib)
+unbound$(EXEEXT): $(DAEMON_OBJ) $(ldnslib) libunbound.la
Main Index |
Thread Index |