From 398961d79a320e4586f9189cf8e717e2719af383 Mon Sep 17 00:00:00 2001 From: he Date: Tue, 27 Aug 2019 09:25:25 +0000 Subject: [PATCH] Update unbound to version 1.9.3 Upstream changes: This release has a number of bug fixes. Added is the ipset module, that helps add ip-addresses that are looked up in a domain to a firewall ip-address filter. Also, the python module has restart next, per-query data and multiple instance support. The unbound -V option has been added and it prints the build config. Features: - PR #28: IPSet module, by Kevin Chou. Created a module to support the ipset that could add the domain's ip to a list easily. Needs libmnl, and --enable-ipset and config it, doc/README.ipset.md. - Merge PR #6: Python module: support multiple instances - Merge PR #5: Python module: define constant MODULE_RESTART_NEXT - Merge PR #4: Python module: assign something useful to the per-query data store 'qdata' - Introduce `-V` option to print the version number and build options. Previously reported build options like linked libs and linked modules are now moved from `-h` to `-V` as well for consistency. - PACKAGE_BUGREPORT now also includes link to GitHub issues. Bug Fixes: - Fix #39: In libunbound, leftover logfile is close()d unpredictably. - Fix for #24: Fix abort due to scan of auth zone masters using old address from previous scan. - Fix to omit RRSIGs from addition to the ipset. - Fix to make unbound-control with ipset, remove unused variable, use unsigned type because of comparison, and assign null instead of compare with it. Remade lex and yacc output. - make depend - Added documentation to the ipset files (for doxygen output). - Fix python dict reference and double free in config. - Fix memleak in unit test, reported from the clang 8.0 static analyzer. - For #45, check that 127.0.0.1 and ::1 are not used in unbound.conf when do-not-query-localhost is turned on, or at default on, unbound-checkconf prints a warning if it is found in forward-addr or stub-addr statements. - Fix for possible assertion failure when answering respip CNAME from cache. - Fix in respip addrtree selection. Absence of addr_tree_init_parents() call made it impossible to go up the tree when the matching netmask is too specific. - Fix #48: Unbound returns additional records on NODATA response, if minimal-responses is enabled, also the additional for negative responses is removed. - Fix #49: Set no renegotiation on the SSL context to stop client session renegotiation. - Fix question section mismatch in local zone redirect. - Add verbose log message when auth zone file is written, at level 4. - Add hex print of trust anchor pointer to trust anchor file temp name to make it unique, for libunbound created multiple contexts. - For #52 #53, second context does not close logfile override. - Fix #52 #53, fix for example fail program. - Fix to return after failed auth zone http chunk write. - Fix to remove unused test for task_probe existance. - Fix to timeval_add for remaining second in microseconds. - Check repinfo in worker_handle_request, if null, drop it. - Generate configlexer with newer flex. - Fix warning for unused variable for compilation without systemd. - Fix #59, when compiled with systemd support check that we can properly communicate with systemd through the `NOTIFY_SOCKET`. - iana portlist updated. - Fix autotrust temp file uniqueness windows compile. - avoid warning about upcast on 32bit systems for autotrust. - escape commandline contents for -V. - Fix character buffer size in ub_ctx_hosts. - Option -V prints if TCP fastopen is available. - Fix unittest valgrind false positive uninitialised value report, where if gcc 9.1.1 uses -O2 (but not -O1) then valgrind 3.15.0 issues an uninitialised value for the token buffer at the str2wire.c rrinternal_get_owner() strcmp with the '@' value. Rewritten to use straight character comparisons removes the false positive. Also valgrinds --expensive-definedness-checks=yes can stop this false positive. - Please doxygen's parser for "@" occurrence in doxygen comment. - Fixup contrib/fastrpz.patch - Remove warning about unknown cast-function-type warning pragma. - Document limitation of pidfile removal outside of chroot directory. - Fix log_dns_msg to log irrespective of minimal responses config. - Fix that pkg-config is setup before --enable-systemd needs it. --- net/unbound/Makefile | 4 ++-- net/unbound/distinfo | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/net/unbound/Makefile b/net/unbound/Makefile index bd0bd54e9a5a..c19d56f88e54 100644 --- a/net/unbound/Makefile +++ b/net/unbound/Makefile @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.68 2019/06/17 09:49:08 he Exp $ +# $NetBSD: Makefile,v 1.69 2019/08/27 09:25:25 he Exp $ -DISTNAME= unbound-1.9.2 +DISTNAME= unbound-1.9.3 CATEGORIES= net MASTER_SITES= http://www.nlnetlabs.nl/downloads/unbound/ diff --git a/net/unbound/distinfo b/net/unbound/distinfo index 510c9025c9be..18ddb2bf2a01 100644 --- a/net/unbound/distinfo +++ b/net/unbound/distinfo @@ -1,7 +1,7 @@ -$NetBSD: distinfo,v 1.51 2019/06/17 09:49:08 he Exp $ +$NetBSD: distinfo,v 1.52 2019/08/27 09:25:25 he Exp $ -SHA1 (unbound-1.9.2.tar.gz) = 9a7ac3163df57a26b1cfb89844993d95fabee359 -RMD160 (unbound-1.9.2.tar.gz) = 63411e761d70b5ce7c5e939dceebd8e7d4818c94 -SHA512 (unbound-1.9.2.tar.gz) = 118f0e53ee2d5cfb53ce1f792ca680cc01b5825bf81575e36bd3b24f3bdbe14e6631401bf1bf85eb2ac2a3fa0ee2ee3eb6a28b245d06d48d9975ce4cc260f764 -Size (unbound-1.9.2.tar.gz) = 5676395 bytes +SHA1 (unbound-1.9.3.tar.gz) = cc3081c042511468177e36897f0c7f0a155493fa +RMD160 (unbound-1.9.3.tar.gz) = 2c589c79cf7ab5aa50b28f61d5f4e2ff62543af5 +SHA512 (unbound-1.9.3.tar.gz) = 21e14dc1577adbe502a262d7fbe9aae0cd389cd9c0b822246beadf00f0ee875e268eeb3ce820433cbb01495d6b182c334b34b63b1bc33b08589a230810ccfe90 +Size (unbound-1.9.3.tar.gz) = 5686017 bytes SHA1 (patch-configure) = eabd0c478e92ebe37adf143849389e0e792dc77f