Commit graph

4837 commits

Author SHA1 Message Date
W.C.A. Wijngaards
5f91d5f74c - Fix wait-limit-netblock and wait-limit-cookie-netblock config parse
to allow two arguments.
2025-04-03 09:53:27 +02:00
W.C.A. Wijngaards
c2ca679f5c - Fix #1263: Exempt loopback addresses from wait-limit. 2025-04-03 09:45:36 +02:00
W.C.A. Wijngaards
ba18abcd35 - Fix that ub_event has the facility to deal with callbacks for
fast reload, doq, windows-stop and dnstap.
- Fix fast reload test to check if pid exists before acting on it.
2025-04-02 16:25:58 +02:00
W.C.A. Wijngaards
a7704ad49f - Fix unbound-control test so it counts the new flush_negative output,
also answers the _ta probe from testns and prints command output
  and skip a thread specific test when no threads are available.
2025-04-02 15:52:20 +02:00
Yorgos Thessalonikefs
8b38fe5ab6 - For #1262, ifdef is no longer needed. 2025-04-02 11:53:50 +02:00
Yorgos Thessalonikefs
fcdb0bbf91 Changelog entry for #1262:
- Merge #1262 from markyang92, fix build with
  'gcc-15 -Wbuiltin-declaration-mismatch' error in compat/malloc.c.
2025-04-02 11:52:04 +02:00
W.C.A. Wijngaards
a7106fc58d - Enable the auth_tls.tdir and auth_tls_failcert.tdir tests. 2025-04-01 14:44:25 +02:00
W.C.A. Wijngaards
17f95ffac1 - Fix escape more characters when printing an RR type with an unquoted
string.
2025-04-01 13:53:29 +02:00
W.C.A. Wijngaards
0ca76b05e0 - Skip the unit tests for auth_tls.tdir and auth_tls_failcert.tdir. 2025-03-31 16:04:07 +02:00
Wouter Wijngaards
218f5cfc92
Fast Reload Option (#1042)
* - fast-reload, add unbound-control fast_reload

* - fast-reload, make a thread to service the unbound-control command.

* - fast-reload, communication sockets for information transfer.

* - fast-reload, fix compile for unbound-dnstap-socket.

* - fast-reload, set nonblocking communication to keep the server thread
  responding to DNS requests.

* - fast-reload, poll routine to test for readiness, timeout fails connection.

* - fast-reload, detect loop in sock_poll_timeout routine.

* - fast-reload, send done and exited notification.

* - fast-reload, defines for constants in ipc.

* - fast-reload, ipc socket recv and send resists partial reads and writes and
  can continue byte by byte. Also it can continue after an interrupt.

* - fast-reload, send exit command to thread when done.

* - fast-reload, output strings for client on string list.

* - fast-reload, add newline to terminal output.

* - fast-reload, send client string to remote client.

* - fast-reload, better debug output.

* - fast-reload, print queue structure, for output to the remote client.

* - fast-reload, move print items to print queue from fast_reload_thread struct.

* - fast-reload, keep list of pending print queue items in daemon struct.

* - fast-reload, comment explains in_list for printq to print remainder.

* - fast-reload, unit test testdata/fast_reload_thread.tdir that tests the
  thread output.

* - fast-reload, fix test link for fast_reload_printq_list_delete function.

* - fast-reload, reread config file from disk.

* - fast-reload, unshare forwards, making the structure locked, with an rwlock.

* - fast-reload, for nonthreaded, the unbound-control commands forward,
  forward_add and forward_delete should be distributed to other processes,
  but when threaded, they should not be distributed to other threads because
  the structure is not thread specific any more.

* - fast-reload, unshared stub hints, making the structure locked, with an rwlock.

* - fast-reload, helpful comments for hints lookup function return value.

* - fast-reload, fix bug in fast reload printout, the strlist appendlist routine,
  and printout time statistics after the reload is done.

* - fast-reload, keep track of reloadtime and deletestime and print them.

* - fast-reload, keep track of constructtime and print it.

* - fast-reload, construct new items.

* - fast-reload, better comment.

* - fast-reload, reload the config and swap trees for forwards and stub hints.

* - fast-reload, in forwards_swap_tree set protection of trees with locks.

* - fast-reload, in hints_swap_tree also swap the node count of the trees.

* - fast-reload, reload ipc to stop and start threads.

* - fast-reload, unused forward declarations removed.

* - fast-reload, unit test that fast reload works with forwards and stubs.

* - fast-reload, fix clang analyzer warnings.

* - fast-reload, small documentation entry in unbound-control -h output.

* - fast-reload, printout memory use by fast reload, in bytes.

* - fast-reload, compile without threads.

* - fast-reload, document fast_reload in man page.

* - fast-reload, print ok when done successfully.

* - fast-reload, option for fast-reload commandline, +v verbosity option,
  with timing and memory use output.

* - fast-reload, option for fast-reload commandline, +p does not pause threads.

* - fast-reload, option for fast-reload commandline, +d drops mesh queries.

* - fast-reload, fix to poll every thread with nopause to make certain that
  resources are not held by the threads and can be deleted.

* - fast-reload, fix to use atomic store for config variables with nopause.

* - fast-reload, reload views.

* - fast-reload, when tag defines are different, it drops the queries.

* - fast-reload, fix tag define check.

* - fast-reload, document that tag change causes drop of queries.

* - fast-reload, fix space in documentation man page.

* - fast-reload, copy respip client information to query state, put views tree
  in module env for lookup.

* - fast-reload, nicer respip view comparison.

* - fast-reload, respip global set is in module env.

* - fast-reload, document that respip_client_info acl info is copied.

* - fast-reload, reload the respip_set.

* - fast-reload, document no pause and pick up of use_response_ip boolean.

* - fast-reload, fix test compile.

* - fast-reload, reload local zones.

* Update locking management for iter_fwd and iter_hints methods. (#1054)

fast reload, move most of the locking management to iter_fwd and
iter_hints methods. The caller still has the ability to handle its
own locking, if desired, for atomic operations on sets of different
structs.

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>

* - fast-reload, reload access-control.

* - fast-reload, reload access control interface, such as interface-action.

* - fast-reload, reload tcp-connection-limit.

* - fast-reload, improve comments on acl_list and tcl_list swap tree.

* - fast-reload, fixup references to old tcp connection limits in open tcp
  connections.

* - fast-reload, fixup to clean tcp connection also for different linked order.

* - fast-reload, if no tcp connection limits existed, no need to remove
  references for that.

* - fast-reload, document more options that work and do not work.

* - fast-reload, reload auth_zone and rpz data.

* - fast-reload, fix auth_zones_get_mem.

* - fast-reload, fix compilation of testbound for the new comm_timer_get_mem
  reference in remote control.

* - fast-reload, change use_rpz with reload.

* - fast-reload, list changes in auth zones and stop zonemd callbacks for
  deleted auth zones.

* - fast-reload, note xtree is not swapped, and why it is not swapped.

* - fast-reload, for added auth zones, pick up zone transfer and zonemd tasks.

* - fast-reload, unlock xfr when done with transfer pick up.

* - fast-reload, unlock z when picking up the xfr for it during transfer task
  pick up.

* - fast-reload, pick up task changes for added, deleted and modified auth zones.

* - fast-reload, remove xfr of auth zone deletion without tasks.

* - fast-reload, pick up zone transfer config.

* - fast-reload, the main worker thread picks up the transfer tasks and also
  performs setup of the xfer struct.

* - fast-reload, keep writelock on newzone when auth zone changes.

* - fast-reload, change cachedb_enabled setting.

* - fast-reload, pick up edns-strings config.

* - fast-reload, note that settings are not updated.

* - fast-reload, pick up dnstap config.

* - fast-reload, dnstap options that need to be loaded without +p.

* - fast-reload, fix auth zone reload

* - fast-reload, remove debug for auth zone test.

* - fast-reload, fix auth zone reload with zone transfer.

* - fast-reload, fix auth zone reload lock order.

* - fast-reload, remove debug from fast reload test.

* - fast-reload, remove unused function.

* - fast-reload, fix the worker trust anchor probe timer lock acquisition in
  the probe answer callback routine for trust anchor probes.

* - fast-reload, reload trust anchors.

* - fast-reload, fix trust anchor reload lock on autr global data and test
  for trust anchor reload.

* - fast-reload, adjust cache sizes.

* - fast-reload, reload cache sizes when changed.

* - fast-reload, reload validator env changes.

* - fast-reload, reload mesh changes.

* - fast-reload, check for incompatible changes.

* - fast-reload, improve error text for incompatible change.

* - fast-reload, fix check config option compatibility.

* - fast-reload, improve error text for nopause change.

* - fast-reload, fix spelling of incompatible options.

* - fast-reload, reload target-fetch-policy, outbound-msg-retry, max-sent-count
  and max-query-restarts.

* - fast-reload, check nopause config change for target-fetch-policy.

* - fast-reload, reload do-not-query-address, private-address and capt-exempt.

* - fast-reload, check nopause config change for do-not-query-address,
  private-address and capt-exempt.

* - fast-reload, check fast reload not possible due to interface and
  outgoing-interface changes.

* - fast-reload, reload nat64 settings.

* - fast-reload, reload settings stored in the infra structure.

* - fast-reload, fix modstack lookup and remove outgoing-range check.

* - fast-reload, more explanation for config parse failure.

* - fast-reload, reload worker outside network changes.

* - fast-reload, detect incompatible changes in network settings.

* fast-reload, commit test files.

* - fast-reload, fix warnings for call types in windows compile.

* - fast-reload, fix warnings and comm_point_internal for tcp wouldblock calls.

* - fast-reload, extend lock checks for repeat thread ids.

* - fast-reload, additional test cases, cache change and tag changes.

* - fast-reload, fix documentation for auth_zone_verify_zonemd_with_key.

* - fast-reload, fix copy_cfg type casts and memory leak on config parse failure.

* - fast-reload, fix use of WSAPoll.

* Review comments for the fast reload feature (#1259)

* - fast-reload review, respip set can be null from a view.

* - fast-reload review, typos.

* - fast-reload review, keep clang static analyzer happy.

* - fast-reload review, don't forget to copy tag_actions.

* - fast-reload review, less indentation.

* - fast-reload review, don't leak respip_actions when reloading.

* - fast-reload review, protect NULL pointer dereference in get_mem
  functions.

* - fast-reload review, add fast_reload_most_options.tdir to test most
  options with high verbosity when fast reloading.

* - fast-reload review, don't skip new line on long error printouts.

* - fast-reload review, typo.

* - fast-reload review, use new_z for consistency.

* - fast-reload review, nit for unlock ordering to make eye comparison
  with the lock counterpart easier.

* - fast-reload review, in case of error the sockets are already closed.

* - fast-reload review, identation.

* - fast-reload review, add static keywords.

* - fast-reload review, update unbound-control usage text.

* - fast-reload review, updates to the man page.

* - fast-reload, the fast-reload command is experimental.

* - fast-reload, fix compile of doqclient for fast reload functions.

* Changelog comment for #1042
- Merge #1042: Fast Reload. The unbound-control fast_reload is added.
  It reads changed config in a thread, then only briefly pauses the
  service threads, that keep running. DNS service is only interrupted
  briefly, less than a second.

---------

Co-authored-by: Yorgos Thessalonikefs <yorgos@nlnetlabs.nl>
2025-03-31 15:25:24 +02:00
W.C.A. Wijngaards
914cef75f9 - iana portlist update. 2025-03-31 14:25:16 +02:00
W.C.A. Wijngaards
f76365754e - Fix for ci test, expat is installed on the osx image. 2025-03-27 10:52:00 +01:00
W.C.A. Wijngaards
aa77d02336 - Fix unit test dname log printout typecast. 2025-03-27 10:47:20 +01:00
Yorgos Thessalonikefs
23273d76a5 - For #1255, for ios try the latest expat version again. 2025-03-26 16:51:46 +01:00
Yorgos Thessalonikefs
94a84d3387 - For #1255, for ios disable building tests that require C++11. 2025-03-26 16:40:10 +01:00
Yorgos Thessalonikefs
d91c857e22 - For #1255, for ios use an older expat version that does not require
C++11 language features.
2025-03-26 16:15:16 +01:00
Yorgos Thessalonikefs
d03e4b1884 - Fix #1255: Multiple pinnings to vulnerable copies of libexpat. 2025-03-26 14:58:54 +01:00
W.C.A. Wijngaards
376f2ade2a - Fix #1254: send failed: Socket is not connected and
`remote address is 0.0.0.0 port 53`.
2025-03-24 08:54:54 +01:00
W.C.A. Wijngaards
0eabc8d0f1 - Fix for #1253: Fix for redis cachedb backend to expect an integer
reply for the EXPIRE command.
2025-03-21 14:07:22 +01:00
W.C.A. Wijngaards
a42fb99508 - Fix #1253: Cache entries fail to be removed from Redis cachedb
backend with unbound-control flush* +c.
2025-03-21 12:56:21 +01:00
W.C.A. Wijngaards
eccf52e39d - Fix print of RR type NSAP-PTR, it is an unquoted string. 2025-03-20 15:51:03 +01:00
W.C.A. Wijngaards
30b9cb5f81 - Fix for windows compile create ssl contexts. 2025-03-18 14:01:53 +01:00
W.C.A. Wijngaards
b0d20e2d28 - Fix #1251: WSAPoll first argument cannot be NULL. 2025-03-18 13:59:53 +01:00
W.C.A. Wijngaards
13afde2cad - Fix representation of types GPOS and RESINFO, add rdf type for 2025-03-17 16:38:17 +01:00
Yorgos Thessalonikefs
71bb60e586 - Fix 'unbound-control flush_negative' when reporting removed data;
reported by David 'eqvinox' Lamparter.
2025-03-16 09:02:20 +01:00
W.C.A. Wijngaards
5c84bb573f Changelog nore for #1238 and add --help description.
- Merge #1238: Prefer SOURCE_DATE_EPOCH over actual time.
  Add --help output description for the SOURCE_DATE_EPOCH variable.
2025-02-28 09:32:49 +01:00
W.C.A. Wijngaards
a3d750b7d8 Changelog note for #1243
- Merge #1243: Do not shadow tm on line 236.
2025-02-25 09:37:36 +01:00
Yorgos Thessalonikefs
c5c5486261 - Fix hash calculation for cachedb to ignore case. Previously, cached
records there were only relevant for same case queries (if not
  already in Unbound's internal cache).
2025-02-24 14:47:13 +01:00
Yorgos Thessalonikefs
1894c0a150 Changelog entry for #1241:
- Merge #1241: Fix infra-keep-probing for low infra-cache-max-rtt
  values.
2025-02-19 13:46:01 +01:00
Yorgos Thessalonikefs
5e1f35b59b - Fix static analysis report about unhandled EOF on error conditions
when reading anchor key files.
2025-02-19 11:24:49 +01:00
Yorgos Thessalonikefs
72828ff81c - Consider reconfigurations when calculating the still_useful_timeout
for servers in the infrastructure cache.
2025-02-17 15:21:18 +01:00
W.C.A. Wijngaards
01cea4d5be - Fix #986: Resolving sas.com with dnssec-validation fails though
signed delegations seem to be (mostly) correct.
2025-01-30 16:26:31 +01:00
Yorgos Thessalonikefs
35dbbcb2f5 - Make the default value of module-config "validator iterator"
regardless of compilation options. --enable-subnet would implicitly
  change the value to enable the subnetcache module by default in the
  past.
2025-01-29 12:08:28 +01:00
Yorgos Thessalonikefs
911509fd59 Changelog entry for #1220:
- Merge #1220 from Petr Menšík, Add unbound members group access to
  control key.
2025-01-24 16:56:09 +01:00
Yorgos Thessalonikefs
cc55beefc8 Changelog entry for #1224:
- Merge #1224 from Theo Buehler: Do not use DSA API unless USE_DSA is
  set.
2025-01-21 17:35:00 +01:00
W.C.A. Wijngaards
d9b863ed76 Changelog note for #1229
- Merge #1229: check before use daemon->shm_info.
2025-01-21 15:48:46 +01:00
Yorgos Thessalonikefs
f822042cd0 - Do not open unencrypted channels next to encrypted ones on the same
port.
2025-01-21 15:26:40 +01:00
W.C.A. Wijngaards
5f58ced71e - Fix to check length in ATMA string to wire. 2025-01-21 12:30:30 +01:00
W.C.A. Wijngaards
207ae97ff9 - Fix encoding of RR type ATMA. 2025-01-21 12:27:15 +01:00
W.C.A. Wijngaards
9a0de14aa1 - Fix compile of interface check code when dnscrypt or quic is
disabled.
2025-01-21 10:13:48 +01:00
Yorgos Thessalonikefs
048c193243 - Use the same interface listening port discovery code for all needed
protocols.
- Port to string only when needed before getaddrinfo().
2025-01-21 10:04:30 +01:00
Yorgos Thessalonikefs
d62fff2c7c - Create the quic SSL listening context only when needed. 2025-01-20 15:49:37 +01:00
Yorgos Thessalonikefs
3f839cebc3 Changelog entry for #1222:
- Merge #1222: Unique DoT and DoH SSL contexts to allow for different
  ALPN.
2025-01-20 15:45:11 +01:00
Yorgos Thessalonikefs
1d428f2d54 Changelog entry for #1221:
- Merge #1221: Consider auth zones when checking for forwarders.
2025-01-17 10:19:26 +01:00
Yorgos Thessalonikefs
f52b2a6ea2 - Add resolver.arpa and service.arpa to the default locally served
zones.
2025-01-14 17:18:32 +01:00
Yorgos Thessalonikefs
62a0e03801 - Fix #1213: Misleading error message on default access control causing
refuse.
2025-01-13 11:33:24 +01:00
Yorgos Thessalonikefs
716f3df385 Changelog entry for #1214:
- Merge #1214: Use TCP_NODELAY on TLS sockets to speed up the TLS
  handshake.
2025-01-10 13:54:49 +01:00
Yorgos Thessalonikefs
eb36c880de Changelog entry for #1174:
- Merge #1174: Serve expired cache update fixes. Fixes a regression bug
  with serve-expired that appeared in 1.22.0 and would not allow the
  iterator to update the cache with not-yet-validated entries resulting
  in increased outgoing traffic.
2024-12-31 16:30:35 +01:00
Yorgos Thessalonikefs
e57e537c85 - For #1207: [FR] Support for RESINFO RRType 261 (RFC9606), add
LDNS_RR_TYPE_RESINFO similar to LDNS_RR_TYPE_TXT.
2024-12-20 15:04:34 +01:00
Yorgos Thessalonikefs
71d821fde9 Changelog entry for #1204:
- Merge #1204: ci: set persist-credentials: false for actions/checkout
  per zizmor suggestion.
2024-12-13 13:43:29 +01:00