- Fix crosscompile windows to use libssp when it exists.
- For the windows compile script disable gost.
- Fix that on windows, use BIO_set_callback_ex instead of deprecated
- Fix crosscompile on windows to work with openssl 3.0.0 the
link with ws2_32 needs -l:libssp.a for __strcpy_chk.
Also copy results from lib64 directory if needed.
- Small fixes for #41: changelog, conflicts resolved,
processQueryResponse takes an iterator env argument like other
functions in the iterator, no colon in string for set_option,
and some whitespace style, to make it similar to the rest.
- Fix RPZ locks. Do not unlock zones lock if requested and rpz find
zone does not find the zone. Readlock the clientip that is found
for ipbased triggers. Unlock the nsdname zone lock when done.
Unlock zone and ip in rpz nsip and nsdname callback. Unlock
authzone and localzone if clientip found in rpz worker call.
Changelog note for #401
- Merge #401: RPZ triggers. This add additional RPZ triggers,
unbound supports a full set of rpz triggers, and this now
includes nsdname, nsip and clientip triggers. Also actions
are fully supported, and this now includes the tcp-only action.
Found by static analyzer svace
Static analyzer message: Array 'token' of size 65536 bytes passed to
function 'rrinternal_parse_rdata' at str2wire.c:679 by passing as 2nd
parameter to function 'rrinternal_parse_rdata' at str2wire.c:775, where
it is accessed by unacceptable index. This may lead to buffer overflow.
Found by static analyzer svace
Static analyzer message: Pointer 'dp' is passed to a function at
iter_hints.c:401 after the referenced memory was deallocated at
iter_hints.c:174 by passing as 3rd parameter to function 'hints_insert'
at iter_hints.c:398.
Found by static analyzer svace
Static analyzer message: Return value of a function 'reply_info_copy'
is dereferenced at dns64.c:923 without checking, but it is usually
checked for this function (4/5).
Fix: log_assert does nothing if UNBOUND_DEBUG is undefined
Found by static analyzer svace
Static analyzer message: Integer value 'len' obtained from untrusted
source at tube.c:374 by passing as 2nd parameter to function 'read'
at tube.c:340 without checking its higher bound is used as a loop bound
at tube.c:374.
Changelog note for #519 and example.conf edit
- Merge #519: Support for selective enabling tcp-upstream for
stub/forward zones.
- For #519: note stub-tcp-upstream and forward-tcp-upstream in
the example configuration file.
Chih-Hsuan Yen [Fri, 23 Jul 2021 05:23:05 +0000 (13:23 +0800)]
- Reduce unnecessary linking
- Link to libpython only when needed, fixes #242
When pyunbound is enabled while pythonmodule is not (i.e., ./configure
--without-pythonmodule --with-pyunbound), only the Python library
_unbound.so uses Python functions, and main programs (unbound,
unbound-anchor, ...) and libunbound.so do not. This patch removes
unneeded linking.
- Link the Python library _unbound.so to Python only. _unbound.so does
not directly use libraries used by libunbound. This patch removes
unneeded linking mentioned in [1]
liheng562653799 [Fri, 6 Aug 2021 04:00:56 +0000 (12:00 +0800)]
Update mini_event.c
When in heavy load, unbound opens many outside_network sockets for out going queries to delegation servers, which may result in a big fd(maxfd) value(for thread A 65500, for thread B 65501, for thread C ...).
There are situations when thread A has a max fd num 65500 where maxfd is of course 65500, thread B has max fd num 20 for now but maxfd is still 65501. Though linux kernel checks whether maxfd+1 passed by select syscall is really the process' maxfd+1. Linux kernel can not tell maxfd+1 passed by thread B select syscall is much bigger(65501+1 or 65500+1 after trimed by kerne) than it should be (20+1).
In this situation, when kernel do_select() for thread B, much work is wasted.
daiyunwei [Tue, 3 Aug 2021 03:40:30 +0000 (11:40 +0800)]
#420
clear the c->buffer in the comm_point_send_reply does resolve the "can't fit qbuffer in c->buffer" issue, but it breaks the mesh reply list function that need to reuse the answer. because the c->buffer is cleared in the comm_point_send_reply, it cannot be resued again. it means that it is not inappropriate to clear c->buffer in the comm_point_send_reply.
After some investigation, i found it is appropriate to clear c->buffer before use in the http2_query_read_done.
- For #515: Fix compilation with openssl 3.0.0 beta2, lib64 dir and
SSL_get_peer_certificate.
- Move acx_nlnetlabs.m4 to version 41, with lib64 openssl dir check.
projects / thirdparty / unbound.git / log
