Florian Obser [Fri, 10 Jan 2020 12:55:55 +0000 (13:55 +0100)]
Allow the kernel to provide random source ports.
On some operating systems, for example OpenBSD since some decades, the
kernel binds to a random source port if asked for any port (port
number 0). There is no need to replicate this functionality in
userland.
gthess [Wed, 5 Feb 2020 13:20:27 +0000 (14:20 +0100)]
Serve stale (#159)
- Added serve-stale functionality as described in
draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used
to configure the behavior.
- Updated cachedb to honor `serve-expired-ttl`; Fixes #107.
- Renamed statistic `num.zero_ttl` to `num.expired` as expired replies
come with a configurable TTL value (`serve-expired-reply-ttl`).
- Fixed stats when replying with cached, cname-aliased records.
- Added missing default values for redis cachedb backend.
Changelog note for PR#151.
- Merge PR#151: Fixes for systemd units, by Maryse47, Edmonds
and Frzk. Updates the unbound.service systemd file and adds
a portable systemd service file.
Maryse47 [Tue, 28 Jan 2020 17:47:21 +0000 (18:47 +0100)]
unbound.service.in: don't write pidfile at start
Pidfiles aren't needed while running unbound through systemd.
The PID of the unbound daemon can still be obtained with:
'systemctl show --property MainPID --value unbound'.
While disabling pidfiles we can also drop CAP_CHOWN and writable
/run directory.
Maryse47 [Tue, 28 Jan 2020 17:42:41 +0000 (18:42 +0100)]
unbound.service.in: drop CAP_IPC_LOCK
CAP_IPC_LOCK controls whether a process can lock pages into physical
memory (for instance to prevent passwords or private keys from
being swapped to disk), e.g. mmap() with the MAP_LOCKED flag or
shmctl() with the SHM_LOCK command, neither of which seem to be
used by unbound.
Maryse47 [Mon, 27 Jan 2020 12:46:31 +0000 (13:46 +0100)]
unbound.service.in: add StateDirectory
State directory will be created under /var/lib/unbound and will be
useful for writing various files managed at runtime like trust
anchors updates there instead of in ConfigureDirectory which could
be made read-only next. For this chroot needs to be disabled.
Maryse47 [Fri, 24 Jan 2020 23:48:25 +0000 (00:48 +0100)]
Move unbound_nochroot.service to unbound_portable.service
The real purpose of this service is to make it work with
https://systemd.io/PORTABLE_SERVICES/ which are incompatible with
chroot workarounds from original unbound.service.
The service content is identical to unbound.service with exception
for chroot related rules which were modified as needed.
Robert Edmonds [Mon, 27 Jan 2020 03:23:53 +0000 (22:23 -0500)]
contrib/libunbound.pc.in: Embed the correct crypto dependencies
This commit removes the hardcoded dependency in the libunbound
pkg-config .pc file on the libcrypto and libssl modules and instead
populates the .pc file based on which crypto library was selected at
configure time.
Note that the .pc file specifies pkg-config module names for the
"Requires" line and this can vary from the library filename (e.g. "nss"
is the pkg-config module name vs. "nss3" being the library name).
Robert Edmonds [Mon, 27 Jan 2020 03:01:38 +0000 (22:01 -0500)]
contrib/libunbound.pc.in: Only specify -lunbound for Libs
According to the pkg-config manpage, the "Libs" line in a .pc file
should give the link flags "specific to your package", and specifically
says not to include link flags for dependencies:
Libs: This line should give the link flags specific to your
package. Don't add any flags for required packages;
pkg-config will add those automatically.
instead of the embedded code copies in contrib/, which will be
difficult to maintain in the long term.
Also patch util/random.c so that, when building with libbsd and without
OpenSSL, arc4random can still be used as the PRNG. Otherwise, building
with libnettle would need a kernel-specific getentropy implementation,
and libbsd does not export one.
[edmonds@debian.org: Imported patch description from BTS, refreshed
patch against Unbound 1.9.6.]
Changelog and contrib/README note for PR#150.
- Merge PR#150 from Frzk: Systemd unit without chroot. It add
contrib/unbound_nochroot.service.in, a systemd file for use with
chroot: "", see comments in the file, it uses systemd protections
instead.
projects / thirdparty / unbound.git / log
