aboutsummaryrefslogtreecommitdiff
path: root/net/unbound
Commit message (Collapse)AuthorAge
...
* unbound: Update to version 1.9.5Josef Schlehofer2019-11-21
| | | | | | Fixes CVE-2019-18934 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* treewide: Use default PKG_BUILD_DIR when possibleJeffery To2019-10-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This removes lines that set PKG_BUILD_DIR when the set value is no different from the default value. Specifically, the line is removed if the assigned value is: * $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION) The default PKG_BUILD_DIR was updated[1] to incorporate BUILD_VARIANT if it is set, so now this is identical to the default value. * $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_SOURCE_SUBDIR) if PKG_SOURCE_SUBDIR is set to $(PKG_NAME)-$(PKG_VERSION), making it the same as the previous case * $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION) This is the same as the default PKG_BUILD_DIR when there is no BUILD_VARIANT. * $(BUILD_DIR)/[name]-$(PKG_VERSION) where [name] is a string that is identical to PKG_NAME [1]: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=e545fac8d968864a965edb9e50c6f90940b0a6c9 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* unbound: Update to version 1.9.4Josef Schlehofer2019-10-04
| | | | | | Fixes CVE-2019-16866 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* unbound: update to 1.9.3Eric Luehrsen2019-08-31
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: improve a few UCI settingsEric Luehrsen2019-06-19
| | | | | | | | | - treat RFC6762 'local.' as nxdomain because avahi and other services will disable if SOA or NS records appear in central DNS. - allow two threads to be enabled with the 'heavy traffic' variant of Unbound packages. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.9.2Eric Luehrsen2019-06-19
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: fix library double packingAlexander Ryzhov2019-06-06
| | | | Signed-off-by: Alexander Ryzhov <github@ryzhov-al.ru>
* unbound: add compile options to library and daemonEric Luehrsen2019-05-28
| | | | | | | Two seperate package names were chosen instead of menu selected options because dependents need a ready (large) package in release directory. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: replace obsolete test expressionsEric Luehrsen2019-05-28
| | | | | | | | Expressions '-o', '-a', and '\( \)' within test or '[ ]' are obsolete. POSIX allows few arguments to test, so long expressions are not portable. '[ p -a q ]' can be replaced with '[ p ] && [ q ]' instead. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: fix local dns synthesis corner casesEric Luehrsen2019-04-29
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update readme.mdEric Luehrsen2019-04-17
| | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: Fix ECC dependencyRosen Penev2019-04-05
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* unbound: Make ECDSA support explicitRosen Penev2019-04-01
| | | | | | | | | | | | Added a dependency to OPENSSL_WITH_EC to prevent any build failures. Switched URLs to HTTPS. Added PKG_CPE_ID for proper CVE tracking. Some Makefile reorganization for consistency between packages. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* unbound: update to 1.9.1 and remove upstream patchesEric Luehrsen2019-03-12
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to version 1.9.0Jan Pavlinec2019-02-11
| | | | | | | | | Changes: -remove old dns64 patch -refresh openssl deprecated patch -add DoT error log patch https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206 Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* unbound: add patch to fix dns64 crashJan Pavlinec2018-12-19
| | | | Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* unbound: update to 1.8.3Eric Luehrsen2018-12-12
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.8.2Eric Luehrsen2018-12-05
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: Remove deprecated OpenSSL APIRosen Penev2018-11-05
| | | | | | This will become pointless once OpenSSL 1.1.1 enters the tree. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* unbound: fix odhcpd link and axfr zone scriptsEric Luehrsen2018-10-24
| | | | | | | - fix AXFR zones to delay a potentially large download with ntp-hotplug - fix odhcpd link script to properly delete expired lease data from DNS Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.8.1Eric Luehrsen2018-10-09
| | | | | | | bug fixes for memory leaks bug fixes for DNS over TLS Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add patches for leaks during TLS queryEric Luehrsen2018-09-27
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.8.0Eric Luehrsen2018-09-15
| | | | | | | - adjust a few UCI translations to coordinate with upstream defaults - remove OpenSSL < 1.1.0 API log error patch which is included upstream Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: drop odhcpd leases with wrong field countEric Luehrsen2018-08-16
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: log openssl-1.0.2 lacks TLS host verificationEric Luehrsen2018-08-10
| | | | | | | | | | | ssl_set1_host() is not available without openssl-1.1.0. Unbound can not do host cert verification. DNS over TLS connects, but hosts are unverified. A patch for log err is added with a noitce in README.md. (see: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=658) Also, squash some minor robustness and TLS usability fixes. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: fix boot time and default run directoryEric Luehrsen2018-08-03
| | | | | | | | | Unbound struggles with boot ifup, so procd triggers changed to push outside of this noise. Unbound has run in /var/lib/unbound/, so chroot (jail) protects /etc/, and it can save flash wear. Compiled defaults reflect this now, so Unbound tools are easier run on the command line. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add UCI for forward stub and auth zone clausesEric Luehrsen2018-07-29
| | | | | | | | | | With growing interest, DNS over TLS can be setup in Unbounds foward-zone: clause. A broader UCI solution is added to support forward-, stub-, and auth- zone clauses in a new 'zone' section. This implentation required reworking scripts, because they did not scale. 'forward_domain' and 'prefetch_root' options are removed, and superceded by 'zone' section. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add README recipe for DNS/TLS outside of UCIEric Luehrsen2018-07-09
| | | | | | | | Unbound UCI so far has limited forward configuration lacking DNS over TLS connection setup tools. User override files 'unbound_srv.conf' and 'unbound_ext.conf' can implement this. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: limit outside script source to init funciton scopeEric Luehrsen2018-06-26
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: clean up domain periods and unnecessary quotesEric Luehrsen2018-06-26
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.7.3Eric Luehrsen2018-06-23
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve local zone evaluation in UCIEric Luehrsen2018-06-12
| | | | | | | | | | | | When UCI local zone is private and static, Unbound covered private addresses with defaults. Optional delegated global IP6 prefix protection lacked a static zone, but it was prevented from appearing in global DNS responses. Domain names router-as-TLD, "lan." and "local." were static, but they lacked default SOA or NS such as Unbound had assinged to private addresses. Clean up these local zones UCI evaluation and block global DNS inclusion. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.7.2Eric Luehrsen2018-06-12
| | | | | | | A few bug fixes but importantly fix a deadlock on AXFR configuration when notify occurs (auth-zone:) Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: Enable TCP fast openToke Høiland-Jørgensen2018-06-04
| | | | | | | This can reduce the lookup times for TCP lookups with a full RTT for supported servers. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* unbound: add root zone file cache optionEric Luehrsen2018-05-28
| | | | | | | | | Add the possibility to use Unbound auto-zone: clause to fetch complete root, arpa, in-addr.arpa, and ip6.arpa zone files. This can speed up recursion when users access many ccTLD or connection logging hits many PTR. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: provide transparent defaults with documentationEric Luehrsen2018-05-28
| | | | | | | | Some resource options bundled many Unbound.conf options and made customizing on top of UCI difficult. Make it easier to use Unbound built defaults (blank conf sections). Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.7.1Eric Luehrsen2018-05-05
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: don't use unitialised vars when UNBOUND_D_DHCP_LINK != odhcpdPeter Wagner2018-05-01
| | | | Signed-off-by: Peter Wagner <tripolar@gmx.at>
* unbound: fix SLAAC DNS inferenceEric Luehrsen2018-03-19
| | | | | | | Bug: If DHCPv4 MAC are used to infer SLAAC and the forth position of the subnet /64 is 0 (X:X:X:0::/64), then DNS records where malformed. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: add domain resolution control optionsEric Luehrsen2018-03-18
| | | | | | | | | | | - Add domain_forward to permit designated domains to forward instead of recurse as listed in resolve.conf.auto from DHCP WAN client - Update rebind_protection and add rebind_interface to protect IP6 GLA locally just like RFC 1918 protection - Rename trigger to trigger_interface with backwards compatability - Update odhcpd script for efficiency handling many clients Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.7.0Eric Luehrsen2018-03-18
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.8 for CVE-2017-15105Eric Luehrsen2018-01-19
| | | | | | | | | | A vulnerability was discovered in the processing of wildcard synthesized NSEC records. While synthesis of NSEC records is allowed by RFC4592, these synthesized owner names should not be used in the NSEC processing. This does, however, happen in Unbound 1.6.7 and earlier versions. (see https://unbound.net/downloads/CVE-2017-15105.txt) Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: fix crash when using odhcpd w/o dnsmasqDaniel Gimpelevich2018-01-18
| | | | | | | | | When using the configuration under "Unbound and odhcpd" in the package's README.md, the scripts generated a malformed config file for unbound, due to an "ip route" command giving extra output lines with the string "anycast" where the awk script expects an address. These are now filtered. Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
* treewide: fix incorrect *_BUILD_DEPENDSMatthias Schiffer2018-01-09
| | | | | | | | | | | | | | | | Build depends refer to source package names, not binary package names. In many cases, PKG_BUILD_DEPENDS simply duplicated runtime dependencies of a source package's binary packages; as the corresponding source packages are implicitly added as bulid dependencies, PKG_BUILD_DEPENDS can simply be dropped in these cases. In the other cases, *_BUILD_DEPENDS is fixed to refer to the correct source package name. Dependency of mysql-server is adjusted from libncursesw to libncurses (as libncursesw is a virtual package provided by libncurses), so the build dependency on ncurses is emitted unconditionally. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* unbound: fix uci for option domain-insecure:Eric Luehrsen2018-01-09
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.7Eric Luehrsen2017-10-11
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update options for remote-controlEric Luehrsen2017-09-22
| | | | | | | | | | Enhance the 'control' option to allow using SSL to connect to the server. Add the 'extended_stats' option to match 'extended-statistics: yes.' Document the 'extended_luci' option; it does not control Unbound, but changes the LuCI tabs. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.6Eric Luehrsen2017-09-21
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.5Eric Luehrsen2017-08-21
| | | | | | This fixes the root.key file if created when unbound is installed between sep11 and oct11 2017 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.4Eric Luehrsen2017-06-27
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
Powered by cgit, Themed by Ted Yin.