CVS commit: pkgsrc/net/unbound

["Fredrik Pettai" <pettai%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   pettai
Date:           Mon Mar 21 15:04:32 UTC 2011

Modified Files:
        pkgsrc/net/unbound: Makefile PLIST distinfo
        pkgsrc/net/unbound/patches: patch-ac

Log Message:
unbound 1.48:

Features:
* harden-below-nxdomain config option, default off (because very old software
  may be incompatible). We could enable it by default in the future.
  From draft-vixie-dnsext-resimprove-00.
* typetransparent localzone: does not block other RR types.
* so-sndbuf option for very busy servers, a bit like so-rcvbuf.

Bug Fixes:
* Fix so a changed NS RRset does not get moved name stuck on old server,
  for type NS the TTL is not increased.
* Fix prefetch so it does not get stuck on old server for moved names.
* Fix insecure CNAME sequence marked as secure, reported by Bert Hubert.
* faster lruhash get_mem routine.
* [bugzilla: 346 ] remove ITAR scripts from contrib,
  the service is discontinued, use the root.
* Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept.
* algorithm compromise protection using the algorithms signalled in the DS
  record. Also, trust anchors, DLV, and RFC5011 receive this, and thus,
  if you have multiple algorithms in your trust-anchor-file then it will now
  behave different than before. Also, 5011 rollover for algorithms needs to be
  double-signature until the old algorithm is revoked.
* squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them)
* fix validation in this case: CNAME to nodata for co-hosted opt-in
  NSEC3 insecure delegation, was bogus, fixed to be insecure.
* Fix our 'BDS' license (typo reported by Xavier Belanger).
* [bugzilla: 338 ] print address when socket creation fails.
* Fix storage of EDNS failures in the infra cache.
* silence 'tcp connect: broken pipe' and 'net down' at low verbosity.
* unbound-anchor compiles with openssl 0.9.7.
* Be lenient and accept imgw.pl malformed packet (like BIND).
* the included ldns tarball is updated (to 1.6.8)
* iana portlist updated.

unbound 1.47:

Features:
* unbound-anchor app, unbound requires libexpat (xml parser library).
  It creates or updates a root.key file. Use it before you start the validator
  (e.g. at system boot time).
* dump_infra and flush_infra commands for unbound-control.

Bug Fixes:
* GOST code enabled by default (RFC 5933).
* Configure detects libev-4.00.
* do not synthesize a CNAME message from cache for qtype DS.
* Use central entropy to seed threads.
* Change the rtt used to probe EDNS-timeout hosts to 1000 msec.
* Fix validation failure for parent and child on same server with an insecure
  childzone and a CNAME from parent to child.
* Change of timeout code. No more lost and backoff in blockage. At 12sec timeout
  (and at least 2x lost before) one probe per IP is allowed only. At 120sec,
  the IP is blocked. After 15min, a 120sec entry has a single retry packet.
* no timeout backoff if meanwhile a query succeeded.
* Configure errors if ldns is not found.
* Windows 7 fix for the installer.
* Fix bug where fallback_tcp causes wrong roundtrip and edns observation to be
  noted in cache. Fix bug where EDNSprobe halted exponential backoff if EDNS
  status unknown.
* interface automatic works for some people with ip6 disabled. Therefore the
  error check is removed, so they can use the option.
* Fix TCP so it uses a random outgoing-interface.
* Fix bug when DLV below a trust-anchor that uses NSEC3 optout where the zone
  has a secure delegation hosted on the same server did not verify as secure
  (it was insecure by mistake).
* Fix alloc_reg_release for longer uptime in out of memory conditions.
* [bugzilla: 329 ] in example.conf show correct ipv4 link-local 169.254/16.
* compliance with draft-ietf-dnsop-default-local-zones-14,
  removed reverse ipv6 orchid prefix from builtin list.
* Algorithm rollover operational reality intrudes, for trust-anchor and
  5011-store, if one key matches it's good enough.
* Fix reported validation error in out of memory condition.
* Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout.
* increased mesh-max-activation from 1000 to 3000 for crazy domains like
  _tcp.slb.com with 262 servers.
* [bugzilla: 327 ] Fix for cannot access stub zones until the root is primed.
* openbsd-lint fixes
* [bugzilla: 321 ] Fix resolution of rs.ripe.net artifacts with 0x20.
  Delegpt structures checked for duplicates always.
  No more nameserver lookups generated when depth is full anyway.
* [bugzilla: 322 ] Fix, configure does not respect CFLAGS on Solaris.
  Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line if use
  sun-cc, but some systems need different flags.
* Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP changes,
  uses m4_bpatsubst now.
* make test (or make check) should be more portable and run the unit test and
  testbound scripts. (make longtest has special requirements).
* More pleasant remote control command parsing.
* Fix name of rrset printed that failed validation.
* Return NXDOMAIN after chain of CNAMEs ends at name-not-found.
* Fix validation in case a trust anchor enters into a zone with
  unsupported algorithms.
* iana portlist updated.
* updated ldns tarball.


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 pkgsrc/net/unbound/Makefile
cvs rdiff -u -r1.3 -r1.4 pkgsrc/net/unbound/PLIST
cvs rdiff -u -r1.10 -r1.11 pkgsrc/net/unbound/distinfo
cvs rdiff -u -r1.6 -r1.7 pkgsrc/net/unbound/patches/patch-ac

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.