Commit Graph

440 Commits

Author SHA1 Message Date
W.C.A. Wijngaards
015b2b0daf - Fix #1126: unbound-control-setup hangs while testing for openssl
presence starting from version 1.21.0.
2024-08-19 15:51:47 +02:00
Wouter Wijngaards
ad21dbd1c2
Cookie secret file (#1090)
* - cookie-secret-file, define struct.

* - cookie-secret-file, add config option, create, read and delete struct.

* - cookie-secret-file, check cookie secrets for cookie validation.

* - cookie-secret-file, unbound-control add_cookie_secret, drop_cookie_secret,
  activate_cookie_secret and print_cookie_secrets.

* - cookie-secret-file, test and fix locks, renew writes a fresh cookie,
  staging cookies get a fresh cookie and spelling in error message.

* - cookie-secret-file, remove unused variable from cookie file unit test.

* Remove unshare and faketime dependencies for cookie_file test; documentation nits.

---------

Co-authored-by: Yorgos Thessalonikefs <yorgos@nlnetlabs.nl>
2024-08-02 13:32:08 +02:00
W.C.A. Wijngaards
f094f4ea3c - Add root key 38696 from 2024 for DNSSEC validation. It is added
to the default root keys in unbound-anchor. The content can be
  inspected with `unbound-anchor -l`.
2024-07-25 11:42:22 +02:00
W.C.A. Wijngaards
ff653a7ef8 Call module init init again, and new function startup and destartup.
NULL can be used if the function is not used. Open shared ports during
reload. Deinit is called during reload.
2024-07-01 16:10:07 +02:00
W.C.A. Wijngaards
3953f827fb Merge branch 'master' of https://github.com/madroach/unbound into ipset-pf-support 2024-07-01 14:36:33 +02:00
W.C.A. Wijngaards
08050dc939 - Fix #1091: Build fails with OpenSSL >= 3.0 built with
OPENSSL_NO_DEPRECATED.
2024-06-17 12:28:45 +02:00
W.C.A. Wijngaards
1974732d19 - Fix typos for 'the the' in text. 2024-06-06 09:35:57 +02:00
Yorgos Thessalonikefs
5fc4673901 - Update patch to remove 'command' shell builtin and update error
text.
2024-05-27 17:17:48 +02:00
Michael Tokarev
faf3d358dc unbound-control-setup: check openssl
Before doing anything, check if openssl binary (which we will use)
is available, and print a useful error message if it is not found.
2024-05-27 16:35:34 +02:00
Yorgos Thessalonikefs
7f184c8ca8
Fix unbound-control stdin commands for multi-process Unbounds (#1069)
- Fix unbound-control commands that read stdin in multi-process
  operation (local_zones_remove, local_zones, local_datas_remove,
  local_datas, view_local_datas_remove, view_local_datas). They will
  be properly distributed to all processes. dump_cache and load_cache
  are no longer supported in multi-process operation.

 - Remove testdata/remote-threaded.tdir. testdata/09-unbound-control.tdir
  now checks both single and multi process/thread operation.

---------

Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
2024-05-17 10:25:24 +02:00
W.C.A. Wijngaards
da2b307aa3 - Fix #1071: [FR] Clear both in-memory and cachedb module cache with
`unbound-control flush*` commands.
2024-05-16 16:56:58 +02:00
Yorgos Thessalonikefs
cd4a017e96 - Fix #876: [FR] can unbound-checkconf be silenced when configuration
is valid?
2024-04-26 14:50:39 +02:00
Yorgos Thessalonikefs
8575d5b35c - Fix #595: unbound-anchor cannot deal with full disk; it will now
first write out to a temp file before replacing the original one,
  like Unbound already does for auto-trust-anchor-file.
2024-04-08 14:15:03 +02:00
W.C.A. Wijngaards
6d1e61173b - Fix #1034: DoT forward-zone via unbound-control. 2024-03-28 09:58:03 +01:00
W.C.A. Wijngaards
2e7714e80c - disable-edns-do, unbound-checkconf warns about disable-edns-do and DNSSEC
validation that is enabled, and suggests to turn one off.
2023-10-04 15:28:52 +02:00
George Thessalonikefs
bab5ad623c - For #762: Introduce stat counters for downstream DNS Cookies per
thread and total: num.queries_cookie_valid, num.queries_cookie_client,
  num.queries.cookie_invalid.
2023-08-08 15:19:56 +02:00
George Thessalonikefs
e839771ddf Merge branch 'master' of https://github.com/eaglegai/unbound into eaglegai-master 2023-07-21 12:43:47 +02:00
George Thessalonikefs
4f52be4db9 - Introduce num.query.cachedb to track cache hits for the external cache. 2023-05-30 17:49:50 +02:00
George Thessalonikefs
adb4aeb609 - For #722: Minor fixes, formatting and refactoring. 2023-05-01 18:23:13 +02:00
Vadim Fedorenko
263096d1f6 stats: add query max wait time metric
Add new statistic value to know the size of the queue in microseconds.

Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
2023-04-26 03:27:25 -07:00
Vadim Fedorenko
e577ab105e stats: add counter for timed out queries
Add counter `num_queries_timed_out` meaning queries that were sitting in the
socket queue and waiting to being processed too long. There is no reason
to process such queries, so let's drop it in the very beginning of the
pipeline.

Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
2023-04-26 03:27:25 -07:00
Vadim Fedorenko
a197aac2f6 timeval_func: move all timeval manipulation to separate file
There are several definitions of the same functions manipulating timeval
structures. Let's move them to separate file and arrange the code
preperly.

Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
2023-04-26 03:23:41 -07:00
Vadim Fedorenko
648ad4db6f Linting change.
Remove config parser/lexer code as it's rebuilded every time but can
break adding new config options.
Also clean up the code base to avoid mixing actual code changes and lint
issues.

Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
2023-04-25 17:05:00 -07:00
yunwei
4954df5859
Changelog entry for #874
unbound-anchor is compliant with RFC 7958, and the XML format remains unchanged between the old draft and RFC 7958.  Update the comments to improve clarity.
2023-04-14 16:45:11 +08:00
eaglegai
319119943f fix potential memory leak in unbound-host when errors happen
==3709953== HEAP SUMMARY:
==3709953==     in use at exit: 276,541 bytes in 23 blocks
==3709953==   total heap usage: 29 allocs, 6 frees, 280,682 bytes allocated
==3709953==
==3709953== 1 bytes in 1 blocks are still reachable in loss record 1 of 23
==3709953==    at 0x4866EC0: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-arm64-linux.so)
==3709953==    by 0x48E2BC3: ub_initstate (random.c:85)
==3709953==    by 0x489B067: ub_ctx_create_nopipe (libunbound.c:114)
==3709953==    by 0x489B31F: ub_ctx_create (libunbound.c:180)
==3709953==    by 0x10E203: main (unbound-host.c:433)
==3709953==
......
==3709953== 8,192 bytes in 1 blocks are still reachable in loss record 22 of 23
==3709953==    at 0x4866EC0: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-arm64-linux.so)
==3709953==    by 0x48E427B: regional_create_custom (regional.c:94)
==3709953==    by 0x48DEA03: edns_strings_create (edns.c:57)
==3709953==    by 0x489B0F3: ub_ctx_create_nopipe (libunbound.c:157)
==3709953==    by 0x489B31F: ub_ctx_create (libunbound.c:180)
==3709953==    by 0x10E203: main (unbound-host.c:433)
==3709953==
==3709953== 262,144 bytes in 1 blocks are still reachable in loss record 23 of 23
==3709953==    at 0x486933C: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-arm64-linux.so)
==3709953==    by 0x48C826F: config_create (config_file.c:179)
==3709953==    by 0x48C85AF: config_create_forlib (config_file.c:383)
==3709953==    by 0x489B0BB: ub_ctx_create_nopipe (libunbound.c:130)
==3709953==    by 0x489B31F: ub_ctx_create (libunbound.c:180)
==3709953==    by 0x10E203: main (unbound-host.c:433)
==3709953==
==3709953== LEAK SUMMARY:
==3709953==    definitely lost: 0 bytes in 0 blocks
==3709953==    indirectly lost: 0 bytes in 0 blocks
==3709953==      possibly lost: 0 bytes in 0 blocks
==3709953==    still reachable: 276,541 bytes in 23 blocks
==3709953==         suppressed: 0 bytes in 0 blocks
==3709953==
==3709953== For lists of detected and suppressed errors, rerun with: -s
==3709953== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

Signed-off-by: eaglegai <eaglegai@163.com>
2023-03-06 22:04:06 +08:00
Sergey Kacheev
52a4ccee18 add a metric about the maximum number of collisions in lrushah 2023-01-13 13:33:38 +07:00
George Thessalonikefs
7716d26d46 - Use an explicit 'reload_keep_cache' command and introduce test cases
for #569.
2022-12-14 16:33:28 +01:00
George Thessalonikefs
857d6ce3a1 Merge branch 'reuse-caches-on-reload' of https://github.com/jinmeiib/unbound-1 into jinmeiib-reuse-caches-on-reload 2022-12-13 16:42:38 +01:00
George Thessalonikefs
859d0f2dfe - Expose 'statistics-inhibit-zero' as a configuration option; the
default value retains Unbound's behavior.
2022-12-13 10:47:37 +01:00
Yorgos Thessalonikefs
c4e51a4cfe
PROXYv2 downstream support (#760) 2022-10-03 15:29:47 +02:00
George Thessalonikefs
c30bdff939 Initial commit for interface based ACL. 2022-09-11 20:21:32 +02:00
W.C.A. Wijngaards
c8add463c4 - Fix compile warning for windows compile. 2022-06-29 12:00:44 +02:00
George Thessalonikefs
b816318106 - Fix #704: [FR] Statistics counter for number of outgoing UDP queries
sent; introduces 'num.query.udpout' to the 'unbound-control stats'
  command.
2022-06-29 10:51:54 +02:00
George Thessalonikefs
f73e548934 - Fix #678: [FR] modify behaviour of unbound-control rpz_enable zone,
by updating unbound-control's documentation.
2022-05-15 22:53:17 +03:00
George Thessalonikefs
ee63ac8f9b - Minor formatting. 2022-03-18 16:04:16 +02:00
eaglegai
c60bed8eef fix -q doesn't work when use with 'unbound-control stats_shm'
Signed-off-by: eaglegai <eaglegai@163.com>
2022-03-18 19:08:50 +08:00
W.C.A. Wijngaards
91a5cc9a08 - Remove debug info from #618 fix. 2022-02-11 16:34:24 +01:00
W.C.A. Wijngaards
a0feea393a - Fix #618: enabling interface-automatic disables DNS-over-TLS.
Adds the option to list interface-automatic-ports.
2022-02-11 10:58:53 +01:00
George Thessalonikefs
f857af873e - Update ratelimit code for recent serviced_query changes and more
accurate ratelimit calculation.
2022-01-29 23:49:38 +01:00
W.C.A. Wijngaards
c7ae3ef156 - For #602: Allow the module-config "subnetcache validator cachedb
iterator".
2022-01-14 16:30:25 +01:00
W.C.A. Wijngaards
eccfe3e1f5 - Fix #598: Fix unbound-checkconf fatal error: module conf
'respip dns64 validator iterator' is not known to work.
2022-01-05 16:14:47 +01:00
George Thessalonikefs
31bac7d5ca - Fix #574: Review fixes for size allocation. 2021-12-01 04:31:58 +01:00
W.C.A. Wijngaards
8648db9583 - Fix #574: Review fix for spelling. 2021-11-29 16:11:32 +01:00
W.C.A. Wijngaards
766c3164a3 - Fix #574: Review fixes for it. 2021-11-29 15:26:07 +01:00
W.C.A. Wijngaards
b48d6760fc - Fix #574: Review fixes for it. 2021-11-29 15:13:14 +01:00
W.C.A. Wijngaards
dcad9d5863 - Fix #574: unbound-checkconf reports fatal error if interface names
are used as value for interfaces:
2021-11-29 14:59:39 +01:00
JINMEI Tatuya
5b2eda28e3 add keep-cache option to unbound-control reload to keep caches 2021-11-11 10:47:08 -08:00
W.C.A. Wijngaards
a64cbe958d - Fix lock debug code for gcc sanitizer reports. 2021-09-10 15:11:30 +02:00
W.C.A. Wijngaards
fdae4cdbbb - Fix to print error from unbound-anchor for writing to the key
file, also when not verbose.
2021-08-12 16:06:02 +02:00
Tomasz Ziolkowski
ae45f46b9e Add (stub|forward)-tcp-upstream options which enable using tcp transport only for specified stub/forward zones 2021-08-05 08:44:18 +02:00