Software Update: Unbound 1.15.0

When you perform a dns lookup, a recursor initially starts by asking the lookup query to a dns root server. This can then redirect to other servers, from where it can redirect to other servers and so on, until finally a server is reached that knows the answer or knows that the look-up is not possible. The latter can be the case if the name does not exist or the servers do not respond. The process of going through different authoritative servers is called recursion. Unbound is a dns recursor with support for modern standards such as Query Name Minimization† Aggressive Use of Dnssec-Validated Cache and authority zones† The developers have released version 1.15.0 with the following changes and improvements:

New Features:

• fix #596: unset the RA bit when a query is blocked by an unbound RPZ nxdomain reply. The option rpz-signal-nxdomain-ra allows to signal that a domain is externally blocked to clients when it is blocked with NXDOMAIN by unsetting RA.
• Add rpz: for-downstream: yesno option, where the RPZ zone is authoritatively answered for, so the RPZ zone contents can be checked with DNS queries directed at the RPZ zone.
• Merge PR #616: Update rate limit logic. It also introduces ratelimit-backoff and ip-ratelimit-backoff configuration options.
• Change aggressive-nsec default to yes.

Bug Fixes:

• Fix compile warning for if_nametoindex on windows 64bit.
• Merge PR #581 from fobser: Fix -Wmissing-prototypes and -Wshadow warnings in rpz.
• Fix validator debug output about DS support, print correct algorithm.
• Add code similar to fix for ldns for tab between strings, for consistency, the test case was not broken.
• Allow local-data for classes other than IN to inherit a configured local-zone’s type if possible, instead of defaulting to type transparent as per the implicit rule.
• Fix to pick up other class local zone information before unlock.
• Add missing configure flags for optional features in the documentation.
• Fix Unbound capitalization in the documentation.
• fix #591: Unbound-anchor manpage links to non-existent license file.
• contrib/aaaa-filter-iterator.patch file renewed diff content to apply cleanly to the current coderepo for the current code version.
• Fix to add test for rpz-signal-nxdomain-ra.
• fix #596: only unset RA when NXDOMAIN is signalled.
• Fix that RPZ does not set RD flag on replies, it should be copied from the query.
• fix for #596: fix that rpz return message is returned and not just the rcode from the iterator return path. This fixes signal unset RA after a CNAME.
• Fix unit tests for rpz now that the AA flag returns successfully from the iterator loop.
• fix for #596: add unit test for nsdname trigger and signal unset RA.
• fix for #596: add unit test for nsip trigger and signal unset RA.
• fix #598: Fix unbound-checkconf fatal error: module conf ‘respip dns64 validator iterator’ is not known to work.
• fix for #596: Fix rpz-signal-nxdomain-ra to work for clientip triggered operation.
• merge #600 from pemensik: Change file mode before changing file owner.
• Fix prematurely terminated TCP queries when a reply has the same ID.
• for #602: Allow the module-config “subnet cache validator cachedb iterator”.
• Fix EDNS to upstream where the same option could be attached more than once.
• Add a region to serviced_query for allocations.
• For dnstap, do not wakeupnow right there. Instead zero the timer to force the wakeup callback asap.
• fix #610: Undefine shift in sldns_str2wire_hip_buf.
• fix #588: Unbound 1.13.2 crashes due to p->pc is NULL in serviced_udp_callback.
• Merge PR #612: TCP race condition.
• Test for NSID in SERVFAIL response due to DNSSEC bogus.
• fix #599† [FR] RFC 9156 (obsoletes RFC 7816), by noting the new RFC document.
• Fix tls-* and ssl-* documented alternate syntax to also be available through remote-control and unbound-checkconf.
• Better cleanup on failed DoT/DoH listening socket creation.
• iana port list update.
• Fix review comment for use-after-free when failing to send UDP out.
• Merge PR #603 from fobser: Use OpenSSL 1.1 API to access DSA and RSA internals.
• Merge PR #532 from Shchelk: Fix: buffer overflow bug.
• Merge PR #617: Update stub/forward-host notation to accept port and tls-auth-name.
• Update stream_ssl.tdir test to also use the new forward-host notation.
• Fix header comment for doxygen for authextstrtoaddr.
• please clang analyzer for loop in test code.
• Fix docker splint test to use more portable uname.
• Update contrib/aaaa-filter-iterator.patch with diff for current software version.
• fix for #611: Integer overflow in sldns_wire2str_pkt_scan.