git: c4e25212639a - stable/15 - unbound: Update to 1.25.2
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 03 Aug 2026 11:38:35 UTC
The branch stable/15 has been updated by des:
URL: https://cgit.FreeBSD.org/src/commit/?id=c4e25212639ad4c219a85415ade68611dee3277e
commit c4e25212639ad4c219a85415ade68611dee3277e
Author: Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-07-22 12:23:53 +0000
Commit: Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-08-03 11:32:11 +0000
unbound: Update to 1.25.2
Release notes at
https://community.nlnetlabs.nl/t/unbound-1-25-2-released
Merge commit 'c68e7bcd81d62e9f5364c6da22fd9917976acf85'
Security: CVE-2026-14586
Security: CVE-2026-32665
Security: CVE-2026-40691
Security: CVE-2026-41637
Security: CVE-2026-42955
Security: CVE-2026-44621
Security: CVE-2026-44687
Security: CVE-2026-44690
Security: CVE-2026-46582
Security: CVE-2026-50045
Security: CVE-2026-50046
Security: CVE-2026-50243
Security: CVE-2026-50248
Security: CVE-2026-50251
Security: CVE-2026-50252
Security: CVE-2026-52863
Security: CVE-2026-54478
Security: CVE-2026-55708
Security: CVE-2026-55717
Security: CVE-2026-55973
Security: CVE-2026-55990
Security: CVE-2026-55991
Security: CVE-2026-56416
Security: CVE-2026-56444
(cherry picked from commit e27b1cae848219d07f0a12a48990af0558b4cced)
---
contrib/unbound/config.guess | 17 +-
contrib/unbound/config.sub | 11 +-
contrib/unbound/configure | 48 ++-
contrib/unbound/configure.ac | 21 +-
contrib/unbound/daemon/daemon.c | 12 +-
contrib/unbound/daemon/daemon.h | 3 +
contrib/unbound/daemon/remote.c | 16 +
contrib/unbound/daemon/worker.c | 30 +-
contrib/unbound/daemon/worker.h | 8 +-
contrib/unbound/dnscrypt/dnscrypt.c | 26 +-
contrib/unbound/dnscrypt/dnscrypt.h | 3 +-
contrib/unbound/dnstap/unbound-dnstap-socket.c | 5 +
contrib/unbound/doc/README | 2 +-
contrib/unbound/doc/example.conf | 2 +-
contrib/unbound/doc/example.conf.in | 2 +-
contrib/unbound/doc/libunbound.3 | 4 +-
contrib/unbound/doc/libunbound.3.in | 4 +-
contrib/unbound/doc/unbound-anchor.8 | 4 +-
contrib/unbound/doc/unbound-anchor.8.in | 4 +-
contrib/unbound/doc/unbound-checkconf.8 | 4 +-
contrib/unbound/doc/unbound-checkconf.8.in | 4 +-
contrib/unbound/doc/unbound-control.8 | 4 +-
contrib/unbound/doc/unbound-control.8.in | 4 +-
contrib/unbound/doc/unbound-host.1 | 4 +-
contrib/unbound/doc/unbound-host.1.in | 4 +-
contrib/unbound/doc/unbound.8 | 4 +-
contrib/unbound/doc/unbound.8.in | 4 +-
contrib/unbound/doc/unbound.conf.5 | 4 +-
contrib/unbound/doc/unbound.conf.5.in | 4 +-
contrib/unbound/doc/unbound.conf.rst | 7 +
contrib/unbound/iterator/iter_donotq.c | 12 +
contrib/unbound/iterator/iterator.c | 67 +++--
contrib/unbound/libunbound/libworker.c | 13 +-
contrib/unbound/libunbound/libworker.h | 3 +
contrib/unbound/respip/respip.c | 8 +-
contrib/unbound/services/authzone.c | 28 +-
contrib/unbound/services/cache/dns.c | 4 +-
contrib/unbound/services/cache/rrset.c | 44 ++-
contrib/unbound/services/listen_dnsport.c | 234 ++++++++++-----
contrib/unbound/services/listen_dnsport.h | 37 ++-
contrib/unbound/services/localzone.h | 2 +-
contrib/unbound/services/mesh.c | 66 ++++-
contrib/unbound/services/mesh.h | 8 +-
contrib/unbound/services/outside_network.c | 388 ++++++++++++++++++++-----
contrib/unbound/services/outside_network.h | 107 ++++++-
contrib/unbound/smallapp/worker_cb.c | 6 +
contrib/unbound/util/data/msgparse.c | 9 +-
contrib/unbound/util/data/packed_rrset.c | 1 +
contrib/unbound/util/fptr_wlist.c | 1 +
contrib/unbound/util/module.h | 6 +
contrib/unbound/util/netevent.c | 44 ++-
contrib/unbound/util/netevent.h | 6 +-
contrib/unbound/validator/val_sigcrypt.c | 18 +-
contrib/unbound/validator/val_utils.c | 17 +-
contrib/unbound/validator/val_utils.h | 4 +
contrib/unbound/validator/validator.c | 59 +++-
lib/libunbound/config.h | 8 +-
57 files changed, 1131 insertions(+), 338 deletions(-)
diff --git a/contrib/unbound/config.guess b/contrib/unbound/config.guess
index a9d01fde4617..c7f4c3294a63 100755
--- a/contrib/unbound/config.guess
+++ b/contrib/unbound/config.guess
@@ -1,10 +1,10 @@
#! /bin/sh
# Attempt to guess a canonical system name.
-# Copyright 1992-2025 Free Software Foundation, Inc.
+# Copyright 1992-2026 Free Software Foundation, Inc.
# shellcheck disable=SC2006,SC2268 # see below for rationale
-timestamp='2025-07-10'
+timestamp='2026-05-17'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -60,7 +60,7 @@ version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
-Copyright 1992-2025 Free Software Foundation, Inc.
+Copyright 1992-2026 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -150,7 +150,7 @@ UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown
UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
case $UNAME_SYSTEM in
-Linux|GNU|GNU/*)
+Ironclad|Linux|GNU|GNU/*)
LIBC=unknown
set_cc_for_build
@@ -167,6 +167,8 @@ Linux|GNU|GNU/*)
LIBC=gnu
#elif defined(__LLVM_LIBC__)
LIBC=llvm
+ #elif defined(__mlibc__)
+ LIBC=mlibc
#else
#include <stdarg.h>
/* First heuristic to detect musl libc. */
@@ -1186,6 +1188,9 @@ EOF
sparc:Linux:*:* | sparc64:Linux:*:*)
GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
;;
+ sw_64:Linux:*:*)
+ GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+ ;;
tile*:Linux:*:*)
GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
;;
@@ -1598,10 +1603,10 @@ EOF
GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE
;;
x86_64:[Ii]ronclad:*:*|i?86:[Ii]ronclad:*:*)
- GUESS=$UNAME_MACHINE-pc-ironclad-mlibc
+ GUESS=$UNAME_MACHINE-pc-ironclad-$LIBC
;;
*:[Ii]ronclad:*:*)
- GUESS=$UNAME_MACHINE-unknown-ironclad-mlibc
+ GUESS=$UNAME_MACHINE-unknown-ironclad-$LIBC
;;
esac
diff --git a/contrib/unbound/config.sub b/contrib/unbound/config.sub
index 3d35cde174de..404aa0824443 100755
--- a/contrib/unbound/config.sub
+++ b/contrib/unbound/config.sub
@@ -1,10 +1,10 @@
#! /bin/sh
# Configuration validation subroutine script.
-# Copyright 1992-2025 Free Software Foundation, Inc.
+# Copyright 1992-2026 Free Software Foundation, Inc.
# shellcheck disable=SC2006,SC2268,SC2162 # see below for rationale
-timestamp='2025-07-10'
+timestamp='2026-05-17'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -76,7 +76,7 @@ Report bugs and patches to <config-patches@gnu.org>."
version="\
GNU config.sub ($timestamp)
-Copyright 1992-2025 Free Software Foundation, Inc.
+Copyright 1992-2026 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -1432,6 +1432,7 @@ case $cpu-$vendor in
| sparcv9v \
| spu \
| sv1 \
+ | sw_64 \
| sx* \
| tahoe \
| thumbv7* \
@@ -1525,7 +1526,7 @@ EOF
;;
ironclad*)
kernel=ironclad
- os=`echo "$basic_os" | sed -e 's|ironclad|mlibc|'`
+ os=`echo "$basic_os" | sed -e 's|ironclad|gnu|'`
;;
linux*)
kernel=linux
@@ -2220,7 +2221,7 @@ case $kernel-$os-$obj in
;;
uclinux-uclibc*- | uclinux-gnu*- )
;;
- ironclad-mlibc*-)
+ ironclad-gnu*- | ironclad-mlibc*- )
;;
managarm-mlibc*- | managarm-kernel*- )
;;
diff --git a/contrib/unbound/configure b/contrib/unbound/configure
index 2c48dc207575..9efc0bafd338 100755
--- a/contrib/unbound/configure
+++ b/contrib/unbound/configure
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for unbound 1.25.1.
+# Generated by GNU Autoconf 2.71 for unbound 1.25.2.
#
# Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
#
@@ -622,8 +622,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='unbound'
PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.25.1'
-PACKAGE_STRING='unbound 1.25.1'
+PACKAGE_VERSION='1.25.2'
+PACKAGE_STRING='unbound 1.25.2'
PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
PACKAGE_URL=''
@@ -1516,7 +1516,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
-\`configure' configures unbound 1.25.1 to adapt to many kinds of systems.
+\`configure' configures unbound 1.25.2 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1582,7 +1582,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
- short | recursive ) echo "Configuration of unbound 1.25.1:";;
+ short | recursive ) echo "Configuration of unbound 1.25.2:";;
esac
cat <<\_ACEOF
@@ -1835,7 +1835,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
-unbound configure 1.25.1
+unbound configure 1.25.2
generated by GNU Autoconf 2.71
Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2492,7 +2492,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
-It was created by unbound $as_me 1.25.1, which was
+It was created by unbound $as_me 1.25.2, which was
generated by GNU Autoconf 2.71. Invocation command line was
$ $0$ac_configure_args_raw
@@ -3256,11 +3256,11 @@ UNBOUND_VERSION_MAJOR=1
UNBOUND_VERSION_MINOR=25
-UNBOUND_VERSION_MICRO=1
+UNBOUND_VERSION_MICRO=2
LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=37
+LIBUNBOUND_REVISION=38
LIBUNBOUND_AGE=1
# 1.0.0 had 0:12:0
# 1.0.1 had 0:13:0
@@ -3365,6 +3365,7 @@ LIBUNBOUND_AGE=1
# 1.24.2 had 9:35:1
# 1.25.0 had 9:36:1
# 1.25.1 had 9:37:1
+# 1.25.2 had 9:38:1
# Current -- the number of the binary API that we're implementing
# Revision -- which iteration of the implementation of the binary
@@ -23677,6 +23678,29 @@ printf "%s\n" "no" >&6; }
fi
rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+ ac_fn_check_decl "$LINENO" "CLOCK_MONOTONIC
+ " "ac_cv_have_decl_CLOCK_MONOTONIC_________" "$ac_includes_default
+#ifdef TIME_WITH_SYS_TIME
+# include <sys/time.h>
+# include <time.h>
+#else
+# ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+# else
+# include <time.h>
+# endif
+#endif
+
+" "$ac_c_undeclared_builtin_options" "CFLAGS"
+if test "x$ac_cv_have_decl_CLOCK_MONOTONIC_________" = xyes
+then :
+
+
+else $as_nop
+ as_fn_error $? "ngtcp2 for QUIC needs at least CLOCK_MONOTONIC on the system" "$LINENO" 5
+
+fi
+
fi
# set static linking for uninstalled libraries if requested
@@ -26307,7 +26331,7 @@ printf "%s\n" "#define MAXSYSLOGMSGLEN 10240" >>confdefs.h
-version=1.25.1
+version=1.25.2
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for build time" >&5
printf %s "checking for build time... " >&6; }
@@ -26837,7 +26861,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
-This file was extended by unbound $as_me 1.25.1, which was
+This file was extended by unbound $as_me 1.25.2, which was
generated by GNU Autoconf 2.71. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -26905,7 +26929,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config='$ac_cs_config_escaped'
ac_cs_version="\\
-unbound config.status 1.25.1
+unbound config.status 1.25.2
configured by $0, generated by GNU Autoconf 2.71,
with options \\"\$ac_cs_config\\"
diff --git a/contrib/unbound/configure.ac b/contrib/unbound/configure.ac
index f1c5b0419782..a4b6b17bdc65 100644
--- a/contrib/unbound/configure.ac
+++ b/contrib/unbound/configure.ac
@@ -12,14 +12,14 @@ sinclude(dnscrypt/dnscrypt.m4)
# must be numbers. ac_defun because of later processing
m4_define([VERSION_MAJOR],[1])
m4_define([VERSION_MINOR],[25])
-m4_define([VERSION_MICRO],[1])
+m4_define([VERSION_MICRO],[2])
AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=37
+LIBUNBOUND_REVISION=38
LIBUNBOUND_AGE=1
# 1.0.0 had 0:12:0
# 1.0.1 had 0:13:0
@@ -124,6 +124,7 @@ LIBUNBOUND_AGE=1
# 1.24.2 had 9:35:1
# 1.25.0 had 9:36:1
# 1.25.1 had 9:37:1
+# 1.25.2 had 9:38:1
# Current -- the number of the binary API that we're implementing
# Revision -- which iteration of the implementation of the binary
@@ -1735,6 +1736,22 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
AC_MSG_RESULT(no)
])
+ AC_CHECK_DECL([CLOCK_MONOTONIC]
+ , []
+ , [AC_MSG_ERROR([ngtcp2 for QUIC needs at least CLOCK_MONOTONIC on the system])]
+ , [AC_INCLUDES_DEFAULT
+#ifdef TIME_WITH_SYS_TIME
+# include <sys/time.h>
+# include <time.h>
+#else
+# ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+# else
+# include <time.h>
+# endif
+#endif
+ ])
+
fi
# set static linking for uninstalled libraries if requested
diff --git a/contrib/unbound/daemon/daemon.c b/contrib/unbound/daemon/daemon.c
index ea4e83e70932..51dd51de38d4 100644
--- a/contrib/unbound/daemon/daemon.c
+++ b/contrib/unbound/daemon/daemon.c
@@ -79,6 +79,7 @@
#include "util/tcp_conn_limit.h"
#include "util/edns.h"
#include "services/listen_dnsport.h"
+#include "services/outside_network.h"
#include "services/cache/rrset.h"
#include "services/cache/infra.h"
#include "services/localzone.h"
@@ -813,6 +814,10 @@ daemon_create_workers(struct daemon* daemon)
fatal_exit("out of memory during daemon init");
numport = daemon_get_shufport(daemon, shufport);
verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
+ if(!(daemon->shared_ports = shared_ports_create(daemon->cfg->out_ifs,
+ daemon->cfg->num_out_ifs, daemon->cfg->do_ip4,
+ daemon->cfg->do_ip6, shufport, numport)))
+ fatal_exit("could not setup shared ports: out of memory");
#ifdef HAVE_NGTCP2
if (cfg_has_quic(daemon->cfg)) {
@@ -843,10 +848,7 @@ daemon_create_workers(struct daemon* daemon)
#endif
}
for(i=0; i<daemon->num; i++) {
- if(!(daemon->workers[i] = worker_create(daemon, i,
- shufport+numport*i/daemon->num,
- numport*(i+1)/daemon->num - numport*i/daemon->num)))
- /* the above is not ports/numthr, due to rounding */
+ if(!(daemon->workers[i] = worker_create(daemon, i)))
fatal_exit("could not create worker");
}
/* create per-worker alloc caches if not reusing existing ones. */
@@ -1204,6 +1206,8 @@ daemon_cleanup(struct daemon* daemon)
if(!daemon->reuse_cache || daemon->need_to_exit)
daemon_clear_allocs(daemon);
daemon->num = 0;
+ shared_ports_delete(daemon->shared_ports);
+ daemon->shared_ports = NULL;
#ifdef USE_DNSTAP
dt_delete(daemon->dtenv);
daemon->dtenv = NULL;
diff --git a/contrib/unbound/daemon/daemon.h b/contrib/unbound/daemon/daemon.h
index 20386d7fc9a0..e6f099629be1 100644
--- a/contrib/unbound/daemon/daemon.h
+++ b/contrib/unbound/daemon/daemon.h
@@ -62,6 +62,7 @@ struct doq_table;
struct cookie_secrets;
struct fast_reload_thread;
struct fast_reload_printq;
+struct shared_ports;
#include "dnstap/dnstap_config.h"
#ifdef USE_DNSTAP
@@ -97,6 +98,8 @@ struct daemon {
int rc_port;
/** listening ports for remote control */
struct listen_port* rc_ports;
+ /** the shared ports structure, with random ports numbers. */
+ struct shared_ports* shared_ports;
/** remote control connections management (for first worker) */
struct daemon_remote* rc;
/** ssl context for listening to dnstcp over ssl */
diff --git a/contrib/unbound/daemon/remote.c b/contrib/unbound/daemon/remote.c
index 1eaf90016b88..61beb7c2fa69 100644
--- a/contrib/unbound/daemon/remote.c
+++ b/contrib/unbound/daemon/remote.c
@@ -1658,6 +1658,14 @@ do_view_data_add(RES* ssl, struct worker* worker, char* arg)
ssl_printf(ssl,"error out of memory\n");
return;
}
+ if(!v->isfirst) {
+ /* Global local-zone is not used for this view,
+ * therefore add defaults to this view-specific
+ * local-zone. */
+ struct config_file lz_cfg;
+ memset(&lz_cfg, 0, sizeof(lz_cfg));
+ local_zone_enter_defaults(v->local_zones, &lz_cfg);
+ }
}
do_data_add(ssl, v->local_zones, arg2);
lock_rw_unlock(&v->lock);
@@ -1683,6 +1691,14 @@ do_view_datas_add(struct daemon_remote* rc, RES* ssl, struct worker* worker,
ssl_printf(ssl,"error out of memory\n");
return;
}
+ if(!v->isfirst) {
+ /* Global local-zone is not used for this view,
+ * therefore add defaults to this view-specific
+ * local-zone. */
+ struct config_file lz_cfg;
+ memset(&lz_cfg, 0, sizeof(lz_cfg));
+ local_zone_enter_defaults(v->local_zones, &lz_cfg);
+ }
}
/* put the view name in the command buf */
(void)snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%s ", arg);
diff --git a/contrib/unbound/daemon/worker.c b/contrib/unbound/daemon/worker.c
index a5dd9bc028e8..765fb2299a55 100644
--- a/contrib/unbound/daemon/worker.c
+++ b/contrib/unbound/daemon/worker.c
@@ -1550,6 +1550,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
return 0;
}
query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+ sldns_buffer_copy(c->dnscrypt_buffer, c->buffer);
return 1;
}
dname_str(qinfo.qname, buf);
@@ -1568,6 +1569,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
query_error(c->buffer, LDNS_RCODE_SERVFAIL,
qinfo.qname_len);
worker->stats.num_query_dnscrypt_cleartext++;
+ sldns_buffer_copy(c->dnscrypt_buffer, c->buffer);
return 1;
}
worker->stats.num_query_dnscrypt_cert++;
@@ -1828,7 +1830,13 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
server_stats_insquery(&worker->stats, c, qinfo.qtype,
qinfo.qclass, &edns, repinfo);
if(c->type != comm_udp)
+#ifdef USE_DNSCRYPT
+ edns.udp_size = (c->dnscrypt && repinfo->is_dnscrypted)
+ ? sldns_buffer_capacity(c->buffer) - DNSCRYPT_REPLY_HEADER_SIZE
+ : 65535;
+#else
edns.udp_size = 65535; /* max size for TCP replies */
+#endif
if(qinfo.qclass == LDNS_RR_CLASS_CH && answer_chaos(worker, &qinfo,
&edns, repinfo, c->buffer)) {
regional_free_all(worker->scratchpad);
@@ -2112,7 +2120,7 @@ send_reply_rc:
}
}
#ifdef USE_DNSCRYPT
- if(!dnsc_handle_uncurved_request(repinfo)) {
+ if(!dnsc_handle_uncurved_request(repinfo, c->buffer)) {
return 0;
}
#endif
@@ -2225,23 +2233,16 @@ void worker_probe_timer_cb(void* arg)
}
struct worker*
-worker_create(struct daemon* daemon, int id, int* ports, int n)
+worker_create(struct daemon* daemon, int id)
{
unsigned int seed;
struct worker* worker = (struct worker*)calloc(1,
sizeof(struct worker));
if(!worker)
return NULL;
- worker->numports = n;
- worker->ports = (int*)memdup(ports, sizeof(int)*n);
- if(!worker->ports) {
- free(worker);
- return NULL;
- }
worker->daemon = daemon;
worker->thread_num = id;
if(!(worker->cmd = tube_create())) {
- free(worker->ports);
free(worker);
return NULL;
}
@@ -2249,7 +2250,6 @@ worker_create(struct daemon* daemon, int id, int* ports, int n)
if(!(worker->rndstate = ub_initstate(daemon->rand))) {
log_err("could not init random numbers.");
tube_delete(worker->cmd);
- free(worker->ports);
free(worker);
return NULL;
}
@@ -2348,14 +2348,14 @@ worker_init(struct worker* worker, struct config_file *cfg,
cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6,
cfg->do_tcp?cfg->outgoing_num_tcp:0, cfg->ip_dscp,
worker->daemon->env->infra_cache, worker->rndstate,
- cfg->use_caps_bits_for_id, worker->ports, worker->numports,
+ cfg->use_caps_bits_for_id,
cfg->unwanted_threshold, cfg->outgoing_tcp_mss,
&worker_alloc_cleanup, worker,
cfg->do_udp || cfg->udp_upstream_without_downstream,
worker->daemon->connect_dot_sslctx, cfg->delay_close,
cfg->tls_use_sni, dtenv, cfg->udp_connect,
cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
- cfg->tcp_auth_query_timeout);
+ cfg->tcp_auth_query_timeout, worker->daemon->shared_ports);
if(!worker->back) {
log_err("could not create outgoing sockets");
worker_delete(worker);
@@ -2506,7 +2506,6 @@ worker_delete(struct worker* worker)
tube_delete(worker->cmd);
comm_timer_delete(worker->stat_timer);
comm_timer_delete(worker->env.probe_timer);
- free(worker->ports);
if(worker->thread_num == 0) {
#ifdef UB_ON_WINDOWS
wsvc_desetup_worker(worker);
@@ -2638,6 +2637,11 @@ void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
log_assert(0);
}
+void libworker_alloc_cleanup(void* ATTR_UNUSED(arg))
+{
+ log_assert(0);
+}
+
int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
{
log_assert(0);
diff --git a/contrib/unbound/daemon/worker.h b/contrib/unbound/daemon/worker.h
index b7bb52fd715b..37f3728efef1 100644
--- a/contrib/unbound/daemon/worker.h
+++ b/contrib/unbound/daemon/worker.h
@@ -104,10 +104,6 @@ struct worker {
struct listen_dnsport* front;
/** the backside outside network interface to the auth servers */
struct outside_network* back;
- /** ports to be used by this worker. */
- int* ports;
- /** number of ports for this worker */
- int numports;
/** the signal handler */
struct comm_signal* comsig;
/** commpoint to listen to commands. */
@@ -146,11 +142,9 @@ struct worker {
* with backpointers only. Use worker_init on it later.
* @param daemon: the daemon that this worker thread is part of.
* @param id: the thread number from 0.. numthreads-1.
- * @param ports: the ports it is allowed to use, array.
- * @param n: the number of ports.
* @return: the new worker or NULL on alloc failure.
*/
-struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);
+struct worker* worker_create(struct daemon* daemon, int id);
/**
* Initialize worker.
diff --git a/contrib/unbound/dnscrypt/dnscrypt.c b/contrib/unbound/dnscrypt/dnscrypt.c
index 173484cdf0b1..6f1a236ad7e5 100644
--- a/contrib/unbound/dnscrypt/dnscrypt.c
+++ b/contrib/unbound/dnscrypt/dnscrypt.c
@@ -474,10 +474,18 @@ dnscrypt_server_curve(const dnsccert *cert,
uint8_t *const buf = sldns_buffer_begin(buffer);
size_t len = sldns_buffer_limit(buffer);
+ if(len + DNSCRYPT_REPLY_HEADER_SIZE > sldns_buffer_capacity(buffer))
+ return -1;
+ sldns_buffer_clear(buffer);
+
if(udp){
if (max_len > max_reply_size)
max_len = max_reply_size;
}
+ if(max_len > sldns_buffer_capacity(buffer))
+ max_len = sldns_buffer_capacity(buffer);
+ if(max_len > 65535)
+ max_len = 65535;
memcpy(nonce, client_nonce, crypto_box_HALF_NONCEBYTES);
@@ -520,6 +528,7 @@ dnscrypt_server_curve(const dnsccert *cert,
DNSCRYPT_MAGIC_HEADER_LEN,
nonce,
crypto_box_NONCEBYTES);
+ sldns_buffer_flip(buffer);
sldns_buffer_set_limit(buffer, len + DNSCRYPT_REPLY_HEADER_SIZE);
return 0;
}
@@ -663,6 +672,8 @@ dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
}
dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
for (i = 0U; i < dnscenv->signed_certs_count; i++) {
+ if(!certs[i].keypair)
+ continue;
if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
return &certs[i];
@@ -804,6 +815,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
sizeof *env->keypairs);
env->certs = sodium_allocarray(env->signed_certs_count,
sizeof *env->certs);
+ memset(env->certs, 0, env->signed_certs_count * sizeof(*env->certs));
cert_id = 0U;
keypair_id = 0U;
@@ -912,12 +924,13 @@ dnsc_handle_curved_request(struct dnsc_env* dnscenv,
}
int
-dnsc_handle_uncurved_request(struct comm_reply *repinfo)
+dnsc_handle_uncurved_request(struct comm_reply *repinfo,
+ struct sldns_buffer* buffer)
{
if(!repinfo->c->dnscrypt) {
return 1;
}
- sldns_buffer_copy(repinfo->c->dnscrypt_buffer, repinfo->c->buffer);
+ sldns_buffer_copy(repinfo->c->dnscrypt_buffer, buffer);
if(!repinfo->is_dnscrypted) {
return 1;
}
@@ -963,12 +976,19 @@ dnsc_create(void)
int
dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
{
+ int nkeys;
if(dnsc_parse_certs(env, cfg) <= 0) {
fatal_exit("dnsc_apply_cfg: no cert file loaded");
}
- if(dnsc_parse_keys(env, cfg) <= 0) {
+ nkeys = dnsc_parse_keys(env, cfg);
+ if(nkeys <= 0) {
fatal_exit("dnsc_apply_cfg: no key file loaded");
}
+ if((size_t)nkeys < env->signed_certs_count) {
+ fatal_exit("dnsc_apply_cfg: %u dnscrypt-provider-cert file(s) have no "
+ "matching dnscrypt-secret-key",
+ (unsigned)(env->signed_certs_count - (size_t)nkeys));
+ }
randombytes_buf(env->hash_key, sizeof env->hash_key);
env->provider_name = cfg->dnscrypt_provider;
diff --git a/contrib/unbound/dnscrypt/dnscrypt.h b/contrib/unbound/dnscrypt/dnscrypt.h
index b0da9b732681..998237d48e83 100644
--- a/contrib/unbound/dnscrypt/dnscrypt.h
+++ b/contrib/unbound/dnscrypt/dnscrypt.h
@@ -128,7 +128,8 @@ int dnsc_handle_curved_request(struct dnsc_env* dnscenv,
* \return 0 in case of failure.
*/
-int dnsc_handle_uncurved_request(struct comm_reply *repinfo);
+int dnsc_handle_uncurved_request(struct comm_reply *repinfo,
+ struct sldns_buffer* buffer);
/**
* Computes the size of the shared secret cache entry.
diff --git a/contrib/unbound/dnstap/unbound-dnstap-socket.c b/contrib/unbound/dnstap/unbound-dnstap-socket.c
index 90b0f6003ff6..2bf017430fe0 100644
--- a/contrib/unbound/dnstap/unbound-dnstap-socket.c
+++ b/contrib/unbound/dnstap/unbound-dnstap-socket.c
@@ -1735,6 +1735,11 @@ void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
log_assert(0);
}
+void libworker_alloc_cleanup(void* ATTR_UNUSED(arg))
+{
+ log_assert(0);
+}
+
int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
{
log_assert(0);
diff --git a/contrib/unbound/doc/README b/contrib/unbound/doc/README
index 265dc1592f9f..fa60d3b0b570 100644
--- a/contrib/unbound/doc/README
+++ b/contrib/unbound/doc/README
@@ -1,4 +1,4 @@
-README for Unbound 1.25.1
+README for Unbound 1.25.2
Copyright 2007 NLnet Labs
http://unbound.net
diff --git a/contrib/unbound/doc/example.conf b/contrib/unbound/doc/example.conf
index 82fd100dbbe9..5d4536a71f6e 100644
--- a/contrib/unbound/doc/example.conf
+++ b/contrib/unbound/doc/example.conf
@@ -1,7 +1,7 @@
#
# Example configuration file.
#
-# See unbound.conf(5) man page, version 1.25.1.
+# See unbound.conf(5) man page, version 1.25.2.
#
# this is a comment.
diff --git a/contrib/unbound/doc/example.conf.in b/contrib/unbound/doc/example.conf.in
index 5514328b1235..e03d41153b36 100644
--- a/contrib/unbound/doc/example.conf.in
+++ b/contrib/unbound/doc/example.conf.in
@@ -1,7 +1,7 @@
#
# Example configuration file.
#
-# See unbound.conf(5) man page, version 1.25.1.
+# See unbound.conf(5) man page, version 1.25.2.
#
# this is a comment.
diff --git a/contrib/unbound/doc/libunbound.3 b/contrib/unbound/doc/libunbound.3
index 91092e67d898..b9158ef902a7 100644
--- a/contrib/unbound/doc/libunbound.3
+++ b/contrib/unbound/doc/libunbound.3
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "LIBUNBOUND" "3" "May 20, 2026" "1.25.1" "Unbound"
+.TH "LIBUNBOUND" "3" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-libunbound \- Unbound DNS validating resolver 1.25.1 functions.
+libunbound \- Unbound DNS validating resolver 1.25.2 functions.
.SH SYNOPSIS
.sp
\fB#include <unbound.h>\fP
diff --git a/contrib/unbound/doc/libunbound.3.in b/contrib/unbound/doc/libunbound.3.in
index 91092e67d898..b9158ef902a7 100644
--- a/contrib/unbound/doc/libunbound.3.in
+++ b/contrib/unbound/doc/libunbound.3.in
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "LIBUNBOUND" "3" "May 20, 2026" "1.25.1" "Unbound"
+.TH "LIBUNBOUND" "3" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-libunbound \- Unbound DNS validating resolver 1.25.1 functions.
+libunbound \- Unbound DNS validating resolver 1.25.2 functions.
.SH SYNOPSIS
.sp
\fB#include <unbound.h>\fP
diff --git a/contrib/unbound/doc/unbound-anchor.8 b/contrib/unbound/doc/unbound-anchor.8
index c9e6b2114f9b..09dfafd4b3e7 100644
--- a/contrib/unbound/doc/unbound-anchor.8
+++ b/contrib/unbound/doc/unbound-anchor.8
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND-ANCHOR" "8" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND-ANCHOR" "8" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound-anchor \- Unbound 1.25.1 anchor utility.
+unbound-anchor \- Unbound 1.25.2 anchor utility.
.SH SYNOPSIS
.sp
\fBunbound\-anchor\fP [\fBopts\fP]
diff --git a/contrib/unbound/doc/unbound-anchor.8.in b/contrib/unbound/doc/unbound-anchor.8.in
index fa1486d18864..c9810f8f2c03 100644
--- a/contrib/unbound/doc/unbound-anchor.8.in
+++ b/contrib/unbound/doc/unbound-anchor.8.in
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND-ANCHOR" "8" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND-ANCHOR" "8" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound-anchor \- Unbound 1.25.1 anchor utility.
+unbound-anchor \- Unbound 1.25.2 anchor utility.
.SH SYNOPSIS
.sp
\fBunbound\-anchor\fP [\fBopts\fP]
diff --git a/contrib/unbound/doc/unbound-checkconf.8 b/contrib/unbound/doc/unbound-checkconf.8
index 9a42e3c309e1..c5904d52d282 100644
--- a/contrib/unbound/doc/unbound-checkconf.8
+++ b/contrib/unbound/doc/unbound-checkconf.8
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND-CHECKCONF" "8" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND-CHECKCONF" "8" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound-checkconf \- Check Unbound 1.25.1 configuration file for errors.
+unbound-checkconf \- Check Unbound 1.25.2 configuration file for errors.
.SH SYNOPSIS
.sp
\fBunbound\-checkconf\fP [\fB\-hf\fP] [\fB\-o option\fP] [cfgfile]
diff --git a/contrib/unbound/doc/unbound-checkconf.8.in b/contrib/unbound/doc/unbound-checkconf.8.in
index cfc4e2375e47..a3094e486a7b 100644
--- a/contrib/unbound/doc/unbound-checkconf.8.in
+++ b/contrib/unbound/doc/unbound-checkconf.8.in
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND-CHECKCONF" "8" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND-CHECKCONF" "8" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound-checkconf \- Check Unbound 1.25.1 configuration file for errors.
+unbound-checkconf \- Check Unbound 1.25.2 configuration file for errors.
.SH SYNOPSIS
.sp
\fBunbound\-checkconf\fP [\fB\-hf\fP] [\fB\-o option\fP] [cfgfile]
diff --git a/contrib/unbound/doc/unbound-control.8 b/contrib/unbound/doc/unbound-control.8
index e84d00d03bc5..f50ca271e415 100644
--- a/contrib/unbound/doc/unbound-control.8
+++ b/contrib/unbound/doc/unbound-control.8
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND-CONTROL" "8" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND-CONTROL" "8" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound-control \- Unbound 1.25.1 remote server control utility.
+unbound-control \- Unbound 1.25.2 remote server control utility.
.SH SYNOPSIS
.sp
\fBunbound\-control\fP [\fB\-hq\fP] [\fB\-c cfgfile\fP] [\fB\-s server\fP] command
diff --git a/contrib/unbound/doc/unbound-control.8.in b/contrib/unbound/doc/unbound-control.8.in
index faf3534d7af8..c1ad6b8d68c6 100644
--- a/contrib/unbound/doc/unbound-control.8.in
+++ b/contrib/unbound/doc/unbound-control.8.in
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND-CONTROL" "8" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND-CONTROL" "8" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound-control \- Unbound 1.25.1 remote server control utility.
+unbound-control \- Unbound 1.25.2 remote server control utility.
.SH SYNOPSIS
.sp
\fBunbound\-control\fP [\fB\-hq\fP] [\fB\-c cfgfile\fP] [\fB\-s server\fP] command
diff --git a/contrib/unbound/doc/unbound-host.1 b/contrib/unbound/doc/unbound-host.1
index 52185a5bb42c..c674a09545d3 100644
--- a/contrib/unbound/doc/unbound-host.1
+++ b/contrib/unbound/doc/unbound-host.1
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND-HOST" "1" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND-HOST" "1" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound-host \- Unbound 1.25.1 DNS lookup utility.
+unbound-host \- Unbound 1.25.2 DNS lookup utility.
.SH SYNOPSIS
.sp
\fBunbound\-host\fP [\fB\-C configfile\fP] [\fB\-vdhr46D\fP] [\fB\-c class\fP]
diff --git a/contrib/unbound/doc/unbound-host.1.in b/contrib/unbound/doc/unbound-host.1.in
index 6f3ef3f2593e..1582fd54813b 100644
--- a/contrib/unbound/doc/unbound-host.1.in
+++ b/contrib/unbound/doc/unbound-host.1.in
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND-HOST" "1" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND-HOST" "1" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound-host \- Unbound 1.25.1 DNS lookup utility.
+unbound-host \- Unbound 1.25.2 DNS lookup utility.
.SH SYNOPSIS
.sp
\fBunbound\-host\fP [\fB\-C configfile\fP] [\fB\-vdhr46D\fP] [\fB\-c class\fP]
diff --git a/contrib/unbound/doc/unbound.8 b/contrib/unbound/doc/unbound.8
index 79f61bd89fed..3fdbc2e90430 100644
--- a/contrib/unbound/doc/unbound.8
+++ b/contrib/unbound/doc/unbound.8
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND" "8" "May 20, 2026" "1.25.1" "Unbound"
+.TH "UNBOUND" "8" "Jul 22, 2026" "1.25.2" "Unbound"
.SH NAME
-unbound \- Unbound DNS validating resolver 1.25.1.
+unbound \- Unbound DNS validating resolver 1.25.2.
.SH SYNOPSIS
.sp
\fBunbound\fP [\fB\-hdpVv\fP] [\fB\-c <cfgfile>\fP]
diff --git a/contrib/unbound/doc/unbound.8.in b/contrib/unbound/doc/unbound.8.in
index a66ee68469a3..cf15d5b2b4a9 100644
--- a/contrib/unbound/doc/unbound.8.in
+++ b/contrib/unbound/doc/unbound.8.in
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "UNBOUND" "8" "May 20, 2026" "1.25.1" "Unbound"
*** 2768 LINES SKIPPED ***