[Bug 280853] dns/unbound: Update to 1.21.0

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280853

            Bug ID: 280853
           Summary: dns/unbound: Update to 1.21.0
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
               URL: https://nlnetlabs.nl/news/2024/Aug/15/unbound-1.21.0-r
                    eleased/
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: Individual Port(s)
          Assignee: ports-bugs@FreeBSD.org
          Reporter: jaap@NLnetLabs.nl
 Attachment #252809 maintainer-approval+
             Flags:

Created attachment 252809
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=252809&action=edit
Patch to upgrade

This release has a fix for the CAMP and CacheFlush issues. They have a low
severity for Unbound, since it does not affect Unbound so much.

The Compositional Amplification (CAMP) type of attacks can lead to DoS attacks
against DNS servers. In Unbound legitimate client requests to the resolvers
under typical workload are not directly affected by CAMP attacks. However we
introduce a global quota for 128 outgoing packets per query (and it's
subqueries) that is never reset to prevent the combination of CAMP with other
amplification attacks in the future. We would like to thank Huayi Duan, Marco
Bearzi, Jodok Vieli, and Cagin Tanir from NetSec group, ETH Zurich for
discovering and notifying us about the issue.

The CacheFlush type of attacks (NSCacheFlush, CNAMECacheFlush) try to evict
cached data by utilizing rogue zones and a steady rogue stream to a resolver.
Based on the zone, the stream, the configured cache size and the legitimate
traffic, Unbound could experience a degradation of service if a useful entry is
evicted and Unbound needs to resolve again. As a mitigation to the NSCacheFlush
attack Unbound is setting a limit of 20 RRs in an NS RRset. We would like to
thank Yehuda Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt (Tel-Aviv
University and Reichman University) for discovering and notifying us about the
issue.

Other fixes in this release are bug fixes. Also the unbound control commands
that flush the cache can clear both the memory and cachedb module cache. The
ipset module can use BSD pf tables. The new option dnstap-sample-rate: 100 can
be used to log 1/N messages, for use in high volume server environments where
the log server does not keep up.

The new DNSSEC key for the root, 38696 from 2024 has been added. It is added to
the default root keys in unbound-anchor. The content can be inspected with
unbound-anchor -l. Older versions of Unbound can keep up with the root key with
auto-trust-anchor-file that has RFC5011 key rollover. Also unbound-anchor can
fetch the keys from the website with a certificate if needed.

For cookie secrets, it is possible to perform rollover. The file with cookie
secret in use and the staging secret is configured with cookie-secret-file.
With the remote control the rollover can be performed, add_cookie_secret,
activate_cookie_secret, drop_cookie_secret and print_cookie_secrets can be used
for that.

This release has also a fix for module loading on Windows.

For a full list of changes, binary and source packages, see the download page.

-- 
You are receiving this mail because:
You are the assignee for the bug.