unbound-1.6.8-150100.10.8.1

- Import changes from OBS for dlv.isc.org.key, root.anchor, and
  root.key to fix bsc#1112033

- Add patch bsc1179191_CVE-2020-28935_19f8f4d9.patch to really fix
  bsc#1179191 CVE-2020-28935: unbound: symbolic link traversal when
  writing PID file

- Add patches
  * bsc1185382_CVE-2019-25031_f8875527.patch
    bsc#1185382 for CVE-2019-25031
    configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
  * bsc1185383.4_CVE-2019-25032.3_226298bb.patch
    bsc#1185383 for CVE-2019-25032
    integer overflow in the regional allocator via regional_alloc
    bsc#1185384 for CVE-2019-25033
    integer overflow in the regional allocator via the ALIGN_UP macro
  * bsc1185385_CVE-2019-25034_a3545867.patch
    bsc#1185385 for CVE-2019-25034
    integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write
  * bsc1185386.7_CVE-2019-25035.6_fa23ee8f.patch
    bsc#1185386 for CVE-2019-25035
    out-of-bounds write in sldns_bget_token_par
    bsc#1185387 for CVE-2019-25036
    assertion failure and denial of service in synth_cname
  * bsc1185391.2_CVE-2019-25040.1_2d444a50.patch
    bsc#1185391 for CVE-2019-25040
    infinite loop via a compressed name in dname_pkt_copy
    bsc#1185392 for CVE-2019-25041
    assertion failure via a compressed name in dname_pkt_copy
  * bsc1185389.90_CVE-2019-25038.9_02080f6b.patch
    bsc#1185389 for CVE-2019-25038
    integer overflow in a size calculation in dnscrypt/dnscrypt.c
    bsc#1185390 for CVE-2019-25039
    integer overflow in a size calculation in respip/respip.c
  * bsc1185388_CVE-2019-25037_d2eb78e8.patch
    bsc#1185388 for CVE-2019-25037
    assertion failure and denial of service in dname_pkt_copy via an invalid packet
  * bsc1185393_CVE-2019-25042_6c3a0b54.patch
    bsc#1185393 for CVE-2019-25042
    out-of-bounds write via a compressed name in rdata_copy
- Correct indentation in patch unbound-1.6.8-amplifying-an-incoming-query.patch
  to make it fit to above patches

- Avoid shell code execution after receiving a specially crafted answer
  Resolves CVE-2019-18934 (bsc#1157268)
  [ + patch_cve_2019-18934.patch ]

- Avoid amplifying an incoming query to a large number of queries
  Resolves CVE-2020-12662 CVE-2020-12663 (bsc#1171889)
  [ + unbound-1.6.8-amplifying-an-incoming-query.patch ]

- Add systemd require in unbound-anchor to reflect new dependency (due to systemd-timers)

- Remove old pwdutils dependency and add shadow to cover both useradd
  and groupadd as suggested in (bsc#1126757)

- Use systemd-tmpfiles to create /var/lib/unbound/root.key
  to avoid transactional update breakage (bsc#1111383)

- Migrated from cron to systemd timers (bsc#1115417)

- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)

- Disabled DLV configuration by default (bsc#1055060)
- Updated the DNSSEC root trust anchor due to KSK roll over (bsc#1112009)

- adjust for root KSK rollover (bsc#1112009, bsc#1004165)

- update to 1.6.8 (bsc#1076963)
  patch for CVE-2017-15105: vulnerability in the processing of
  wildcard synthesized NSEC records.

- Use python3 instead of python2 (fate#323526)

- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)

- update to 1.6.7
  Features:
- Set trust-anchor-signaling default to yes
- Fix #1440: [dnscrypt] client nonce cache.
- Fix #1435: Please allow UDP to be disabled separately upstream and
  downstream.
  Bug fixes:
- Fix that looping modules always stop the query, and don't pass
  control.
- Fix unbound-host to report error for DNSSEC state of failed lookups.
- Spelling fixes, from Josh Soref.
- Fix #1400: allowing use of global cache on ECS-forwarding unless
  always-forward.
- use a cachedb answer even if it's "expired" when serve-expired is yes
  (patch from Jinmei Tatuya).
- trigger refetching of the answer in that case (this will bypass
  cachedb lookup)
- allow storing a 0-TTL answer from cachedb in the in-memory message
  cache when serve-expired is yes
- Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff.
- Log name of looping module
- Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch
  (by Danilo G. Baio).
- Fix param unused warning for windows exportsymbol compile.
- Use RCODE from A query on DNS64 synthesized answer.
- Fix trust-anchor-signaling works in libunbound.
- Fix spelling in unbound-control man page.

- update to 1.6.6
  Features:
- unbound-control dump_infra prints port number for address if not 53.
- Fix #1344: RFC6761-reserved domains: test. and invalid.
- Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor).
  With the -p option unbound does not create a pidfile.
- Added stats for queries that have been ratelimited by domain
  recursion.
- Patch to show DNSCrypt status in help output, from Carsten
  Strotmann.
- Fix #1407: Add ECS options check to unbound-checkconf.
- Fix #1415: [dnscrypt] shared secret cache, patch from
  Manu Bretelle.
  Bug Fixes:
- fixup of dnscrypt_cert_chacha test (from Manu Bretelle).
- First fix for zero b64 and hex text zone format in sldns.
- Better fixup of dnscrypt_cert_chacha test for different escapes.
- Fix that infra cache host hash does not change after reconfig.
- Fix python example0 return module wait instead of error for pass.
- enhancement for hardened-tls for DNS over TLS.  Removed duplicated
  security settings.
- Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned
  on.
- Fix #1331: libunbound segfault in threaded mode when context is
  deleted.
- Fix pythonmod link line option flag.
- Fix openssl 1.1.0 load of ssl error strings from ssl init.
- Fix 1332: Bump verbosity of failed chown'ing of the control socket.
- Redirect all localhost names to localhost address for RFC6761.
- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
- Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg.
- upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
  config.sub(2016-09-05).
- annotate case statement fallthrough for gcc 7.1.1.
- flex output from flex 2.6.1.
- snprintf of thread number does not warn about truncated string.
- squelch TCP fast open error on FreeBSD when kernel has it disabled,
  unless verbosity is high.
- remove warning from windows compile.
- Fix compile with libnettle
- Fix DSA configure switch (--disable dsa) for libnettle and libnss.
- Fix #1365: Add Ed25519 support using libnettle.
- Fix #1394: mix of serve-expired and response-ip could cause a crash.
- Remove unused iter_env member (ip6arpa_dname)
- Do not reset rrset.bogus stats when called using stats_noreset.
- Do not add rrset_bogus and query ratelimiting stats per thread, these
  module stats are global.
- Fix #1397: Recursive DS lookups for AS112 zones names should recurse.
- Fix #1398: make cachedb secret configurable.
- Remove spaces from Makefile.
- Fix issue on macOX 10.10 where TCP fast open is detected but not
  implemented causing TCP to fail. The fix allows fallback to regular
  TCP in this case and is also more robust for cases where connectx()
  fails for some reason.
- Fix #1402: squelch invalid argument error for fd_set_block on windows.
- Fix to reclaim tcp handler when it is closed due to dnscrypt buffer
  allocation failure.
- Fix #1415: patch to free dnscrypt environment on reload.
- iana portlist update
- Small fixes for the shared secret cache patch.
- Fix WKS records on kvm autobuild host, with default protobyname
  entries for udp and tcp.
- Fix #1414: fix segfault on parse failure and log_replies.
- zero qinfo in handle_request, this zeroes local_alias and also the
  qname member.
- new keys and certs for dnscrypt tests.
- fixup WKS test on buildhost without servicebyname.
- updated contrib/fastrpz.patch to apply with configparser changes.
- Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs.
- Fix #1424: cachedb:testframe is not thread safe.
- Fix #1417: [dnscrypt] shared secret cache counters, and works when
  dnscrypt is not enabled.  And cache size configuration option.
- Fix #1418: [ip ratelimit] initialize slabhash using
  ip-ratelimit-slabs.
- Recommend 1472 buffer size in unbound.conf

- update to 1.6.5
  * Fix install of trust anchor when two anchors are present, makes both
    valid.  Checks hash of DS but not signature of new key.  This fixes
    installs between sep11 and oct11 2017.

- RPM group fix. Do not suppress user/group creation problems.
  Replace %__ type macro indirections.

- update to 1.6.4
  Features:
- Implemented trust anchor signaling using key tag query.
- unbound-checkconf -o allows query of dnstap config variables.
  Also unbound-control get_option.  Also for dnscrypt.
- unbound.h exports the shm stats structures.  They use
  type long long and no ifdefs, and ub_ before the typenames.
- Implemented opportunistic IPsec support module (ipsecmod).
- Added redirect-bogus.patch to contrib directory.
- Support for the ED25519 algorithm with openssl (from openssl 1.1.1).
- renumbering B-Root's IPv6 address to 2001:500:200::b.
- Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher.
- Fix #1277: disable domain ratelimit by setting value to 0.
- Added fastrpz patch to contrib
  Bug Fixes:
- Added ECS unit test (from Manu Bretelle).
- ECS documentation fix (from Manu Bretelle).
- Fix #1252: more indentation inconsistencies.
- Fix #1253: unused variable in edns-subnet/addrtree.c:getbit().
- Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle).
- iana portlist update
- Based on #1257: check parse limit before t increment in sldns RR
  string parse routine.
- Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start.
  and fix that 64bit getting installed in C:\Program Files (x86).
- Fix #1259: "--disable-ecdsa" argument overwritten
  by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c".
- iana portlist update
- Added test for leak of stub information.
- Fix sldns wire2str printout of RR type CAA tags.
- Fix sldns int16_data parse.
- Fix sldns parse and printout of TSIG RRs.
- sldns SMIMEA and AVC definitions, same as getdns definitions.
- Fix tcp-mss failure printout text.
- Set SO_REUSEADDR on outgoing tcp connections to fix the bind before
  connect limited tcp connections.  With the option tcp connections
  can share the same source port (for different destinations).
- Add 'c' to getopt() in testbound.
- Adjust servfail by iterator to not store in cache when serve-expired
  is enabled, to avoid overwriting useful information there.
- Fix queries for nameservers under a stub leaking to the internet.
- document trust-anchor-signaling in example config file.
- updated configure, dependencies and flex output.
- better module memory lookup, fix of unbound-control shm names for
  module memory printout of statistics.
- Fix type AVC sldns rrdef.
- Some whitespace fixup.
- Fix #1265: contrib/unbound.service contains hardcoded path.
- Fix #1265 to use /bin/kill.
- Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs,
  and compatibility with BoringSSL.
- Fix #1268: SIGSEGV after log_reopen.
- exec_prefix is by default equal to prefix.
- printout localzone for duplicate local-zone warnings.
- Fix assertion for low buffer size and big edns payload when worker
  overrides udpsize.
- Support for openssl EVP_DigestVerify.
- Fix #1269: inconsistent use of built-in local zones with views.
- Add defaults for new local-zone trees added to views using
  unbound-control.
- Fix #1273: cachedb.c doesn't compile with -Wextra.
- If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write.
- Also use global local-zones when there is a matching view that does
  not have any local-zone specified.
- Fix fastopen EPIPE fallthrough to perform connect.
- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
  (from Manu Bretelle).
- Fix #1275: cached data in cachedb is never used.
- Fix that unbound-control can set val_clean_additional and
  val_permissive_mode.
- Add dnscrypt XChaCha20 tests.
- Detect chacha for dnscrypt at configure time.
- dnscrypt unit tests with chacha.
- Added domain name based ECS whitelist.
- Fix #1278: Incomplete wildcard proof.
- Fix #1279: Memory leak on reload when python module is enabled.
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname.  When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.
- More fixes in depth for buffer checks in 0x20 qname checks.
- Fix stub zone queries leaking to the internet for
  harden-referral-path ns checks.
- Fix query for refetch_glue of stub leaking to internet.
- Fix #1301: memory leak in respip and tests.
- Free callback in edns-subnetmod on exit and restart.
- Fix memory leak in sldns_buffer_new_frm_data.
- Fix memory leak in dnscrypt config read.
- Fix dnscrypt chacha cert support ifdefs.
- Fix dnscrypt chacha cert unit test escapes in grep.
- Fix to unlock view in view test.
- Fix warning in pythonmod under clang compiler.
- Fix lintian typo.
- Fix #1316: heap read buffer overflow in parse_edns_options.

- update to 1.6.3
  Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
  contains malformed qname. When 0x20 caps-for-id is enabled, when
  assertions are not enabled the malformed qname is handled correctly.