[Bug 297299] dns/unbound: Update to 1.26.0

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D297299

            Bug ID: 297299
           Summary: dns/unbound: Update to 1.26.0
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
               URL: https://community.nlnetlabs.nl/t/unbound-1-26-0-releas
                    ed/3434
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: [email protected]
          Reporter: [email protected]
 Attachment #273488 maintainer-approval+
             Flags:

Created attachment 273488
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D273488&action=
=3Dedit
patch to update

This release has some features and a number of bug fixes.

The certificates for the root key are updated. The icannbundle.pem
file is updated with the public keys for 2009 to 2029 and for 2025
to 2045. This is available in the unbound-anchor tool. With the
`-l` option unbound-anchor lists the builtin key and cert that it
has. The updated certificates are valid for a longer time. With
`-c` the icannbundle.pem file can be given from the commandline.
Then unbound-anchor does not use the builtin certificates. And
this allows the update of the certificate file without a change
in unbound-anchor.

The ipsecmod module is changed, that the script, for the hook, has
to start with a line like `#!/bin/sh`. The file is executed with
execv, and not any longer with system, so that it is better for
security. It is an in-depth protection against possible quotation
and buffer failures.

The server continues to start if secondary zones, for auth zones,
fail to load from zonefile. To protects against malformed content
in the zonefiles, and the server continues to serve, and attempt
to fetch new updates for the zone. Also for primary auth zones, if
the zonefile does not exist, the server continues to start up. This
makes the server start more easily. Secondary zones are no longer
allowed to have a `$INCLUDE` in the zonefile. That is for safety,
for what file is chosen. The server drops out-of-zone content from
auth zones when they are read, those records are not supposed to be
part of the auth zone. The primary hostname that is transferred from,
can now be a name that uses CNAME(s).

The options `max-transfer-size` and `max-transfer-time` can be used
to limit the amount of size and time that auth-zone transfers use. The
default is disabled, that is backwards compatible.

The unbound-control command `local_data_remove` is overloaded to also
work to be able to remove specific records. Specify the record with
its details to remove it.

Apart from the local-zone type `block_a`, that denies A lookups,
there is now also `block_aaaa`, it denies AAAA lookups. The local zone
types `block_a_wdata` and `block_aaaa_wdata` can be used to also have
local-data, that is served, if it is not there, like `transparent`, it
lookups recursively, or denies the particular type from lookup. These
are helpful in IPv4 with IPv6 deployment situations, as it forces
applications to not use a particular transport. With the changes to
respip and RPZ processing that make the filters apply equally after
dns64, so that dns64 does not bypass the filter, the new local-zone
types can be used to apply denial of a particular transport.

Features & Bugs

For a full list, see the Relaes Notes:
https://community.nlnetlabs.nl/t/unbound-1-26-0-released/3434

--=20
You are receiving this mail because:
You are the assignee for the bug.=