Log message:
Unbound 1.5.6
=============

Features:
* Default for ssl-port is port 853, the temporary port assignment for
  secure domain name system traffic. If you used to rely on the older default
  of port 443, you have to put a clause in unbound.conf for that. The new
  value is likely going to be the standardised port number for this traffic.
* ANY responses include DNAME records if present,
  as per Evan Hunt's remark in dnsop.

Bug Fixes:
* Fix segfault in the dns64 module in the formaterror error path.
* Fix manpage to suggest using SIGTERM to terminate the server.
* iana portlist update.

Unbound 1.5.5
=============

Features:
* Change default of harden-algo-downgrade to off.
  This is lenient for algorithm rollover.
* Added permit-small-holddown config to debug fast 5011 rollover.
* Allow certificate chain files to allow for intermediate certificates.
* Enable ECDHE for servers. Where available, use SSL_CTX_set_ecdh_auto()
  for TLS-wrapped server configurations to enable ECDHE. Otherwise,
  manually offer curve p256. Client connections should automatically
  use ECDHE when available.
* [bugzilla: 699 ] Feature --enable-pie option to that builds PIE binary.
* [bugzilla: 700 ] Feature --enable-relro-now option that enables full
  read-only relocation.
* [bugzilla: 702 ] New IPs for for h.root-servers.net.

Bug Fixes:
* [bugzilla: 681 ] Fix setting forwarders with unbound-control forward
  implicitly turns on forward-first.
* [bugzilla: 690 ] Fix that reload fails when so-reuseport is yes
  after changing num-threads.
* please afl-gcc (llvm) for uninitialised variable warning.
* Fix mktime in unbound-anchor not using UTC.
* Fix 5011 anchor update timer after reload.
* 5011 implementation does not insist on all algorithms,
  when harden-algo-downgrade is turned off.
* Document in the manual more text about configuring locally served zones.
* Document that local-zone nodefault matches exactly and transparent can
  be used to release a subzone.
* [bugzilla: 694 ] Fix that configure script does not detect LibreSSL 2.2.2
* Fix deadlock for local data add and zone add when unbound-control
  list_local_data printout is interrupted.
* [bugzilla: 697 ] Fix get PY_MAJOR_VERSION failure at configure for
  python 2.4 to 2.6.
* changed windows setup compression to be more transparent.
* Fix config globbed include chroot treatment, this fixes reload of globs.
* [bugzilla: 705 ] Fix ub_ctx_set_fwd() return value mishandled on windows.
* Fix minor error in unbound.conf.5.in.
* Fix unbound.conf(5) access-control description for precedence and default.
* Fix unbound-control flush that does not succeed in removing data.
* MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution failures.
* iana portlist update.

Log message:
Add SMF support. Bump revision.

Log message:
Unbound 1.5.4

Features:
-   [bugzilla: 644 ] harden-algo-downgrade option, if turned off,
    fixes the reported excessive validation failure when multiple
    algorithms are present. If set to 'no', it allows the weakest
    algorithm to validate the zone.
-   stats reports tcp usage, of incoming-num-tcp buffers.
-   contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal
    scripts.
-   Add ip-transparent config option for bind to non-local addresses.
-   Synthesize ANY responses from cache. Does not search exhaustively,
    but MX,A,AAAA,SOA,NS also CNAME.
-   unbound-control list_insecure command shows the negative trust
    anchors currently configured.
-   ratelimit feature, ratelimit: 1000, can be used to turn it on. It
    ratelimits recursion effort per zone. For particular names you can
    configure exceptions in unbound.conf.
-   Ratelimit does not apply to prefetched queries, and
    ratelimit-factor is default 10. Repeated normal queries get resolved
    and with prefetch stay in the cache.
-   unbound-control ratelimit_list lists high rate domains.
-   caps-whitelist in unbound.conf allows whitelist of loadbalancers
    that cannot work with caps-for-id or its fallback.
-   RFC 7553 RR type URI support, is now enabled by default.
-   cache-max-negative-ttl config option, default 3600.
-   Add local-zone type inform_deny, that logs query and drops answer.

Bug Fixes:
-   Unbound exits with a fatal error when the auto-trust-anchor-file
    fails to be writable. This is seconds after startup. You can load a
    readonly auto-trust-anchor-file with trust-anchor-file. The file has
    to be writable to notice the trust anchor change, without it, a trust
    anchor change will be unnoticed and the system will then become
    inoperable.
-   DLV is going to be decommissioned. Advice to stop using it, and
    put text in the example configuration and man page to that effect.
-   Patch from Brad Smith that syncs compat/getentropy_linux with
    OpenBSD's version (2015-03-04).
-   0x20 fallback improved: servfail responses do not count as missing
    comparisons (except if all responses are errors), inability to find
    nameservers does not fail equality comparisons, many nameservers does
    not try to compare more than max-sent-count, parse failures start 0x20
    fallback procedure.
-   store caps_response with best response in case downgrade response
    happens to be the last one.
-   Document that incoming-num-tcp increase is good for large servers.
-   Fix lintian warning in unbound-checkconf man page.
-   Updated default keylength in unbound-control-setup to 3k.
-   Fixup compile on cygwin, more portable openssl thread id.
-   Use reallocarray for integer overflow protection.
-   Fixed to add integer overflow checks on allocation (defense in depth).
-   Fix segfault on user not found at startup.
-   [bugzilla: 657 ] Fix that libunbound(3) recommends deprecated
    CRYPTO_set_id_callback.
-   If unknown trust anchor algorithm, and libressl is used, error
    message encourages upgrade of the libressl package.
-   rename ldns subdirectory to sldns to avoid name collision.
-   [bugzilla: 660 ] Fix interface-automatic broken in the presence of
    asymmetric routing.
-   Libunbound skips dos-line-endings from etc/hosts.
-   Fix crash in dnstap: Do not try to log TCP responses after timeout.
-   Fix that get_option for cache-sizes does not print double newline.
-   [bugzilla: 663 ] Fix that ssl handshake fails when using unix
    socket because dh size is too small.
-   [bugzilla: 664 ] libunbound python3 related fixes (from Tomas
    Hozza); Use print_function also for Python2. libunbound examples:
    produce sorted output. libunbound-Python: libldns is not used anymore.
    Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns.
-   Fix leaked dns64prefix configuration string.
-   Removed contrib/unbound_unixsock.diff, because it has been
    integrated, use control-interface: /path in unbound.conf.
-   Change syntax of particular validator error to be easier for
    machine parse, swap rrset and ip adres info so it looks like:
    validation failure <www.example.nl. TXT IN>: signature crypto failed
    from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN>
-   Fix that unparseable error responses are ratelimited.
-   SOA negative TTL is capped at minimumttl in its rdata section.
-   [bugzilla: 674 ] Do not free pointers given by getenv.
-   [bugzilla: 677 ] Fix CNAME corresponding to a DNAME was checked
    incorrectly and was therefore always synthesized.
    And fix DNAME responses from cache that failed internal chain test.
-   iana portlist update.

Log message:
Unbound 1.5.3

Bug Fixes:
* [bugzilla: 647 ] Fix #647 crash in 1.5.2 because pwd.db no longer
accessible after reload.
* [bugzilla: 645 ] Fix #645 Portability to Solaris 10, use AF_LOCAL.
* [bugzilla: 646 ] Fix #646 Portability to Solaris, -lrt for
getentropy_solaris.
* Use the getrandom syscall introduced in Linux 3.17

Log message:
update the rc-script so it works correctly for the unbound user

Log message:
Unbound 1.5.2

Features:
* local-zone: example.com inform makes unbound log a message with
  client IP for queries in that zone. Eg. for finding infected hosts.
* patch from Stephane Lapie that adds to the python API, that
  exposes struct delegpt, and adds the find_delegation function.
* Updated contrib warmup.cmd/sh to support two modes - load from
  pre-defined list of domains or (with filename as argument) load from
  user-specified list of domains, and updated contrib
  unbound_cache.sh/cmd to support loading/save/reload cache to/from
  default path or (with secondary argument) arbitrary path/filename
* patch for remote control over local sockets. Use control-interface:
  /path/sock and control-use-cert: no.
* unbound-checkconf -f prints chroot with pidfile path.
* infra-cache-min-rtt patch from Florian Riehm, for expected long
  uplink roundtrip times.

Bug Fixes:
* config.guess and config.sub update from libtoolize.
* getauxval test for ppc64 linux compatibility.
* make strip works for unbound-host and unbound-anchor.
* print query name when max target count is exceeded.
* patch from Stuart Henderson that fixes DESTDIR in
  unbound-control-setup for installs where config is not in the prefix
  location.
* [bugzilla: 634 ] Fix #634: fix fail to start on Linux LTS 3.14.X,
  ignores missing IP_MTU_DISCOVER OMIT option.
* Patch to contrib/unbound_munin_ that uses type ABSOLUTE.
  Allows munin.conf: [idleserver.example.net]
  unbound_munin_hits.graph_period minute
* Fix pyunbound ord call, portable for python 2 and 3.
* Fix unintended use of gcc extension for incomplete enum types,
  compile with pedantic c99 compliance.
* Fix pyunbound byte string representation for python3.
* Fix 0x20 capsforid fallback to omit gratuitous NS and additional
  section changes.
* Fix validation failure in case upstream forwarder (ISC BIND) does
  not have the same trust anchors and decides to insert unsigned NS
  record in authority section.
* Fix scrubber with harden-glue turned off to reject NS (and other
  not-address) records.
* iana portlist update.
* [bugzilla: 643 ] Fix doc/example.conf.in: unnecessary whitespace.

Log message:
Unbound 1.5.1

Features:

Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, added to \ 
contrib/aaaa-filter-iterator.patch.

Bug Fixes:

* Fix that CD flag disables DNS64 processing, returning the DNSSEC signed AAAA \ 
denial.
* Fix compat/getentropy_win.c check if CryptGenRandom works and no immediate \ 
exit on windows.
* Fix crash on multiple thread random usage on systems without arc4random.
* Fix log at high verbosity and memory allocation failure.
* Fix libunbound undefined symbol errors for main.
* Patch from Robert Edmonds to build pyunbound python module differently. No \ 
versioninfo, with -shared and without $(LIBS).
* Patch from Robert Edmonds fixes hyphens in unbound-anchor man page.
* Removed 'increased limit open files' log message that is written to console. \ 
It is only written on verbosity 4 and higher. This keeps system bootup console \ 
cleaner.
* Patch from James Raftery, always print stats for rcodes 0..5.
* [bugzilla: 627 ] Fix SSL_CTX_load_verify_locations return code not properly \ 
checked.
* Fix makefile for build from noexec source tree.
* Add include to getentropy_linux.c, fixing debian build.
* [bugzilla: 632 ] Fix that unbound fails to build on AArch64, protects \ 
getentropy compat code from calling sysctl if it is has been removed.
* Fix CVE-2014-8602: denial of service by making resolver chase endless series \ 
of delegations.

Unbound 1.5.0

Features:

Alot of new features...
(See http://www.unbound.net/download.html)

Bug Fixes:

Alot of bug fixes...
(See http://www.unbound.net/download.html)

Log message:
Add fix for CVE-2014-8602

Log message:
Unbound 1.4.22

Features:
* separate ldns into core ldns inside ldns/ subdirectory.  No more
  configure --with-ldns is needed and unbound does not rely on libldns.
* Accept ip-address: as an alternative for interface: for
  consistency with nsd.conf syntax.
* Fix ref#536: acl_deny_non_local and refuse_non_local added.
* so-reuseport: yesno option to distribute queries evenly over
  threads on Linux (Thanks Robert Edmonds).
  Reuseport is attempted, then fallback to without on failure.
* delay-close: msec option that delays closing ports for which
  the UDP reply has timed out.  Keeps the port open, only accepts
  the correct reply.  This correct reply is not used, but the port
  is open so that no port-denied ICMPs are generated.

Bug Fixes:
* Fix #528: if very high logging (4 or more) segfault on allow_snoop.
* Fix #531: Set SO_REUSEADDR so that the wildcard interface and a
  more specific interface port 53 can be used at the same time, and
  one of the daemons is unbound.
* if configured --with-libunbound-only fix make install.
* Patch from Neel Goyal to fix callback in libunbound.
* Patch from Neel Goyal to fix async id assignment if callback
  is called by libunbound in the mesh attach.
* Fix bug#537: compile python plugin without ldns library.
* Windows port, adjust %lld to %I64d, and warning in win_event.c.
* Fix #544: Fixed +i causes segfault when running with module conf
  "iterator".
* Fix #547: no trustanchor written if filesystem full, fclose checked.
* unbound-event.h is installed if you configure --enable-event-api.
  It contains low-level library calls, that use libevent's event_base
  and a wireformat return packet in a buffer to perform async
  resolution in the client's eventloop.
* speed up unbound, by reducing lock contention on localzones.lock.
* Fix parse (in ldns) of quoted parenthesized text strings.
* Detect libevent2 install automatically by configure and fixup
  link with lib/event2 subdir.
* Fix #551: License change "Regents" to "Copyright holder", \ 
matching
  the BSD license on opensource.org.
* Fix parse of #553(NSD) string in sldns, quotes without spaces.
* Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is
  received. This is okay according 4035, but not after revising
  existence in 4592.  NSEC empty non-terminals exist and thus the
  RCODE should have been NOERROR. If this occurs, and the RRsets
  are secure, we set the RCODE to NOERROR and the security status
  of the response is also considered secure.
* iana portlist updated.
* Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes
  because of spelling..

Log message:
Remove example rc.d scripts from PLISTs.

These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or
ignored otherwise.