%{?!with_python2: %global with_python2 0} %{?!with_python3: %global with_python3 1} %{?!with_munin: %global with_munin 1} %global _hardened_build 1 #global extra_version rc1 %if 0%{with_python2} %global python_primary %{__python2} %endif # with_python2 %if 0%{with_python3} %global python_primary %{__python3} %endif # with_python3 %if 0%{?rhel} %global with_munin 0 %if 0%{?with_python2} && 0%{?rhel} <= 6 # needed just for EPEL %{!?__python2: %global __python2 /usr/bin/python2} %{!?python2_sitelib: %global python2_sitelib %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")} %{!?python2_sitearch: %global python2_sitearch %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} %endif # with_python2 && rhel <= 6 %if 0%{?rhel} <= 7 %global with_python3 0 %else %global with_python2 0 %endif # rhel <= 7 %endif # rhel Summary: Validating, recursive, and caching DNS(SEC) resolver Name: unbound Version: 1.7.3 Release: 15%{?extra_version:.%{extra_version}}%{?dist} License: BSD Url: https://www.unbound.net/ Source: https://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz Source1: unbound.service Source2: unbound.conf Source3: unbound.munin Source4: unbound_munin_ Source5: root.key Source7: unbound-keygen.service Source8: tmpfiles-unbound.conf Source9: example.com.key Source10: example.com.conf Source11: block-example.com.conf Source12: https://data.iana.org/root-anchors/icannbundle.pem Source13: root.anchor Source14: unbound.sysconfig Source15: unbound-anchor.timer Source16: unbound-munin.README Source17: unbound-anchor.service Patch2: unbound-1.7.2-python3-devel.patch Patch3: unbound-1.7.2-python3-pkgconfig.patch Patch4: unbound-1.7.3-anchor-fallback.patch Patch5: unbound-1.7.3-host-any.patch Patch6: unbound-1.7.3-use-basic-lock.patch Patch7: unbound-1.7.3-ipsec-hook.patch Patch8: unbound-1.7.3-auth-callback.patch Patch9: unbound-1.7.3-ksk-2010-revoked.patch Patch10: unbound-1.7.3-DNS-over-TLS-memory-leak.patch Patch11: unbound-1.7.3-amplifying-an-incoming-query.patch Patch12: unbound-1.7.3-crypto-policy-non-compliance-openssl.patch Patch13: unbound-1.7.3-additional-logging.patch Patch14: unbound-1.7.3-security-hardening.patch Patch15: unbound-1.7.3-symlink-traversal.patch BuildRequires: gdb BuildRequires: gcc, make BuildRequires: byacc, flex, openssl-devel BuildRequires: libevent-devel expat-devel BuildRequires: pkgconfig %if 0%{with_python2} BuildRequires: python2-devel swig %endif # with_python %if 0%{with_python3} BuildRequires: python3-devel swig %endif # with_python3 BuildRequires: systemd # Required for SVN versions # BuildRequires: bison # BuildRequires: automake autoconf libtool %{?systemd_requires} # Needed because /usr/sbin/unbound links unbound libs staticly Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description Unbound is a validating, recursive, and caching DNS(SEC) resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modular components, so that also DNSSEC (secure DNS) validation and stub-resolvers (that do not run as a server, but are linked into an application) are easily possible. %if %{with_munin} %package munin Summary: Plugin for the munin / munin-node monitoring package Requires: munin-node Requires: %{name} = %{version}-%{release}, bc BuildArch: noarch %description munin Plugin for the munin / munin-node monitoring package %endif %package devel Summary: Development package that includes the unbound header files Requires: %{name}-libs%{?_isa} = %{version}-%{release}, openssl-devel Requires: pkgconfig %description devel The devel package contains the unbound library and the include files %package libs Summary: Libraries used by the unbound server and client applications %{?systemd_requires} Requires(pre): shadow-utils %description libs Contains libraries used by the unbound server and client applications %if 0%{with_python2} %package -n python2-unbound %{?python_provide:%python_provide python2-unbound} Summary: Python 2 modules and extensions for unbound Requires: %{name}-libs%{?_isa} = %{version}-%{release} Provides: unbound-python = %{version}-%{release} Obsoletes: unbound-python < %{version}-%{release} %description -n python2-unbound Python 2 modules and extensions for unbound %endif # with_python %if 0%{with_python3} %package -n python3-unbound Summary: Python 3 modules and extensions for unbound Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description -n python3-unbound Python 3 modules and extensions for unbound %endif # with_python3 %prep %global pkgname %{name}-%{version}%{?extra_version} %if 0%{with_python2} && 0%{with_python3} %global dir_primary %{pkgname}_python3 %global python_primary %{__python3} %global dir_secondary %{pkgname}_python2 %global python_secondary %{__python2} %else %global dir_primary %{pkgname} %endif # with_python2 && with_python3 %setup -qcn %{pkgname} pushd %{pkgname} %patch2 -p1 -b .python3 %patch3 -p1 -b .python3 %patch4 -p1 -b .anchor-fallback %patch5 -p1 -b .host-any %patch6 -p1 -b .use-basic-lock %patch7 -p1 -b .ipsec-hook %patch8 -p1 -b .auth-callback %patch9 -p1 -b .ksk-2010-revoked %patch10 -p1 -b .DNS-over-TLS-memory-leak %patch11 -p1 -b .amplifying-an-incoming-query %patch12 -p1 -b .crypto-policy %patch13 -p1 -b .additional-logging %patch14 -p1 -b .security-hardening %patch15 -p1 -b .symlink-traversal # only for snapshots # autoreconf -iv # copy common doc files - after here, since it may be patched cp -pr doc pythonmod libunbound ../ popd %if 0%{with_python2} && 0%{with_python3} mv %{pkgname} %{dir_primary} cp -a %{dir_primary} %{dir_secondary} %endif %build # This is needed to rebuild the configure script to support Python 3.x # autoreconf -iv # ./configure script common arguments %global configure_args --with-libevent --with-pthreads --with-ssl \\\ --disable-rpath --disable-static \\\ --enable-relro-now --enable-pie \\\ --enable-subnet --enable-ipsecmod \\\ --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \\\ --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \\\ --enable-sha2 --disable-gost --enable-ecdsa \\\ --with-rootkey-file=%{_sharedstatedir}/unbound/root.key pushd %{dir_primary} %configure \ %if 0%{?python_primary:1} --with-pythonmodule --with-pyunbound PYTHON=%{python_primary} \ %endif # python_primary %{configure_args} %{__make} %{?_smp_mflags} %{__make} %{?_smp_mflags} streamtcp popd %if 0%{?python_secondary:1} pushd %{dir_secondary} %configure \ --with-pythonmodule --with-pyunbound PYTHON=%{python_secondary} \ %{configure_args} %{__make} %{?_smp_mflags} popd %endif # python_secondary %install install -p -m 0644 %{SOURCE16} . %if 0%{?python_secondary:1} # install first secondary build. It will be overwritten by primary pushd %{dir_secondary} %{__make} DESTDIR=%{buildroot} unbound-event-install install popd %endif # python_secondary pushd %{dir_primary} %{__make} DESTDIR=%{buildroot} unbound-event-install install install -m 0755 streamtcp %{buildroot}%{_sbindir}/unbound-streamtcp popd install -d -m 0755 %{buildroot}%{_unitdir} %{buildroot}%{_sysconfdir}/sysconfig install -p -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/unbound.service install -p -m 0644 %{SOURCE7} %{buildroot}%{_unitdir}/unbound-keygen.service install -p -m 0644 %{SOURCE15} %{buildroot}%{_unitdir}/unbound-anchor.timer install -p -m 0644 %{SOURCE17} %{buildroot}%{_unitdir}/unbound-anchor.service install -p -m 0755 %{SOURCE2} %{buildroot}%{_sysconfdir}/unbound install -p -m 0644 %{SOURCE12} %{buildroot}%{_sysconfdir}/unbound install -p -m 0644 %{SOURCE14} %{buildroot}%{_sysconfdir}/sysconfig/unbound %if %{with_munin} # Install munin plugin and its softlinks install -d -m 0755 %{buildroot}%{_sysconfdir}/munin/plugin-conf.d install -p -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/munin/plugin-conf.d/unbound install -d -m 0755 %{buildroot}%{_datadir}/munin/plugins/ install -p -m 0755 %{SOURCE4} %{buildroot}%{_datadir}/munin/plugins/unbound for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unbound_munin_by_type unbound_munin_by_class unbound_munin_by_opcode unbound_munin_by_rcode unbound_munin_by_flags unbound_munin_histogram; do ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin done %endif pushd %{dir_primary} # install streamtcp man page install -m 0644 testcode/streamtcp.1 %{buildroot}/%{_mandir}/man1/unbound-streamtcp.1 install -D -m 0644 contrib/libunbound.pc %{buildroot}/%{_libdir}/pkgconfig/libunbound.pc popd # Install tmpfiles.d config install -d -m 0755 %{buildroot}%{_tmpfilesdir} %{buildroot}%{_sharedstatedir}/unbound install -m 0644 %{SOURCE8} %{buildroot}%{_tmpfilesdir}/unbound.conf # install root - we keep a copy of the root key in old location, # in case user has changed the configuration and we wouldn't update it there install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/unbound/ install -m 0644 %{SOURCE13} %{buildroot}%{_sharedstatedir}/unbound/root.key # remove static library from install (fedora packaging guidelines) rm %{buildroot}%{_libdir}/*.la %if 0%{with_python2} rm %{buildroot}%{python2_sitearch}/*.la %endif # with_python %if 0%{with_python3} rm %{buildroot}%{python3_sitearch}/*.la %endif # with_python3 # create softlink for all functions of libunbound man pages for mpage in ub_ctx ub_result ub_ctx_create ub_ctx_delete ub_ctx_set_option ub_ctx_get_option ub_ctx_config ub_ctx_set_fwd ub_ctx_resolvconf ub_ctx_hosts ub_ctx_add_ta ub_ctx_add_ta_file ub_ctx_trustedkeys ub_ctx_debugout ub_ctx_debuglevel ub_ctx_async ub_poll ub_wait ub_fd ub_process ub_resolve ub_resolve_async ub_cancel ub_resolve_free ub_strerror ub_ctx_print_local_zones ub_ctx_zone_add ub_ctx_zone_remove ub_ctx_data_add ub_ctx_data_remove; do echo ".so man3/libunbound.3" > %{buildroot}%{_mandir}/man3/$mpage ; done mkdir -p %{buildroot}%{_localstatedir}/run/unbound # Install directories for easier config file drop in mkdir -p %{buildroot}%{_sysconfdir}/unbound/{keys.d,conf.d,local.d} install -p %{SOURCE9} %{buildroot}%{_sysconfdir}/unbound/keys.d/ install -p %{SOURCE10} %{buildroot}%{_sysconfdir}/unbound/conf.d/ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/unbound/local.d/ # Link unbound-control-setup.8 manpage to unbound-control.8 echo ".so man8/unbound-control.8" > %{buildroot}/%{_mandir}/man8/unbound-control-setup.8 %pre libs getent group unbound >/dev/null || groupadd -r unbound getent passwd unbound >/dev/null || \ useradd -r -g unbound -d %{_sysconfdir}/unbound -s /sbin/nologin \ -c "Unbound DNS resolver" unbound %post %systemd_post unbound.service %systemd_post unbound-keygen.service %post libs %{?ldconfig} %systemd_post unbound-anchor.timer # start the timer only if installing the package to prevent starting it, if it was stopped on purpose if [ "$1" -eq 1 ]; then # the Unit is in presets, but would be started after reboot /bin/systemctl start unbound-anchor.timer >/dev/null 2>&1 || : fi %preun %systemd_preun unbound.service %systemd_preun unbound-keygen.service %preun libs %systemd_preun unbound-anchor.timer %postun %systemd_postun_with_restart unbound.service %systemd_postun unbound-keygen.service %postun libs %{?ldconfig} %systemd_postun_with_restart unbound-anchor.timer %triggerun -- unbound < 1.4.12-4 # Save the current service runlevel info # User must manually run systemd-sysv-convert --apply unbound # to migrate them to systemd targets /usr/bin/systemd-sysv-convert --save unbound >/dev/null 2>&1 ||: # Run these because the SysV package being removed won't do them /sbin/chkconfig --del unbound >/dev/null 2>&1 || : /bin/systemctl try-restart unbound.service >/dev/null 2>&1 || : /bin/systemctl try-restart unbound-keygen.service >/dev/null 2>&1 || : %check pushd %{dir_primary} #pushd pythonmod #make test #popd make check popd %if 0%{?python_secondary:1} pushd %{dir_secondary} #pushd pythonmod #make test #popd make check popd %endif # python_secondary %files %doc doc/CREDITS doc/FEATURES %{_unitdir}/%{name}.service %{_unitdir}/%{name}-keygen.service %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name} %attr(0644,root,root) %{_tmpfilesdir}/unbound.conf %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/%{name} %dir %attr(0755,root,unbound) %{_sysconfdir}/%{name}/keys.d %attr(0644,root,unbound) %config(noreplace) %{_sysconfdir}/%{name}/keys.d/*.key %dir %attr(0755,root,unbound) %{_sysconfdir}/%{name}/conf.d %attr(0644,root,unbound) %config(noreplace) %{_sysconfdir}/%{name}/conf.d/*.conf %dir %attr(0755,root,unbound) %{_sysconfdir}/%{name}/local.d %attr(0644,root,unbound) %config(noreplace) %{_sysconfdir}/%{name}/local.d/*.conf %ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_control.pem %ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_control.key %ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_server.pem %ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_server.key %{_sbindir}/unbound %{_sbindir}/unbound-checkconf %{_sbindir}/unbound-control %{_sbindir}/unbound-control-setup %{_sbindir}/unbound-host %{_sbindir}/unbound-streamtcp %{_mandir}/man1/* %{_mandir}/man5/* %exclude %{_mandir}/man8/unbound-anchor* %{_mandir}/man8/* %if 0%{with_python2} %files -n python2-unbound %license pythonmod/LICENSE %{python2_sitearch}/* %doc libunbound/python/examples/* %doc pythonmod/examples/* %endif %if 0%{with_python3} %files -n python3-unbound %license pythonmod/LICENSE %{python3_sitearch}/* %doc libunbound/python/examples/* %doc pythonmod/examples/* %endif %if 0%{with_munin} %files munin %doc unbound-munin.README %config(noreplace) %{_sysconfdir}/munin/plugin-conf.d/unbound %{_datadir}/munin/plugins/unbound* %endif %files devel %{_libdir}/libunbound.so %{_includedir}/unbound.h %{_includedir}/unbound-event.h %{_mandir}/man3/* %{_libdir}/pkgconfig/*.pc %files libs %doc doc/README %license doc/LICENSE %attr(0755,root,root) %dir %{_sysconfdir}/%{name} %{_sbindir}/unbound-anchor %{_libdir}/libunbound.so.* %{_mandir}/man8/unbound-anchor* %{_sysconfdir}/%{name}/icannbundle.pem %{_unitdir}/unbound-anchor.timer %{_unitdir}/unbound-anchor.service %dir %attr(0755,unbound,unbound) %{_sharedstatedir}/%{name} %attr(0644,unbound,unbound) %config %{_sharedstatedir}/%{name}/root.key # just left for backwards compat with user changed unbound.conf files - format is different! %attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key # modification of root.key is maintained by unbound-achor.service and is intentional, so let rpm know %verify(not md5 size mtime) %{_sharedstatedir}/%{name}/root.key %changelog * Tue Sep 01 2020 Anna Khaitovich - 1.7.3-15 - Fix SPEC file to not check md5 mtime and size of /var/lib/unbound/root.key - Resolves: rhbz#1714175 - Use system-wide crypto policy setting (PROFILE=SYSTEM) instead of custom setting - Resolves: rhbz#1842837 - Enable additional logging in unbound - Resolves: rhbz#1850460 - security hardening from x41 report - Resolves: rhbz#1859933 - symbolic link traversal when writing PID file - Resolves: rhbz#1899058 * Thu May 28 2020 Anna Khaitovich - 1.7.3-14 - Fix unbound-1.7.3-amplifying-an-incoming-query.patch patch - Resolves: rhbz#1839178 (CVE-2020-12662) * Mon May 25 2020 Anna Khaitovich - 1.7.3-13 - Fix two previous patches and add missing patch lines to %%prep - Fix amplifying an incoming query into a large number of queries directed to a target - Resolves: rhbz#1839178 (CVE-2020-12662) * Tue Apr 21 2020 Anna Khaitovich - 1.7.3-12 - Remove KSK-2010 from configuration files - Resolves: rhbz#1665502 - Replace legacy directory /var/run/ with /run - Resolves: rhbz#1766463 - Resolves: rhbz#1805978 - Fix memory leak when DNS over TLS forwarding is configured - Resolves: rhbz#1819870 * Thu Apr 16 2020 Artem Egorenkov - 1.7.3-11 - Resolves bz1818761. unbound crash fixed. * Tue Dec 10 2019 Tomas Korbar - 1.7.3-10 - Secure ipsec mode (#1772061) - CVE-2019-18934 * Tue Dec 10 2019 Tomas Korbar - 1.7.3-9 - Use pthread_mutex_t locks when dealing with I/O operations (#1775708) * Tue Jul 31 2018 Petr Menšík - 1.7.3-8 - Release memory in unbound-host * Mon Jul 23 2018 Petr Menšík - 1.7.3-7 - Remove unused Group tag * Wed Jul 18 2018 Petr Menšík - 1.7.3-6 - Cleanup generated client and server keys (#1601773) * Sat Jul 14 2018 Fedora Release Engineering - 1.7.3-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Mon Jul 09 2018 Petr Menšík - 1.7.3-4 - Do not call ldconfig if possible * Wed Jul 04 2018 Petr Menšík - 1.7.3-3 - Update trust anchors also behind firewall (#1598078) * Mon Jul 02 2018 Miro Hrončok - 1.7.3-2 - Rebuilt for Python 3.7 * Wed Jun 27 2018 Petr Menšík - 1.7.3-1 - Update to 1.7.3 (#1593708) * Wed Jun 27 2018 Petr Menšík - 1.7.2-3 - Remove last python2 dependency from python3 build * Mon Jun 25 2018 Tomas Hozza - 1.7.0-6 - Disable Python2 support * Mon Apr 09 2018 Petr Menšík - 1.7.0-5 - Require gcc and make on build - Remove group, simplify systemd requires - Simplify building with single python version, make python3 primary * Mon Apr 09 2018 Paul Wouters - 1.7.0-4 - Patch for prefetching after flushing cache * Fri Apr 06 2018 Paul Wouters - 1.7.0-3 - Patch for referral with auth-zone: response * Wed Mar 21 2018 Paul Wouters - 1.7.0-2 - Patch for broken Aggressive NSEC + stub-zone configuration causing NXDOMAIN at TTL expiry * Thu Mar 15 2018 Paul Wouters - 1.7.0-1 - Updated to 1.7.0 (aggressive nsec, local root support, bugfixes) * Thu Feb 22 2018 Petr Menšík - 1.6.8-6 - Uncomment again original max-upd-size * Wed Feb 21 2018 Petr Menšík - 1.6.8-5 - Use default RPM build flags and configure parameters (#1539097) * Wed Feb 21 2018 Petr Menšík - 1.6.8-4 - Remove group writable bit from some config files (#1528445) * Wed Feb 14 2018 Filipe Rosset - 1.6.8-3 - rebuilt due new libevent 2.1.8 * Fri Feb 09 2018 Igor Gnatenko - 1.6.8-2 - Escape macros in %%changelog * Mon Jan 22 2018 Paul Wouters - 1.6.8-1 - Resolves rhbz#1483572 unbound-1.6.8 is available - Resolves rhbz#1507049 CVE-2017-15105 unbound: Improper validation of wildcard synthesized NSEC records - Resolves rhbz#1536518 CVE-2017-15105 unbound: Improper validation of wildcard synthesized NSEC records [fedora-all] * Sun Dec 17 2017 Zbigniew Jędrzejewski-Szmek - 1.6.7-2 - Python 2 binary package renamed to python2-unbound See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 * Thu Oct 12 2017 Paul Wouters - 1.6.7-1 - Updated to 1.6.7 (minor bugfixes) * Tue Oct 03 2017 Petr Menšík - 1.6.6-3 - Update icannbundle.pem * Mon Oct 02 2017 Paul Wouters - 1.6.6-2 - Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics * Fri Sep 22 2017 Paul Wouters - 1.6.6-1 - Resolves: rhbz#1483572 unbound-1.6.6 is available - Resolves: rhbz#1465575 unbound fails to start up, complains about missing ipsecmod-hook (edit) * Wed Aug 16 2017 Paul Wouters - 1.6.4-4 - Rebuilt with KSK2017 added to root.key and root.anchor - Remove noreplace for root key files. We can only improve these files over local copies * Thu Aug 03 2017 Fedora Release Engineering - 1.6.4-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild * Thu Jul 27 2017 Fedora Release Engineering - 1.6.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild * Sun Jul 02 2017 Paul Wouters - 1.6.4-1 - Updated to 1.6.4 full release, patch to allow missing ipsechook - Resolves rhbz#1465575 unbound fails to start up, complains about missing ipsecmod-hook * Thu Jun 22 2017 Paul Wouters - 1.6.4-0.rc2 - Update to 1.6.4 (esubnet, ipsecmod support, bugfixes) * Tue Jun 13 2017 Paul Wouters - 1.6.3-1 - Updated to 1.6.3 (fixes assertion failure when receiving malformed packet with 0x20 enabled) * Thu Jun 08 2017 Paul Wouters - 1.6.2-2 - Patch for cmd: unbound-control set_option val-permissive-mode: yes * Wed Apr 26 2017 Paul Wouters - 1.6.2-1 - Update to 1.6.2 (rhbz#1425649) - Updated unbound.conf with new options * Wed Mar 22 2017 Paul Wouters - 1.6.0-6 - Call make unbound-event-install to install unbound-event.h * Sat Feb 11 2017 Fedora Release Engineering - 1.6.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild * Wed Jan 18 2017 Paul Wouters - 1.6.0-4 - Remove obsoleted DLV key * Mon Jan 02 2017 Paul Wouters - 1.6.0-3 - Actually remove dependency because minimum is always satisfied * Mon Jan 02 2017 Paul Wouters - 1.6.0-2 - Depend on openssl-libs, not opensl * Wed Dec 21 2016 Kevin Fenzi - 1.6.0-1 - Update to 1.6.0 * Mon Dec 19 2016 Miro Hrončok - 1.5.10-3 - Rebuild for Python 3.6 * Wed Oct 26 2016 Ilya Evseev - 1.5.10-2 - Bugfix building without python2 and python3 - Fixup streamtcp build (Paul) * Tue Sep 27 2016 Paul Wouters - 1.5.10-1 - Updated to 1.5.10 (better TCP handling, bugfixes) - Install pkgconfig file in -devel package - Updated unbound.conf * Tue Jul 19 2016 Fedora Release Engineering - 1.5.9-4 - https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages * Thu Jul 07 2016 Paul Wouters - 1.5.9-3 - Fix upper port range to 60999 because that's what selinux allows * Thu Jun 16 2016 Paul Wouters - 1.5.9-2 - Patch for allowing more queries before failure (needed for query minimalization) * Mon Jun 13 2016 Paul Wouters - 1.5.9-1 - Updated to 1.5.9 * Thu Apr 21 2016 Toshio Kuratomi - 1.5.8-2 - Fix streamtcp to link against libpython3.x instead of libpython2.x * Wed Mar 02 2016 Paul Wouters - 1.5.8-1 - Update to 1.5.8 (rhbz#1313831) which incorporates rhbz#1294339 patch - Updated unbound.conf with new upstream options - Enabled ip-transparent: yes (see rhbz#1291449) * Fri Feb 05 2016 Fedora Release Engineering - 1.5.7-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild * Thu Jan 21 2016 Tomas Hozza - 1.5.7-2 - Fix escaping of shell chars in unbound-control-setup (#1294339) * Fri Dec 11 2015 Paul Wouters - 1.5.7-1 - Update to 1.5.7 - Enable query minimalization for enhanced DNS query privacy - Enable nxdomain hardening to assist with query minimalization and SBLs - Updated default unbound.conf for new features from upstream. * Fri Nov 13 2015 Tomas Hozza - 1.5.6-1 - Update to 1.5.6 (#1176729) * Wed Nov 04 2015 Robert Kuska - 1.5.5-2 - Rebuilt for Python3.5 rebuild * Wed Oct 07 2015 Tomas Hozza - 1.5.5-1 - New upstream release 1.5.5 (#1269137) - Removed the anchor update from %%post section of -libs subpackage (#1269137#c2) * Tue Sep 15 2015 Tomas Hozza - 1.5.4-5 - Removed dependency and ordering on unbound-anchor.service in unbound.service * Thu Sep 03 2015 Tomas Hozza - 1.5.4-4 - Prefer Python3 build over Python2 build for now (#1254566) * Mon Jul 20 2015 Tomas Hozza - 1.5.4-3 - Added ExecReload section to unbound.service (#1195785) - Removed After syslog.target since it is not needed any more * Thu Jul 16 2015 Tomas Hozza - 1.5.4-2 - Start unbound-anchor.timer only on new installations - Rename root.anchor to root.key in %%post section * Tue Jul 14 2015 Paul Wouters - 1.5.4-1 - Update to 1.5.4 - Removed patches merged into upstream * Tue Jun 16 2015 Tomas Hozza - 1.5.3-8 - Revert: Use low maximum negative cache TTL (5 sec) (#1229596) * Mon Jun 15 2015 Tomas Hozza - 1.5.3-7 - Add option for maximum negative cache TTL (#1229599) - Use low maximum negative cache TTL (5 sec) (#1229596) * Tue May 26 2015 Tomas Hozza - 1.5.3-6 - Removed usage of DLV from the default configuration (#1223363) * Wed May 13 2015 Tomas Hozza - 1.5.3-5 - unbound.service now Wants unbound-anchor.timer - unbound-anchor man page moved to the unbound-libs * Mon May 11 2015 Paul Wouters - 1.5.3-4 - Fixup scriptlets causing systemctl: command not found - Resolves rhbz#1219587 Error in PREIN scriptlet in rpm package unbound-libs * Mon Apr 27 2015 Tomas Hozza - 1.5.3-3 - migrate cronjob to systemd timer unit (#1177285) - change the period for unbound-anchor from monthly to daily (#1180267) - Thanks to Tomasz Torcz for the initial patch * Thu Apr 16 2015 Tomas Hozza - 1.5.3-2 - Fix FTBFS (#1206129) - Build python3-unbound and python-unbound bindings for Python 3 and 2 (#1188080) * Mon Mar 16 2015 Paul Wouters - 1.5.3-1 - Updated to 1.5.3 which is a bugfix on 1.5.2 for sighup handling - Updated to 1.5.2 which fixes DNSSEC validation with different trust anchors upstream, local-zone has a new keyword 'inform' * Mon Feb 02 2015 Paul Wouters - 1.5.1-4 - Build with --enable-ecdsa * Sun Feb 01 2015 Paul Wouters - 1.5.1-3 - Fix post to create root.anchor, not root.key, to match cron job * Tue Dec 09 2014 Paul Wouters - 1.5.1-2 - Change systemd-units to systemd - Use _tmpfilesdir macro, don't mark tmpfiles as config * Tue Dec 09 2014 Paul Wouters - 1.5.1-1 - Update to 1.5.1 for CVE-2014-8602 (rhbz#1172066) - Removed unbound-aarch64.patch which was merged upstream - Don't require autotools for non snapshots or run autoreconf * Fri Nov 28 2014 Tomas Hozza - 1.5.1-0.1.rc1 - update to 1.5.1rc1 * Fri Nov 28 2014 Marcin Juszkiewicz - 1.5.0-3 - fix build on aarch64 * Wed Nov 26 2014 Tomas Hozza - 1.5.0-2 - Fix race condition in arc4random (#1166878) * Wed Nov 19 2014 Tomas Hozza - 1.5.0-1 - update to 1.5.0 * Wed Sep 24 2014 Pavel Šimerda - 1.4.22-6 - Resolves: #1115489 - build with python 3.x for fedora >= 22 * Thu Aug 21 2014 Kevin Fenzi - 1.4.22-5 - Rebuild for rpm bug 1131960 * Mon Aug 18 2014 Fedora Release Engineering - 1.4.22-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild * Sun Jun 08 2014 Fedora Release Engineering - 1.4.22-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild * Thu May 01 2014 Paul Wouters - 1.4.22-2 - Added flushcache patch (SVN commit 3125) * Thu Mar 13 2014 Paul Wouters - 1.4.22-1 - Updated to 1.4.22 - No longer requires the ldns library * Thu Jan 16 2014 Tomas Hozza - 1.4.21-3 - Fix segfault on adding insecure forward zone when using only iterator (#1054192) * Mon Oct 21 2013 Tomas Hozza - 1.4.21-2 - run test suite during the build * Thu Sep 19 2013 Paul Wouters - 1.4.21-1 - Updated to 1.4.21, - Enabled new max-udp-size: 3072 (so ANY isc.org won't fit) - Removed patched merged in by upstream - Enable statistics-cumulative for munin-plugin - Added outgoing-port-avoid: 0-32767 conformant to SElinux restrictions - Updated unbound.conf * Mon Aug 26 2013 Tomas Hozza - 1.4.20-19 - Fix errors found by static analysis of source * Mon Aug 12 2013 Paul Wouters - 1.4.20-18 - Change unbound.conf to only use ephemeral ports (32768-65535) * Sun Aug 04 2013 Fedora Release Engineering - 1.4.20-17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild * Mon Jul 22 2013 Tomas Hozza - 1.4.20-16 - provide man page for unbound-streamtcp * Mon Jul 08 2013 Paul Wouters - 1.4.20-15 - Re-introduce hardening flags for full relro and pie - Fixes compilation failure for python module * Wed Jul 03 2013 Tomas Hozza - 1.4.20-14 - remove missing unbound-rootkey.service from post/preun/postun sections - don't hardcode hardening flags, let hardened build macro handles it * Sat Jun 01 2013 Paul Wouters - 1.4.20-13 - Run unbound-anchor as user unbound in unbound.service * Tue May 28 2013 Paul Wouters - 1.4.20-12 - Enable round-robin (with noths() patch) - Change cron and systemd service to use root.key, not root.anchor * Sat May 25 2013 Paul Wouters - 1.4.20-10 - Use /var/lib/unbound/root.key (more consistent with other distros) - Enable minimal responses * Mon Apr 22 2013 Paul Wouters - 1.4.20-8 - Refix * Fri Apr 19 2013 Paul Wouters - 1.4.20-7 - Fix runuser call in post. * Tue Apr 16 2013 Paul Wouters - 1.4.20-6 - /var/lib/unbound should be owned by unbound. group write is not enough * Fri Apr 12 2013 Paul Wouters - 1.4.20-5 - Fix cron job syntax (rhbz#951725) - Use install -p to prevent .rpmnew files that are identical to originals * Mon Apr 8 2013 Paul Wouters - 1.4.20-4 - Updated to 1.4.20 - Build with full RELRO (not use -z,relro but with -z,relo,-z,now) - Fixup man page for unbound-control-setup - unbound.service should start before nss-lookup.target (rhbz#919955) - Removed patch for rhbz#888759 merged in upstream - Move root.anchor to /var/lib/unbound to make selinux policy easier for updating (rhbz#896599/rhbz#891008) - Move cronjob for root.anchor from unbound to unbound-libs, require crontabs - /etc/unbound (and all) should be owned by unbound-libs (rhbz#909691) - Remove Obsolete/Provides for dnssec-conf which was last seen in f13 - Ensure any unbound-anchor failure in post is ignored * Tue Mar 05 2013 Adam Tkac - 1.4.19-5 - build with full RELRO - symlink unbound-control-setup.8 manpage to unbound-control.8 * Fri Feb 15 2013 Fedora Release Engineering - 1.4.19-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild * Wed Dec 12 2012 Paul Wouters - 1.4.19-3 - Updated to 1.4.19 - this integrates all existing patches - Patch for unbound-anchor (rhbz#888759) * Fri Nov 09 2012 Paul Wouters - 1.4.18-6 - Patch to ensure stube-zone's aren't lost when using dnssec-triggerd - added unbound-munin.README file * Wed Sep 26 2012 Paul Wouters - 1.4.18-5 - Patch to allow wildcards in include: statements - Add directories /etc/unbound/keys.d,conf.d,local.d with example entries - Added /etc/unbound/root.anchor, maintained by unbound-anchor which is installed as monthly cron and PreExec in systemd config (root.key is unused, but left installed in case people depend on it) - Native systemd (simple) and /etc/sysconfig/unbound support - Run unbound-checkconf in PreExec - Moved trust anchor related files to unbound-libs, as they can be used without the daemon. - sub packages now depends on base package of same arch - Build munin package as noarch - unbound-anchor moved to unbound-libs package. It is needed to update the root.anchor key file. * Tue Sep 04 2012 Paul Wouters - 1.4.18-3 - Fix openssl thread locking bug under high query load * Thu Aug 23 2012 Paul Wouters - 1.4.18-2 - Use new systemd-rpm macros (rhbz#850351) - Clean up old obsoleted dnssec-conf from < fedora 15 * Fri Aug 03 2012 Paul Wouters - 1.4.18-1 - Updated to 1.4.18 (FIPS related fixes mostly) - Removed patches that were merged in upstream - Added comment to root.key * Mon Jul 23 2012 Paul Wouters - 1.4.17-5 - Fix for unbound crasher (upstream bug #452) - Support libunbound functions in man pages and place in -devel * Sun Jul 22 2012 Fedora Release Engineering - 1.4.17-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild * Tue Jul 03 2012 Paul Wouters - 1.4.17-3 - unbound FIPS patches for MD5,randomness (rhbz#835106) * Fri Jun 15 2012 Adam Tkac - 1.4.17-2 - don't build unbound-munin on RHEL * Thu May 24 2012 Paul Wouters - 1.4.17-1 - Updated to 1.4.17 (which mostly brings in patches we already applied from svn trunk) * Wed Feb 29 2012 Paul Wouters - 1.4.16-3 - Since the daemon links to the libs staticly, add Requires: (this is rhbz#745288) - Package up streamtcp as unbound-streamtcp (for monitoring) * Mon Feb 27 2012 Paul Wouters - 1.4.16-2 - Don't ghost the directory (rhbz#788805) - Patch for unbound to support unbound-control forward_zone (needed for openswan in XAUTH mode) * Thu Feb 02 2012 Paul Wouters - 1.4.16-1 - Upgraded to 1.4.16, which was relesed due to the soname and some DNSSEC validation failures * Wed Feb 01 2012 Paul Wouters - 1.4.15-2 - Patch for SONAME version (libtool's -version-number vs -version-info) * Fri Jan 27 2012 Paul Wouters - 1.4.15-1 - Upgraded to 1.4.15 - Updated unbound.conf to show how to configure listening on tls443 * Sat Jan 14 2012 Fedora Release Engineering - 1.4.14-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild * Mon Dec 19 2011 Paul Wouters - 1.4.14-1 - Upgraded to 1.4.14 for CVE-2011-4528 / VU#209659 - SSL-wrapped query support for dnssec-trigger - EDNS handling changes - Removed integrated EDNS patches - Disabled use-caps-for-id, GoDaddy domains now break on it - Enabled new harden-below-nxdomain * Thu Sep 15 2011 Paul Wouters - 1.4.13-1 - Upgraded to 1.4.13 - Removed merged in pythonmod patch - Added EDNS1480 patch to fix unbound on broken EDNS/UDP networks - Fix python to go into sitearch instead of sitelib * Wed Sep 14 2011 Tom Callaway - 1.4.12-4 - convert to systemd, tmpfiles.d * Mon Aug 08 2011 Paul Wouters - 1.4.12-3 - Added pythonmod docs and examples * Mon Aug 08 2011 Paul Wouters - 1.4.12-2 - Fix for python module load in the server (Tom Hendrikx) - No longer enable --enable-debug as it causes degraded performance under load. * Mon Jul 18 2011 Paul Wouters - 1.4.12-1 - Updated to 1.4.12 * Sun Jul 03 2011 Paul Wouters - 1.4.11-1 - Updated to 1.4.11 - removed integrated CVE patch - updated stock unbound.conf for new options introduced * Mon Jun 06 2011 Paul Wouters - 1.4.10-1 - Added ghost for /var/run/unbound (bz#656710) * Mon Jun 06 2011 Paul Wouters - 1.4.9-3 - rebuilt * Wed May 25 2011 Paul Wouters - 1.4.9-2 - Applied patch for CVE-2011-1922 DoS vulnerability * Sun Mar 27 2011 Paul Wouters - 1.4.9-1 - Updated to 1.4.9 * Sat Feb 12 2011 Paul Wouters - 1.4.8-2 - rebuilt * Tue Jan 25 2011 Paul Wouters - 1.4.8-1 - Updated to 1.4.8 - Enable root key for DNSSEC - Fix unbound-munin to use proper file (could cause excessive logging) - Build unbound-python per default - Disable gost as Fedora/EPEL does not allow ECC and has mangled openssl * Tue Oct 26 2010 Paul Wouters - 1.4.5-4 - Revert last build - it was on the wrong branch * Tue Oct 26 2010 Paul Wouters - 1.4.5-3 - Disable do-ipv6 per default - causes severe degradation on non-ipv6 machines (see comments in inbound.conf) * Tue Jun 15 2010 Paul Wouters - 1.4.5-2 - Bump release - forgot to upload the new tar ball. * Tue Jun 15 2010 Paul Wouters - 1.4.5-1 - Upgraded to 1.4.5 * Mon May 31 2010 Paul Wouters - 1.4.4-2 - Added accidentally omitted svn patches to cvs * Mon May 31 2010 Paul Wouters - 1.4.4-1 - Upgraded to 1.4.4 with svn patches - Obsolete dnssec-conf to ensure it is de-installed * Thu Mar 11 2010 Paul Wouters - 1.4.3-1 - Update to 1.4.3 that fixes 64bit crasher * Tue Mar 09 2010 Paul Wouters - 1.4.2-1 - Updated to 1.4.2 - Updated unbound.conf with new options - Enabled pre-fetching DNSKEY records (DNSSEC speedup) - Enabled re-fetching popular records before they expire - Enabled logging of DNSSEC validation errors * Mon Mar 01 2010 Paul Wouters - 1.4.1-5 - Overriding -D_GNU_SOURCE is no longer needed. This fixes DSO issues with pthreads * Wed Feb 24 2010 Paul Wouters - 1.4.1-3 - Change make/configure lines to attempt to fix -lphtread linking issue * Thu Feb 18 2010 Paul Wouters - 1.4.1-2 - Removed dependancy for dnssec-conf - Added ISC DLV key (formerly in dnssec-conf) - Fixup old DLV locations in unbound.conf file via %%post - Fix parent child disagreement handling and no-ipv6 present [svn r1953] * Tue Jan 05 2010 Paul Wouters - 1.4.1-1 - Updated to 1.4.1 - Changed %%define to %%global * Thu Oct 08 2009 Paul Wouters - 1.3.4-2 - Bump version * Thu Oct 08 2009 Paul Wouters - 1.3.4-1 - Upgraded to 1.3.4. Security fix with validating NSEC3 records * Fri Aug 21 2009 Tomas Mraz - 1.3.3-2 - rebuilt with new openssl * Mon Aug 17 2009 Paul Wouters - 1.3.3-1 - Updated to 1.3.3 * Sun Jul 26 2009 Fedora Release Engineering - 1.3.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild * Sat Jun 20 2009 Paul Wouters - 1.3.0-2 - Added missing glob patch to cvs - Place python macros within the %%with_python check * Sat Jun 20 2009 Paul Wouters - 1.3.0-1 - Updated to 1.3.0 - Added unbound-python sub package. disabled for now - Patch from svn to fix DLV lookups - Patches from svn to detect wrong truncated response from BIND 9.6.1 with minimal-responses) - Added Default-Start and Default-Stop to unbound.init - Re-enabled --enable-sha2 - Re-enabled glob.patch * Wed May 20 2009 Paul Wouters - 1.2.1-7 - unbound-iterator.patch was not commited * Wed May 20 2009 Paul Wouters - 1.2.1-6 - Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793 * Tue Mar 17 2009 Paul Wouters - 1.2.1-5 - Use --nocheck to avoid giving an error on missing unbound-remote certs/keys * Tue Mar 10 2009 Adam Tkac - 1.2.1-4 - enable DNSSEC only if it is enabled in sysconfig/dnssec * Mon Mar 09 2009 Adam Tkac - 1.2.1-3 - add DNSSEC support to initscript and enabled it per default - add requires dnssec-conf * Wed Feb 25 2009 Fedora Release Engineering - 1.2.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild * Tue Feb 10 2009 Paul Wouters - 1.2.0-2 - rebuild with new openssl * Wed Jan 14 2009 Paul Wouters - 1.1.1-7 - Modified scandir patch to silently fail when wildcard matches nothing - Patch to allow unbound-checkconf to find empty wildcard matches * Mon Jan 5 2009 Paul Wouters - 1.1.1-6 - Added scandir patch for trusted-keys-file: option, which is used to load multiple dnssec keys in bind file format * Mon Dec 8 2008 Paul Wouters - 1.1.1-4 - Added Requires: for selinux-policy >= 3.5.13-33 for proper SElinux rules. * Mon Dec 1 2008 Paul Wouters - 1.1.1-3 - We did not own the /etc/unbound directory (#474020) - Fixed cvs anomalies * Fri Nov 28 2008 Adam Tkac - 1.1.1-2 - removed all obsolete chroot related stuff - label control certs after generation correctly * Thu Nov 20 2008 Paul Wouters - 1.1.1-1 - Updated to unbound 1.1.1 which fixes a crasher and addresses nlnetlabs bug #219 * Wed Nov 19 2008 Paul Wouters - 1.1.0-3 - Remove the chroot, obsoleted by SElinux - Add additional munin plugin links supported by unbound plugin - Move configuration directory from /var/lib/unbound to /etc/unbound - Modified unbound.init and unbound.conf to account for chroot changes - Updated unbound.conf with new available options - Enabled dns-0x20 protection per default * Wed Nov 19 2008 Adam Tkac - 1.1.0-2 - unbound-1.1.0-log_open.patch - make sure log is opened before chroot call - tracked as http://www.nlnetlabs.nl/bugs/show_bug.cgi?id=219 - removed /dev/log and /var/run/unbound and /etc/resolv.conf from chroot, not needed - don't mount files in chroot, it causes problems during updates - fixed typo in default config file * Fri Nov 14 2008 Paul Wouters - 1.1.0-1 - Updated to version 1.1.0 - Updated unbound.conf's statistics options and remote-control to work properly for munin - Added unbound-munin package - Generate unbound remote-control key/certs on first startup - Required ldns is now 1.4.0 * Wed Oct 22 2008 Paul Wouters - 1.0.2-5 - Only call ldconfig in -libs package - Move configure into build section - devel subpackage should only depend on libs subpackage * Tue Oct 21 2008 Paul Wouters - 1.0.2-4 - Fix CFLAGS getting lost in build - Don't enable interface-automatic:yes because that causes unbound to listen on 0.0.0.0 instead of 127.0.0.1 * Sun Oct 19 2008 Paul Wouters - 1.0.2-3 - Split off unbound-libs, make build verbose * Thu Oct 9 2008 Paul Wouters - 1.0.2-2 - FSB compliance, chroot fixes, initscript fixes * Thu Sep 11 2008 Paul Wouters - 1.0.2-1 - Upgraded to 1.0.2 * Wed Jul 16 2008 Paul Wouters - 1.0.1-1 - upgraded to new release * Wed May 21 2008 Paul Wouters - 1.0.0-2 - Build against ldns-1.3.0 * Wed May 21 2008 Paul Wouters - 1.0.0-1 - Split of -devel package, fixed dependancies, make rpmlint happy * Fri Apr 25 2008 Wouter Wijngaards - 0.12 - Using parts from ports collection entry by Jaap Akkerhuis. - Using Fedoraproject wiki guidelines. * Wed Apr 23 2008 Wouter Wijngaards - 0.11 - Initial version.