Created attachment 252809 [details] Patch to upgrade This release has a fix for the CAMP and CacheFlush issues. They have a low severity for Unbound, since it does not affect Unbound so much. The Compositional Amplification (CAMP) type of attacks can lead to DoS attacks against DNS servers. In Unbound legitimate client requests to the resolvers under typical workload are not directly affected by CAMP attacks. However we introduce a global quota for 128 outgoing packets per query (and it's subqueries) that is never reset to prevent the combination of CAMP with other amplification attacks in the future. We would like to thank Huayi Duan, Marco Bearzi, Jodok Vieli, and Cagin Tanir from NetSec group, ETH Zurich for discovering and notifying us about the issue. The CacheFlush type of attacks (NSCacheFlush, CNAMECacheFlush) try to evict cached data by utilizing rogue zones and a steady rogue stream to a resolver. Based on the zone, the stream, the configured cache size and the legitimate traffic, Unbound could experience a degradation of service if a useful entry is evicted and Unbound needs to resolve again. As a mitigation to the NSCacheFlush attack Unbound is setting a limit of 20 RRs in an NS RRset. We would like to thank Yehuda Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt (Tel-Aviv University and Reichman University) for discovering and notifying us about the issue. Other fixes in this release are bug fixes. Also the unbound control commands that flush the cache can clear both the memory and cachedb module cache. The ipset module can use BSD pf tables. The new option dnstap-sample-rate: 100 can be used to log 1/N messages, for use in high volume server environments where the log server does not keep up. The new DNSSEC key for the root, 38696 from 2024 has been added. It is added to the default root keys in unbound-anchor. The content can be inspected with unbound-anchor -l. Older versions of Unbound can keep up with the root key with auto-trust-anchor-file that has RFC5011 key rollover. Also unbound-anchor can fetch the keys from the website with a certificate if needed. For cookie secrets, it is possible to perform rollover. The file with cookie secret in use and the staging secret is configured with cookie-secret-file. With the remote control the rollover can be performed, add_cookie_secret, activate_cookie_secret, drop_cookie_secret and print_cookie_secrets can be used for that. This release has also a fix for module loading on Windows. For a full list of changes, binary and source packages, see the download page.
Do you want merge-quarterly?
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=3fd26c319ff1625e8069b4479ff7bfb058cde949 commit 3fd26c319ff1625e8069b4479ff7bfb058cde949 Author: Jaap Akkerhuis <jaap@NLnetLabs.nl> AuthorDate: 2024-08-16 16:12:38 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2024-08-16 16:12:38 +0000 dns/unbound: Update 1.20.0 → 1.21.0 Release announcement: https://nlnetlabs.nl/news/2024/Aug/15/unbound-1.21.0-released/ PR: 280853 MFH: 2024Q3 dns/unbound/Makefile | 4 +--- dns/unbound/distinfo | 6 +++--- dns/unbound/pkg-plist | 2 +- 3 files changed, 5 insertions(+), 7 deletions(-)
A commit in branch 2024Q3 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=be3a49808366f39d150281134aa0a5e5e1fb7e06 commit be3a49808366f39d150281134aa0a5e5e1fb7e06 Author: Jaap Akkerhuis <jaap@NLnetLabs.nl> AuthorDate: 2024-08-16 16:12:38 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2024-08-16 16:16:31 +0000 dns/unbound: Update 1.20.0 → 1.21.0 Release announcement: https://nlnetlabs.nl/news/2024/Aug/15/unbound-1.21.0-released/ PR: 280853 MFH: 2024Q3 (cherry picked from commit 3fd26c319ff1625e8069b4479ff7bfb058cde949) dns/unbound/Makefile | 4 +--- dns/unbound/distinfo | 6 +++--- dns/unbound/pkg-plist | 2 +- 3 files changed, 5 insertions(+), 7 deletions(-)
Thanks.
Also remove GNU_CONFIGURE_MANPREFIX.