   Changelog for the c-ares project. Generated with git2changes.pl

Version 1.21.0 (26 Oct 2023)

Brad House (26 Oct 2023)
- SonarCloud: reduce reported complexity that exists for no reason.

- SonarCloud: fix some #undef codesmells

- formatting

- document ARES_RR_* records

- no reason to limit on truncation

- linguist fixes

- don't use test cases to determine language of c-ares

- fix grammar

- fix count

GitHub (25 Oct 2023)
- [Brad House brought this change]

  1.21.0 release prep (#585)

Brad House (25 Oct 2023)
- fix build warning

GitHub (25 Oct 2023)
- [Brad House brought this change]

  SonarCloud: clean up more codesmells (#584)

Brad House (25 Oct 2023)
- resolve reported memory leaks

- add test vector said to cause a memory leak

GitHub (25 Oct 2023)
- [Brad House brought this change]

  sonarcloud: fix more codesmells (#583)

- [Brad House brought this change]

  sonarcloud easy codesmells (#582)
  
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  Modernization: replace multiple hand-parsers with new memory-safe parser (#581)
  
  New DNS record parsing code. The old code was basically just some helper macros and functions for parsing an entire DNS message. The caller had to know the RFCs to use the parsers, except for some pre-made exceptions. The new parsing code parses the entire DNS message into an opaque data structure in a memory safe manner with various accessors for reading and manipulating the data.
  
  The existing parser helpers for the various record types were reimplemented as wrappers around the new parser.
  
  The accessors allow easy iteration across the DNS record datastructure, and can be used to easily create dig-like output without needing to know anything about the various record types and formats as dynamic helpers are provided for enumeration of values and data types of those values.
  
  At some point in the future, this new DNS record structure, accessors, and parser will be exposed publicly. This is not done at this point as we don't want to do that until the API is completely stable. Likely a write() function to output the DNS record back into an actual message buffer will be introduced with the stable API as well.
  
  Some subtle bugs in the existing code were uncovered, some which had test cases which turned out to be bogus. Validation with third-party implementations (e.g. BIND9) were performed to validate such cases were indeed bugs.
  
  Adding additional RR parsers such as for TLSA (#470) or SVCB/HTTPS (#566) are trivial now since focus can be put on only parsing the data within the RR, not the entire message. That said, as the new parser is not yet public, it isn't clear the best way to expose any new RRs (probably best to wait for the new parser to be public rather than hacking in another legacy function).
  
  Some additional RRs that are part of DNS RFC1035 or EDNS RFC6891 that didn't have previously implemented parsers are now also implemented (e.g. HINFO, OPT). Any unrecognized RRs are encapsulated into a "RAW_RR" as binary data which can be inserted or extracted, but are otherwise not interpreted in any way.
  
  Fix By: Brad House (@bradh352)

- [Gregor Jasny brought this change]

  feat: use CMake to control symbol visibility (#574)
  
  In contrast to #572 this solution does not need any extra headers. But it is also limited to GCC-like compilers.
  
  Fix By: Gregor Jasny (@gjasny)

- [Brad House brought this change]

  remove ares_nowarn helpers #580
  
  Now that the code internally is using proper datatypes, there is no longer a need for ares_nowarn helpers. Remove them.
  
  Fix By: Brad House (@bradh352)

Brad House (16 Oct 2023)
- clang-format: fix structure alignment
  
  It appears the structure alignment chosen just doesn't work right.
  Switch to 'left', it appears to be mostly correct.
  
  Fix By: Brad House (@bradh352)

GitHub (15 Oct 2023)
- [Brad House brought this change]

  Reformat code using clang-format (#579)
  
  c-ares uses multiple code styles, standardize on one. Talking with @bagder he feels strongly about maintaining an 80 column limit, but feels less strongly about things I feel strongly about (like alignment).
  
  Can re-run the formatter on the codebase via:
  ```
  clang-format -i */*.c */*.h */*/*.c */*/*.h
  ```
  
  Fix By: Brad House (@bradh352)

Brad House (15 Oct 2023)
- inet_ntop requires ares_private.h

- SonarCloud: Fix additional code smells
  
  Fix By: Brad House (@bradh352)

- SonarCloud: Ignore codesmells c89 doesn't support
  
  C89 doesn't support iterator declaration in for loop, kill warning.
  
  Fix By: Brad House (@bradh352)

GitHub (15 Oct 2023)
- [Brad House brought this change]

  set compiler standard to ISO C90/ANSI C89 (#577)
  
  SonarCloud is outputting some code smells for things that aren't possible for C89. Hopefully setting the code standard to C89/C90 properly will fix those bogus warnings.
  
  Fix By: Brad House (@bradh352)

Brad House (15 Oct 2023)
- fix new ares_strcpy to ensure null termination

- build fix

GitHub (15 Oct 2023)
- [Brad House brought this change]

  SonarCloud: Fix up codesmells due to strlen(), strcpy(), and strncpy() (#576)
  
  Create ares_strlen() and ares_strcpy() in order to resolve SonarCloud codesmells related to their use.
  
  ares_strlen() just becomes null-safe.
  
  ares_strcpy() is equivalent to strlcpy(), so unlike strncpy() it guarantees NULL termination.
  
  Fix By: Brad House (@bradh352)

Brad House (15 Oct 2023)
- SonarCloud: try to appease it better

- SonarCloud: Fix reported bugs
  
  SonarCloud reported a few bugs, this commit should fix those reports.
  
  Fix By: Brad House (@bradh352)

GitHub (15 Oct 2023)
- [Brad House brought this change]

  Fix internal datatype usage and warnings (#573)
  
  PR #568 increased the warning levels and c-ares code emitted a bunch of warnings. This PR fixes those warnings and starts transitioning internal data types into more proper forms (e.g. data lengths should be size_t not int). It does, however, have to manually cast back to what the public API needs due to API and ABI compliance (we aren't looking to break integrations, just clean up internals).
  
  Fix By: Brad House (@bradh352)

Brad House (15 Oct 2023)
- SonarCloud: exclude tests

- fix source directories

GitHub (15 Oct 2023)
- [Brad House brought this change]

  Sonarcloud (#575)

- [Brad House brought this change]

  Increase compiler warnings by default (#568)
  
  c-ares was missing a couple of common compiler warnings during building that are widely recognized as a best practice. This PR makes no code changes, only build system changes to increase warning levels.
  
  This PR does cause some new warnings to be emitted, a follow-up PR will address those.
  
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  introduce ares_bool_t datatype (#570)
  
  c-ares currently uses int for boolean, which can be confusing as there are some functions which return int but use '0' as the success condition. Some internal variable usage is similar. Lets try to identify the boolean use cases and split them out into their own data type of ares_bool_t. Since we're trying to keep C89 compatibility, we can't rely on stdbool.h or the _Bool C99 data type, so we'll define our own.
  
  Also, chose using an enum rather than say unsigned char or int because of the type safety benefits it provides. Compilers should warn if you try to pass, ARES_TRUE on to a ares_status_t enum (or similar) since they are different enums.
  
  Fix By: Brad House (@bradh352)

Brad House (12 Oct 2023)
- Socket callbacks were passed SOCK_STREAM instead of SOCK_DGRAM on udp
  
  A regression was introduced in 1.20.0 that would pass SOCK_STREAM on udp
  connections due to code refactoring.  If a client application validated this
  data, it could cause issues as seen in gRPC.
  
  Fixes Issue: #571
  Fix By: Brad House (@bradh352)

- Enhance test of ares_getsock()
  
  In an attempt to see if ares_getsock() was broken as per #571, do
  further sanity checks of the results of ares_getsock().  It seems
  as though ares_getsock() is fine.
  
  Fix By: Brad House (@bradh352)

GitHub (10 Oct 2023)
- [Brad House brought this change]

  Tool: STAYOPEN flag could make tools not terminate (#569)
  
  If a flag is set to keep the connections to the DNS servers open even if there are no queries, the tools would not exit until the remote server closed the connection due to the user of ares_fds() to determine if there are any active queries. Instead, rely on ares_timeout() returning NULL if there are no active queries (technically this returns the value passed to max_tv in ares_timeout(), but in our use case, that is always NULL).
  
  Fixes Issue: #452
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  ares_status_t enum for status codes (#567)
  
  The list of possible error codes in c-ares was a #define list. This not only doesn't provide for any sort of type safety but it also lacks clarification on what a function may return or what it takes, as an int could be an ares status, a boolean, or possibly even a length in the current code.
  
  We are not changing any public APIs as though the C standard states the underlying size and type of an enum is int, there are compiler attributes to override this as well as compiler flags like -fshort-enums. GCC in particular is known to expand an enum's width based on the data values (e.g., it can emit a 64bit integer enum).
  
  All internal usages should be changed by this PR, but of course, there may be some I missed.
  
  Fix By: Brad House (@bradh352)

Daniel Stenberg (9 Oct 2023)
- docs: provide better man page references
  
  When referring to another c-ares function use \fI function(3) \fP to let
  the webpage rendering find and cross-link them appropriately.
  
  SEE ALSO references should be ".BR name (3),", with a space before the
  open parenthesis. This helps the manpage to HTML renderer.
  
  Closes #565

Version 1.20.1 (8 Oct 2023)

GitHub (8 Oct 2023)
- [Daniel Stenberg brought this change]

  ares-test:  silence warning (#564)
  
  warning: comparison of integer expressions of different signedness
  
  Fix By: Daniel Stenberg (@bagder)

Brad House (8 Oct 2023)
- fix README.md

GitHub (8 Oct 2023)
- [Brad House brought this change]

  1.20.1 release (#563)

- [Brad House brought this change]

  fix reference to freed memory (#562)
  
  Issue #561 shows free'd memory could be accessed in some error conditions.
  
  Fixes Issue #561
  Fix By: Brad House (@bradh352)

Brad House (8 Oct 2023)
- reported build/test systems may timeout on intensive tests. reduce test case to still be relevant but to reduce false positive errors

GitHub (8 Oct 2023)
- [Gregor Jasny brought this change]

  Regression: Fix typo in fuzzcheck target name (#559)
  
  This seems to be a vim'esque typo introduced with c1b00c41.
  
  Fix By: Gregor Jasny (@gjasny)

Version 1.20.0 (6 Oct 2023)

Brad House (6 Oct 2023)
- fix slist search off by 1

GitHub (6 Oct 2023)
- [Brad House brought this change]

  1.20.0 release prep (#557)

- [Brad House brought this change]

  ares__buf should return standard error codes.  more helpers implemented. (#558)
  
  The purpose of this PR is to hopefully make the private API of this set of routines less likely to need to be changed in a future release.  While this is not a public API, it could become harder in the future to change usage as it becomes more widely used within c-ares.
  
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  Update from 1989 MIT license text to modern MIT license text (#556)
  
  ares (and thus c-ares) was originally licensed under the 1989 MIT license text:
  https://fedoraproject.org/wiki/Licensing:MIT#Old_Style_(no_advertising_without_permission)
  
  This change updates the license to the modern MIT license as recognized here:
  https://opensource.org/license/mit/
  
  care has been taken to ensure correct attributions remain for the authors contained within the copyright headers, and all authors with attributions in the headers have been contacted for approval regarding the change.  Any authors which were not able to be contacted, the original copyright maintains, luckily that exists in only a single file `ares_parse_caa_reply.c` at this time.
  
  Please see PR #556 for the documented approvals by each contributor.
  
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  Test Harness: use ares_timeout() to calculate the value to pass to select() these days. (#555)
  
  The test framework was using 100ms timeout passed to select(), and not using ares_timeout() to calculate the actual recommended value based on the queries in queue. Using ares_timeout() tests the functionality of ares_timeout() itself and will provide more responsive results.
  
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  Fix for TCP back to back queries (#552)
  
  As per #266, TCP queries are basically broken. If we get a partial reply, things just don't work, but unlike UDP, TCP may get fragmented and we need to properly handle that.
  
  I've started creating a basic parser/buffer framework for c-ares for memory safety reasons, but it also helps for things like this where we shouldn't be manually tracking positions and fetching only a couple of bytes at a time from a socket. This parser/buffer will be expanded and used more in the future.
  
  This also resolves #206 by allowing NULL to be specified for some socket callbacks so they will auto-route to the built-in c-ares functions.
  
  Fixes: #206, #266
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  remove acountry from built tools as nerd.dk is gone (#554)
  
  The acountry utility required a third party DNSBL service from nerd.dk in order to operate. That service has been offline for about a year and there is no other comparable service offering. We are keeping the code in the repository as an example, but no longer building it.
  
  Fixes: #537
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  Don't requeue any queries for getaddrinfo() during destruction. (#553)
  
  During ares_destroy(), any outstanding queries are terminated, however ares_getaddrinfo() had an ordering issue with status codes which in some circumstances could lead to a new query being enqueued rather than honoring the termination.
  
  Fixes #532
  Fix By: @Chilledheart and Brad House (@bradh352)

- [Brad House brought this change]

  ares_getaddrinfo(): Fail faster on AF_UNSPEC if we've already received one address class  (#551)
  
  As per #541, when using AF_UNSPEC with ares_getaddrinfo() (and in turn with ares_gethostbynam()) if we receive a successful response for one address class, we should not allow the other address class to continue on with retries, just return the address class we have.
  
  This will limit the overall query time to whatever timeout remains for the pending query for the other address class, it will not, however, terminate the other query as it may still prove to be successful (possibly coming in less than a millisecond later) and we'd want that result still. It just turns off additional error processing to get the result back quicker.
  
  Fixes Bug: #541
  Fix By: Brad House (@bradh352)

- [Sam Morris brought this change]

  Avoid producing an ill-formed result when qualifying a name with the root domain (#546)
  
  This prevents the result of qualifying "name" with "." being "name.." which is ill-formed.
  
  Fixes Bug: #545
  Fix By: Sam Morris (@yrro)

- [Brad House brought this change]

  Configuration option to limit number of UDP queries per ephemeral port (#549)
  
  Add a new ARES_OPT_UDP_MAX_QUERIES option with udp_max_queries parameter that can be passed to ares_init_options(). This value defaults to 0 (unlimited) to maintain existing compatibility, any positive number will cause new UDP ephemeral ports to be created once the threshold is reached, we'll call these 'connections' even though its technically wrong for UDP.
  
  Implementation Details:
  * Each server entry in a channel now has a linked-list of connections/ports for udp and tcp. The first connection in the list is the one most likely to be eligible to accept new queries.
  * Queries are now tracked by connection rather than by server.
  * Every time a query is detached from a connection, the connection that it was attached to will be checked to see if it needs to be cleaned up.
  * Insertion, lookup, and searching for connections has been implemented as O(1) complexity so the number of connections will not impact performance.
  * Remove is_broken from the server, it appears it would be set and immediately unset, so must have been invalidated via a prior patch. A future patch should probably track consecutive server errors and de-prioritize such servers. The code right now will always try servers in the order of configuration, so a bad server in the list will always be tried and may rely on timeout logic to try the next.
  * Various other cleanups to remove code duplication and for clarification.
  
  Fixes Bug: #444
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  its not 1991 anymore, lower default timeout and retry count (#542)
  
  A lot of time has passed since the original timeouts and retry counts were chosen. We have on and off issues reported due to this. Even on geostationary satellite links, latency is worst case around 1.5s. This PR changes the per-server timeout to 2s and the retry count lowered from 4 to 3.
  
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  Modernization: Implement base data-structures and replace usage (#540)
  
  c-ares currently lacks modern data structures that can make coding easier and more efficient. This PR implements a new linked list, skip list (sorted linked list), and hashtable implementation that are easy to use and hard to misuse. Though these implementations use more memory allocations than the prior implementation, the ability to more rapidly iterate on the codebase is a bigger win than any marginal performance difference (which is unlikely to be visible, modern systems are much more powerful than when c-ares was initially created).
  
  The data structure implementation favors readability and audit-ability over performance, however using the algorithmically correct data type for the purpose should offset any perceived losses.
  
  The primary motivation for this PR is to facilitate future implementation for Issues #444, #135, #458, and possibly #301
  
  A couple additional notes:
  
  The ares_timeout() function is now O(1) complexity instead of O(n) due to the use of a skiplist.
  Some obscure bugs were uncovered which were actually being incorrectly validated in the test cases. These have been addressed in this PR but are not explicitly discussed.
  Fixed some dead code warnings in ares_rand for systems that don't need rc4
  
  Fix By: Brad House (@bradh352)

- [Jérôme Duval brought this change]

  fix missing prefix for CMake generated libcares.pc (#530)
  
  'pkg-config grpc --cflags' complains with:
  Variable 'prefix' not defined in libcares.pc
  
  Fix By: Jérôme Duval (@korli)

bradh352 (11 Jul 2023)
- windows get_DNS_Windows port fix for ipv6

- windows get_DNS_Windows port is in network byte order

- backoff to debian 11 due to coverage check failure

- extend on PR #534, windows should also honor a port

GitHub (11 Jul 2023)
- [Brad House brought this change]

  Support configuration of DNS server ports (#534)
  
  As per https://man.openbsd.org/OpenBSD-5.1/resolv.conf.5 we should
  support bracketed syntax for resolv.conf entries to contain an optional
  port number.
  
  We also need to utilize this format for configuration of MacOS
  DNS servers as seen when using the Viscosity OpenVPN client, where
  it starts a private DNS server listening on localhost on a non-standard
  port.
  
  Fix By: Brad House (@bradh352)

Daniel Stenberg (9 Jun 2023)
- provide SPDX identifiers and a REUSE CI job to verify
  
  All files have their licence and copyright information clearly
  identifiable. If not in the file header, they are set separately in
  .reuse/dep5.
  
  All used license texts are provided in LICENSES/

GitHub (30 May 2023)
- [Alexey A Tikhonov brought this change]

  Remove unreachable code as reported by Coverity (#527)
  
  Coverity reported some code as unreachable.  A manual inspection confirmed the reports.
  
  Fix By: Alexey A Tikhonov (@alexey-tikhonov)

- [Ben Noordhuis brought this change]

  rand: add support for getrandom() (#526)
  
  glibc provides arc4random_buf() but musl does not and /dev/urandom is
  not always available.

- [Tim Wojtulewicz brought this change]

  Replace uses of sprintf with snprintf (#525)
  
  sprintf isn't safe even if you think you are using it right.  Switch to snprintf().
  
  Fix By: Tim Wojtulewicz (@timwoj)

bradh352 (23 May 2023)
- update version and release procedure

GitHub (22 May 2023)
- [Douglas R. Reno brought this change]

  INSTALL.md: Add Watcom instructions and update Windows documentation URLs (#524)
  
  This commit adds instructions on how to use the WATCOM compiler to build c-ares. This was just tested on c-ares-1.19.1 and works well.
  
  While going through the links for the C Runtime documentation for Windows systems, I discovered that all three of the KB articles that were linked are now nonexistent. This commit replaces KB94248 with the current replacement available on Microsoft's website, which also makes the other two KB articles obsolete.
  
  Fix By: Douglas R. Reno (@renodr)

Version 1.19.1 (22 May 2023)

bradh352 (22 May 2023)
- Makefile.inc Windows requires tabs not spaces for nmake

GitHub (22 May 2023)
- [Daniel Stenberg brought this change]

  ares_expand_name: fix compiler warnings (#522)
  
  Fix some compiler warnings (not introduced in this release)
  
  Fix By: Daniel Stenberg (@bagder)

bradh352 (22 May 2023)
- windows MSVC compiler fix on 32bit

- update security advisory links

- minor CI issues fixes for imported inet_net_pton

- ares_rand static analysis fixes from CI

- windows build fix

- security release notes

GitHub (22 May 2023)
- [Brad House brought this change]

  Merge pull request from GHSA-9g78-jv2r-p7vc

- [Brad House brought this change]

  Merge pull request from GHSA-x6mf-cxr9-8q6v
  
  * Merged latest OpenBSD changes for inet_net_pton_ipv6() into c-ares.
  * Always use our own IP conversion functions now, do not delegate to OS
    so we can have consistency in testing and fuzzing.
  * Removed bogus test cases that never should have passed.
  * Add new test case for crash bug found.
  
  Fix By: Brad House (@bradh352)

- [Brad House brought this change]

  Merge pull request from GHSA-8r8p-23f3-64c2
  
  * segment random number generation into own file
  
  * abstract random code to make it more modular so we can have multiple backends
  
  * rand: add support for arc4random_buf() and also direct CARES_RANDOM_FILE reading
  
  * autotools: fix detection of arc4random_buf
  
  * rework initial rc4 seed for PRNG as last fallback
  
  * rc4: more proper implementation, simplified for clarity
  
  * clarifications

bradh352 (20 May 2023)
- add public release note information

- bump version to 1.19.1

GitHub (6 May 2023)
- [Gregor Jasny brought this change]

  test: fix warning about uninitialized memory (#515)
  
  fix warning in tests
  
  Fix By: Gregor Jasny (@gjasny)

- [lifenjoiner brought this change]

  Turn off IPV6_V6ONLY on Windows if it is supported (#520)
  
  Turn off IPV6_V6ONLY on Windows if it is supported, support for IPv4-mapped IPv6 addresses.
  
  IPV6_V6ONLY refs:
  https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresses
  https://github.com/golang/go/blob/master/src/net/ipsock_posix.go
  https://en.wikipedia.org/wiki/Unix-like
  off:
  https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html#proc-sys-net-ipv6-variables
  https://man.netbsd.org/inet6.4
  https://man.freebsd.org/cgi/man.cgi?query=inet6
  https://github.com/apple-oss-distributions/xnu/blob/main/bsd/man/man4/inet6.4
  on:
  https://learn.microsoft.com/en-us/windows/win32/winsock/ipproto-ipv6-socket-options
  acts like off, but returns 1 and dummy setting:
  https://man.dragonflybsd.org/?command=inet6
  https://man.dragonflybsd.org/?command=ip6
  unsupported and read-only returns 1:
  https://man.openbsd.org/inet6.4
  
  default value refs:
  https://datatracker.ietf.org/doc/html/rfc3493#section-5.3
  https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html#proc-sys-net-ipv6-variables

- [Brad House brought this change]

  Merge pull request from GHSA-54xr-f67r-4pc4
  
  * CARES_RANDOM_FILE should always default to /dev/urandom
  
  During cross-compilation, CARES_RANDOM_FILE may not be able to be appropriately
  detected, therefore we should always set it to /dev/urandom and allow the
  entity requesting compilation override the value.  The code does appropriately
  fall back if CARES_RANDOM_FILE cannot be opened.
  
  * use set not option

bradh352 (18 Mar 2023)
- ares_getaddrinfo using service of "0" should be allowed
  
  As per #517 glibc allows a service/servname of "0" to be treated the
  same as if NULL was provided.  Also, add a sanity check to ensure
  the port number is in range instead of a blind cast.
  
  Fixes: #517
  Fix By: Brad House (@bradh352)

GitHub (10 Feb 2023)
- [Nikolaos Chatzikonstantinou brought this change]

  fix memory leak in ares_send (#511)
  
  When the condition channel->nservers < 1 holds, the function returns
  prematurely, without deallocating query->tcpbuf. We rearrange the
  check to be done prior to the allocations, avoiding the memory
  leak. In this way, we also avoid unnecessary allocations if
  channel->nservers < 1 holds.
  
  Fix By: Nikolaos Chatzikonstantinou (@createyourpersonalaccount)

- [Nikolaos Chatzikonstantinou brought this change]

  change comment style to old-style (#513)
  
  Following the README.md guidelines,
  
      "Comments must be written in the old-style"
  
  the comment is changed to the old style.
  
  Fix By: Nikolaos Chatzikonstantinou (@createyourpersonalaccount)

- [Nikolaos Chatzikonstantinou brought this change]

  use strncasecmp in ares__strsplit (#512)
  
  strncasecmp on platforms that don't already have it is already #define'd to a private implementation.  There is no need to have OS-specific logic.  Also removes ares__strsplit.h as a header as ares_private.h already includes it.
  
  Fix By: Nikolaos Chatzikonstantinou (@createyourpersonalaccount)

- [Yijie Ma brought this change]

  Fix a typo in ares_init_options.3 (#510)
  
  that -> than
  
  Fix By: Yijie Ma (@yijiem)

- [Douglas R. Reno brought this change]

  Watcom Portability Improvements (#509)
  
  - Modify the Watcom Makefile for the source code reorganization (#352)
  - Add *.map files into .gitignore
  - Fix build errors with Watcom's builtin Windows SDK (which is rather
    outdated). It's smart enough to understand Windows Vista, but doesn't
    have PMIB_UNICASTIPADDRESS_TABLE or MIB_IPFORWARD_ROW2.
  
  It may be possible to use a different Windows SDK with the Watcom
  compiler, such as the most recent Windows 10 SDK. Alternatively the SDK
  in OpenWatcom 2.0 (which is in development) should fix this.
  
  I have no problems testing this Makefile prior to releases, just give me
  a ping.
  
  Tested with Windows Vista, Windows 7, and Windows 10 using 'adig',
  'acountry', and 'ahost'. This also seems to work on Windows XP, though
  this is likely due to the compiler in use.
  
  Fix By: Douglas R. Reno (@renodr)
  Fixes Bug: #352

- [Jay Freeman (saurik) brought this change]

  ignore aminclude_static.am, as generated by AX_AM_MACROS_STATIC (#508)
  
  Fix By: Jay Freeman (@saurik)

- [Jay Freeman (saurik) brought this change]

  sync ax_pthread.m4 with upstream (#507)
  
  The version in the repository is many years old so this PR simply pulls in the latest
  available revision from:
  http://git.savannah.gnu.org/gitweb/?p=autoconf-archive.git;a=tree;f=m4
  
  Fix By: Jay Freeman (@saurik)

- [Chilledheart brought this change]

  Windows: Invalid stack variable out of scope for HOSTS file path  (#502)
  
  In some conditions Windows might try to use a stack address that has gone out of scope when determining where to read the hosts data from for file lookups.
  
  Fix By: @Chilledheart

- [Brad House brought this change]

  sync ax_cxx_compile_stdcxx_11.m4 with upstream (#505)
  
  It was reported that ax_cxx_compile_stdcxx_11.m4 was not compatible with uclibc.
  The version in the repository is many years old so this PR simply pulls in the latest
  available revision from:
  http://git.savannah.gnu.org/gitweb/?p=autoconf-archive.git;a=tree;f=m4
  
  Fixes Bug: #504
  Fix By: Brad House (@bradh352)

Version 1.19.0 (18 Jan 2023)

bradh352 (18 Jan 2023)
- Prep for 1.19.0 release

- Fix inverted logic in 25523e2
  
  Fix .localhost. handling in prior commit
  
  Fix By: Brad House (@bradh352)

- RFC6761 localhost definition includes subdomains
  
  RFC6761 6.3 states:
    The domain "localhost." and any names falling within ".localhost."
  
  We were only honoring "localhost".
  
  Fixes: #477
  Fix By: Brad House (@bradh352)

- docs: ARES_OPT_UDP_PORT and ARES_OPT_TCP_PORT docs wrong byte order
  
  As per #487, documentation states the port should be in network byte
  order, but we can see from the test cases using MockServers on
  different ports that this is not the case, it is definitely in host
  byte order.
  
  Fix By: Brad House (@bradh352)

GitHub (18 Jan 2023)
- [hopper-vul brought this change]

  Add str len check in config_sortlist to avoid stack overflow (#497)
  
  In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse
  the input str and initialize a sortlist configuration.
  
  However, ares_set_sortlist has not any checks about the validity of the input str.
  It is very easy to create an arbitrary length stack overflow with the unchecked
  `memcpy(ipbuf, str, q-str);` and `memcpy(ipbufpfx, str, q-str);`
  statements in the config_sortlist call, which could potentially cause severe
  security impact in practical programs.
  
  This commit add necessary check for `ipbuf` and `ipbufpfx` which avoid the
  potential stack overflows.
  
  fixes #496
  
  Fix By: @hopper-vul

bradh352 (18 Jan 2023)
- Fix build due to str-split sed gone wrong
  
  Fix By: Brad House (@bradh352)

- cirrus-ci: switch to scan-build-py for MacOS
  
  MacOS seems to work better with scan-build-py
  
  Fix By: Brad House (@bradh352)

- ares_strsplit* -> ares__strsplit* to comply with internal function naming
  
  Inspired by #495, but was missing test cases and would failed to build.
  
  Fix By: Brad House (@bradh352), Daniel Stenberg (@bagder)

- Cirrus-CI: MacOS Homebrew has changed from /usr/local/opt to /opt/homebrew
  
  Fix paths for homebrew.
  
  Fix By: Brad House (@bradh352)

- cirrus-ci: iOS build needs to use ARM MacOS image
  
  CirrusCI removed Intel-based MacOS images.  Need to switch
  iOS builds to use new ARM images as well.
  
  Fix By: Brad House (@bradh352)

- cirrus-ci: new MacOS image
  
  Cirrus-CI has recently EOL'd Intel MacOS VMs, switch to the latest
  ARM-based image.
  
  Fix By: Brad House (@bradh352)

- acountry was passing stack variable to callback
  
  Recent ASAN versions picked up that acountry was passing stack
  variables to ares_gethostbyname() then leaving the stack context.
  We will now allocate a buffer for this.
  
  Fix By: Brad House (@bradh352)

GitHub (13 Dec 2022)
- [Daniel Stenberg brought this change]

  docs: reformat/cleanup man pages SYNOPSIS sections (#494)
  
  To make them render "nicer" in both terminals and on the website.
  
  - Removes the bold
  - Removes .PP lines
  - Indents them more like proper code style
  
  Fix By: Daniel Stenberg (@bagder)

- [Nikolaos Chatzikonstantinou brought this change]

  bug fix: new ares_strsplit (#492)
  
  * add ares_strsplit unit test
  
  The test reveals a bug in the implementation of ares_strsplit when the
  make_set parameter is set to 1, as distinct domains are confused for
  equal:
  
    out = ares_strsplit("example.com, example.co", ", ", 1, &n);
  
  evaluates to n = 1 with out = { "example.com" }.
  
  * bugfix and cleanup of ares_strsplit
  
  The purpose of ares_strsplit in c-ares is to split a comma-delimited
  string of unique (up to letter case) domains. However, because the
  terminating NUL byte was not checked in the substrings when comparing
  for uniqueness, the function would sometimes drop domains it should
  not. For example,
  
      ares_strsplit("example.com, example.co", ",")
  
  would only result in a single domain "example.com".
  
  Aside from this bugfix, the following cleanup is performed:
  
  1. The tokenization now happens with the help of strcspn instead of the
     custom function is_delim.
  2. The function list_contains has been inlined.
  3. The interface of ares_strsplit has been simplified by removing the
     parameter make_set since in practice it was always 1.
  4. There are fewer passes over the input string.
  5. We resize the table using realloc() down to its minimum size.
  6. The docstring of ares_strsplit is updated and also a couple typos
     are fixed.
  
  There occurs a single use of ares_strsplit and since the make_set
  parameter has been removed, the call in ares_init.c is modified
  accordingly. The unit test for ares_strsplit is also updated.
  
  Fix By: Nikolaos Chatzikonstantinou (@createyourpersonalaccount)

bradh352 (23 Oct 2022)
- CirrusCI: update freebsd image
  
  Old FreeBSD image for CirrusCI has issues with newer symbols, update to later one.
  
  Fix By: Brad House (@bradh352)

GitHub (23 Oct 2022)
- [Stephen Sachs brought this change]

  Fix Intel compiler deprecated options (#485)
  
  Options `-we ###` and `-wd ###` should not include a whitespace. They are also deprecated and `-diag-error` and `-diag-disable` are their replacements.
  
  Intel compiler 2021.6 is not able to be used in configure without the proposed patch.
  
  Fix By: Stephen Sachs (@stephenmsachs)

- [Jonathan Ringer brought this change]

  Allow for CMake to use absolute install paths (#486)
  
  Generated libcares.pc could have bad paths when using absolute paths.
  
  Fix By: Jonathan Ringer (@jonringer)

- [Thomas Dreibholz brought this change]

  Fix for issue #488: ensure that the number of iovec entries does not exceed system limits. (#489)
  
  c-ares could try to exceed maximum number of iovec entries supported by system.
  
  Fix By: Thomas Dreibholz (@dreibh)

- [bsergean brought this change]

  Add include guards to ares_data.h (#491)
  
  All the other header files in the src/lib folder do have an include guard so it look like an overthought.
  
  Fix By: @bsergean

- [Brad Spencer brought this change]

  Fix typo in docs for ares_process_fd (#490)
  
  A single letter was missing
  
  Fix By: Brad Spencer (@b-spencer)

- [lifenjoiner brought this change]

  tools: refine help (#481)
  
  fix invalid help options and documentation typos
  
  Fix By: @lifenjoiner

- [lifenjoiner brought this change]

  Git: ignore CMake temporary files (#480)
  
  exclude more files from git
  
  Fix By: @lifenjoiner

- [lifenjoiner brought this change]

  adig: fix `-T` option (#479)
  
  Helper was missing flag to enable TCP mode of operation.
  
  Fix By: @lifenjoiner

- [Frank brought this change]

  Add vcpkg installation instructions (#478)
  
  Update to include vcpkg installation instructions
  
  Fix By: @FrankXie05

- [marc-groundctl brought this change]

  Convert total timeout to per-query (#467)
  
  On Apple platforms, libresolv reports the total timeout in retrans, not the per-query time. This patch undoes that math to get the per-query time, which is what c-ares expects. This is not perfect because libresolv is inconsistent on whether the timeout is multiplied by retry or retry+1, but I don't see any way to distinguish these cases.
  
  Fix By: Marc Aldorasi (@marc-groundctl)

- [marc-groundctl brought this change]

  Don't include version info in the static library (#468)
  
  The static library should not contain version info, since it would be linked into an executable or dll with its own version info.
  
  Fix By: @marc-groundctl

- [Ridge Kennedy brought this change]

  Fix ares_getaddrinfo() numerical address fast path with AF_UNSPEC (#469)
  
  The conversion of numeric IPv4 addresses in fake_addrinfo() is broken when
  the family is AF_UNSPEC. The initial call to ares_inet_pton with AF_INET
  will succeed, but the subsequent call using AF_INET6 will fail. This results
  in the fake_addrinfo() fast path failing, and ares_getaddrinfo() making a
  query when none should be required.
  
  Resolve this by only attempting the call to ares_inet_pton with AF_INET6
  if the initial call with AF_INET was unsuccessful.
  
  Fix By: Ridge Kennedy (@ridgek)

- [Manish Mehra brought this change]
