imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

unbound: Update to 1.26.1

Browse Source 
Release notes at
    https://community.nlnetlabs.nl/t/unbound-1-26-1-released

Merge commit '120aa088f4807126af42a652a07c5090e7294fcf'

Security:	CVE-2026-77860
Security:	CVE-2026-77955
Security:	CVE-2026-78227
Security:	CVE-2026-80225
Security:	CVE-2026-81634
Security:	CVE-2026-81642
Security:	CVE-2026-82717
Security:	CVE-2026-82720
Security:	CVE-2026-85501
This commit is contained in:
Dag-Erling Smørgrav committed 2026-09-16 14:22:09 +00:00
2 parents 6ff2d2d5d4 120aa088f4
commit 1fb9c5ffe2
58 files changed
+9051 -9148
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

contrib/unbound/config.guess
Vendored
+17 -9
View File
@@ -1,10 +1,10 @@
#!/usr/bin/sh
#! /bin/sh
# Attempt to guess a canonical system name.
# Copyright 1992-2024 Free Software Foundation, Inc.
# Copyright 1992-2026 Free Software Foundation, Inc.
# shellcheck disable=SC2006,SC2268 # see below for rationale
timestamp='2024-07-27'
timestamp='2026-05-17'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -60,7 +60,7 @@ version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
Copyright 1992-2024 Free Software Foundation, Inc.
Copyright 1992-2026 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -150,7 +150,7 @@ UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown
UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
case $UNAME_SYSTEM in
Linux|GNU|GNU/*)
Ironclad|Linux|GNU|GNU/*)
LIBC=unknown
set_cc_for_build
@@ -167,6 +167,8 @@ Linux|GNU|GNU/*)
LIBC=gnu
#elif defined(__LLVM_LIBC__)
LIBC=llvm
#elif defined(__mlibc__)
LIBC=mlibc
#else
#include <stdarg.h>
/* First heuristic to detect musl libc. */
@@ -1186,6 +1188,9 @@ EOF
sparc:Linux:*:* | sparc64:Linux:*:*)
GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
;;
sw_64:Linux:*:*)
GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
;;
tile*:Linux:*:*)
GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
;;
@@ -1597,8 +1602,11 @@ EOF
*:Unleashed:*:*)
GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE
;;
*:Ironclad:*:*)
GUESS=$UNAME_MACHINE-unknown-ironclad
x86_64:[Ii]ronclad:*:*|i?86:[Ii]ronclad:*:*)
GUESS=$UNAME_MACHINE-pc-ironclad-$LIBC
;;
*:[Ii]ronclad:*:*)
GUESS=$UNAME_MACHINE-unknown-ironclad-$LIBC
;;
esac
@@ -1808,8 +1816,8 @@ fi
exit 1
# Local variables:
# eval: (add-hook 'before-save-hook 'time-stamp)
# eval: (add-hook 'before-save-hook 'time-stamp nil t)
# time-stamp-start: "timestamp='"
# time-stamp-format: "%:y-%02m-%02d"
# time-stamp-format: "%Y-%02m-%02d"
# time-stamp-end: "'"
# End:
contrib/unbound/config.h.in
+186 -196
View File
@@ -51,19 +51,19 @@
internal symbols */
#undef EXPORT_ALL_SYMBOLS
/* Define to 1 if you have the 'accept4' function. */
/* Define to 1 if you have the `accept4' function. */
#undef HAVE_ACCEPT4
/* Define to 1 if you have the 'arc4random' function. */
/* Define to 1 if you have the `arc4random' function. */
#undef HAVE_ARC4RANDOM
/* Define to 1 if you have the 'arc4random_uniform' function. */
/* Define to 1 if you have the `arc4random_uniform' function. */
#undef HAVE_ARC4RANDOM_UNIFORM
/* Define to 1 if you have the <arpa/inet.h> header file. */
#undef HAVE_ARPA_INET_H
/* Define to 1 if you have the 'ASN1_STRING_get0_data' function. */
/* Define to 1 if you have the `ASN1_STRING_get0_data' function. */
#undef HAVE_ASN1_STRING_GET0_DATA
/* Whether the C compiler accepts the "fallthrough" attribute */
@@ -87,7 +87,7 @@
/* If we have be64toh */
#undef HAVE_BE64TOH
/* Define to 1 if you have the 'BIO_set_callback_ex' function. */
/* Define to 1 if you have the `BIO_set_callback_ex' function. */
#undef HAVE_BIO_SET_CALLBACK_EX
/* Define to 1 if you have the <bsd/stdlib.h> header file. */
@@ -96,255 +96,255 @@
/* Define to 1 if you have the <bsd/string.h> header file. */
#undef HAVE_BSD_STRING_H
/* Define to 1 if you have the 'chown' function. */
/* Define to 1 if you have the `chown' function. */
#undef HAVE_CHOWN
/* Define to 1 if you have the 'chroot' function. */
/* Define to 1 if you have the `chroot' function. */
#undef HAVE_CHROOT
/* Define to 1 if you have the 'CRYPTO_cleanup_all_ex_data' function. */
/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
#undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
/* Define to 1 if you have the 'CRYPTO_THREADID_set_callback' function. */
/* Define to 1 if you have the `CRYPTO_THREADID_set_callback' function. */
#undef HAVE_CRYPTO_THREADID_SET_CALLBACK
/* Define to 1 if you have the 'ctime_r' function. */
/* Define to 1 if you have the `ctime_r' function. */
#undef HAVE_CTIME_R
/* Define to 1 if you have the 'daemon' function. */
/* Define to 1 if you have the `daemon' function. */
#undef HAVE_DAEMON
/* Define to 1 if you have the declaration of 'arc4random', and to 0 if you
/* Define to 1 if you have the declaration of `arc4random', and to 0 if you
don't. */
#undef HAVE_DECL_ARC4RANDOM
/* Define to 1 if you have the declaration of 'arc4random_uniform', and to 0
/* Define to 1 if you have the declaration of `arc4random_uniform', and to 0
if you don't. */
#undef HAVE_DECL_ARC4RANDOM_UNIFORM
/* Define to 1 if you have the declaration of 'evsignal_assign', and to 0 if
/* Define to 1 if you have the declaration of `evsignal_assign', and to 0 if
you don't. */
#undef HAVE_DECL_EVSIGNAL_ASSIGN
/* Define to 1 if you have the declaration of 'inet_ntop', and to 0 if you
/* Define to 1 if you have the declaration of `inet_ntop', and to 0 if you
don't. */
#undef HAVE_DECL_INET_NTOP
/* Define to 1 if you have the declaration of 'inet_pton', and to 0 if you
/* Define to 1 if you have the declaration of `inet_pton', and to 0 if you
don't. */
#undef HAVE_DECL_INET_PTON
/* Define to 1 if you have the declaration of 'nghttp2_session_server_new',
/* Define to 1 if you have the declaration of `nghttp2_session_server_new',
and to 0 if you don't. */
#undef HAVE_DECL_NGHTTP2_SESSION_SERVER_NEW
/* Define to 1 if you have the declaration of 'ngtcp2_conn_server_new', and to
/* Define to 1 if you have the declaration of `ngtcp2_conn_server_new', and to
0 if you don't. */
#undef HAVE_DECL_NGTCP2_CONN_SERVER_NEW
/* Define to 1 if you have the declaration of 'ngtcp2_crypto_encrypt_cb', and
/* Define to 1 if you have the declaration of `ngtcp2_crypto_encrypt_cb', and
to 0 if you don't. */
#undef HAVE_DECL_NGTCP2_CRYPTO_ENCRYPT_CB
/* Define to 1 if you have the declaration of 'ngtcp2_crypto_ossl_ctx_new',
/* Define to 1 if you have the declaration of `ngtcp2_crypto_ossl_ctx_new',
and to 0 if you don't. */
#undef HAVE_DECL_NGTCP2_CRYPTO_OSSL_CTX_NEW
/* Define to 1 if you have the declaration of 'NID_ED25519', and to 0 if you
/* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
don't. */
#undef HAVE_DECL_NID_ED25519
/* Define to 1 if you have the declaration of 'NID_ED448', and to 0 if you
/* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
don't. */
#undef HAVE_DECL_NID_ED448
/* Define to 1 if you have the declaration of 'NID_secp384r1', and to 0 if you
/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
don't. */
#undef HAVE_DECL_NID_SECP384R1
/* Define to 1 if you have the declaration of 'NID_X9_62_prime256v1', and to 0
/* Define to 1 if you have the declaration of `NID_X9_62_prime256v1', and to 0
if you don't. */
#undef HAVE_DECL_NID_X9_62_PRIME256V1
/* Define to 1 if you have the declaration of 'reallocarray', and to 0 if you
/* Define to 1 if you have the declaration of `reallocarray', and to 0 if you
don't. */
#undef HAVE_DECL_REALLOCARRAY
/* Define to 1 if you have the declaration of 'redisConnect', and to 0 if you
/* Define to 1 if you have the declaration of `redisConnect', and to 0 if you
don't. */
#undef HAVE_DECL_REDISCONNECT
/* Define to 1 if you have the declaration of 'sk_SSL_COMP_pop_free', and to 0
/* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
if you don't. */
#undef HAVE_DECL_SK_SSL_COMP_POP_FREE
/* Define to 1 if you have the declaration of
'SSL_COMP_get_compression_methods', and to 0 if you don't. */
`SSL_COMP_get_compression_methods', and to 0 if you don't. */
#undef HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
/* Define to 1 if you have the declaration of 'SSL_CTX_set_ecdh_auto', and to
/* Define to 1 if you have the declaration of `SSL_CTX_set_ecdh_auto', and to
0 if you don't. */
#undef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
/* Define to 1 if you have the declaration of 'SSL_CTX_set_tmp_ecdh', and to 0
/* Define to 1 if you have the declaration of `SSL_CTX_set_tmp_ecdh', and to 0
if you don't. */
#undef HAVE_DECL_SSL_CTX_SET_TMP_ECDH
/* Define to 1 if you have the declaration of 'strlcat', and to 0 if you
/* Define to 1 if you have the declaration of `strlcat', and to 0 if you
don't. */
#undef HAVE_DECL_STRLCAT
/* Define to 1 if you have the declaration of 'strlcpy', and to 0 if you
/* Define to 1 if you have the declaration of `strlcpy', and to 0 if you
don't. */
#undef HAVE_DECL_STRLCPY
/* Define to 1 if you have the declaration of 'XML_StopParser', and to 0 if
/* Define to 1 if you have the declaration of `XML_StopParser', and to 0 if
you don't. */
#undef HAVE_DECL_XML_STOPPARSER
/* Define to 1 if you have the <dlfcn.h> header file. */
#undef HAVE_DLFCN_H
/* Define to 1 if you have the 'DSA_SIG_set0' function. */
/* Define to 1 if you have the `DSA_SIG_set0' function. */
#undef HAVE_DSA_SIG_SET0
/* Define to 1 if you have the <endian.h> header file. */
#undef HAVE_ENDIAN_H
/* Define to 1 if you have the 'endprotoent' function. */
/* Define to 1 if you have the `endprotoent' function. */
#undef HAVE_ENDPROTOENT
/* Define to 1 if you have the 'endpwent' function. */
/* Define to 1 if you have the `endpwent' function. */
#undef HAVE_ENDPWENT
/* Define to 1 if you have the 'endservent' function. */
/* Define to 1 if you have the `endservent' function. */
#undef HAVE_ENDSERVENT
/* Define to 1 if you have the 'ENGINE_cleanup' function. */
/* Define to 1 if you have the `ENGINE_cleanup' function. */
#undef HAVE_ENGINE_CLEANUP
/* Define to 1 if you have the 'ERR_free_strings' function. */
/* Define to 1 if you have the `ERR_free_strings' function. */
#undef HAVE_ERR_FREE_STRINGS
/* Define to 1 if you have the 'ERR_load_crypto_strings' function. */
/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
#undef HAVE_ERR_LOAD_CRYPTO_STRINGS
/* Define to 1 if you have the 'event_assign' function. */
/* Define to 1 if you have the `event_assign' function. */
#undef HAVE_EVENT_ASSIGN
/* Define to 1 if you have the 'event_base_free' function. */
/* Define to 1 if you have the `event_base_free' function. */
#undef HAVE_EVENT_BASE_FREE
/* Define to 1 if you have the 'event_base_get_method' function. */
/* Define to 1 if you have the `event_base_get_method' function. */
#undef HAVE_EVENT_BASE_GET_METHOD
/* Define to 1 if you have the 'event_base_new' function. */
/* Define to 1 if you have the `event_base_new' function. */
#undef HAVE_EVENT_BASE_NEW
/* Define to 1 if you have the 'event_base_once' function. */
/* Define to 1 if you have the `event_base_once' function. */
#undef HAVE_EVENT_BASE_ONCE
/* Define to 1 if you have the <event.h> header file. */
#undef HAVE_EVENT_H
/* Define to 1 if you have the 'EVP_aes_256_cbc' function. */
/* Define to 1 if you have the `EVP_aes_256_cbc' function. */
#undef HAVE_EVP_AES_256_CBC
/* Define to 1 if you have the 'EVP_cleanup' function. */
/* Define to 1 if you have the `EVP_cleanup' function. */
#undef HAVE_EVP_CLEANUP
/* Define to 1 if you have the 'EVP_default_properties_is_fips_enabled'
/* Define to 1 if you have the `EVP_default_properties_is_fips_enabled'
function. */
#undef HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED
/* Define to 1 if you have the 'EVP_DigestVerify' function. */
/* Define to 1 if you have the `EVP_DigestVerify' function. */
#undef HAVE_EVP_DIGESTVERIFY
/* Define to 1 if you have the 'EVP_dss1' function. */
/* Define to 1 if you have the `EVP_dss1' function. */
#undef HAVE_EVP_DSS1
/* Define to 1 if you have the 'EVP_EncryptInit_ex' function. */
/* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
#undef HAVE_EVP_ENCRYPTINIT_EX
/* Define to 1 if you have the 'EVP_MAC_CTX_set_params' function. */
/* Define to 1 if you have the `EVP_MAC_CTX_set_params' function. */
#undef HAVE_EVP_MAC_CTX_SET_PARAMS
/* Define to 1 if you have the 'EVP_MD_CTX_new' function. */
/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
#undef HAVE_EVP_MD_CTX_NEW
/* Define to 1 if you have the 'EVP_sha1' function. */
/* Define to 1 if you have the `EVP_sha1' function. */
#undef HAVE_EVP_SHA1
/* Define to 1 if you have the 'EVP_sha256' function. */
/* Define to 1 if you have the `EVP_sha256' function. */
#undef HAVE_EVP_SHA256
/* Define to 1 if you have the 'EVP_sha512' function. */
/* Define to 1 if you have the `EVP_sha512' function. */
#undef HAVE_EVP_SHA512
/* Define to 1 if you have the 'ev_default_loop' function. */
/* Define to 1 if you have the `ev_default_loop' function. */
#undef HAVE_EV_DEFAULT_LOOP
/* Define to 1 if you have the 'ev_loop' function. */
/* Define to 1 if you have the `ev_loop' function. */
#undef HAVE_EV_LOOP
/* Define to 1 if you have the <expat.h> header file. */
#undef HAVE_EXPAT_H
/* Define to 1 if you have the 'explicit_bzero' function. */
/* Define to 1 if you have the `explicit_bzero' function. */
#undef HAVE_EXPLICIT_BZERO
/* Define to 1 if you have the 'fcntl' function. */
/* Define to 1 if you have the `fcntl' function. */
#undef HAVE_FCNTL
/* Define to 1 if you have the 'FIPS_mode' function. */
/* Define to 1 if you have the `FIPS_mode' function. */
#undef HAVE_FIPS_MODE
/* Define to 1 if you have the 'fnmatch' function. */
/* Define to 1 if you have the `fnmatch' function. */
#undef HAVE_FNMATCH
/* Define to 1 if you have the <fnmatch.h> header file. */
#undef HAVE_FNMATCH_H
/* Define to 1 if you have the 'fork' function. */
/* Define to 1 if you have the `fork' function. */
#undef HAVE_FORK
/* Define to 1 if fseeko (and ftello) are declared in stdio.h. */
/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
#undef HAVE_FSEEKO
/* Define to 1 if you have the 'fsync' function. */
/* Define to 1 if you have the `fsync' function. */
#undef HAVE_FSYNC
/* Whether getaddrinfo is available */
#undef HAVE_GETADDRINFO
/* Define to 1 if you have the 'getauxval' function. */
/* Define to 1 if you have the `getauxval' function. */
#undef HAVE_GETAUXVAL
/* Define to 1 if you have the 'getentropy' function. */
/* Define to 1 if you have the `getentropy' function. */
#undef HAVE_GETENTROPY
/* Define to 1 if you have the 'getifaddrs' function. */
/* Define to 1 if you have the `getifaddrs' function. */
#undef HAVE_GETIFADDRS
/* Define to 1 if you have the <getopt.h> header file. */
#undef HAVE_GETOPT_H
/* Define to 1 if you have the 'getpwnam' function. */
/* Define to 1 if you have the `getpwnam' function. */
#undef HAVE_GETPWNAM
/* Define to 1 if you have the 'getrlimit' function. */
/* Define to 1 if you have the `getrlimit' function. */
#undef HAVE_GETRLIMIT
/* Define to 1 if you have the 'gettid' function. */
/* Define to 1 if you have the `gettid' function. */
#undef HAVE_GETTID
/* Define to 1 if you have the 'glob' function. */
/* Define to 1 if you have the `glob' function. */
#undef HAVE_GLOB
/* Define to 1 if you have the <glob.h> header file. */
#undef HAVE_GLOB_H
/* Define to 1 if you have the 'gmtime_r' function. */
/* Define to 1 if you have the `gmtime_r' function. */
#undef HAVE_GMTIME_R
/* Define to 1 if you have the <grp.h> header file. */
@@ -353,7 +353,7 @@
/* Define to 1 if you have the <hiredis/hiredis.h> header file. */
#undef HAVE_HIREDIS_HIREDIS_H
/* Define to 1 if you have the 'HMAC_Init_ex' function. */
/* Define to 1 if you have the `HMAC_Init_ex' function. */
#undef HAVE_HMAC_INIT_EX
/* If we have htobe64 */
@@ -362,19 +362,19 @@
/* Define to 1 if you have the <ifaddrs.h> header file. */
#undef HAVE_IFADDRS_H
/* Define to 1 if you have the 'if_nametoindex' function. */
/* Define to 1 if you have the `if_nametoindex' function. */
#undef HAVE_IF_NAMETOINDEX
/* Define to 1 if you have the 'inet_aton' function. */
/* Define to 1 if you have the `inet_aton' function. */
#undef HAVE_INET_ATON
/* Define to 1 if you have the 'inet_ntop' function. */
/* Define to 1 if you have the `inet_ntop' function. */
#undef HAVE_INET_NTOP
/* Define to 1 if you have the 'inet_pton' function. */
/* Define to 1 if you have the `inet_pton' function. */
#undef HAVE_INET_PTON
/* Define to 1 if you have the 'initgroups' function. */
/* Define to 1 if you have the `initgroups' function. */
#undef HAVE_INITGROUPS
/* Define to 1 if you have the <inttypes.h> header file. */
@@ -386,10 +386,10 @@
/* Define to 1 if you have the <iphlpapi.h> header file. */
#undef HAVE_IPHLPAPI_H
/* Define to 1 if you have the 'isblank' function. */
/* Define to 1 if you have the `isblank' function. */
#undef HAVE_ISBLANK
/* Define to 1 if you have the 'kill' function. */
/* Define to 1 if you have the `kill' function. */
#undef HAVE_KILL
/* Use portable libbsd functions */
@@ -407,7 +407,7 @@
/* Define to 1 if you have the <linux/net_tstamp.h> header file. */
#undef HAVE_LINUX_NET_TSTAMP_H
/* Define to 1 if you have the 'localtime_r' function. */
/* Define to 1 if you have the `localtime_r' function. */
#undef HAVE_LOCALTIME_R
/* Define to 1 if you have the <login_cap.h> header file. */
@@ -416,7 +416,7 @@
/* If have GNU libc compatible malloc */
#undef HAVE_MALLOC
/* Define to 1 if you have the 'memmove' function. */
/* Define to 1 if you have the `memmove' function. */
#undef HAVE_MEMMOVE
/* Define to 1 if you have the <minix/config.h> header file. */
@@ -458,52 +458,52 @@
/* Define this to use ngtcp2. */
#undef HAVE_NGTCP2
/* Define to 1 if you have the 'ngtcp2_ccerr_default' function. */
/* Define to 1 if you have the `ngtcp2_ccerr_default' function. */
#undef HAVE_NGTCP2_CCERR_DEFAULT
/* Define to 1 if you have the 'ngtcp2_conn_encode_0rtt_transport_params'
/* Define to 1 if you have the `ngtcp2_conn_encode_0rtt_transport_params'
function. */
#undef HAVE_NGTCP2_CONN_ENCODE_0RTT_TRANSPORT_PARAMS
/* Define to 1 if you have the 'ngtcp2_conn_get_max_local_streams_uni'
/* Define to 1 if you have the `ngtcp2_conn_get_max_local_streams_uni'
function. */
#undef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI
/* Define to 1 if you have the 'ngtcp2_conn_get_num_scid' function. */
/* Define to 1 if you have the `ngtcp2_conn_get_num_scid' function. */
#undef HAVE_NGTCP2_CONN_GET_NUM_SCID
/* Define to 1 if you have the 'ngtcp2_conn_in_closing_period' function. */
/* Define to 1 if you have the `ngtcp2_conn_in_closing_period' function. */
#undef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD
/* Define to 1 if you have the 'ngtcp2_conn_in_draining_period' function. */
/* Define to 1 if you have the `ngtcp2_conn_in_draining_period' function. */
#undef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD
/* Define if ngtcp2_conn_shutdown_stream has 4 arguments. */
#undef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4
/* Define to 1 if you have the 'ngtcp2_conn_tls_early_data_rejected' function.
/* Define to 1 if you have the `ngtcp2_conn_tls_early_data_rejected' function.
*/
#undef HAVE_NGTCP2_CONN_TLS_EARLY_DATA_REJECTED
/* Define to 1 if you have the 'ngtcp2_crypto_encrypt_cb' function. */
/* Define to 1 if you have the `ngtcp2_crypto_encrypt_cb' function. */
#undef HAVE_NGTCP2_CRYPTO_ENCRYPT_CB
/* Define to 1 if you have the
'ngtcp2_crypto_quictls_configure_client_context' function. */
`ngtcp2_crypto_quictls_configure_client_context' function. */
#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_CLIENT_CONTEXT
/* Define to 1 if you have the
'ngtcp2_crypto_quictls_configure_server_context' function. */
`ngtcp2_crypto_quictls_configure_server_context' function. */
#undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT
/* Define to 1 if you have the
'ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
`ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
#undef HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL
/* Define to 1 if you have the 'ngtcp2_crypto_quictls_init' function. */
/* Define to 1 if you have the `ngtcp2_crypto_quictls_init' function. */
#undef HAVE_NGTCP2_CRYPTO_QUICTLS_INIT
/* Define to 1 if the system has the type 'ngtcp2_encryption_level'. */
/* Define to 1 if the system has the type `ngtcp2_encryption_level'. */
#undef HAVE_NGTCP2_ENCRYPTION_LEVEL
/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_openssl.h> header file.
@@ -523,16 +523,16 @@
/* Use libnss for crypto */
#undef HAVE_NSS
/* Define to 1 if you have the 'OpenSSL_add_all_digests' function. */
/* Define to 1 if you have the `OpenSSL_add_all_digests' function. */
#undef HAVE_OPENSSL_ADD_ALL_DIGESTS
/* Define to 1 if you have the <openssl/bn.h> header file. */
#undef HAVE_OPENSSL_BN_H
/* Define to 1 if you have the 'OPENSSL_cleanup' function. */
/* Define to 1 if you have the `OPENSSL_cleanup' function. */
#undef HAVE_OPENSSL_CLEANUP
/* Define to 1 if you have the 'OPENSSL_config' function. */
/* Define to 1 if you have the `OPENSSL_config' function. */
#undef HAVE_OPENSSL_CONFIG
/* Define to 1 if you have the <openssl/conf.h> header file. */
@@ -553,10 +553,10 @@
/* Define to 1 if you have the <openssl/err.h> header file. */
#undef HAVE_OPENSSL_ERR_H
/* Define to 1 if you have the 'OPENSSL_init_crypto' function. */
/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
#undef HAVE_OPENSSL_INIT_CRYPTO
/* Define to 1 if you have the 'OPENSSL_init_ssl' function. */
/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
#undef HAVE_OPENSSL_INIT_SSL
/* Define to 1 if you have the <openssl/param_build.h> header file. */
@@ -571,10 +571,10 @@
/* Define to 1 if you have the <openssl/ssl.h> header file. */
#undef HAVE_OPENSSL_SSL_H
/* Define to 1 if you have the 'OSSL_PARAM_BLD_new' function. */
/* Define to 1 if you have the `OSSL_PARAM_BLD_new' function. */
#undef HAVE_OSSL_PARAM_BLD_NEW
/* Define to 1 if you have the 'poll' function. */
/* Define to 1 if you have the `poll' function. */
#undef HAVE_POLL
/* Define to 1 if you have the <poll.h> header file. */
@@ -589,7 +589,7 @@
/* Have PTHREAD_PRIO_INHERIT. */
#undef HAVE_PTHREAD_PRIO_INHERIT
/* Define to 1 if the system has the type 'pthread_rwlock_t'. */
/* Define to 1 if the system has the type `pthread_rwlock_t'. */
#undef HAVE_PTHREAD_RWLOCK_T
/* Define if pthread_setname_np has the common 2 arguments. */
@@ -604,7 +604,7 @@
/* Define if pthread_setname_np exists as pthread_set_name_np instead. */
#undef HAVE_PTHREAD_SET_NAME_NP
/* Define to 1 if the system has the type 'pthread_spinlock_t'. */
/* Define to 1 if the system has the type `pthread_spinlock_t'. */
#undef HAVE_PTHREAD_SPINLOCK_T
/* Define to 1 if you have the <pwd.h> header file. */
@@ -613,104 +613,104 @@
/* Define if you have Python libraries and header files. */
#undef HAVE_PYTHON
/* Define to 1 if you have the 'random' function. */
/* Define to 1 if you have the `random' function. */
#undef HAVE_RANDOM
/* Define to 1 if you have the 'RAND_cleanup' function. */
/* Define to 1 if you have the `RAND_cleanup' function. */
#undef HAVE_RAND_CLEANUP
/* If we have reallocarray(3) */
#undef HAVE_REALLOCARRAY
/* Define to 1 if you have the 'recvmsg' function. */
/* Define to 1 if you have the `recvmsg' function. */
#undef HAVE_RECVMSG
/* Define to 1 if you have the 'sendmsg' function. */
/* Define to 1 if you have the `sendmsg' function. */
#undef HAVE_SENDMSG
/* Define to 1 if you have the 'setregid' function. */
/* Define to 1 if you have the `setregid' function. */
#undef HAVE_SETREGID
/* Define to 1 if you have the 'setresgid' function. */
/* Define to 1 if you have the `setresgid' function. */
#undef HAVE_SETRESGID
/* Define to 1 if you have the 'setresuid' function. */
/* Define to 1 if you have the `setresuid' function. */
#undef HAVE_SETRESUID
/* Define to 1 if you have the 'setreuid' function. */
/* Define to 1 if you have the `setreuid' function. */
#undef HAVE_SETREUID
/* Define to 1 if you have the 'setrlimit' function. */
/* Define to 1 if you have the `setrlimit' function. */
#undef HAVE_SETRLIMIT
/* Define to 1 if you have the 'setsid' function. */
/* Define to 1 if you have the `setsid' function. */
#undef HAVE_SETSID
/* Define to 1 if you have the 'setusercontext' function. */
/* Define to 1 if you have the `setusercontext' function. */
#undef HAVE_SETUSERCONTEXT
/* Define to 1 if you have the 'SHA512_Update' function. */
/* Define to 1 if you have the `SHA512_Update' function. */
#undef HAVE_SHA512_UPDATE
/* Define to 1 if you have the 'shmget' function. */
/* Define to 1 if you have the `shmget' function. */
#undef HAVE_SHMGET
/* Define to 1 if you have the 'sigprocmask' function. */
/* Define to 1 if you have the `sigprocmask' function. */
#undef HAVE_SIGPROCMASK
/* Define to 1 if you have the 'sleep' function. */
/* Define to 1 if you have the `sleep' function. */
#undef HAVE_SLEEP
/* Define to 1 if you have the 'snprintf' function. */
/* Define to 1 if you have the `snprintf' function. */
#undef HAVE_SNPRINTF
/* Define to 1 if you have the 'socketpair' function. */
/* Define to 1 if you have the `socketpair' function. */
#undef HAVE_SOCKETPAIR
/* Using Solaris threads */
#undef HAVE_SOLARIS_THREADS
/* Define to 1 if you have the 'srandom' function. */
/* Define to 1 if you have the `srandom' function. */
#undef HAVE_SRANDOM
/* Define if you have the SSL libraries installed. */
#undef HAVE_SSL
/* Define to 1 if you have the 'SSL_CTX_set_alpn_protos' function. */
/* Define to 1 if you have the `SSL_CTX_set_alpn_protos' function. */
#undef HAVE_SSL_CTX_SET_ALPN_PROTOS
/* Define to 1 if you have the 'SSL_CTX_set_alpn_select_cb' function. */
/* Define to 1 if you have the `SSL_CTX_set_alpn_select_cb' function. */
#undef HAVE_SSL_CTX_SET_ALPN_SELECT_CB
/* Define to 1 if you have the 'SSL_CTX_set_ciphersuites' function. */
/* Define to 1 if you have the `SSL_CTX_set_ciphersuites' function. */
#undef HAVE_SSL_CTX_SET_CIPHERSUITES
/* Define to 1 if you have the 'SSL_CTX_set_security_level' function. */
/* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
#undef HAVE_SSL_CTX_SET_SECURITY_LEVEL
/* Define to 1 if you have the 'SSL_CTX_set_tlsext_ticket_key_evp_cb'
/* Define to 1 if you have the `SSL_CTX_set_tlsext_ticket_key_evp_cb'
function. */
#undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
/* Define to 1 if you have the 'SSL_get0_alpn_selected' function. */
/* Define to 1 if you have the `SSL_get0_alpn_selected' function. */
#undef HAVE_SSL_GET0_ALPN_SELECTED
/* Define to 1 if you have the 'SSL_get0_peername' function. */
/* Define to 1 if you have the `SSL_get0_peername' function. */
#undef HAVE_SSL_GET0_PEERNAME
/* Define to 1 if you have the 'SSL_get1_peer_certificate' function. */
/* Define to 1 if you have the `SSL_get1_peer_certificate' function. */
#undef HAVE_SSL_GET1_PEER_CERTIFICATE
/* Define to 1 if you have the 'SSL_is_quic' function. */
/* Define to 1 if you have the `SSL_is_quic' function. */
#undef HAVE_SSL_IS_QUIC
/* Define to 1 if you have the 'SSL_set1_dnsname' function. */
/* Define to 1 if you have the `SSL_set1_dnsname' function. */
#undef HAVE_SSL_SET1_DNSNAME
/* Define to 1 if you have the 'SSL_set1_host' function. */
/* Define to 1 if you have the `SSL_set1_host' function. */
#undef HAVE_SSL_SET1_HOST
/* Define to 1 if you have the 'SSL_set_quic_tls_early_data_enabled' function.
/* Define to 1 if you have the `SSL_set_quic_tls_early_data_enabled' function.
*/
#undef HAVE_SSL_SET_QUIC_TLS_EARLY_DATA_ENABLED
@@ -732,7 +732,7 @@
/* Define to 1 if you have the <stdlib.h> header file. */
#undef HAVE_STDLIB_H
/* Define to 1 if you have the 'strftime' function. */
/* Define to 1 if you have the `strftime' function. */
#undef HAVE_STRFTIME
/* Define to 1 if you have the <strings.h> header file. */
@@ -741,45 +741,45 @@
/* Define to 1 if you have the <string.h> header file. */
#undef HAVE_STRING_H
/* Define to 1 if you have the 'strlcat' function. */
/* Define to 1 if you have the `strlcat' function. */
#undef HAVE_STRLCAT
/* Define to 1 if you have the 'strlcpy' function. */
/* Define to 1 if you have the `strlcpy' function. */
#undef HAVE_STRLCPY
/* Define to 1 if you have the 'strptime' function. */
/* Define to 1 if you have the `strptime' function. */
#undef HAVE_STRPTIME
/* Define to 1 if you have the 'strsep' function. */
/* Define to 1 if you have the `strsep' function. */
#undef HAVE_STRSEP
/* Define to 1 if 'ipi_spec_dst' is a member of 'struct in_pktinfo'. */
/* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
#undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
/* Define to 1 if 'tokenlen' is a member of 'struct ngtcp2_pkt_hd'. */
/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_pkt_hd'. */
#undef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN
/* Define to 1 if 'max_tx_udp_payload_size' is a member of 'struct
/* Define to 1 if `max_tx_udp_payload_size' is a member of `struct
ngtcp2_settings'. */
#undef HAVE_STRUCT_NGTCP2_SETTINGS_MAX_TX_UDP_PAYLOAD_SIZE
/* Define to 1 if 'tokenlen' is a member of 'struct ngtcp2_settings'. */
/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_settings'. */
#undef HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN
/* Define to 1 if 'original_dcid_present' is a member of 'struct
/* Define to 1 if `original_dcid_present' is a member of `struct
ngtcp2_transport_params'. */
#undef HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT
/* Define to 1 if the system has the type 'struct ngtcp2_version_cid'. */
/* Define to 1 if the system has the type `struct ngtcp2_version_cid'. */
#undef HAVE_STRUCT_NGTCP2_VERSION_CID
/* Define to 1 if 'sun_len' is a member of 'struct sockaddr_un'. */
/* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
#undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
/* Define to 1 if 'st_mtimensec' is a member of 'struct stat'. */
/* Define to 1 if `st_mtimensec' is a member of `struct stat'. */
#undef HAVE_STRUCT_STAT_ST_MTIMENSEC
/* Define to 1 if 'st_mtim.tv_nsec' is a member of 'struct stat'. */
/* Define to 1 if `st_mtim.tv_nsec' is a member of `struct stat'. */
#undef HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC
/* Define if you have Swig libraries and header files. */
@@ -839,16 +839,16 @@
/* Define to 1 if you have the <time.h> header file. */
#undef HAVE_TIME_H
/* Define to 1 if you have the 'tzset' function. */
/* Define to 1 if you have the `tzset' function. */
#undef HAVE_TZSET
/* Define to 1 if you have the <unistd.h> header file. */
#undef HAVE_UNISTD_H
/* Define to 1 if you have the 'usleep' function. */
/* Define to 1 if you have the `usleep' function. */
#undef HAVE_USLEEP
/* Define to 1 if you have the 'vfork' function. */
/* Define to 1 if you have the `vfork' function. */
#undef HAVE_VFORK
/* Define to 1 if you have the <vfork.h> header file. */
@@ -866,28 +866,28 @@
/* Define to 1 if you have the <winsock2.h> header file. */
#undef HAVE_WINSOCK2_H
/* Define to 1 if 'fork' works. */
/* Define to 1 if `fork' works. */
#undef HAVE_WORKING_FORK
/* Define to 1 if 'vfork' works. */
/* Define to 1 if `vfork' works. */
#undef HAVE_WORKING_VFORK
/* Define to 1 if you have the 'writev' function. */
/* Define to 1 if you have the `writev' function. */
#undef HAVE_WRITEV
/* Define to 1 if you have the <ws2tcpip.h> header file. */
#undef HAVE_WS2TCPIP_H
/* Define to 1 if you have the 'X509_get_key_usage' function. */
/* Define to 1 if you have the `X509_get_key_usage' function. */
#undef HAVE_X509_GET_KEY_USAGE
/* Define to 1 if you have the 'X509_NAME_get_text_by_NID' function. */
/* Define to 1 if you have the `X509_NAME_get_text_by_NID' function. */
#undef HAVE_X509_NAME_GET_TEXT_BY_NID
/* Define to 1 if you have the 'X509_VERIFY_PARAM_set1_host' function. */
/* Define to 1 if you have the `X509_VERIFY_PARAM_set1_host' function. */
#undef HAVE_X509_VERIFY_PARAM_SET1_HOST
/* Define to 1 if you have the '_beginthreadex' function. */
/* Define to 1 if you have the `_beginthreadex' function. */
#undef HAVE__BEGINTHREADEX
/* If HMAC_Init_ex() returns void */
@@ -986,16 +986,16 @@
/* Shared data */
#undef SHARE_DIR
/* The size of 'pthread_t', as computed by sizeof. */
/* The size of `pthread_t', as computed by sizeof. */
#undef SIZEOF_PTHREAD_T
/* The size of 'size_t', as computed by sizeof. */
/* The size of `size_t', as computed by sizeof. */
#undef SIZEOF_SIZE_T
/* The size of 'time_t', as computed by sizeof. */
/* The size of `time_t', as computed by sizeof. */
#undef SIZEOF_TIME_T
/* The size of 'unsigned long', as computed by sizeof. */
/* The size of `unsigned long', as computed by sizeof. */
#undef SIZEOF_UNSIGNED_LONG
/* define if (v)snprintf does not return length needed, (but length used) */
@@ -1004,7 +1004,7 @@
/* Define to 1 if libsodium supports sodium_set_misuse_handler */
#undef SODIUM_MISUSE_HANDLER
/* Define to 1 if all of the C89 standard headers exist (not just the ones
/* Define to 1 if all of the C90 standard headers exist (not just the ones
required in a freestanding environment). This macro is provided for
backward compatibility; new code need not use it. */
#undef STDC_HEADERS
@@ -1101,7 +1101,7 @@
/* Define this to enable SHA256 and SHA512 support. */
#undef USE_SHA2
/* Enable extensions on AIX, Interix, z/OS. */
/* Enable extensions on AIX 3, Interix. */
#ifndef _ALL_SOURCE
# undef _ALL_SOURCE
#endif
@@ -1162,15 +1162,11 @@
#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
# undef __STDC_WANT_IEC_60559_DFP_EXT__
#endif
/* Enable extensions specified by C23 Annex F. */
#ifndef __STDC_WANT_IEC_60559_EXT__
# undef __STDC_WANT_IEC_60559_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-4:2015. */
#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
# undef __STDC_WANT_IEC_60559_FUNCS_EXT__
#endif
/* Enable extensions specified by C23 Annex H and ISO/IEC TS 18661-3:2015. */
/* Enable extensions specified by ISO/IEC TS 18661-3:2015. */
#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
# undef __STDC_WANT_IEC_60559_TYPES_EXT__
#endif
@@ -1211,36 +1207,30 @@
/* Define if you want PyUnbound. */
#undef WITH_PYUNBOUND
/* Define to 1 if 'lex' declares 'yytext' as a 'char *' by default, not a
'char[]'. */
/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
`char[]'. */
#undef YYTEXT_POINTER
/* Number of bits in a file offset, on hosts where this is settable. */
#undef _FILE_OFFSET_BITS
/* Define to 1 if necessary to make fseeko visible. */
/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
#undef _LARGEFILE_SOURCE
/* Define to 1 on platforms where this makes off_t a 64-bit type. */
/* Define for large files, on AIX-style hosts. */
#undef _LARGE_FILES
/* Enable for compile on Minix */
#undef _NETBSD_SOURCE
/* Number of bits in time_t, on hosts where this is settable. */
#undef _TIME_BITS
/* Define to 1 on platforms where this makes time_t a 64-bit type. */
#undef __MINGW_USE_VC2005_COMPAT
/* defined to use gcc ansi snprintf and sscanf that understands %lld when
compiled for windows. */
#undef __USE_MINGW_ANSI_STDIO
/* Define to empty if 'const' does not conform to ANSI C. */
/* Define to empty if `const' does not conform to ANSI C. */
#undef const
/* Define as 'int' if <sys/types.h> doesn't define. */
/* Define to `int' if <sys/types.h> doesn't define. */
#undef gid_t
/* in_addr_t */
@@ -1249,28 +1239,28 @@
/* in_port_t */
#undef in_port_t
/* Define to '__inline__' or '__inline' if that's what the C compiler
/* Define to `__inline__' or `__inline' if that's what the C compiler
calls it, or to nothing if 'inline' is not supported under any name. */
#ifndef __cplusplus
#undef inline
#endif
/* Define to 'short' if <sys/types.h> does not define. */
/* Define to `short' if <sys/types.h> does not define. */
#undef int16_t
/* Define to 'int' if <sys/types.h> does not define. */
/* Define to `int' if <sys/types.h> does not define. */
#undef int32_t
/* Define to 'long long' if <sys/types.h> does not define. */
/* Define to `long long' if <sys/types.h> does not define. */
#undef int64_t
/* Define to 'signed char' if <sys/types.h> does not define. */
/* Define to `signed char' if <sys/types.h> does not define. */
#undef int8_t
/* Define if replacement function should be used. */
#undef malloc
/* Define to 'long int' if <sys/types.h> does not define. */
/* Define to `long int' if <sys/types.h> does not define. */
#undef off_t
/* Define as a signed integer type capable of holding a process identifier. */
@@ -1279,34 +1269,34 @@
/* Define to 'int' if not defined */
#undef rlim_t
/* Define as 'unsigned int' if <stddef.h> doesn't define. */
/* Define to `unsigned int' if <sys/types.h> does not define. */
#undef size_t
/* Define to 'int' if not defined */
#undef socklen_t
/* Define to 'int' if <sys/types.h> does not define. */
/* Define to `int' if <sys/types.h> does not define. */
#undef ssize_t
/* Define to 'unsigned char if not defined */
#undef u_char
/* Define as 'int' if <sys/types.h> doesn't define. */
/* Define to `int' if <sys/types.h> doesn't define. */
#undef uid_t
/* Define to 'unsigned short' if <sys/types.h> does not define. */
/* Define to `unsigned short' if <sys/types.h> does not define. */
#undef uint16_t
/* Define to 'unsigned int' if <sys/types.h> does not define. */
/* Define to `unsigned int' if <sys/types.h> does not define. */
#undef uint32_t
/* Define to 'unsigned long long' if <sys/types.h> does not define. */
/* Define to `unsigned long long' if <sys/types.h> does not define. */
#undef uint64_t
/* Define to 'unsigned char' if <sys/types.h> does not define. */
/* Define to `unsigned char' if <sys/types.h> does not define. */
#undef uint8_t
/* Define as 'fork' if 'vfork' does not work. */
/* Define as `fork' if `vfork' does not work. */
#undef vfork
#if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE)
contrib/unbound/config.sub
Vendored
+21 -10
View File
@@ -1,10 +1,10 @@
#!/usr/bin/sh
#! /bin/sh
# Configuration validation subroutine script.
# Copyright 1992-2024 Free Software Foundation, Inc.
# Copyright 1992-2026 Free Software Foundation, Inc.
# shellcheck disable=SC2006,SC2268,SC2162 # see below for rationale
timestamp='2024-05-27'
timestamp='2026-05-17'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -76,7 +76,7 @@ Report bugs and patches to <[email protected]>."
version="\
GNU config.sub ($timestamp)
Copyright 1992-2024 Free Software Foundation, Inc.
Copyright 1992-2026 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -145,6 +145,7 @@ case $1 in
| kfreebsd*-gnu* \
| knetbsd*-gnu* \
| kopensolaris*-gnu* \
| ironclad-* \
| linux-* \
| managarm-* \
| netbsd*-eabi* \
@@ -242,7 +243,6 @@ case $1 in
| rombug \
| semi \
| sequent* \
| siemens \
| sgi* \
| siemens \
| sim \
@@ -261,7 +261,7 @@ case $1 in
basic_machine=$field1-$field2
basic_os=
;;
zephyr*)
tock* | zephyr*)
basic_machine=$field1-unknown
basic_os=$field2
;;
@@ -1194,7 +1194,7 @@ case $cpu-$vendor in
xscale-* | xscalee[bl]-*)
cpu=`echo "$cpu" | sed 's/^xscale/arm/'`
;;
arm64-* | aarch64le-*)
arm64-* | aarch64le-* | arm64_32-*)
cpu=aarch64
;;
@@ -1321,6 +1321,7 @@ case $cpu-$vendor in
| i960 \
| ia16 \
| ia64 \
| intelgt \
| ip2k \
| iq2000 \
| javascript \
@@ -1431,6 +1432,7 @@ case $cpu-$vendor in
| sparcv9v \
| spu \
| sv1 \
| sw_64 \
| sx* \
| tahoe \
| thumbv7* \
@@ -1522,6 +1524,10 @@ EOF
kernel=nto
os=`echo "$basic_os" | sed -e 's|nto|qnx|'`
;;
ironclad*)
kernel=ironclad
os=`echo "$basic_os" | sed -e 's|ironclad|gnu|'`
;;
linux*)
kernel=linux
os=`echo "$basic_os" | sed -e 's|linux|gnu|'`
@@ -1976,6 +1982,7 @@ case $os in
| atheos* \
| auroraux* \
| aux* \
| banan_os* \
| beos* \
| bitrig* \
| bme* \
@@ -2022,7 +2029,6 @@ case $os in
| ios* \
| iris* \
| irix* \
| ironclad* \
| isc* \
| its* \
| l4re* \
@@ -2118,6 +2124,7 @@ case $os in
| sysv* \
| tenex* \
| tirtos* \
| tock* \
| toppers* \
| tops10* \
| tops20* \
@@ -2214,6 +2221,8 @@ case $kernel-$os-$obj in
;;
uclinux-uclibc*- | uclinux-gnu*- )
;;
ironclad-gnu*- | ironclad-mlibc*- )
;;
managarm-mlibc*- | managarm-kernel*- )
;;
windows*-msvc*-)
@@ -2249,6 +2258,8 @@ case $kernel-$os-$obj in
;;
*-eabi*- | *-gnueabi*-)
;;
ios*-simulator- | tvos*-simulator- | watchos*-simulator- )
;;
none--*)
# None (no kernel, i.e. freestanding / bare metal),
# can be paired with an machine code file format
@@ -2347,8 +2358,8 @@ echo "$cpu-$vendor${kernel:+-$kernel}${os:+-$os}${obj:+-$obj}"
exit
# Local variables:
# eval: (add-hook 'before-save-hook 'time-stamp)
# eval: (add-hook 'before-save-hook 'time-stamp nil t)
# time-stamp-start: "timestamp='"
# time-stamp-format: "%:y-%02m-%02d"
# time-stamp-format: "%Y-%02m-%02d"
# time-stamp-end: "'"
# End:
contrib/unbound/configure
Vendored
+1936 -2732
View File
File diff suppressed because it is too large. Load diff
contrib/unbound/configure.ac
+3 -2
View File
@@ -12,14 +12,14 @@ sinclude(dnscrypt/dnscrypt.m4)
# must be numbers. ac_defun because of later processing
m4_define([VERSION_MAJOR],[1])
m4_define([VERSION_MINOR],[26])
m4_define([VERSION_MICRO],[0])
m4_define([VERSION_MICRO],[1])
AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[[email protected] or https://github.com/NLnetLabs/unbound/issues],[unbound])
AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
LIBUNBOUND_CURRENT=9
LIBUNBOUND_REVISION=39
LIBUNBOUND_REVISION=40
LIBUNBOUND_AGE=1
# 1.0.0 had 0:12:0
# 1.0.1 had 0:13:0
@@ -126,6 +126,7 @@ LIBUNBOUND_AGE=1
# 1.25.1 had 9:37:1
# 1.25.2 had 9:38:1
# 1.26.0 had 9:39:1
# 1.26.1 had 9:40:1
# Current -- the number of the binary API that we're implementing
# Revision -- which iteration of the implementation of the binary
contrib/unbound/daemon/remote.c
+2
View File
@@ -6590,6 +6590,8 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
COPY_VAR_ptr(ipset_name_v6);
#endif
COPY_VAR_int(ede);
COPY_VAR_int(val_validation_attempts);
COPY_VAR_int(val_hash_attempts);
COPY_VAR_int(iter_scrub_ns);
COPY_VAR_int(iter_scrub_cname);
COPY_VAR_int(iter_scrub_rrsig);
contrib/unbound/daemon/worker.c
+1 -1
View File
@@ -863,7 +863,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
"validation");
goto bail_out; /* need to validate cache entry first */
} else if(rep->security == sec_status_secure) {
if(reply_all_rrsets_secure(rep)) {
if(reply_an_ns_rrsets_secure(rep)) {
*is_secure_answer = 1;
} else {
if(must_validate) {
contrib/unbound/doc/README
+1 -1
View File
@@ -1,4 +1,4 @@
README for Unbound 1.26.0
README for Unbound 1.26.1
Copyright 2007 NLnet Labs
http://unbound.net
contrib/unbound/doc/example.conf
+8 -2
View File
@@ -1,7 +1,7 @@
#
# Example configuration file.
#
# See unbound.conf(5) man page, version 1.26.0.
# See unbound.conf(5) man page, version 1.26.1.
#
# this is a comment.
@@ -203,6 +203,12 @@ server:
# protects against poison attempts.
# iter-scrub-promiscuous: yes
# Limit on number of DNSSEC validation attempts for a query.
# val-validation-attempts: 32
# Limit on number of DNSSEC hash attempts for a query.
# val-hash-attempts: 32
# msec for waiting for an unknown server to reply. Increase if you
# are behind a slow satellite link, to eg. 1128.
# unknown-server-time-limit: 376
@@ -728,7 +734,7 @@ server:
# non-secure data. Useful to shield the users of this validator from
# potential bogus data in the additional section. All unsigned data
# in the additional section is removed from secure messages.
# val-clean-additional: yes
# val-clean-additional: no
# Turn permissive mode on to permit bogus messages. Thus, messages
# for which security checks failed will be returned to clients,
contrib/unbound/doc/example.conf.in
+8 -2
View File
@@ -1,7 +1,7 @@
#
# Example configuration file.
#
# See unbound.conf(5) man page, version 1.26.0.
# See unbound.conf(5) man page, version 1.26.1.
#
# this is a comment.
@@ -203,6 +203,12 @@ server:
# protects against poison attempts.
# iter-scrub-promiscuous: yes
# Limit on number of DNSSEC validation attempts for a query.
# val-validation-attempts: 32
# Limit on number of DNSSEC hash attempts for a query.
# val-hash-attempts: 32
# msec for waiting for an unknown server to reply. Increase if you
# are behind a slow satellite link, to eg. 1128.
# unknown-server-time-limit: 376
@@ -728,7 +734,7 @@ server:
# non-secure data. Useful to shield the users of this validator from
# potential bogus data in the additional section. All unsigned data
# in the additional section is removed from secure messages.
# val-clean-additional: yes
# val-clean-additional: no
# Turn permissive mode on to permit bogus messages. Thus, messages
# for which security checks failed will be returned to clients,
contrib/unbound/doc/libunbound.3
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "LIBUNBOUND" "3" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "LIBUNBOUND" "3" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
libunbound \- Unbound DNS validating resolver 1.26.0 functions.
libunbound \- Unbound DNS validating resolver 1.26.1 functions.
.SH SYNOPSIS
.sp
\fB#include <unbound.h>\fP
contrib/unbound/doc/libunbound.3.in
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "LIBUNBOUND" "3" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "LIBUNBOUND" "3" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
libunbound \- Unbound DNS validating resolver 1.26.0 functions.
libunbound \- Unbound DNS validating resolver 1.26.1 functions.
.SH SYNOPSIS
.sp
\fB#include <unbound.h>\fP
contrib/unbound/doc/unbound-anchor.8
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND-ANCHOR" "8" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND-ANCHOR" "8" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound-anchor \- Unbound 1.26.0 anchor utility.
unbound-anchor \- Unbound 1.26.1 anchor utility.
.SH SYNOPSIS
.sp
\fBunbound\-anchor\fP [\fBopts\fP]
contrib/unbound/doc/unbound-anchor.8.in
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND-ANCHOR" "8" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND-ANCHOR" "8" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound-anchor \- Unbound 1.26.0 anchor utility.
unbound-anchor \- Unbound 1.26.1 anchor utility.
.SH SYNOPSIS
.sp
\fBunbound\-anchor\fP [\fBopts\fP]
contrib/unbound/doc/unbound-checkconf.8
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND-CHECKCONF" "8" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND-CHECKCONF" "8" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound-checkconf \- Check Unbound 1.26.0 configuration file for errors.
unbound-checkconf \- Check Unbound 1.26.1 configuration file for errors.
.SH SYNOPSIS
.sp
\fBunbound\-checkconf\fP [\fB\-hf\fP] [\fB\-o option\fP] [cfgfile]
contrib/unbound/doc/unbound-checkconf.8.in
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND-CHECKCONF" "8" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND-CHECKCONF" "8" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound-checkconf \- Check Unbound 1.26.0 configuration file for errors.
unbound-checkconf \- Check Unbound 1.26.1 configuration file for errors.
.SH SYNOPSIS
.sp
\fBunbound\-checkconf\fP [\fB\-hf\fP] [\fB\-o option\fP] [cfgfile]
contrib/unbound/doc/unbound-control.8
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND-CONTROL" "8" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND-CONTROL" "8" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound-control \- Unbound 1.26.0 remote server control utility.
unbound-control \- Unbound 1.26.1 remote server control utility.
.SH SYNOPSIS
.sp
\fBunbound\-control\fP [\fB\-hq\fP] [\fB\-c cfgfile\fP] [\fB\-s server\fP] command
contrib/unbound/doc/unbound-control.8.in
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND-CONTROL" "8" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND-CONTROL" "8" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound-control \- Unbound 1.26.0 remote server control utility.
unbound-control \- Unbound 1.26.1 remote server control utility.
.SH SYNOPSIS
.sp
\fBunbound\-control\fP [\fB\-hq\fP] [\fB\-c cfgfile\fP] [\fB\-s server\fP] command
contrib/unbound/doc/unbound-host.1
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND-HOST" "1" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND-HOST" "1" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound-host \- Unbound 1.26.0 DNS lookup utility.
unbound-host \- Unbound 1.26.1 DNS lookup utility.
.SH SYNOPSIS
.sp
\fBunbound\-host\fP [\fB\-C configfile\fP] [\fB\-vdhr46D\fP] [\fB\-c class\fP]
contrib/unbound/doc/unbound-host.1.in
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND-HOST" "1" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND-HOST" "1" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound-host \- Unbound 1.26.0 DNS lookup utility.
unbound-host \- Unbound 1.26.1 DNS lookup utility.
.SH SYNOPSIS
.sp
\fBunbound\-host\fP [\fB\-C configfile\fP] [\fB\-vdhr46D\fP] [\fB\-c class\fP]
contrib/unbound/doc/unbound.8
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND" "8" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND" "8" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound \- Unbound DNS validating resolver 1.26.0.
unbound \- Unbound DNS validating resolver 1.26.1.
.SH SYNOPSIS
.sp
\fBunbound\fP [\fB\-hdpVv\fP] [\fB\-c <cfgfile>\fP]
contrib/unbound/doc/unbound.8.in
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND" "8" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND" "8" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound \- Unbound DNS validating resolver 1.26.0.
unbound \- Unbound DNS validating resolver 1.26.1.
.SH SYNOPSIS
.sp
\fBunbound\fP [\fB\-hdpVv\fP] [\fB\-c <cfgfile>\fP]
contrib/unbound/doc/unbound.conf.5
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND.CONF" "5" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND.CONF" "5" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound.conf \- Unbound 1.26.0 configuration file.
unbound.conf \- Unbound 1.26.1 configuration file.
.SH SYNOPSIS
.sp
\fBunbound.conf\fP
contrib/unbound/doc/unbound.conf.5.in
+2 -2
View File
@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "UNBOUND.CONF" "5" "Aug 4, 2026" "1.26.0" "Unbound"
.TH "UNBOUND.CONF" "5" "Sep 16, 2026" "1.26.1" "Unbound"
.SH NAME
unbound.conf \- Unbound 1.26.0 configuration file.
unbound.conf \- Unbound 1.26.1 configuration file.
.SH SYNOPSIS
.sp
\fBunbound.conf\fP
contrib/unbound/doc/unbound.conf.rst
+21 -1
View File
@@ -2320,7 +2320,7 @@ These options are part of the ``server:`` section.
Use this setting to protect the users that rely on this validator for
authentication from potentially bad data in the additional section.
Default: yes
Default: no
@@[email protected]@val-log-level@@: *<number>*
@@ -3358,6 +3358,26 @@ These options are part of the ``server:`` section.
Default: yes
@@[email protected]@val-validation-attempts@@: *<number>*
Limit on the number of DNSSEC validation attempts for a query.
This protects against too large numbers of cryptographic operations,
like for a deep delegation chain.
This counts attempts to validate RRSIGs.
When it is exceeded, the query fails.
Default: 32
@@[email protected]@val-hash-attempts@@: *<number>*
Limit on the number of DNSSEC hash attempts for a query.
This protects against too large numbers of cryptographic operations,
like for a deep delegation chain.
This counts DS hash attempts to match DNSKEYs.
When it is exceeded, the query fails.
Default: 32
@@[email protected]@fast-server-permil@@: *<number>*
Specify how many times out of 1000 to pick from the set of fastest servers.
0 turns the feature off.
contrib/unbound/iterator/iter_scrub.c
+19 -1
View File
@@ -294,7 +294,14 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
if(ttl_t > MAX_TTL) ttl_t = MAX_TTL;
ttl = (uint32_t)ttl_t;
sldns_write_uint32(cn->rr_first->ttl_data, ttl);
sldns_write_uint32(rrset->rr_first->ttl_data, ttl);
/* Do NOT write the clamp back into the packet buffer:
* parse_packet already sized every name from the original
* bytes and rdata_copy re-walks them trusting those sizes;
* mutating packet bytes between the walks breaks that
* invariant (compression pointers can target these TTL
* bytes). The DNAME rrset receives the same clamp at store
* time in rdata_copy, so the DNAME and the synthesized
* CNAME still carry equal TTLs in the cache. */
}
sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
@@ -648,6 +655,9 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
if(rrset->type == LDNS_RR_TYPE_NS &&
rrset->rr_count > env->cfg->iter_scrub_ns) {
shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
} else if(rrset->type == LDNS_RR_TYPE_DS &&
rrset->rr_count > env->cfg->iter_scrub_ns) {
shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
}
prev = rrset;
rrset = rrset->rrset_all_next;
@@ -667,6 +677,9 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
if(rrset->type == LDNS_RR_TYPE_NS &&
rrset->rr_count > env->cfg->iter_scrub_ns) {
shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
} else if(rrset->type == LDNS_RR_TYPE_DS &&
rrset->rr_count > env->cfg->iter_scrub_ns) {
shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
}
/* Mark the additional names from relevant rrset as OK. */
@@ -791,6 +804,11 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
shorten_rrset(pkt, rrset, env->cfg->iter_scrub_ns);
}
}
} else if(rrset->type==LDNS_RR_TYPE_DS) {
if(rrset->rr_count > env->cfg->iter_scrub_ns) {
shorten_rrset(pkt, rrset,
env->cfg->iter_scrub_ns);
}
}
/* if this is type DS and we query for type DS we just got
* a referral answer for our type DS query, fix packet */
contrib/unbound/services/authzone.c
+177 -67
View File
@@ -392,6 +392,20 @@ auth_data_del(rbnode_type* n, void* ATTR_UNUSED(arg))
auth_data_delete(z);
}
/** delete chunklist */
static void
auth_chunk_list_delete(struct auth_chunk* first)
{
struct auth_chunk* c, *cn;
c = first;
while(c) {
cn = c->next;
free(c->data);
free(c);
c = cn;
}
}
/** delete an auth zone structure (tree remove must be done elsewhere) */
static void
auth_zone_delete(struct auth_zone* z, struct auth_zones* az)
@@ -413,6 +427,7 @@ auth_zone_delete(struct auth_zone* z, struct auth_zones* az)
}
if(z->rpz)
rpz_delete(z->rpz);
auth_chunk_list_delete(z->perform_write_chunk_list);
free(z->name);
free(z->zonefile);
free(z);
@@ -2369,14 +2384,7 @@ static void
auth_chunks_delete(struct auth_transfer* at)
{
if(at->chunks_first) {
struct auth_chunk* c, *cn;
c = at->chunks_first;
while(c) {
cn = c->next;
free(c->data);
free(c);
c = cn;
}
auth_chunk_list_delete(at->chunks_first);
}
at->chunks_first = NULL;
at->chunks_last = NULL;
@@ -3593,7 +3601,13 @@ int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo,
*fallback = 1;
return 0;
}
if(z->zone_expired) {
if(z->zone_expired || (z->zonemd_check && z->zonemd_callback_env)) {
/* Do not serve from a zonemd-check zone while its ZONEMD
* verification is still pending: the content is not yet known
* to pass the configured check. The pending marker
* (zonemd_callback_env) is set under z->lock when the async
* lookup is spawned and cleared by the callback under z->lock,
* so this test is race-free. */
*fallback = z->fallback_enabled;
lock_rw_unlock(&z->lock);
return 0;
@@ -3695,7 +3709,10 @@ int auth_zones_downstream_answer(struct auth_zones* az, struct module_env* env,
lock_rw_unlock(&z->lock);
return 0;
}
if(z->zone_expired) {
if(z->zone_expired || (z->zonemd_check && z->zonemd_callback_env)) {
/* see auth_zones_lookup: a pending ZONEMD verification is
* treated like expiry - the zone content is not yet known
* to pass the configured check. */
if(z->fallback_enabled) {
lock_rw_unlock(&z->lock);
return 0;
@@ -5299,7 +5316,7 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
/** write http chunks to zonefile to create downloaded file */
static int
auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
auth_zone_write_chunks(struct auth_chunk* chunk_list, const char* fname)
{
FILE* out;
struct auth_chunk* p;
@@ -5308,7 +5325,7 @@ auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
log_err("could not open %s: %s", fname, strerror(errno));
return 0;
}
for(p = xfr->task_transfer->chunks_first; p ; p = p->next) {
for(p = chunk_list; p ; p = p->next) {
if(!write_out(out, (char*)p->data, p->len)) {
log_err("could not write http download to %s", fname);
fclose(out);
@@ -5319,14 +5336,91 @@ auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
return 1;
}
/** write to zonefile after zone has been updated */
/** write to zonefile after zone has been updated, z has rdlock by caller. */
static void
xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
zone_write_after_update(struct auth_zone* z, struct module_env* env,
struct auth_chunk* chunk_list)
{
struct config_file* cfg = env->cfg;
struct auth_zone* z;
char tmpfile[1024];
char* zfilename;
if(z->zonefile == NULL || z->zonefile[0] == 0) {
/* no write needed, no zonefile set */
auth_chunk_list_delete(chunk_list);
return;
}
zfilename = z->zonefile;
if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
zfilename += strlen(cfg->chrootdir);
if(verbosity >= VERB_ALGO) {
char nm[LDNS_MAX_DOMAINLEN];
dname_str(z->name, nm);
verbose(VERB_ALGO, "write zonefile %s for %s", zfilename, nm);
}
/* write to tempfile first */
if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) {
verbose(VERB_ALGO, "tmpfilename too long, cannot update "
" zonefile %s", zfilename);
auth_chunk_list_delete(chunk_list);
return;
}
snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename,
(unsigned)getpid());
if(chunk_list) {
/* use the stored chunk list to write them */
if(!auth_zone_write_chunks(chunk_list, tmpfile)) {
unlink(tmpfile);
auth_chunk_list_delete(chunk_list);
return;
}
auth_chunk_list_delete(chunk_list);
} else if(!auth_zone_write_file(z, tmpfile)) {
unlink(tmpfile);
return;
}
#ifdef UB_ON_WINDOWS
(void)unlink(zfilename); /* windows does not replace file with rename() */
#endif
if(rename(tmpfile, zfilename) < 0) {
log_err("could not rename(%s, %s): %s", tmpfile, zfilename,
strerror(errno));
unlink(tmpfile);
return;
}
}
/** write to zonefile after zone has updated, reacquires z readlock. */
static void
zone_write_after_update_reacq(uint8_t* bakname, size_t baknamelen,
uint16_t bakdclass, struct module_env* env,
struct auth_chunk* chunk_list)
{
struct auth_zone* z;
/* get lock again, so it is a readlock and concurrently queries
* can be answered */
lock_rw_rdlock(&env->auth_zones->lock);
z = auth_zone_find(env->auth_zones, bakname, baknamelen, bakdclass);
if(!z) {
lock_rw_unlock(&env->auth_zones->lock);
/* the zone is gone, ignore xfr results */
return;
}
lock_rw_rdlock(&z->lock);
lock_rw_unlock(&env->auth_zones->lock);
zone_write_after_update(z, env, chunk_list);
lock_rw_unlock(&z->lock);
}
/** write to zonefile after zone has been updated */
static void
xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env,
struct auth_chunk* chunk_list)
{
struct auth_zone* z;
lock_basic_unlock(&xfr->lock);
/* get lock again, so it is a readlock and concurrently queries
@@ -5344,52 +5438,7 @@ xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
lock_basic_lock(&xfr->lock);
lock_rw_unlock(&env->auth_zones->lock);
if(z->zonefile == NULL || z->zonefile[0] == 0) {
lock_rw_unlock(&z->lock);
/* no write needed, no zonefile set */
return;
}
zfilename = z->zonefile;
if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
zfilename += strlen(cfg->chrootdir);
if(verbosity >= VERB_ALGO) {
char nm[LDNS_MAX_DOMAINLEN];
dname_str(z->name, nm);
verbose(VERB_ALGO, "write zonefile %s for %s", zfilename, nm);
}
/* write to tempfile first */
if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) {
verbose(VERB_ALGO, "tmpfilename too long, cannot update "
" zonefile %s", zfilename);
lock_rw_unlock(&z->lock);
return;
}
snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename,
(unsigned)getpid());
if(xfr->task_transfer->master->http) {
/* use the stored chunk list to write them */
if(!auth_zone_write_chunks(xfr, tmpfile)) {
unlink(tmpfile);
lock_rw_unlock(&z->lock);
return;
}
} else if(!auth_zone_write_file(z, tmpfile)) {
unlink(tmpfile);
lock_rw_unlock(&z->lock);
return;
}
#ifdef UB_ON_WINDOWS
(void)unlink(zfilename); /* windows does not replace file with rename() */
#endif
if(rename(tmpfile, zfilename) < 0) {
log_err("could not rename(%s, %s): %s", tmpfile, zfilename,
strerror(errno));
unlink(tmpfile);
lock_rw_unlock(&z->lock);
return;
}
zone_write_after_update(z, env, chunk_list);
lock_rw_unlock(&z->lock);
}
@@ -5422,6 +5471,8 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
int* ixfr_fail)
{
struct auth_zone* z;
int zonemd_in_progress;
struct auth_chunk* current_chunk_list = NULL;
/* obtain locks and structures */
lock_basic_unlock(&xfr->lock);
@@ -5505,6 +5556,25 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
if(z->rpz)
rpz_finish_config(z->rpz);
if(z->zonemd_check && z->zonemd_callback_env) {
zonemd_in_progress = 1;
z->zonemd_callback_perform_write = 1;
auth_chunk_list_delete(z->perform_write_chunk_list);
z->perform_write_chunk_list = NULL;
if(xfr->task_transfer->master->http) {
z->perform_write_chunk_list = xfr->task_transfer->chunks_first;
xfr->task_transfer->chunks_first = NULL;
auth_chunks_delete(xfr->task_transfer);
}
} else {
zonemd_in_progress = 0;
z->zonemd_callback_perform_write = 0;
if(xfr->task_transfer->master->http) {
current_chunk_list = xfr->task_transfer->chunks_first;
xfr->task_transfer->chunks_first = NULL;
auth_chunks_delete(xfr->task_transfer);
}
}
/* unlock */
lock_rw_unlock(&z->lock);
@@ -5515,7 +5585,9 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
(unsigned)xfr->serial);
}
/* see if we need to write to a zonefile */
xfr_write_after_update(xfr, env);
if(!zonemd_in_progress) {
xfr_write_after_update(xfr, env, current_chunk_list);
}
return 1;
}
@@ -8162,7 +8234,8 @@ static int zonemd_dnssec_verify_rrset(struct auth_zone* z,
"zonemd: verify %s RRset with DNSKEY", typestr);
}
sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, sigalg, why_bogus, NULL,
LDNS_SECTION_ANSWER, NULL, &verified, reasonbuf, reasonlen);
LDNS_SECTION_ANSWER, NULL, NULL, &verified, reasonbuf,
reasonlen);
if(sec == sec_status_secure) {
return 1;
}
@@ -8511,8 +8584,8 @@ zonemd_get_dnskey_from_anchor(struct auth_zone* z, struct module_env* env,
auth_zone_log(z->name, VERB_QUERY,
"zonemd: verify DNSKEY RRset with trust anchor");
sec = val_verify_DNSKEY_with_TA(env, ve, keystorage, anchor->ds_rrset,
anchor->dnskey_rrset, NULL, why_bogus, NULL, NULL, reasonbuf,
reasonlen);
anchor->dnskey_rrset, NULL, why_bogus, NULL, NULL, NULL,
reasonbuf, reasonlen);
regional_free_all(env->scratch);
if(sec == sec_status_secure) {
/* success */
@@ -8572,7 +8645,7 @@ auth_zone_verify_zonemd_key_with_ds(struct auth_zone* z,
keystorage->rk.rrset_class = htons(z->dclass);
auth_zone_log(z->name, VERB_QUERY, "zonemd: verify zone DNSKEY with DS");
sec = val_verify_DNSKEY_with_DS(env, ve, keystorage, ds, sigalg,
why_bogus, NULL, NULL, reasonbuf, reasonlen);
why_bogus, NULL, NULL, NULL, reasonbuf, reasonlen);
regional_free_all(env->scratch);
if(sec == sec_status_secure) {
/* success */
@@ -8601,9 +8674,13 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
char reasonbuf[256];
char* reason = NULL, *ds_bogus = NULL, *typestr="DNSKEY";
struct ub_packed_rrset_key* dnskey = NULL, *ds = NULL;
int is_insecure = 0, downprot;
int is_insecure = 0, downprot, perform_write = 0;
struct ub_packed_rrset_key keystorage;
uint8_t sigalg[ALGO_NEEDS_MAX+1];
uint8_t bakname[LDNS_MAX_DOMAINLEN];
size_t baknamelen;
uint16_t bakdclass;
struct auth_chunk* chunk_list = NULL;
lock_rw_wrlock(&z->lock);
env = z->zonemd_callback_env;
@@ -8726,7 +8803,37 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
auth_zone_verify_zonemd_with_key(z, env, &env->mesh->mods, dnskey,
is_insecure, NULL, downprot?sigalg:NULL);
regional_free_all(env->scratch);
if(z->zonemd_callback_perform_write) {
if(!z->zone_expired) {
/* Write to zonefile if the ZONEMD is okay. */
perform_write = 1;
/* copy the key to lookup the z structure.
* The new lookup is readonly so concurrent
* queries can continue. */
if(z->namelen > sizeof(bakname)) {
perform_write = 0;
auth_chunk_list_delete(z->perform_write_chunk_list);
z->perform_write_chunk_list = NULL;
} else {
memcpy(bakname, z->name, z->namelen);
baknamelen = z->namelen;
bakdclass = z->dclass;
chunk_list = z->perform_write_chunk_list;
z->perform_write_chunk_list = NULL;
}
} else {
auth_chunk_list_delete(z->perform_write_chunk_list);
z->perform_write_chunk_list = NULL;
}
z->zonemd_callback_perform_write = 0;
}
lock_rw_unlock(&z->lock);
if(perform_write) {
zone_write_after_update_reacq(bakname, baknamelen, bakdclass,
env, chunk_list);
}
}
/** lookup DNSKEY for ZONEMD verification */
@@ -8794,6 +8901,9 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env)
&auth_zonemd_dnskey_lookup_callback, z, 0,
&z->zonemd_callback_unique_info)) {
lock_rw_wrlock(&z->lock);
/* no callback will run; do not leave the pending
* marker set */
z->zonemd_callback_env = NULL;
log_err("out of memory lookup of %s for zonemd",
(fetch_ds?"DS":"DNSKEY"));
return 0;
contrib/unbound/services/authzone.h
+4
View File
@@ -146,6 +146,10 @@ struct auth_zone {
uint16_t zonemd_callback_qtype;
/** for the zonemd callback, the unique info */
void* zonemd_callback_unique_info;
/** if the zonemd callback should write to file */
int zonemd_callback_perform_write;
/** chunklist to write for chunked transfer. */
struct auth_chunk* perform_write_chunk_list;
/** zone has been deleted */
int zone_deleted;
/** deletelist pointer, unused normally except during delete */
contrib/unbound/services/cache/dns.c
Vendored
+1 -1
View File
@@ -677,7 +677,7 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
rrset_array_unlock(r->ref, r->rrset_count);
return NULL;
}
if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
if(r->security == sec_status_secure && !reply_an_ns_rrsets_secure(r)) {
/* message rrsets have changed status, revalidate */
rrset_array_unlock(r->ref, r->rrset_count);
return NULL;
contrib/unbound/services/listen_dnsport.c
+12 -2
View File
@@ -2133,7 +2133,7 @@ void listen_start_accept(struct listen_dnsport* listen)
}
struct tcp_req_info*
tcp_req_info_create(struct sldns_buffer* spoolbuf)
tcp_req_info_create(struct comm_base* base, struct sldns_buffer* spoolbuf)
{
struct tcp_req_info* req = (struct tcp_req_info*)malloc(sizeof(*req));
if(!req) {
@@ -2141,6 +2141,12 @@ tcp_req_info_create(struct sldns_buffer* spoolbuf)
return NULL;
}
memset(req, 0, sizeof(*req));
req->read_again_timer = comm_timer_create(base, tcp_read_again_cb, req);
if(!req->read_again_timer) {
log_err("malloc failure");
free(req);
return NULL;
}
req->spool_buffer = spoolbuf;
return req;
}
@@ -2150,6 +2156,7 @@ tcp_req_info_delete(struct tcp_req_info* req)
{
if(!req) return;
tcp_req_info_clear(req);
comm_timer_delete(req->read_again_timer);
/* cp is pointer back to commpoint that owns this struct and
* called delete on us */
/* spool_buffer is shared udp buffer, not deleted here */
@@ -2189,6 +2196,9 @@ void tcp_req_info_clear(struct tcp_req_info* req)
req->done_req_list = NULL;
req->num_done_req = 0;
req->read_is_closed = 0;
if(comm_timer_is_set(req->read_again_timer))
comm_timer_disable(req->read_again_timer);
}
void
@@ -4504,7 +4514,7 @@ doq_stream_reset_cb(ngtcp2_conn* ATTR_UNUSED(conn), int64_t stream_id,
"unknown stream %d", (int)stream_id);
return 0;
}
if(!doq_stream_close(doq_conn, stream, 0))
if(!doq_stream_close(doq_conn, stream, 1))
return NGTCP2_ERR_CALLBACK_FAILURE;
return 0;
}
contrib/unbound/services/listen_dnsport.h
+7 -1
View File
@@ -347,6 +347,10 @@ struct tcp_req_info {
int num_done_req;
/** list of pending writable result packets, malloced one at a time */
struct tcp_req_done_item* done_req_list;
/** the read again timer, when the number of pipelined TCP queries
* is large, it waits, zero time, for a new event loop to service
* the remainder of the TCP traffic on the fd. */
struct comm_timer* read_again_timer;
};
/**
@@ -377,10 +381,12 @@ struct tcp_req_done_item {
* Create tcp request info structure that keeps track of open
* requests on the TCP channel that are resolved at the same time,
* and the pending results that have to get written back to that client.
* @param base: comm base for read again timer.
* @param spoolbuf: shared buffer
* @return new structure or NULL on alloc failure.
*/
struct tcp_req_info* tcp_req_info_create(struct sldns_buffer* spoolbuf);
struct tcp_req_info* tcp_req_info_create(struct comm_base* base,
struct sldns_buffer* spoolbuf);
/**
* Delete tcp request structure. Called by owning commpoint.
contrib/unbound/services/mesh.c
+73 -75
View File
@@ -373,7 +373,7 @@ mesh_serve_expired_lookup(struct module_qstate* qstate,
"validation");
goto bail_out; /* need to validate cache entry first */
} else if(msg->rep->security == sec_status_secure &&
!reply_all_rrsets_secure(msg->rep) && must_validate) {
!reply_an_ns_rrsets_secure(msg->rep) && must_validate) {
verbose(VERB_ALGO, "Serve expired: secure entry"
" changed status");
goto bail_out; /* rrset changed, re-verify */
@@ -1097,6 +1097,18 @@ mesh_state_make_unique(struct mesh_state* mstate)
mstate->unique = mstate;
}
/** pop a reply from the reply list, if there are any. */
static struct mesh_reply*
mesh_reply_list_pop_first(struct mesh_state* mstate)
{
if(mstate->reply_list) {
struct mesh_reply* r = mstate->reply_list;
mstate->reply_list = r->next;
return r;
}
return NULL;
}
void
mesh_state_cleanup(struct mesh_state* mstate)
{
@@ -1112,15 +1124,30 @@ mesh_state_cleanup(struct mesh_state* mstate)
}
/* drop unsent replies */
if(!mstate->replies_sent) {
struct mesh_reply* rep = mstate->reply_list;
struct mesh_reply* rep;
struct mesh_cb* cb;
/* in tcp_req_info, the mstates linked are removed, but
* the reply_list is now NULL, so the remove-from-empty-list
* takes no time and also it does not do the mesh accounting */
mstate->reply_list = NULL;
for(; rep; rep=rep->next) {
/* Pop items from the list, that means there is no iterator.
* And then items can be removed from the reply list, from
* like comm_point_drop_reply and comm_point_close calls.
* As the tcp_req_info and http2 code drops the entire
* connection. That could delete mesh_reply items previous and
* after the current state. The previous items are already
* popped. And the next items can be altered, like to when a
* connection has more replies on the reply list.
* The current item is also popped so the code needs to
* remove its references. */
while((rep = mesh_reply_list_pop_first(mstate)) != NULL) {
infra_wait_limit_dec(mesh->env->infra_cache,
&rep->query_reply, mesh->env->cfg);
if(rep->query_reply.c->tcp_req_info)
tcp_req_info_remove_mesh_state(
rep->query_reply.c->tcp_req_info,
mstate);
else if(rep->query_reply.c->use_h2)
http2_stream_remove_mesh_state(rep->h2_stream);
else if(rep->query_reply.doq_stream)
doq_stream_remove_mesh_state(
rep->query_reply.doq_stream);
comm_point_drop_reply(&rep->query_reply);
log_assert(mesh->num_reply_addrs > 0);
mesh->num_reply_addrs--;
@@ -1484,12 +1511,6 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
struct timeval end_time;
struct timeval duration;
int secure;
/* briefly set the replylist to null in case the
* meshsendreply calls tcpreqinfo sendreply that
* comm_point_drops because of size, and then the
* null stops the mesh state remove and thus
* reply_list modification and accounting */
struct mesh_reply* rlist = m->reply_list;
/* rpz: apply actions */
rcode = mesh_is_udp(r) && mesh_is_rpz_respip_tcponly_action(m)
@@ -1546,9 +1567,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
sldns_buffer_write_at(r_buffer, 0, &r->qid, sizeof(uint16_t));
sldns_buffer_write_at(r_buffer, 12, r->qname,
m->s.qinfo.qname_len);
m->reply_list = NULL;
comm_point_send_reply(&r->query_reply);
m->reply_list = rlist;
} else if(rcode) {
m->s.qinfo.qname = r->qname;
m->s.qinfo.local_alias = r->local_alias;
@@ -1570,9 +1589,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
}
error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
r->qflags, &r->edns);
m->reply_list = NULL;
comm_point_send_reply(&r->query_reply);
m->reply_list = rlist;
} else {
size_t udp_size = r->edns.udp_size;
r->edns.edns_version = EDNS_ADVERTISED_VERSION;
@@ -1608,9 +1625,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
&m->s.qinfo, r->qid, r->qflags, &r->edns);
}
m->reply_list = NULL;
comm_point_send_reply(&r->query_reply);
m->reply_list = rlist;
}
infra_wait_limit_dec(m->s.env->infra_cache, &r->query_reply,
m->s.env->cfg);
@@ -1762,6 +1777,7 @@ void mesh_query_done(struct mesh_state* mstate)
struct reply_info* rep = (mstate->s.return_msg?
mstate->s.return_msg->rep:NULL);
struct timeval tv = {0, 0};
struct mesh_area* mesh = mstate->s.env->mesh;
int i = 0;
/* No need for the serve expired timer anymore; we are going to reply. */
if(mstate->s.serve_expired_data) {
@@ -1786,7 +1802,18 @@ void mesh_query_done(struct mesh_state* mstate)
&& (!rep || rep->security != sec_status_secure))
dns_error_reporting(&mstate->s, rep);
for(r = mstate->reply_list; r; r = r->next) {
while((r = mesh_reply_list_pop_first(mstate)) != NULL) {
/* it was not detached (because it had a reply list), could be now */
if(!mstate->reply_list && !mstate->cb_list
&& mstate->super_set.count == 0) {
mesh->num_detached_states++;
}
/* if not replies any more in mstate, it is no longer a reply_state */
if(!mstate->reply_list && !mstate->cb_list) {
log_assert(mesh->num_reply_states > 0);
mesh->num_reply_states--;
}
if(mesh_is_udp(r)) {
/* For UDP queries, the old replies are discarded.
* This stops a large volume of old replies from
@@ -1801,22 +1828,18 @@ void mesh_query_done(struct mesh_state* mstate)
((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
mstate->s.env->cfg->discard_timeout) {
/* Drop the reply, it is too old */
/* briefly set the reply_list to NULL, so that the
* tcp req info cleanup routine that calls the mesh
* to deregister the meshstate for it is not done
* because the list is NULL and also accounting is not
* done there, but instead we do that here. */
struct mesh_reply* reply_list = mstate->reply_list;
verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
infra_wait_limit_dec(mstate->s.env->infra_cache,
&r->query_reply, mstate->s.env->cfg);
mstate->reply_list = NULL;
if(r->query_reply.c->use_h2)
if(r->query_reply.c->tcp_req_info)
tcp_req_info_remove_mesh_state(
r->query_reply.c->tcp_req_info,
mstate);
else if(r->query_reply.c->use_h2)
http2_stream_remove_mesh_state(r->h2_stream);
else if(r->query_reply.doq_stream)
doq_stream_remove_mesh_state(r->query_reply.doq_stream);
comm_point_drop_reply(&r->query_reply);
mstate->reply_list = reply_list;
log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
mstate->s.env->mesh->num_reply_addrs--;
mstate->s.env->mesh->num_queries_discard_timeout++;
@@ -1841,22 +1864,17 @@ void mesh_query_done(struct mesh_state* mstate)
/* if this query is determined to be dropped during the
* mesh processing, this is the point to take that action. */
if(mstate->s.is_drop) {
/* briefly set the reply_list to NULL, so that the
* tcp req info cleanup routine that calls the mesh
* to deregister the meshstate for it is not done
* because the list is NULL and also accounting is not
* done there, but instead we do that here. */
struct mesh_reply* reply_list = mstate->reply_list;
infra_wait_limit_dec(mstate->s.env->infra_cache,
&r->query_reply, mstate->s.env->cfg);
mstate->reply_list = NULL;
if(r->query_reply.c->use_h2) {
if(r->query_reply.c->tcp_req_info) {
tcp_req_info_remove_mesh_state(
r->query_reply.c->tcp_req_info, mstate);
} else if(r->query_reply.c->use_h2) {
http2_stream_remove_mesh_state(r->h2_stream);
} else if(r->query_reply.doq_stream) {
doq_stream_remove_mesh_state(r->query_reply.doq_stream);
}
comm_point_drop_reply(&r->query_reply);
mstate->reply_list = reply_list;
log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
mstate->s.env->mesh->num_reply_addrs--;
} else {
@@ -1897,18 +1915,6 @@ void mesh_query_done(struct mesh_state* mstate)
}
}
/* Mesh area accounting */
if(mstate->reply_list) {
mstate->reply_list = NULL;
if(!mstate->reply_list && !mstate->cb_list) {
/* was a reply state, not anymore */
log_assert(mstate->s.env->mesh->num_reply_states > 0);
mstate->s.env->mesh->num_reply_states--;
}
if(!mstate->reply_list && !mstate->cb_list &&
mstate->super_set.count == 0)
mstate->s.env->mesh->num_detached_states++;
}
mstate->replies_sent = 1;
while((c = mstate->cb_list) != NULL) {
@@ -2498,7 +2504,6 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
}
}
static int
apply_respip_action(struct module_qstate* qstate,
const struct query_info* qinfo, struct respip_client_info* cinfo,
@@ -2631,7 +2636,18 @@ mesh_serve_expired_callback(void* arg)
if(verbosity >= VERB_ALGO)
log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
for(r = mstate->reply_list; r; r = r->next) {
while((r = mesh_reply_list_pop_first(mstate)) != NULL) {
/* it was not detached (because it had a reply list), could be now */
if(!mstate->reply_list && !mstate->cb_list
&& mstate->super_set.count == 0) {
mesh->num_detached_states++;
}
/* if not replies any more in mstate, it is no longer a reply_state */
if(!mstate->reply_list && !mstate->cb_list) {
log_assert(mesh->num_reply_states > 0);
mesh->num_reply_states--;
}
if(mesh_is_udp(r)) {
struct timeval old;
timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
@@ -2639,22 +2655,17 @@ mesh_serve_expired_callback(void* arg)
((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
mstate->s.env->cfg->discard_timeout) {
/* Drop the reply, it is too old */
/* briefly set the reply_list to NULL, so that the
* tcp req info cleanup routine that calls the mesh
* to deregister the meshstate for it is not done
* because the list is NULL and also accounting is not
* done there, but instead we do that here. */
struct mesh_reply* reply_list = mstate->reply_list;
verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
infra_wait_limit_dec(mstate->s.env->infra_cache,
&r->query_reply, mstate->s.env->cfg);
mstate->reply_list = NULL;
if(r->query_reply.c->use_h2)
if(r->query_reply.c->tcp_req_info)
tcp_req_info_remove_mesh_state(
r->query_reply.c->tcp_req_info, mstate);
else if(r->query_reply.c->use_h2)
http2_stream_remove_mesh_state(r->h2_stream);
else if(r->query_reply.doq_stream)
doq_stream_remove_mesh_state(r->query_reply.doq_stream);
comm_point_drop_reply(&r->query_reply);
mstate->reply_list = reply_list;
log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
mstate->s.env->mesh->num_reply_addrs--;
mstate->s.env->mesh->num_queries_discard_timeout++;
@@ -2692,8 +2703,7 @@ mesh_serve_expired_callback(void* arg)
if(r->query_reply.c->tcp_req_info)
tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
/* mesh_send_reply removed mesh state from http2_stream. */
infra_wait_limit_dec(mstate->s.env->infra_cache,
&r->query_reply, mstate->s.env->cfg);
/* mesh_send_reply decremented wait_limit. */
prev = r;
prev_buffer = r_buffer;
}
@@ -2712,18 +2722,6 @@ mesh_serve_expired_callback(void* arg)
}
}
/* Mesh area accounting */
if(mstate->reply_list) {
mstate->reply_list = NULL;
if(!mstate->reply_list && !mstate->cb_list) {
log_assert(mesh->num_reply_states > 0);
mesh->num_reply_states--;
if(mstate->super_set.count == 0) {
mesh->num_detached_states++;
}
}
}
while((c = mstate->cb_list) != NULL) {
/* take this cb off the list; so that the list can be
* changed, eg. by adds from the callback routine */
contrib/unbound/util/config_file.c
+7 -1
View File
@@ -278,7 +278,7 @@ config_create(void)
cfg->val_sig_skew_min = 3600; /* at least daylight savings trouble */
cfg->val_sig_skew_max = 86400; /* at most timezone settings trouble */
cfg->val_max_restart = 5;
cfg->val_clean_additional = 1;
cfg->val_clean_additional = 0; /* off to protect against much data. */
cfg->val_log_level = 0;
cfg->val_log_squelch = 0;
cfg->val_permissive_mode = 0;
@@ -429,6 +429,8 @@ config_create(void)
cfg->iter_scrub_rrsig = 8;
cfg->iter_scrub_promiscuous = 1;
cfg->max_global_quota = 200;
cfg->val_validation_attempts = 32;
cfg->val_hash_attempts = 32;
return cfg;
error_exit:
config_delete(cfg);
@@ -785,6 +787,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
else S_NUMBER_OR_ZERO("iter-scrub-rrsig:", iter_scrub_rrsig)
else S_YNO("iter-scrub-promiscuous:", iter_scrub_promiscuous)
else S_NUMBER_OR_ZERO("max-global-quota:", max_global_quota)
else S_NUMBER_OR_ZERO("val-validation-attempts:", val_validation_attempts)
else S_NUMBER_OR_ZERO("val-hash-attempts:", val_hash_attempts)
else S_YNO("serve-original-ttl:", serve_original_ttl)
else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
else S_YNO("zonemd-permissive-mode:", zonemd_permissive_mode)
@@ -1265,6 +1269,8 @@ config_get_option(struct config_file* cfg, const char* opt,
else O_DEC(opt, "iter-scrub-rrsig", iter_scrub_rrsig)
else O_YNO(opt, "iter-scrub-promiscuous", iter_scrub_promiscuous)
else O_DEC(opt, "max-global-quota", max_global_quota)
else O_DEC(opt, "val-validation-attempts", val_validation_attempts)
else O_DEC(opt, "val-hash-attempts", val_hash_attempts)
else O_YNO(opt, "serve-original-ttl", serve_original_ttl)
else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
else O_YNO(opt, "zonemd-permissive-mode", zonemd_permissive_mode)
contrib/unbound/util/config_file.h
+4
View File
@@ -798,6 +798,10 @@ struct config_file {
int iter_scrub_rrsig;
/** limit on upstream queries for an incoming query and subqueries. */
int max_global_quota;
/** limit on validator validation attempts. */
int val_validation_attempts;
/** limit on validator hash attempts. */
int val_hash_attempts;
/** Should the iterator scrub promiscuous NS rrsets, from positive
* answers. */
int iter_scrub_promiscuous;
contrib/unbound/util/configlexer.c
+3727 -3671
View File
File diff suppressed because it is too large. Load diff
contrib/unbound/util/configlexer.lex
+2
View File
@@ -609,6 +609,8 @@ iter-scrub-ns{COLON} { YDVAR(1, VAR_ITER_SCRUB_NS) }
iter-scrub-cname{COLON} { YDVAR(1, VAR_ITER_SCRUB_CNAME) }
iter-scrub-rrsig{COLON} { YDVAR(1, VAR_ITER_SCRUB_RRSIG) }
max-global-quota{COLON} { YDVAR(1, VAR_MAX_GLOBAL_QUOTA) }
val-validation-attempts{COLON} { YDVAR(1, VAR_VAL_VALIDATION_ATTEMPTS) }
val-hash-attempts{COLON} { YDVAR(1, VAR_VAL_HASH_ATTEMPTS) }
max-transfer-size{COLON} { YDVAR(1, VAR_MAX_TRANSFER_SIZE) }
max-transfer-time{COLON} { YDVAR(1, VAR_MAX_TRANSFER_TIME) }
iter-scrub-promiscuous{COLON} { YDVAR(1, VAR_ITER_SCRUB_PROMISCUOUS) }
contrib/unbound/util/configparser.c
+2070 -2037
View File
File diff suppressed because it is too large. Load diff
contrib/unbound/util/configparser.h
+9 -5
View File
@@ -432,8 +432,10 @@ extern int yydebug;
VAR_MAX_GLOBAL_QUOTA = 633, /* VAR_MAX_GLOBAL_QUOTA */
VAR_HARDEN_UNVERIFIED_GLUE = 634, /* VAR_HARDEN_UNVERIFIED_GLUE */
VAR_LOG_TIME_ISO = 635, /* VAR_LOG_TIME_ISO */
VAR_ITER_SCRUB_PROMISCUOUS = 636, /* VAR_ITER_SCRUB_PROMISCUOUS */
VAR_LOG_THREAD_ID = 637 /* VAR_LOG_THREAD_ID */
VAR_VAL_VALIDATION_ATTEMPTS = 636, /* VAR_VAL_VALIDATION_ATTEMPTS */
VAR_VAL_HASH_ATTEMPTS = 637, /* VAR_VAL_HASH_ATTEMPTS */
VAR_ITER_SCRUB_PROMISCUOUS = 638, /* VAR_ITER_SCRUB_PROMISCUOUS */
VAR_LOG_THREAD_ID = 639 /* VAR_LOG_THREAD_ID */
};
typedef enum yytokentype yytoken_kind_t;
#endif
@@ -820,8 +822,10 @@ extern int yydebug;
#define VAR_MAX_GLOBAL_QUOTA 633
#define VAR_HARDEN_UNVERIFIED_GLUE 634
#define VAR_LOG_TIME_ISO 635
#define VAR_ITER_SCRUB_PROMISCUOUS 636
#define VAR_LOG_THREAD_ID 637
#define VAR_VAL_VALIDATION_ATTEMPTS 636
#define VAR_VAL_HASH_ATTEMPTS 637
#define VAR_ITER_SCRUB_PROMISCUOUS 638
#define VAR_LOG_THREAD_ID 639
/* Value type. */
#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -831,7 +835,7 @@ union YYSTYPE
char* str;
#line 835 "util/configparser.h"
#line 839 "util/configparser.h"
};
typedef union YYSTYPE YYSTYPE;
contrib/unbound/util/configparser.y
+21 -1
View File
@@ -218,6 +218,7 @@ extern struct config_parser_state* cfg_parser;
%token VAR_ITER_SCRUB_RRSIG
%token VAR_MAX_TRANSFER_SIZE VAR_MAX_TRANSFER_TIME
%token VAR_MAX_GLOBAL_QUOTA VAR_HARDEN_UNVERIFIED_GLUE VAR_LOG_TIME_ISO
%token VAR_VAL_VALIDATION_ATTEMPTS VAR_VAL_HASH_ATTEMPTS
%token VAR_ITER_SCRUB_PROMISCUOUS VAR_LOG_THREAD_ID
%%
@@ -360,7 +361,8 @@ content_server: server_num_threads | server_verbosity | server_port |
server_harden_unknown_additional | server_disable_edns_do |
server_log_destaddr | server_cookie_secret_file |
server_iter_scrub_ns | server_iter_scrub_cname | server_max_global_quota |
server_iter_scrub_rrsig |
server_val_validation_attempts |
server_val_hash_attempts | server_iter_scrub_rrsig |
server_harden_unverified_glue | server_log_time_iso | server_iter_scrub_promiscuous
;
stub_clause: stubstart contents_stub
@@ -4317,6 +4319,24 @@ server_iter_scrub_promiscuous: VAR_ITER_SCRUB_PROMISCUOUS STRING_ARG
free($2);
}
;
server_val_validation_attempts: VAR_VAL_VALIDATION_ATTEMPTS STRING_ARG
{
OUTYY(("P(server_val_validation_attempts:%s)\n", $2));
if(atoi($2) == 0 && strcmp($2, "0") != 0)
yyerror("number expected");
else cfg_parser->cfg->val_validation_attempts = atoi($2);
free($2);
}
;
server_val_hash_attempts: VAR_VAL_HASH_ATTEMPTS STRING_ARG
{
OUTYY(("P(server_val_hash_attempts:%s)\n", $2));
if(atoi($2) == 0 && strcmp($2, "0") != 0)
yyerror("number expected");
else cfg_parser->cfg->val_hash_attempts = atoi($2);
free($2);
}
;
ipsetstart: VAR_IPSET
{
OUTYY(("\nP(ipset:)\n"));
contrib/unbound/util/data/dname.c
+14 -7
View File
@@ -192,34 +192,34 @@ pkt_dname_len(sldns_buffer* pkt)
while(1) {
/* read next label */
if(sldns_buffer_remaining(pkt) < 1)
return 0;
goto fail;
labellen = sldns_buffer_read_u8(pkt);
if(LABEL_IS_PTR(labellen)) {
/* compression ptr */
uint16_t ptr;
if(sldns_buffer_remaining(pkt) < 1)
return 0;
goto fail;
ptr = PTR_OFFSET(labellen, sldns_buffer_read_u8(pkt));
if(ptrcount++ > MAX_COMPRESS_PTRS)
return 0; /* loop! */
goto fail; /* loop! */
if(sldns_buffer_limit(pkt) <= ptr)
return 0; /* out of bounds! */
goto fail; /* out of bounds! */
if(!endpos)
endpos = sldns_buffer_position(pkt);
sldns_buffer_set_position(pkt, ptr);
} else {
/* label contents */
if(labellen > 0x3f)
return 0; /* label too long */
goto fail; /* label too long */
len += 1 + labellen;
if(len > LDNS_MAX_DOMAINLEN)
return 0;
goto fail;
if(labellen == 0) {
/* end of dname */
break;
}
if(sldns_buffer_remaining(pkt) < labellen)
return 0;
goto fail;
sldns_buffer_skip(pkt, (ssize_t)labellen);
}
}
@@ -227,6 +227,13 @@ pkt_dname_len(sldns_buffer* pkt)
sldns_buffer_set_position(pkt, endpos);
return len;
fail:
/* Restore the position on failure too: callers (rdata_copy) compute
* the consumed field length from the buffer position and must not
* see a partial walk of a name that failed to parse. */
if(endpos)
sldns_buffer_set_position(pkt, endpos);
return 0;
}
int
contrib/unbound/util/data/msgreply.c
+40 -5
View File
@@ -248,6 +248,7 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
sldns_pkt_section section)
{
uint16_t pkt_len;
size_t tolen;
uint32_t ttl;
const sldns_rr_descriptor* desc;
@@ -293,9 +294,13 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
(rr->ttl_data - sldns_buffer_begin(pkt) + sizeof(uint32_t)));
/* insert decompressed size into rdata len stored in memory */
/* -2 because rdatalen bytes are not included. */
tolen = rr->size;
if(tolen < 2)
return 0;
pkt_len = htons(rr->size - 2);
memmove(to, &pkt_len, sizeof(uint16_t));
to += 2;
tolen -= 2;
/* read packet rdata len */
pkt_len = sldns_buffer_read_u16(pkt);
if(sldns_buffer_remaining(pkt) < pkt_len)
@@ -304,16 +309,29 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
if(pkt_len > 0 && desc && desc->_dname_count > 0) {
int count = (int)desc->_dname_count;
int rdf = 0;
size_t len;
size_t oldpos;
size_t len, dlen;
size_t oldpos, newpos;
/* decompress dnames. */
while(pkt_len > 0 && count) {
switch(desc->_wireformat[rdf]) {
case LDNS_RDF_TYPE_DNAME:
oldpos = sldns_buffer_position(pkt);
dname_pkt_copy(pkt, to,
dlen = pkt_dname_len(pkt);
if(dlen == 0)
return 0; /* malformed */
if(dlen > tolen)
return 0; /* alloc mismatch */
newpos = sldns_buffer_position(pkt);
if(oldpos > newpos)
return 0; /* should have moved forward*/
sldns_buffer_set_position(pkt, oldpos);
dname_pkt_copy(pkt, to,
sldns_buffer_current(pkt));
to += pkt_dname_len(pkt);
sldns_buffer_set_position(pkt, newpos);
to += dlen;
tolen -= dlen;
if(sldns_buffer_position(pkt)-oldpos > pkt_len)
return 0; /* malformed: walks diverged */
pkt_len -= sldns_buffer_position(pkt)-oldpos;
count--;
len = 0;
@@ -326,9 +344,12 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
break;
}
if(len) {
if(len > tolen)
return 0; /* alloc mismatch */
log_assert(len <= pkt_len);
memmove(to, sldns_buffer_current(pkt), len);
to += len;
tolen -= len;
sldns_buffer_skip(pkt, (ssize_t)len);
pkt_len -= len;
}
@@ -336,8 +357,11 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
}
}
/* copy remaining rdata */
if(pkt_len > 0)
if(pkt_len > 0) {
if(pkt_len > tolen)
return 0; /* alloc mismatch */
memmove(to, sldns_buffer_current(pkt), pkt_len);
}
return 1;
}
@@ -1115,6 +1139,17 @@ reply_all_rrsets_secure(struct reply_info* rep)
return 1;
}
int reply_an_ns_rrsets_secure(struct reply_info* rep)
{
size_t i;
for(i=0; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
if( ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
->security != sec_status_secure )
return 0;
}
return 1;
}
struct reply_info*
parse_reply_in_temp_region(sldns_buffer* pkt, struct regional* region,
struct query_info* qi)
contrib/unbound/util/data/msgreply.h
+3
View File
@@ -494,6 +494,9 @@ int reply_check_cname_chain(struct query_info* qinfo, struct reply_info* rep);
*/
int reply_all_rrsets_secure(struct reply_info* rep);
/** Check status of answer and authority section RRs. */
int reply_an_ns_rrsets_secure(struct reply_info* rep);
/**
* Find answer rrset in reply, the one matching qinfo. Follows CNAMEs, so the
* result may have a different owner name.
contrib/unbound/util/fptr_wlist.c
+2
View File
@@ -141,6 +141,8 @@ fptr_whitelist_comm_timer(void (*fptr)(void*))
#ifdef UB_ON_WINDOWS
else if(fptr == &wsvc_cron_cb) return 1;
#endif
else if(fptr == &tcp_read_again_cb) return 1;
else if(fptr == &tcp_more_read_again_cb) return 1;
else if(fptr == &auth_xfer_timer) return 1;
else if(fptr == &auth_xfer_probe_timer_callback) return 1;
else if(fptr == &auth_xfer_transfer_timer_callback) return 1;
contrib/unbound/util/netevent.c
+86 -1
View File
@@ -122,6 +122,10 @@
#define NUM_UDP_PER_SELECT 1
#endif
/** The number of TCP queries over a TCP connection, per read indication
* from select. */
#define NUM_TCP_PER_SELECT 100
/** timeout in millisec to wait for write to unblock, packets dropped after.*/
#define SEND_BLOCKED_WAIT_TIMEOUT 200
/** max number of times to wait for write to unblock, packets dropped after.*/
@@ -3226,6 +3230,26 @@ static int http2_submit_settings(struct http2_session* h2_session)
}
#endif /* HAVE_NGHTTP2 */
/** Clear http2 stream mesh states */
static void http2_session_clear_meshstate(struct http2_session* h2_session)
{
#ifdef HAVE_NGHTTP2
/* Since the session gets closed, remove the mesh state references. */
struct http2_stream* h2_stream;
for(h2_stream = h2_session->first_stream; h2_stream;
h2_stream = h2_stream->next) {
if(h2_stream->mesh_state) {
mesh_state_remove_reply(h2_stream->mesh,
h2_stream->mesh_state, h2_session->c,
h2_stream, NULL);
h2_stream->mesh_state = NULL;
}
}
#else
(void)h2_session;
#endif /* HAVE_NGHTTP2 */
}
#ifdef HAVE_NGHTTP2
/** Delete http2 stream. After session delete or stream close callback */
static void http2_stream_delete(struct http2_session* h2_session,
@@ -4621,6 +4645,10 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
static int
tcp_req_info_read_again(int fd, struct comm_point* c)
{
/* One event-loop visit drains at most this many pipelined queries;
* the rest is re-queued, so that other file descriptors get
* serviced in between. */
int budget = NUM_TCP_PER_SELECT;
while(c->tcp_req_info->read_again) {
int r;
c->tcp_req_info->read_again = 0;
@@ -4637,6 +4665,16 @@ tcp_req_info_read_again(int fd, struct comm_point* c)
}
return 0;
}
if(--budget <= 0 && c->tcp_req_info->read_again) {
/* Defer the rest of the drain to the next loop turn.
* This uses a zero delay timer. For TLS the undrained
* remainder sits in OpenSSL's user-space buffer. */
struct timeval tv;
memset(&tv, 0, sizeof(tv));
verbose(VERB_ALGO, "Defer tcp_req_info read again");
comm_timer_set(c->tcp_req_info->read_again_timer, &tv);
return 1;
}
}
return 1;
}
@@ -4650,6 +4688,7 @@ tcp_more_read_again(int fd, struct comm_point* c)
/* this continues until the read routines get EAGAIN or so,
* and thus does not call the callback, and the bool is 0 */
int* moreread = c->tcp_more_read_again;
int budget = NUM_TCP_PER_SELECT;
while(moreread && *moreread) {
*moreread = 0;
if(!comm_point_tcp_handle_read(fd, c, 0)) {
@@ -4662,6 +4701,30 @@ tcp_more_read_again(int fd, struct comm_point* c)
}
return;
}
if(--budget <= 0 && *moreread) {
/* Defer the rest of the drain to the next loop turn.
* This uses a zero delay timer. For TLS the undrained
* remainder sits in OpenSSL's user-space buffer. */
struct timeval tv;
memset(&tv, 0, sizeof(tv));
if(!c->tcp_more_read_again_timer) {
c->tcp_more_read_again_timer = comm_timer_create(c->ev->base, tcp_more_read_again_cb, c);
if(!c->tcp_more_read_again_timer) {
log_err("out of memory for tcp more read again timer");
reclaim_tcp_handler(c);
if(!c->tcp_do_close) {
fptr_ok(fptr_whitelist_comm_point(
c->callback));
(void)(*c->callback)(c, c->cb_arg,
NETEVENT_CLOSED, NULL);
}
return;
}
}
verbose(VERB_ALGO, "Defer more read again");
comm_timer_set(c->tcp_more_read_again_timer, &tv);
return;
}
}
}
@@ -4689,6 +4752,23 @@ tcp_more_write_again(int fd, struct comm_point* c)
}
}
void
tcp_read_again_cb(void* arg)
{
struct tcp_req_info* req = (struct tcp_req_info*)arg;
verbose(VERB_ALGO, "tcp_read_again_cb");
if(!tcp_req_info_read_again(req->cp->fd, req->cp))
return;
}
void
tcp_more_read_again_cb(void* arg)
{
struct comm_point* c = (struct comm_point*)arg;
verbose(VERB_ALGO, "tcp_more_read_again_cb");
tcp_more_read_again(c->fd, c);
}
void
comm_point_tcp_handle_callback(int fd, short event, void* arg)
{
@@ -6131,7 +6211,7 @@ comm_point_create_tcp_handler(struct comm_base *base,
c->pp2_enabled = parent->pp2_enabled;
c->pp2_header_state = pp2_header_none;
if(spoolbuf) {
c->tcp_req_info = tcp_req_info_create(spoolbuf);
c->tcp_req_info = tcp_req_info_create(base, spoolbuf);
if(!c->tcp_req_info) {
log_err("could not create tcp commpoint");
sldns_buffer_free(c->buffer);
@@ -6693,6 +6773,9 @@ comm_point_close(struct comm_point* c)
*c->tcp_more_read_again = 0;
if(c->tcp_more_write_again && *c->tcp_more_write_again)
*c->tcp_more_write_again = 0;
if(c->tcp_more_read_again_timer &&
comm_timer_is_set(c->tcp_more_read_again_timer))
comm_timer_disable(c->tcp_more_read_again_timer);
/* close fd after removing from event lists, or epoll.. is messed up */
if(c->fd != -1 && !c->do_not_close) {
@@ -6732,6 +6815,7 @@ comm_point_delete(struct comm_point* c)
free(c->tcp_handlers);
}
free(c->timeout);
comm_timer_delete(c->tcp_more_read_again_timer);
if(c->type == comm_tcp || c->type == comm_local || c->type == comm_http) {
sldns_buffer_free(c->buffer);
#ifdef USE_DNSCRYPT
@@ -6872,6 +6956,7 @@ comm_point_drop_reply(struct comm_reply* repinfo)
if(repinfo->c->type == comm_http) {
if(repinfo->c->h2_session) {
repinfo->c->h2_session->is_drop = 1;
http2_session_clear_meshstate(repinfo->c->h2_session);
if(!repinfo->c->h2_session->postpone_drop)
reclaim_http_handler(repinfo->c);
return;
contrib/unbound/util/netevent.h
+9
View File
@@ -384,6 +384,9 @@ struct comm_point {
* Or leave NULL if it is not used at all. */
int* tcp_more_write_again;
/** resume timer for tcp_more_read_again */
struct comm_timer* tcp_more_read_again_timer;
/** if set, read/write completes:
read/write state of tcp is toggled.
buffer reset/bytecount reset.
@@ -1133,6 +1136,12 @@ void doq_send_pkt(struct comm_point* c, struct doq_pkt_addr* paddr,
/** doq timer callback function. */
void doq_timer_cb(void* arg);
/** tcp read again callback function. For tcp req info listen. */
void tcp_read_again_cb(void* arg);
/** tcp more read again callback function. For outside network. */
void tcp_more_read_again_cb(void* arg);
/**
* This routine is published for checks and tests, and is only used internally.
* handle libevent callback for timer comm.
contrib/unbound/validator/autotrust.c
+13 -9
View File
@@ -1297,12 +1297,13 @@ void autr_write_file(struct module_env* env, struct trust_anchor* tp)
* @param tp: trust point to verify with
* @param rrset: DNSKEY rrset to verify.
* @param qstate: qstate with region.
* @param vq: validator query state.
* @return false on failure, true if verification successful.
*/
static int
verify_dnskey(struct module_env* env, struct val_env* ve,
struct trust_anchor* tp, struct ub_packed_rrset_key* rrset,
struct module_qstate* qstate)
struct module_qstate* qstate, struct val_qstate* vq)
{
char reasonbuf[256];
char* reason = NULL;
@@ -1310,7 +1311,7 @@ verify_dnskey(struct module_env* env, struct val_env* ve,
int downprot = env->cfg->harden_algo_downgrade;
enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason,
NULL, qstate, reasonbuf, sizeof(reasonbuf));
NULL, qstate, vq, reasonbuf, sizeof(reasonbuf));
/* sigalg is ignored, it returns algorithms signalled to exist, but
* in 5011 there are no other rrsets to check. if downprot is
* enabled, then it checks that the DNSKEY is signed with all
@@ -1350,16 +1351,18 @@ min_expiry(struct module_env* env, struct packed_rrset_data* dd)
static int
rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* dnskey_rrset, size_t i,
struct module_qstate* qstate)
struct module_qstate* qstate, struct val_qstate* vq)
{
enum sec_status sec;
char* reason = NULL;
size_t num_tagmatches = 0;
verbose(VERB_ALGO, "seen REVOKE flag, check self-signed, rr %d",
(int)i);
/* no algorithm downgrade protection necessary, if it is selfsigned
* revoked it can be removed. */
sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
&reason, NULL, LDNS_SECTION_ANSWER, qstate);
&reason, NULL, LDNS_SECTION_ANSWER, qstate, vq,
&num_tagmatches);
return (sec == sec_status_secure);
}
@@ -1575,7 +1578,7 @@ init_events(struct trust_anchor* tp)
static void
check_contains_revoked(struct module_env* env, struct val_env* ve,
struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
int* changed, struct module_qstate* qstate)
int* changed, struct module_qstate* qstate, struct val_qstate* vq)
{
struct packed_rrset_data* dd = (struct packed_rrset_data*)
dnskey_rrset->entry.data;
@@ -1595,7 +1598,8 @@ check_contains_revoked(struct module_env* env, struct val_env* ve,
}
if(!ta)
continue; /* key not found */
if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate)) {
if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate,
vq)) {
/* checked if there is an rrsig signed by this key. */
/* same keytag, but stored can be revoked already, so
* compare keytags, with +0 or +128(REVOKE flag) */
@@ -2209,7 +2213,7 @@ autr_tp_remove(struct module_env* env, struct trust_anchor* tp,
int autr_process_prime(struct module_env* env, struct val_env* ve,
struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
struct module_qstate* qstate)
struct module_qstate* qstate, struct val_qstate* vq)
{
int changed = 0;
log_assert(tp && tp->autr);
@@ -2250,7 +2254,7 @@ int autr_process_prime(struct module_env* env, struct val_env* ve,
return 1; /* trust point exists */
}
/* check for revoked keys to remove immediately */
check_contains_revoked(env, ve, tp, dnskey_rrset, &changed, qstate);
check_contains_revoked(env, ve, tp, dnskey_rrset, &changed, qstate, vq);
if(changed) {
verbose(VERB_ALGO, "autotrust: revokedkeys, reassemble");
if(!autr_assemble(tp)) {
@@ -2266,7 +2270,7 @@ int autr_process_prime(struct module_env* env, struct val_env* ve,
}
}
/* verify the dnskey rrset and see if it is valid. */
if(!verify_dnskey(env, ve, tp, dnskey_rrset, qstate)) {
if(!verify_dnskey(env, ve, tp, dnskey_rrset, qstate, vq)) {
verbose(VERB_ALGO, "autotrust: dnskey did not verify.");
/* only increase failure count if this is not the first prime,
* this means there was a previous successful probe */
contrib/unbound/validator/autotrust.h
+3 -1
View File
@@ -50,6 +50,7 @@ struct module_env;
struct module_qstate;
struct val_env;
struct sldns_buffer;
struct val_qstate;
/** Autotrust anchor states */
typedef enum {
@@ -190,13 +191,14 @@ void autr_point_delete(struct trust_anchor* tp);
* @param dnskey_rrset: DNSKEY rrset probed (can be NULL if bad prime result).
* allocated in a region. Has not been validated yet.
* @param qstate: qstate with region.
* @param vq: validator query state.
* @return false if trust anchor was revoked completely.
* Otherwise logs errors to log, does not change return value.
* On errors, likely the trust point has been unchanged.
*/
int autr_process_prime(struct module_env* env, struct val_env* ve,
struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
struct module_qstate* qstate);
struct module_qstate* qstate, struct val_qstate* vq);
/**
* Debug printout of rfc5011 tracked anchors
contrib/unbound/validator/val_nsec.c
+6 -5
View File
@@ -177,7 +177,8 @@ static int
nsec_verify_rrset(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* nsec, struct key_entry_key* kkey,
char** reason, sldns_ede_code* reason_bogus,
struct module_qstate* qstate, char* reasonbuf, size_t reasonlen)
struct module_qstate* qstate, struct val_qstate* vq, char* reasonbuf,
size_t reasonlen)
{
struct packed_rrset_data* d = (struct packed_rrset_data*)
nsec->entry.data;
@@ -189,7 +190,7 @@ nsec_verify_rrset(struct module_env* env, struct val_env* ve,
if(d->security == sec_status_secure)
return 1;
d->security = val_verify_rrset_entry(env, ve, nsec, kkey, reason,
reason_bogus, LDNS_SECTION_AUTHORITY, qstate, &verified,
reason_bogus, LDNS_SECTION_AUTHORITY, qstate, vq, &verified,
reasonbuf, reasonlen);
if(d->security == sec_status_secure) {
rrset_update_sec_status(env->rrset_cache, nsec, *env->now);
@@ -203,7 +204,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
struct query_info* qinfo, struct reply_info* rep,
struct key_entry_key* kkey, time_t* proof_ttl, char** reason,
sldns_ede_code* reason_bogus, struct module_qstate* qstate,
char* reasonbuf, size_t reasonlen)
struct val_qstate* vq, char* reasonbuf, size_t reasonlen)
{
struct ub_packed_rrset_key* nsec = reply_find_rrset_section_ns(
rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_NSEC,
@@ -221,7 +222,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
* 2) this is not a delegation point */
if(nsec) {
if(!nsec_verify_rrset(env, ve, nsec, kkey, reason,
reason_bogus, qstate, reasonbuf, reasonlen)) {
reason_bogus, qstate, vq, reasonbuf, reasonlen)) {
verbose(VERB_ALGO, "NSEC RRset for the "
"referral did not verify.");
return sec_status_bogus;
@@ -258,7 +259,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
if(rep->rrsets[i]->rk.type != htons(LDNS_RR_TYPE_NSEC))
continue;
if(!nsec_verify_rrset(env, ve, rep->rrsets[i], kkey, reason,
reason_bogus, qstate, reasonbuf, reasonlen)) {
reason_bogus, qstate, vq, reasonbuf, reasonlen)) {
verbose(VERB_ALGO, "NSEC for empty non-terminal "
"did not verify.");
*reason = "NSEC for empty non-terminal "
contrib/unbound/validator/val_nsec.h
+4 -1
View File
@@ -52,6 +52,7 @@ struct ub_packed_rrset_key;
struct reply_info;
struct query_info;
struct key_entry_key;
struct val_qstate;
/**
* Check DS absence.
@@ -68,6 +69,7 @@ struct key_entry_key;
* @param reason: string explaining why bogus.
* @param reason_bogus: relevant EDE code for validation failure.
* @param qstate: qstate with region.
* @param vq: validator qstate.
* @param reasonbuf: buffer to use for fail reason string print.
* @param reasonlen: length of reasonbuf.
* @return security status.
@@ -80,7 +82,8 @@ enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env,
struct val_env* ve, struct query_info* qinfo,
struct reply_info* rep, struct key_entry_key* kkey,
time_t* proof_ttl, char** reason, sldns_ede_code* reason_bogus,
struct module_qstate* qstate, char* reasonbuf, size_t reasonlen);
struct module_qstate* qstate, struct val_qstate* vq, char* reasonbuf,
size_t reasonlen);
/**
* nsec typemap check, takes an NSEC-type bitmap as argument, checks for type.
contrib/unbound/validator/val_nsec3.c
+6 -4
View File
@@ -1521,7 +1521,8 @@ static int
list_is_secure(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key** list, size_t num,
struct key_entry_key* kkey, char** reason, sldns_ede_code *reason_bogus,
struct module_qstate* qstate, char* reasonbuf, size_t reasonlen)
struct module_qstate* qstate, struct val_qstate* vq, char* reasonbuf,
size_t reasonlen)
{
struct packed_rrset_data* d;
size_t i;
@@ -1537,7 +1538,7 @@ list_is_secure(struct module_env* env, struct val_env* ve,
continue;
d->security = val_verify_rrset_entry(env, ve, list[i], kkey,
reason, reason_bogus, LDNS_SECTION_AUTHORITY, qstate,
&verified, reasonbuf, reasonlen);
vq, &verified, reasonbuf, reasonlen);
if(d->security != sec_status_secure) {
verbose(VERB_ALGO, "NSEC3 did not verify");
return 0;
@@ -1552,7 +1553,8 @@ nsec3_prove_nods(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key** list, size_t num,
struct query_info* qinfo, struct key_entry_key* kkey, char** reason,
sldns_ede_code* reason_bogus, struct module_qstate* qstate,
struct nsec3_cache_table* ct, char* reasonbuf, size_t reasonlen)
struct val_qstate* vq, struct nsec3_cache_table* ct, char* reasonbuf,
size_t reasonlen)
{
struct nsec3_filter flt;
struct ce_response ce;
@@ -1568,7 +1570,7 @@ nsec3_prove_nods(struct module_env* env, struct val_env* ve,
return sec_status_bogus; /* no valid NSEC3s, bogus */
}
if(!list_is_secure(env, ve, list, num, kkey, reason, reason_bogus,
qstate, reasonbuf, reasonlen)) {
qstate, vq, reasonbuf, reasonlen)) {
*reason = "not all NSEC3 records secure";
return sec_status_bogus; /* not all NSEC3 records secure */
}
contrib/unbound/validator/val_nsec3.h
+4 -1
View File
@@ -78,6 +78,7 @@ struct reply_info;
struct query_info;
struct key_entry_key;
struct sldns_buffer;
struct val_qstate;
/**
* 0 1 2 3 4 5 6 7
@@ -215,6 +216,7 @@ nsec3_prove_wildcard(struct module_env* env, struct val_env* ve,
* @param reason: string for bogus result.
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param qstate: qstate with region.
* @param vq: validator qstate.
* @param ct: cached hashes table.
* @param reasonbuf: buffer to use for fail reason string print.
* @param reasonlen: length of reasonbuf.
@@ -230,7 +232,8 @@ nsec3_prove_nods(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key** list, size_t num,
struct query_info* qinfo, struct key_entry_key* kkey, char** reason,
sldns_ede_code* reason_bogus, struct module_qstate* qstate,
struct nsec3_cache_table* ct, char* reasonbuf, size_t reasonlen);
struct val_qstate* vq, struct nsec3_cache_table* ct, char* reasonbuf,
size_t reasonlen);
/**
* Prove NXDOMAIN or NODATA.
contrib/unbound/validator/val_sigcrypt.c
+108 -8
View File
@@ -82,6 +82,8 @@
/** Maximum number of RRSIG validations for an RRset. */
#define MAX_VALIDATE_RRSIGS 8
/** Maximum number of NSEC validations for a message. */
#define MAX_VALIDATE_NSECS 8
/** return number of rrs in an rrset */
static size_t
@@ -305,6 +307,8 @@ ds_create_dnskey_digest(struct module_env* env,
* digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);
* DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key. */
sldns_buffer_clear(b);
if(!sldns_buffer_available(b, dnskey_rrset->rk.dname_len + dnskey_len-2))
return 0; /* buffer too small */
sldns_buffer_write(b, dnskey_rrset->rk.dname,
dnskey_rrset->rk.dname_len);
query_dname_tolower(sldns_buffer_begin(b));
@@ -546,8 +550,10 @@ int algo_needs_missing(struct algo_needs* n)
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param section: section of packet where this rrset comes from.
* @param qstate: qstate with region.
* @param vq: validator qstate with attempt counts.
* @param numverified: incremented when the number of RRSIG validations
* increases.
* @param num_tagmatches: incremented for tag matches.
* @return secure if any key signs *this* signature. bogus if no key signs it,
* unchecked on error, or indeterminate if all keys are not supported by
* the crypto library (openssl3+ only).
@@ -559,7 +565,7 @@ dnskeyset_verify_rrset_sig(struct module_env* env, struct val_env* ve,
struct rbtree_type** sortree,
char** reason, sldns_ede_code *reason_bogus,
sldns_pkt_section section, struct module_qstate* qstate,
int* numverified)
struct val_qstate* vq, int* numverified, size_t* num_tagmatches)
{
/* find matching keys and check them */
enum sec_status sec = sec_status_bogus;
@@ -578,6 +584,14 @@ dnskeyset_verify_rrset_sig(struct module_env* env, struct val_env* ve,
}
for(i=0; i<num; i++) {
if((*num_tagmatches)++ > MAX_TAG_MATCHES) {
*reason = "too many tag matches";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
verbose(VERB_ALGO, "verify sig: too many tag matches, "
"MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
return sec_status_bogus;
}
/* see if key matches keytag and algo */
if(algo != dnskey_get_algo(dnskey, i) ||
tag != dnskey_calc_keytag(dnskey, i))
@@ -585,6 +599,26 @@ dnskeyset_verify_rrset_sig(struct module_env* env, struct val_env* ve,
numchecked ++;
(*numverified)++;
if(vq && vq->num_validation_attempts++ > env->cfg->val_validation_attempts) {
*reason = "too many validation attempts";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
verbose(VERB_ALGO, "verify sig: too many validation attempts, "
"val-validation-attempts (%d); bogus", env->cfg->val_validation_attempts);
return sec_status_bogus;
}
if(vq && (ntohs(rrset->rk.type) == LDNS_RR_TYPE_NSEC ||
ntohs(rrset->rk.type) == LDNS_RR_TYPE_NSEC3) &&
vq->num_nsec_attempts++ > MAX_VALIDATE_NSECS) {
*reason = "too many NSEC or NSEC3 validation attempts";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
verbose(VERB_ALGO, "verify sig: too many NSEC or NSEC3 validation attempts, "
"(%d); bogus", MAX_VALIDATE_NSECS);
vq->num_nsec_attempts_exceeded = 1;
return sec_status_bogus;
}
/* see if key verifies */
sec = dnskey_verify_rrset_sig(env->scratch,
env->scratch_buffer, ve, now, rrset, dnskey, i,
@@ -624,11 +658,12 @@ enum sec_status
dnskeyset_verify_rrset(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* dnskey,
uint8_t* sigalg, char** reason, sldns_ede_code *reason_bogus,
sldns_pkt_section section, struct module_qstate* qstate, int* verified,
char* reasonbuf, size_t reasonlen)
sldns_pkt_section section, struct module_qstate* qstate,
struct val_qstate* vq, int* verified, char* reasonbuf,
size_t reasonlen)
{
enum sec_status sec;
size_t i, num;
size_t i, num, num_tagmatches = 0;
rbtree_type* sortree = NULL;
/* make sure that for all DNSKEY algorithms there are valid sigs */
struct algo_needs needs;
@@ -656,9 +691,19 @@ dnskeyset_verify_rrset(struct module_env* env, struct val_env* ve,
}
}
for(i=0; i<num; i++) {
if(num_tagmatches > MAX_TAG_MATCHES) {
*reason = "too many tag matches";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
verbose(VERB_ALGO, "rrset failed to verify: too many tag matches, "
"MAX_TAG_MATCHES (%d)", MAX_TAG_MATCHES);
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
return sec_status_bogus;
}
sec = dnskeyset_verify_rrset_sig(env, ve, *env->now, rrset,
dnskey, i, &sortree, reason, reason_bogus,
section, qstate, verified);
section, qstate, vq, verified, &num_tagmatches);
/* see which algorithm has been fixed up */
if(sec == sec_status_secure) {
if(!sigalg)
@@ -707,7 +752,8 @@ enum sec_status
dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* dnskey,
size_t dnskey_idx, char** reason, sldns_ede_code *reason_bogus,
sldns_pkt_section section, struct module_qstate* qstate)
sldns_pkt_section section, struct module_qstate* qstate,
struct val_qstate* vq, size_t* num_tagmatches)
{
enum sec_status sec;
size_t i, num, numchecked = 0, numindeterminate = 0;
@@ -728,9 +774,26 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
}
for(i=0; i<num; i++) {
/* see if sig matches keytag and algo */
if((*num_tagmatches)++ > MAX_TAG_MATCHES) {
*reason = "too many tag matches";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
verbose(VERB_ALGO, "rrset failed to verify: too many tag matches, "
"MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
return sec_status_bogus;
}
if(algo != rrset_get_sig_algo(rrset, i) ||
tag != rrset_get_sig_keytag(rrset, i))
continue;
if(vq && vq->num_validation_attempts++ > env->cfg->val_validation_attempts) {
*reason = "too many validation attempts";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
verbose(VERB_ALGO, "rrset failed to verify: too many validation attempts, "
"val-validation-attempts (%d); bogus", env->cfg->val_validation_attempts);
return sec_status_bogus;
}
buf_canon = 0;
sec = dnskey_verify_rrset_sig(env->scratch,
env->scratch_buffer, ve, *env->now, rrset,
@@ -1308,15 +1371,32 @@ rrset_canonical(struct regional* region, sldns_buffer* buf,
}
sldns_buffer_clear(buf);
if(sldns_buffer_remaining(buf) < siglen || siglen < 18+1) {
verbose(VERB_ALGO, "verify: failed to canonicalize, "
"rrset too big");
return 0;
}
sldns_buffer_write(buf, sig, siglen);
/* canonicalize signer name */
canon_dname_tolower(sldns_buffer_begin(buf)+18,
sldns_buffer_current(buf));
if(sldns_buffer_remaining(buf) < k->rk.dname_len+2) {
/* Check if the first can_owner name can fit in the buffer.
* The length is k->rk.dname_len or k->rk.dname_len+2
* if it has '*.' in prefixed. Checks the upper bound,
* also realistically the rest of the rrtype, rrclass, origttl,
* rdata and so on has to be inserted, so that extra space has
* to be there. */
verbose(VERB_ALGO, "verify: failed to canonicalize, "
"rrset too big");
return 0;
}
RBTREE_FOR(walk, struct canon_rr*, (*sortree)) {
/* see if there is enough space left in the buffer */
if(sldns_buffer_remaining(buf) < can_owner_len + 2 + 2 + 4
+ d->rr_len[walk->rr_idx]) {
log_err("verify: failed to canonicalize, "
verbose(VERB_ALGO, "verify: failed to canonicalize, "
"rrset too big");
return 0;
}
@@ -1325,6 +1405,13 @@ rrset_canonical(struct regional* region, sldns_buffer* buf,
sldns_buffer_write(buf, can_owner, can_owner_len);
else insert_can_owner(buf, k, sig, &can_owner,
&can_owner_len);
/* Check again, if the rdata can fit in the buffer */
if(sldns_buffer_remaining(buf) < 2 + 2 + 4
+ d->rr_len[walk->rr_idx]) {
verbose(VERB_ALGO, "verify: failed to canonicalize, "
"rrset too big");
return 0;
}
sldns_buffer_write(buf, &k->rk.type, 2);
sldns_buffer_write(buf, &k->rk.rrset_class, 2);
sldns_buffer_write(buf, sig+4, 4);
@@ -1376,11 +1463,17 @@ rrset_canonicalize_to_buffer(struct regional* region, sldns_buffer* buf,
canonical_sort(k, d, sortree, rrs);
sldns_buffer_clear(buf);
if(sldns_buffer_remaining(buf) < k->rk.dname_len) {
/* Check if the first can_owner name can fit in the buffer. */
verbose(VERB_ALGO, "verify: failed to canonicalize, "
"rrset too big");
return 0;
}
RBTREE_FOR(walk, struct canon_rr*, sortree) {
/* see if there is enough space left in the buffer */
if(sldns_buffer_remaining(buf) < can_owner_len + 2 + 2 + 4
+ d->rr_len[walk->rr_idx]) {
log_err("verify: failed to canonicalize, "
verbose(VERB_ALGO, "verify: failed to canonicalize, "
"rrset too big");
return 0;
}
@@ -1393,6 +1486,13 @@ rrset_canonicalize_to_buffer(struct regional* region, sldns_buffer* buf,
query_dname_tolower(can_owner);
can_owner_len = k->rk.dname_len;
}
/* Check again, if the rdata can fit in the buffer */
if(sldns_buffer_remaining(buf) < 2 + 2 + 4
+ d->rr_len[walk->rr_idx]) {
verbose(VERB_ALGO, "verify: failed to canonicalize, "
"rrset too big");
return 0;
}
sldns_buffer_write(buf, &k->rk.type, 2);
sldns_buffer_write(buf, &k->rk.rrset_class, 2);
sldns_buffer_write_u32(buf, d->rr_ttl[walk->rr_idx]);
contrib/unbound/validator/val_sigcrypt.h
+9 -3
View File
@@ -53,6 +53,7 @@ struct ub_packed_rrset_key;
struct rbtree_type;
struct regional;
struct sldns_buffer;
struct val_qstate;
/** number of entries in algorithm needs array */
#define ALGO_NEEDS_MAX 256
@@ -262,6 +263,7 @@ uint16_t dnskey_get_flags(struct ub_packed_rrset_key* k, size_t idx);
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param section: section of packet where this rrset comes from.
* @param qstate: qstate with region.
* @param vq: validator qstate with attempt counts.
* @param verified: if not NULL the number of RRSIG validations is returned.
* @param reasonbuf: buffer to use for fail reason string print.
* @param reasonlen: length of reasonbuf.
@@ -273,8 +275,9 @@ enum sec_status dnskeyset_verify_rrset(struct module_env* env,
struct val_env* ve, struct ub_packed_rrset_key* rrset,
struct ub_packed_rrset_key* dnskey, uint8_t* sigalg,
char** reason, sldns_ede_code *reason_bogus,
sldns_pkt_section section, struct module_qstate* qstate, int* verified,
char* reasonbuf, size_t reasonlen);
sldns_pkt_section section, struct module_qstate* qstate,
struct val_qstate* vq, int* verified, char* reasonbuf,
size_t reasonlen);
/**
* verify rrset against one specific dnskey (from rrset)
@@ -287,13 +290,16 @@ enum sec_status dnskeyset_verify_rrset(struct module_env* env,
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param section: section of packet where this rrset comes from.
* @param qstate: qstate with region.
* @param vq: validator qstate with attempt counts.
* @param num_tagmatches: incremented to keep track of tag matches.
* @return secure if *this* key signs any of the signatures on rrset.
* unchecked on error or and bogus on bad signature.
*/
enum sec_status dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* dnskey,
size_t dnskey_idx, char** reason, sldns_ede_code *reason_bogus,
sldns_pkt_section section, struct module_qstate* qstate);
sldns_pkt_section section, struct module_qstate* qstate,
struct val_qstate* vq, size_t* num_tagmatches);
/**
* verify rrset, with specific dnskey(from set), for a specific rrsig
contrib/unbound/validator/val_utils.c
+86 -19
View File
@@ -406,7 +406,8 @@ val_verify_rrset(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys,
uint8_t* sigalg, char** reason, sldns_ede_code *reason_bogus,
sldns_pkt_section section, struct module_qstate* qstate,
int *verified, char* reasonbuf, size_t reasonlen)
struct val_qstate* vq, int *verified, char* reasonbuf,
size_t reasonlen)
{
enum sec_status sec;
struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
@@ -431,7 +432,8 @@ val_verify_rrset(struct module_env* env, struct val_env* ve,
log_nametypeclass(VERB_ALGO, "verify rrset", rrset->rk.dname,
ntohs(rrset->rk.type), ntohs(rrset->rk.rrset_class));
sec = dnskeyset_verify_rrset(env, ve, rrset, keys, sigalg, reason,
reason_bogus, section, qstate, verified, reasonbuf, reasonlen);
reason_bogus, section, qstate, vq, verified, reasonbuf,
reasonlen);
verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec));
regional_free_all(env->scratch);
@@ -475,7 +477,8 @@ val_verify_rrset_entry(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey,
char** reason, sldns_ede_code *reason_bogus,
sldns_pkt_section section, struct module_qstate* qstate,
int* verified, char* reasonbuf, size_t reasonlen)
struct val_qstate* vq, int* verified, char* reasonbuf,
size_t reasonlen)
{
/* temporary dnskey rrset-key */
struct ub_packed_rrset_key dnskey;
@@ -489,7 +492,8 @@ val_verify_rrset_entry(struct module_env* env, struct val_env* ve,
dnskey.entry.key = &dnskey;
dnskey.entry.data = kd->rrset_data;
sec = val_verify_rrset(env, ve, rrset, &dnskey, kd->algo, reason,
reason_bogus, section, qstate, verified, reasonbuf, reasonlen);
reason_bogus, section, qstate, vq, verified, reasonbuf,
reasonlen);
return sec;
}
@@ -499,13 +503,20 @@ verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* dnskey_rrset,
struct ub_packed_rrset_key* ds_rrset, size_t ds_idx, char** reason,
sldns_ede_code *reason_bogus, struct module_qstate* qstate,
int *nonechecked, char* reasonbuf, size_t reasonlen)
struct val_qstate* vq, int *nonechecked, char* reasonbuf,
size_t reasonlen, size_t* num_tagmatches,
size_t* num_tagmatches_dnskeysig)
{
enum sec_status sec = sec_status_bogus;
size_t i, num, numchecked = 0, numhashok = 0, numsizesupp = 0;
num = rrset_get_count(dnskey_rrset);
*nonechecked = 0;
for(i=0; i<num; i++) {
if((*num_tagmatches)++ > MAX_TAG_MATCHES) {
verbose(VERB_ALGO, "DS match attempt reached "
"MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
return sec_status_bogus;
}
/* Skip DNSKEYs that don't match the basic criteria. */
if(ds_get_key_algo(ds_rrset, ds_idx)
!= dnskey_get_algo(dnskey_rrset, i)
@@ -518,6 +529,15 @@ verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
ds_get_key_algo(ds_rrset, ds_idx),
ds_get_keytag(ds_rrset, ds_idx));
if(vq && vq->num_hash_attempts++ > env->cfg->val_hash_attempts) {
*reason = "too many hash attempts";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
verbose(VERB_ALGO, "rrset failed to verify: too many hash attempts, "
"val-hash-attempts (%d); bogus", env->cfg->val_hash_attempts);
return sec_status_bogus;
}
/* Convert the candidate DNSKEY into a hash using the
* same DS hash algorithm. */
if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset,
@@ -541,8 +561,14 @@ verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
/* Otherwise, we have a match! Make sure that the DNSKEY
* verifies *with this key* */
if(*num_tagmatches_dnskeysig > MAX_TAG_MATCHES) {
verbose(VERB_ALGO, "DS that matched has too many DNSKEY to RRSIG tag matches "
"MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
return sec_status_bogus;
}
sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset,
i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate);
i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate,
vq, num_tagmatches_dnskeysig);
if(sec == sec_status_secure) {
return sec;
}
@@ -586,14 +612,14 @@ val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* dnskey_rrset,
struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason,
sldns_ede_code *reason_bogus, struct module_qstate* qstate,
char* reasonbuf, size_t reasonlen)
struct val_qstate* vq, char* reasonbuf, size_t reasonlen)
{
/* as long as this is false, we can consider this DS rrset to be
* equivalent to no DS rrset. */
int has_useful_ds = 0, digest_algo, alg, has_algo_refusal = 0,
nonechecked, has_checked_ds = 0;
struct algo_needs needs;
size_t i, num;
size_t i, num, num_tagmatches = 0, num_tagmatches_dnskeysig = 0;
enum sec_status sec;
if(dnskey_rrset->rk.dname_len != ds_rrset->rk.dname_len ||
@@ -615,6 +641,13 @@ val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
}
num = rrset_get_count(ds_rrset);
for(i=0; i<num; i++) {
if(num_tagmatches > MAX_TAG_MATCHES) {
verbose(VERB_ALGO, "DS verify attempt reached "
"MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
*reason = "DS verify has too many tag matches";
return sec_status_bogus;
}
/* Check to see if we can understand this DS.
* And check it is the strongest digest */
if(!ds_digest_algo_is_supported(ds_rrset, i) ||
@@ -623,9 +656,16 @@ val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
continue;
}
if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) {
verbose(VERB_ALGO, "DS verify attempt reached "
"DNSKEY to RRSIG MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
*reason = "DS verify has too many DNSKEY to RRSIG tag matches";
return sec_status_bogus;
}
sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
ds_rrset, i, reason, reason_bogus, qstate,
&nonechecked, reasonbuf, reasonlen);
ds_rrset, i, reason, reason_bogus, qstate, vq,
&nonechecked, reasonbuf, reasonlen, &num_tagmatches,
&num_tagmatches_dnskeysig);
if(sec == sec_status_insecure) {
/* DNSKEY too large unsupported or algo refused by
* crypto lib. */
@@ -687,12 +727,12 @@ val_verify_new_DNSKEYs(struct regional* region, struct module_env* env,
struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason,
sldns_ede_code *reason_bogus, struct module_qstate* qstate,
char* reasonbuf, size_t reasonlen)
struct val_qstate* vq, char* reasonbuf, size_t reasonlen)
{
uint8_t sigalg[ALGO_NEEDS_MAX+1];
enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve,
dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason,
reason_bogus, qstate, reasonbuf, reasonlen);
reason_bogus, qstate, vq, reasonbuf, reasonlen);
if(sec == sec_status_secure) {
return key_entry_create_rrset(region,
@@ -718,14 +758,14 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
struct ub_packed_rrset_key* ta_ds,
struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason,
sldns_ede_code *reason_bogus, struct module_qstate* qstate,
char* reasonbuf, size_t reasonlen)
struct val_qstate* vq, char* reasonbuf, size_t reasonlen)
{
/* as long as this is false, we can consider this anchor to be
* equivalent to no anchor. */
int has_useful_ta = 0, digest_algo = 0, alg, has_algo_refusal = 0,
nonechecked, has_checked_ds = 0;
struct algo_needs needs;
size_t i, num;
size_t i, num, num_tagmatches = 0, num_tagmatches_dnskeysig = 0;
enum sec_status sec;
if(ta_ds && (dnskey_rrset->rk.dname_len != ta_ds->rk.dname_len ||
@@ -761,6 +801,15 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
if(ta_ds) {
num = rrset_get_count(ta_ds);
for(i=0; i<num; i++) {
if(num_tagmatches > MAX_TAG_MATCHES) {
verbose(VERB_ALGO, "anchor DS verify attempt reached "
"MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
*reason = "anchor DS verify has too many tag matches";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
return sec_status_bogus;
}
/* Check to see if we can understand this DS.
* And check it is the strongest digest */
if(!ds_digest_algo_is_supported(ta_ds, i) ||
@@ -768,9 +817,18 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
ds_get_digest_algo(ta_ds, i) != digest_algo)
continue;
if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) {
verbose(VERB_ALGO, "anchor DS verify has too many DNSKEY to RRSIG tag matches "
"MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
*reason = "anchor DS verify has too many DNSKEY to RRSIG tag matches";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
return sec_status_bogus;
}
sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
ta_ds, i, reason, reason_bogus, qstate, &nonechecked,
reasonbuf, reasonlen);
ta_ds, i, reason, reason_bogus, qstate, vq,
&nonechecked, reasonbuf, reasonlen, &num_tagmatches,
&num_tagmatches_dnskeysig);
if(sec == sec_status_insecure) {
has_algo_refusal = 1;
continue;
@@ -813,8 +871,16 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
/* we saw a useful TA */
has_useful_ta = 1;
if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) {
verbose(VERB_ALGO, "anchor DS that matched has too many DNSKEY to RRSIG tag matches "
"MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
*reason = "anchor DS that matched has too many DNSKEY to RRSIG tag matches";
if(reason_bogus)
*reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
return sec_status_bogus;
}
sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
ta_dnskey, i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate);
ta_dnskey, i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate, vq, &num_tagmatches_dnskeysig);
if(sec == sec_status_secure) {
if(!sigalg || algo_needs_set_secure(&needs,
(uint8_t)dnskey_get_algo(ta_dnskey, i))) {
@@ -862,12 +928,13 @@ val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env,
struct ub_packed_rrset_key* ta_ds_rrset,
struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot,
char** reason, sldns_ede_code *reason_bogus,
struct module_qstate* qstate, char* reasonbuf, size_t reasonlen)
struct module_qstate* qstate, struct val_qstate* vq, char* reasonbuf,
size_t reasonlen)
{
uint8_t sigalg[ALGO_NEEDS_MAX+1];
enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve,
dnskey_rrset, ta_ds_rrset, ta_dnskey_rrset,
downprot?sigalg:NULL, reason, reason_bogus, qstate,
downprot?sigalg:NULL, reason, reason_bogus, qstate, vq,
reasonbuf, reasonlen);
if(sec == sec_status_secure) {
contrib/unbound/validator/val_utils.h
+16 -5
View File
@@ -55,6 +55,11 @@ struct regional;
struct val_anchors;
struct rrset_cache;
struct sock_list;
struct val_qstate;
/** Maximum number of matches with key tag and algorithm, for DNSKEY to
* RRSIG and DS to DNSKEY. Since the number is O(N*N), there is a limit. */
#define MAX_TAG_MATCHES 256
/**
* Response classifications for the validator. The different types of proofs.
@@ -124,6 +129,7 @@ void val_find_signer(enum val_classification subtype,
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param section: section of packet where this rrset comes from.
* @param qstate: qstate with region.
* @param vq: validator qstate with attempt counts.
* @param verified: if not NULL, the number of RRSIG validations is returned.
* @param reasonbuf: buffer to use for fail reason string print.
* @param reasonlen: length of reasonbuf.
@@ -133,7 +139,8 @@ enum sec_status val_verify_rrset_entry(struct module_env* env,
struct val_env* ve, struct ub_packed_rrset_key* rrset,
struct key_entry_key* kkey, char** reason, sldns_ede_code *reason_bogus,
sldns_pkt_section section, struct module_qstate* qstate,
int* verified, char* reasonbuf, size_t reasonlen);
struct val_qstate* vq, int* verified, char* reasonbuf,
size_t reasonlen);
/**
* Verify DNSKEYs with DS rrset. Like val_verify_new_DNSKEYs but
@@ -148,6 +155,7 @@ enum sec_status val_verify_rrset_entry(struct module_env* env,
* @param reason: reason of failure. Fixed string or alloced in scratch.
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param qstate: qstate with region.
* @param vq: validator qstate with attempt counts.
* @param reasonbuf: buffer to use for fail reason string print.
* @param reasonlen: length of reasonbuf.
* @return: sec_status_secure if a DS matches.
@@ -158,7 +166,7 @@ enum sec_status val_verify_DNSKEY_with_DS(struct module_env* env,
struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason,
sldns_ede_code *reason_bogus, struct module_qstate* qstate,
char* reasonbuf, size_t reasonlen);
struct val_qstate* vq, char* reasonbuf, size_t reasonlen);
/**
* Verify DNSKEYs with DS and DNSKEY rrset. Like val_verify_DNSKEY_with_DS
@@ -174,6 +182,7 @@ enum sec_status val_verify_DNSKEY_with_DS(struct module_env* env,
* @param reason: reason of failure. Fixed string or alloced in scratch.
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param qstate: qstate with region.
* @param vq: validator qstate with attempt counts.
* @param reasonbuf: buffer to use for fail reason string print.
* @param reasonlen: length of reasonbuf.
* @return: sec_status_secure if a DS matches.
@@ -185,7 +194,7 @@ enum sec_status val_verify_DNSKEY_with_TA(struct module_env* env,
struct ub_packed_rrset_key* ta_ds,
struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason,
sldns_ede_code *reason_bogus, struct module_qstate* qstate,
char* reasonbuf, size_t reasonlen);
struct val_qstate* vq, char* reasonbuf, size_t reasonlen);
/**
* Verify new DNSKEYs with DS rrset. The DS contains hash values that should
@@ -202,6 +211,7 @@ enum sec_status val_verify_DNSKEY_with_TA(struct module_env* env,
* @param reason: reason of failure. Fixed string or alloced in scratch.
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param qstate: qstate with region.
* @param vq: validator qstate with attempt counts.
* @param reasonbuf: buffer to use for fail reason string print.
* @param reasonlen: length of reasonbuf.
* @return a KeyEntry. This will either contain the now trusted
@@ -219,7 +229,7 @@ struct key_entry_key* val_verify_new_DNSKEYs(struct regional* region,
struct ub_packed_rrset_key* dnskey_rrset,
struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason,
sldns_ede_code *reason_bogus, struct module_qstate* qstate,
char* reasonbuf, size_t reasonlen);
struct val_qstate* vq, char* reasonbuf, size_t reasonlen);
/**
* Verify rrset with trust anchor: DS and DNSKEY rrset.
@@ -235,6 +245,7 @@ struct key_entry_key* val_verify_new_DNSKEYs(struct regional* region,
* @param reason: reason of failure. Fixed string or alloced in scratch.
* @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
* @param qstate: qstate with region.
* @param vq: validator qstate with attempt counts.
* @param reasonbuf: buffer to use for fail reason string print.
* @param reasonlen: length of reasonbuf.
* @return a KeyEntry. This will either contain the now trusted
@@ -253,7 +264,7 @@ struct key_entry_key* val_verify_new_DNSKEYs_with_ta(struct regional* region,
struct ub_packed_rrset_key* ta_ds_rrset,
struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot,
char** reason, sldns_ede_code *reason_bogus, struct module_qstate* qstate,
char* reasonbuf, size_t reasonlen);
struct val_qstate* vq, char* reasonbuf, size_t reasonlen);
/**
* Determine if DS rrset is usable for validator or not.
contrib/unbound/validator/validator.c
+75 -34
View File
@@ -350,13 +350,17 @@ static void
val_restart(struct val_qstate* vq)
{
struct comm_timer* temp_timer;
int restart_count;
int restart_count, num_validation_attempts, num_hash_attempts;
if(!vq) return;
temp_timer = vq->suspend_timer;
restart_count = vq->restart_count+1;
num_validation_attempts = vq->num_validation_attempts;
num_hash_attempts = vq->num_hash_attempts;
memset(vq, 0, sizeof(*vq));
vq->suspend_timer = temp_timer;
vq->restart_count = restart_count;
vq->num_validation_attempts = num_validation_attempts;
vq->num_hash_attempts = num_hash_attempts;
vq->state = VAL_INIT_STATE;
}
@@ -455,6 +459,24 @@ already_validated(struct dns_msg* ret_msg)
return 0;
}
/** If it is possible to restart the validation state */
static int
val_can_restart(struct module_qstate* qstate, struct val_qstate* vq,
struct val_env* ve)
{
/* For validation failures that are limits exceeded on the amount
* of work that the DNSSEC validator is willing to do, the restart
* is not allowed. A restart would increase the amount of effort
* spent even further. */
if(vq->restart_count < ve->max_restart &&
vq->num_validation_attempts <= qstate->env->cfg->val_validation_attempts &&
vq->num_hash_attempts <= qstate->env->cfg->val_hash_attempts &&
!vq->num_nsec_attempts_exceeded)
return 1;
(void)qstate;
return 0;
}
/**
* Generate a request for DNS data.
*
@@ -763,8 +785,8 @@ validate_msg_signatures(struct module_qstate* qstate, struct val_qstate* vq,
/* Verify the answer rrset */
sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
&reason_bogus, LDNS_SECTION_ANSWER, qstate, &verified,
reasonbuf, sizeof(reasonbuf));
&reason_bogus, LDNS_SECTION_ANSWER, qstate, vq,
&verified, reasonbuf, sizeof(reasonbuf));
/* If the (answer) rrset failed to validate, then this
* message is BAD. */
if(sec != sec_status_secure) {
@@ -808,7 +830,7 @@ validate_msg_signatures(struct module_qstate* qstate, struct val_qstate* vq,
continue;
s = chase_reply->rrsets[i];
sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
&reason_bogus, LDNS_SECTION_AUTHORITY, qstate,
&reason_bogus, LDNS_SECTION_AUTHORITY, qstate, vq,
&verified, reasonbuf, sizeof(reasonbuf));
/* If anything in the authority section fails to be secure,
* we have a bad message. */
@@ -855,7 +877,7 @@ validate_msg_signatures(struct module_qstate* qstate, struct val_qstate* vq,
if(sname && query_dname_compare(sname, key_entry->name)==0)
(void)val_verify_rrset_entry(env, ve, s, key_entry,
&reason, NULL, LDNS_SECTION_ADDITIONAL, qstate,
&verified, reasonbuf, sizeof(reasonbuf));
vq, &verified, reasonbuf, sizeof(reasonbuf));
/* the additional section can fail to be secure,
* it is optional, check signature in case we need
* to clean the additional section later. */
@@ -1433,16 +1455,20 @@ validate_nameerror_response(struct module_env* env, struct val_env* ve,
* trusted DNSKEY rrset that signs this response must already have been
* completed.
*
* @param env: module env.
* @param chase_reply: answer to validate.
*/
static void
validate_referral_response(struct reply_info* chase_reply)
validate_referral_response(struct module_env* env, struct reply_info* chase_reply)
{
size_t i;
size_t i, count;
enum sec_status s;
/* message security equals lowest rrset security */
chase_reply->security = sec_status_secure;
for(i=0; i<chase_reply->rrset_count; i++) {
if(env->cfg->val_clean_additional)
count = chase_reply->rrset_count;
else count = chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
for(i=0; i<count; i++) {
s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
->entry.data)->security;
if(s < chase_reply->security)
@@ -2309,7 +2335,7 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
key_entry_get_reason_bogus(vq->key_entry));
errinf_ede(qstate, "while building chain of trust",
key_entry_get_reason_bogus(vq->key_entry));
if(vq->restart_count >= ve->max_restart)
if(!val_can_restart(qstate, vq, ve))
key_cache_insert(ve->kcache, vq->key_entry,
qstate->env->cfg->val_log_level >= 2);
return 1;
@@ -2457,7 +2483,7 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
case VAL_CLASS_REFERRAL:
verbose(VERB_ALGO, "Validating a referral response");
validate_referral_response(vq->chase_reply);
validate_referral_response(qstate->env, vq->chase_reply);
verbose(VERB_DETAIL, "validate(referral): %s",
sec_status_to_string(
vq->chase_reply->security));
@@ -2531,15 +2557,17 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
}
if(subtype == VAL_CLASS_REFERRAL) {
/* for a referral, move to next unchecked rrset and check it*/
vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
vq->rrset_skip);
if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
/* and restart for this rrset */
verbose(VERB_ALGO, "validator: go to next rrset");
vq->chase_reply->security = sec_status_unchecked;
vq->state = VAL_INIT_STATE;
return 1;
if(qstate->env->cfg->val_clean_additional) {
/* for a referral, move to next unchecked rrset and check it*/
vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
vq->rrset_skip);
if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
/* and restart for this rrset */
verbose(VERB_ALGO, "validator: go to next rrset");
vq->chase_reply->security = sec_status_unchecked;
vq->state = VAL_INIT_STATE;
return 1;
}
}
/* referral chase is done */
}
@@ -2584,7 +2612,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
struct msgreply_entry* e;
/* see if we can try again to fetch data */
if(vq->restart_count < ve->max_restart) {
if(val_can_restart(qstate, vq, ve)) {
verbose(VERB_ALGO, "validation failed, "
"blacklist and retry to fetch data");
val_blacklist(&qstate->blacklist, qstate->region,
@@ -2876,6 +2904,7 @@ val_operate(struct module_qstate* qstate, enum module_ev event, int id,
* (this rrset is allocated in the wrong region, not the qstate).
* @param ta: trust anchor.
* @param qstate: qstate that needs key.
* @param vq: validator qstate.
* @param id: module id.
* @param sub_qstate: the sub query state, that is the lookup that fetched
* the trust anchor data, it contains error information for the answer.
@@ -2886,8 +2915,8 @@ val_operate(struct module_qstate* qstate, enum module_ev event, int id,
*/
static struct key_entry_key*
primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
struct trust_anchor* ta, struct module_qstate* qstate, int id,
struct module_qstate* sub_qstate)
struct trust_anchor* ta, struct module_qstate* qstate,
struct val_qstate* vq, int id, struct module_qstate* sub_qstate)
{
struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
struct key_entry_key* kkey = NULL;
@@ -2927,7 +2956,8 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
/* attempt to verify with trust anchor DS and DNSKEY */
kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
&reason, &reason_bogus, qstate, reasonbuf, sizeof(reasonbuf));
&reason, &reason_bogus, qstate, vq, reasonbuf,
sizeof(reasonbuf));
if(!kkey) {
log_err("out of memory: verifying prime TA");
return NULL;
@@ -3040,7 +3070,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
* bogus, then we are done. */
sec = val_verify_rrset_entry(qstate->env, ve, ds,
vq->key_entry, &reason, &reason_bogus,
LDNS_SECTION_ANSWER, qstate, &verified, reasonbuf,
LDNS_SECTION_ANSWER, qstate, vq, &verified, reasonbuf,
sizeof(reasonbuf));
if(sec != sec_status_secure) {
verbose(VERB_DETAIL, "DS rrset in DS response did "
@@ -3091,7 +3121,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
/* Try to prove absence of the DS with NSEC */
sec = val_nsec_prove_nodata_dsreply(
qstate->env, ve, qinfo, msg->rep, vq->key_entry,
&proof_ttl, &reason, &reason_bogus, qstate,
&proof_ttl, &reason, &reason_bogus, qstate, vq,
reasonbuf, sizeof(reasonbuf));
switch(sec) {
case sec_status_secure:
@@ -3129,7 +3159,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
sec = nsec3_prove_nods(qstate->env, ve,
msg->rep->rrsets + msg->rep->an_numrrsets,
msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason,
&reason_bogus, qstate, &vq->nsec3_cache_table,
&reason_bogus, qstate, vq, &vq->nsec3_cache_table,
reasonbuf, sizeof(reasonbuf));
switch(sec) {
case sec_status_insecure:
@@ -3197,7 +3227,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
}
sec = val_verify_rrset_entry(qstate->env, ve, cname,
vq->key_entry, &reason, &reason_bogus,
LDNS_SECTION_ANSWER, qstate, &verified, reasonbuf,
LDNS_SECTION_ANSWER, qstate, vq, &verified, reasonbuf,
sizeof(reasonbuf));
if(sec == sec_status_secure) {
/* Check for wildcard expansion */
@@ -3318,6 +3348,7 @@ process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
uint8_t* olds = vq->empty_DS_name;
int ret;
*suspend = 0;
vq->num_nsec_attempts = 0;
vq->empty_DS_name = NULL;
if(sub_qstate && sub_qstate->rpz_applied) {
verbose(VERB_ALGO, "rpz was applied to the DS lookup, "
@@ -3329,6 +3360,8 @@ process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
}
ret = ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske,
sub_qstate);
/* New NSEC attempt count for next message validation. */
vq->num_nsec_attempts = 0;
if(ret != 0) {
switch(ret) {
case 1:
@@ -3370,7 +3403,7 @@ process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
/* Keep the forState.state on FINDKEY. */
} else if(key_entry_isbad(dske)
&& vq->restart_count < ve->max_restart) {
&& val_can_restart(qstate, vq, ve)) {
vq->empty_DS_name = olds;
val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
qstate->errinf = NULL;
@@ -3420,6 +3453,7 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
char* reason = NULL;
sldns_ede_code reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
vq->num_nsec_attempts = 0;
if(sub_qstate && sub_qstate->rpz_applied) {
verbose(VERB_ALGO, "rpz was applied to the DNSKEY lookup, "
"make it insecure");
@@ -3439,7 +3473,7 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
"DNSKEY query.");
if(vq->restart_count < ve->max_restart) {
if(val_can_restart(qstate, vq, ve)) {
val_blacklist(&vq->chain_blacklist, qstate->region,
origin, 1);
qstate->errinf = NULL;
@@ -3476,7 +3510,9 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
downprot = qstate->env->cfg->harden_algo_downgrade;
vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
ve, dnskey, vq->ds_rrset, downprot, &reason, &reason_bogus,
qstate, reasonbuf, sizeof(reasonbuf));
qstate, vq, reasonbuf, sizeof(reasonbuf));
/* New NSEC attempt count for next message validation. */
vq->num_nsec_attempts = 0;
if(!vq->key_entry) {
log_err("out of memory in verify new DNSKEYs");
@@ -3487,7 +3523,7 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
* state. */
if(!key_entry_isgood(vq->key_entry)) {
if(key_entry_isbad(vq->key_entry)) {
if(vq->restart_count < ve->max_restart) {
if(val_can_restart(qstate, vq, ve)) {
val_blacklist(&vq->chain_blacklist,
qstate->region, origin, 1);
qstate->errinf = NULL;
@@ -3539,6 +3575,7 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
struct trust_anchor* ta = anchor_find(qstate->env->anchors,
vq->trust_anchor_name, vq->trust_anchor_labs,
vq->trust_anchor_len, vq->qchase.qclass);
vq->num_nsec_attempts = 0;
if(!ta) {
/* trust anchor revoked, restart with less anchors */
vq->state = VAL_INIT_STATE;
@@ -3557,19 +3594,23 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
if(ta->autr) {
if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset,
qstate)) {
qstate, vq)) {
/* New NSEC attempt count for next message validation. */
vq->num_nsec_attempts = 0;
/* trust anchor revoked, restart with less anchors */
vq->state = VAL_INIT_STATE;
vq->trust_anchor_name = NULL;
return;
}
}
vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id,
vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, vq, id,
sub_qstate);
lock_basic_unlock(&ta->lock);
/* New NSEC attempt count for next message validation. */
vq->num_nsec_attempts = 0;
if(vq->key_entry) {
if(key_entry_isbad(vq->key_entry)
&& vq->restart_count < ve->max_restart) {
&& val_can_restart(qstate, vq, ve)) {
val_blacklist(&vq->chain_blacklist, qstate->region,
origin, 1);
qstate->errinf = NULL;
contrib/unbound/validator/validator.h
+13
View File
@@ -231,6 +231,19 @@ struct val_qstate {
struct comm_timer* suspend_timer;
/** Number of suspends */
int suspend_count;
/** Number of DNSKEY RRSIG validation attempts. This is the number of
* cryptographic operations done for the mesh state. */
int num_validation_attempts;
/** Number of DS hash verification attempts. This is the number of
* hash operations done for the mesh state.
* It does not count NSEC3 hashes. */
int num_hash_attempts;
/** Number of NSEC validations. And NSEC3 too. This is reset per
* answer. */
int num_nsec_attempts;
/** The nsec attempts have been exceeded. */
int num_nsec_attempts_exceeded;
};
/**
lib/libunbound/config.h
+189 -199
View File
@@ -52,19 +52,19 @@
internal symbols */
/* #undef EXPORT_ALL_SYMBOLS */
/* Define to 1 if you have the 'accept4' function. */
/* Define to 1 if you have the `accept4' function. */
#define HAVE_ACCEPT4 1
/* Define to 1 if you have the 'arc4random' function. */
/* Define to 1 if you have the `arc4random' function. */
#define HAVE_ARC4RANDOM 1
/* Define to 1 if you have the 'arc4random_uniform' function. */
/* Define to 1 if you have the `arc4random_uniform' function. */
#define HAVE_ARC4RANDOM_UNIFORM 1
/* Define to 1 if you have the <arpa/inet.h> header file. */
#define HAVE_ARPA_INET_H 1
/* Define to 1 if you have the 'ASN1_STRING_get0_data' function. */
/* Define to 1 if you have the `ASN1_STRING_get0_data' function. */
#define HAVE_ASN1_STRING_GET0_DATA 1
/* Whether the C compiler accepts the "fallthrough" attribute */
@@ -88,7 +88,7 @@
/* If we have be64toh */
#define HAVE_BE64TOH 1
/* Define to 1 if you have the 'BIO_set_callback_ex' function. */
/* Define to 1 if you have the `BIO_set_callback_ex' function. */
#define HAVE_BIO_SET_CALLBACK_EX 1
/* Define to 1 if you have the <bsd/stdlib.h> header file. */
@@ -97,255 +97,255 @@
/* Define to 1 if you have the <bsd/string.h> header file. */
/* #undef HAVE_BSD_STRING_H */
/* Define to 1 if you have the 'chown' function. */
/* Define to 1 if you have the `chown' function. */
#define HAVE_CHOWN 1
/* Define to 1 if you have the 'chroot' function. */
/* Define to 1 if you have the `chroot' function. */
#define HAVE_CHROOT 1
/* Define to 1 if you have the 'CRYPTO_cleanup_all_ex_data' function. */
/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
/* #undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA */
/* Define to 1 if you have the 'CRYPTO_THREADID_set_callback' function. */
/* Define to 1 if you have the `CRYPTO_THREADID_set_callback' function. */
/* #undef HAVE_CRYPTO_THREADID_SET_CALLBACK */
/* Define to 1 if you have the 'ctime_r' function. */
/* Define to 1 if you have the `ctime_r' function. */
#define HAVE_CTIME_R 1
/* Define to 1 if you have the 'daemon' function. */
/* Define to 1 if you have the `daemon' function. */
#define HAVE_DAEMON 1
/* Define to 1 if you have the declaration of 'arc4random', and to 0 if you
/* Define to 1 if you have the declaration of `arc4random', and to 0 if you
don't. */
/* #undef HAVE_DECL_ARC4RANDOM */
/* Define to 1 if you have the declaration of 'arc4random_uniform', and to 0
/* Define to 1 if you have the declaration of `arc4random_uniform', and to 0
if you don't. */
/* #undef HAVE_DECL_ARC4RANDOM_UNIFORM */
/* Define to 1 if you have the declaration of 'evsignal_assign', and to 0 if
/* Define to 1 if you have the declaration of `evsignal_assign', and to 0 if
you don't. */
/* #undef HAVE_DECL_EVSIGNAL_ASSIGN */
/* Define to 1 if you have the declaration of 'inet_ntop', and to 0 if you
/* Define to 1 if you have the declaration of `inet_ntop', and to 0 if you
don't. */
#define HAVE_DECL_INET_NTOP 1
/* Define to 1 if you have the declaration of 'inet_pton', and to 0 if you
/* Define to 1 if you have the declaration of `inet_pton', and to 0 if you
don't. */
#define HAVE_DECL_INET_PTON 1
/* Define to 1 if you have the declaration of 'nghttp2_session_server_new',
/* Define to 1 if you have the declaration of `nghttp2_session_server_new',
and to 0 if you don't. */
/* #undef HAVE_DECL_NGHTTP2_SESSION_SERVER_NEW */
/* Define to 1 if you have the declaration of 'ngtcp2_conn_server_new', and to
/* Define to 1 if you have the declaration of `ngtcp2_conn_server_new', and to
0 if you don't. */
/* #undef HAVE_DECL_NGTCP2_CONN_SERVER_NEW */
/* Define to 1 if you have the declaration of 'ngtcp2_crypto_encrypt_cb', and
/* Define to 1 if you have the declaration of `ngtcp2_crypto_encrypt_cb', and
to 0 if you don't. */
/* #undef HAVE_DECL_NGTCP2_CRYPTO_ENCRYPT_CB */
/* Define to 1 if you have the declaration of 'ngtcp2_crypto_ossl_ctx_new',
/* Define to 1 if you have the declaration of `ngtcp2_crypto_ossl_ctx_new',
and to 0 if you don't. */
/* #undef HAVE_DECL_NGTCP2_CRYPTO_OSSL_CTX_NEW */
/* Define to 1 if you have the declaration of 'NID_ED25519', and to 0 if you
/* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
don't. */
#define HAVE_DECL_NID_ED25519 1
/* Define to 1 if you have the declaration of 'NID_ED448', and to 0 if you
/* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
don't. */
#define HAVE_DECL_NID_ED448 1
/* Define to 1 if you have the declaration of 'NID_secp384r1', and to 0 if you
/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
don't. */
#define HAVE_DECL_NID_SECP384R1 1
/* Define to 1 if you have the declaration of 'NID_X9_62_prime256v1', and to 0
/* Define to 1 if you have the declaration of `NID_X9_62_prime256v1', and to 0
if you don't. */
#define HAVE_DECL_NID_X9_62_PRIME256V1 1
/* Define to 1 if you have the declaration of 'reallocarray', and to 0 if you
/* Define to 1 if you have the declaration of `reallocarray', and to 0 if you
don't. */
#define HAVE_DECL_REALLOCARRAY 1
/* Define to 1 if you have the declaration of 'redisConnect', and to 0 if you
/* Define to 1 if you have the declaration of `redisConnect', and to 0 if you
don't. */
/* #undef HAVE_DECL_REDISCONNECT */
/* Define to 1 if you have the declaration of 'sk_SSL_COMP_pop_free', and to 0
/* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
if you don't. */
#define HAVE_DECL_SK_SSL_COMP_POP_FREE 1
/* Define to 1 if you have the declaration of
'SSL_COMP_get_compression_methods', and to 0 if you don't. */
`SSL_COMP_get_compression_methods', and to 0 if you don't. */
#define HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS 1
/* Define to 1 if you have the declaration of 'SSL_CTX_set_ecdh_auto', and to
/* Define to 1 if you have the declaration of `SSL_CTX_set_ecdh_auto', and to
0 if you don't. */
#define HAVE_DECL_SSL_CTX_SET_ECDH_AUTO 1
/* Define to 1 if you have the declaration of 'SSL_CTX_set_tmp_ecdh', and to 0
/* Define to 1 if you have the declaration of `SSL_CTX_set_tmp_ecdh', and to 0
if you don't. */
#define HAVE_DECL_SSL_CTX_SET_TMP_ECDH 1
/* Define to 1 if you have the declaration of 'strlcat', and to 0 if you
/* Define to 1 if you have the declaration of `strlcat', and to 0 if you
don't. */
/* #undef HAVE_DECL_STRLCAT */
/* Define to 1 if you have the declaration of 'strlcpy', and to 0 if you
/* Define to 1 if you have the declaration of `strlcpy', and to 0 if you
don't. */
/* #undef HAVE_DECL_STRLCPY */
/* Define to 1 if you have the declaration of 'XML_StopParser', and to 0 if
/* Define to 1 if you have the declaration of `XML_StopParser', and to 0 if
you don't. */
#define HAVE_DECL_XML_STOPPARSER 1
/* Define to 1 if you have the <dlfcn.h> header file. */
#define HAVE_DLFCN_H 1
/* Define to 1 if you have the 'DSA_SIG_set0' function. */
/* Define to 1 if you have the `DSA_SIG_set0' function. */
#define HAVE_DSA_SIG_SET0 1
/* Define to 1 if you have the <endian.h> header file. */
#define HAVE_ENDIAN_H 1
/* Define to 1 if you have the 'endprotoent' function. */
/* Define to 1 if you have the `endprotoent' function. */
#define HAVE_ENDPROTOENT 1
/* Define to 1 if you have the 'endpwent' function. */
/* Define to 1 if you have the `endpwent' function. */
#define HAVE_ENDPWENT 1
/* Define to 1 if you have the 'endservent' function. */
/* Define to 1 if you have the `endservent' function. */
#define HAVE_ENDSERVENT 1
/* Define to 1 if you have the 'ENGINE_cleanup' function. */
/* Define to 1 if you have the `ENGINE_cleanup' function. */
/* #undef HAVE_ENGINE_CLEANUP */
/* Define to 1 if you have the 'ERR_free_strings' function. */
/* Define to 1 if you have the `ERR_free_strings' function. */
/* #undef HAVE_ERR_FREE_STRINGS */
/* Define to 1 if you have the 'ERR_load_crypto_strings' function. */
/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
/* #undef HAVE_ERR_LOAD_CRYPTO_STRINGS */
/* Define to 1 if you have the 'event_assign' function. */
/* Define to 1 if you have the `event_assign' function. */
/* #undef HAVE_EVENT_ASSIGN */
/* Define to 1 if you have the 'event_base_free' function. */
/* Define to 1 if you have the `event_base_free' function. */
/* #undef HAVE_EVENT_BASE_FREE */
/* Define to 1 if you have the 'event_base_get_method' function. */
/* Define to 1 if you have the `event_base_get_method' function. */
/* #undef HAVE_EVENT_BASE_GET_METHOD */
/* Define to 1 if you have the 'event_base_new' function. */
/* Define to 1 if you have the `event_base_new' function. */
/* #undef HAVE_EVENT_BASE_NEW */
/* Define to 1 if you have the 'event_base_once' function. */
/* Define to 1 if you have the `event_base_once' function. */
/* #undef HAVE_EVENT_BASE_ONCE */
/* Define to 1 if you have the <event.h> header file. */
/* #undef HAVE_EVENT_H */
/* Define to 1 if you have the 'EVP_aes_256_cbc' function. */
/* Define to 1 if you have the `EVP_aes_256_cbc' function. */
#define HAVE_EVP_AES_256_CBC 1
/* Define to 1 if you have the 'EVP_cleanup' function. */
/* Define to 1 if you have the `EVP_cleanup' function. */
/* #undef HAVE_EVP_CLEANUP */
/* Define to 1 if you have the 'EVP_default_properties_is_fips_enabled'
/* Define to 1 if you have the `EVP_default_properties_is_fips_enabled'
function. */
#define HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED 1
/* Define to 1 if you have the 'EVP_DigestVerify' function. */
/* Define to 1 if you have the `EVP_DigestVerify' function. */
#define HAVE_EVP_DIGESTVERIFY 1
/* Define to 1 if you have the 'EVP_dss1' function. */
/* Define to 1 if you have the `EVP_dss1' function. */
/* #undef HAVE_EVP_DSS1 */
/* Define to 1 if you have the 'EVP_EncryptInit_ex' function. */
/* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
#define HAVE_EVP_ENCRYPTINIT_EX 1
/* Define to 1 if you have the 'EVP_MAC_CTX_set_params' function. */
/* Define to 1 if you have the `EVP_MAC_CTX_set_params' function. */
#define HAVE_EVP_MAC_CTX_SET_PARAMS 1
/* Define to 1 if you have the 'EVP_MD_CTX_new' function. */
/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
#define HAVE_EVP_MD_CTX_NEW 1
/* Define to 1 if you have the 'EVP_sha1' function. */
/* Define to 1 if you have the `EVP_sha1' function. */
#define HAVE_EVP_SHA1 1
/* Define to 1 if you have the 'EVP_sha256' function. */
/* Define to 1 if you have the `EVP_sha256' function. */
#define HAVE_EVP_SHA256 1
/* Define to 1 if you have the 'EVP_sha512' function. */
/* Define to 1 if you have the `EVP_sha512' function. */
#define HAVE_EVP_SHA512 1
/* Define to 1 if you have the 'ev_default_loop' function. */
/* Define to 1 if you have the `ev_default_loop' function. */
/* #undef HAVE_EV_DEFAULT_LOOP */
/* Define to 1 if you have the 'ev_loop' function. */
/* Define to 1 if you have the `ev_loop' function. */
/* #undef HAVE_EV_LOOP */
/* Define to 1 if you have the <expat.h> header file. */
#define HAVE_EXPAT_H 1
/* Define to 1 if you have the 'explicit_bzero' function. */
/* Define to 1 if you have the `explicit_bzero' function. */
#define HAVE_EXPLICIT_BZERO 1
/* Define to 1 if you have the 'fcntl' function. */
/* Define to 1 if you have the `fcntl' function. */
#define HAVE_FCNTL 1
/* Define to 1 if you have the 'FIPS_mode' function. */
/* Define to 1 if you have the `FIPS_mode' function. */
/* #undef HAVE_FIPS_MODE */
/* Define to 1 if you have the 'fnmatch' function. */
/* Define to 1 if you have the `fnmatch' function. */
#define HAVE_FNMATCH 1
/* Define to 1 if you have the <fnmatch.h> header file. */
#define HAVE_FNMATCH_H 1
/* Define to 1 if you have the 'fork' function. */
/* Define to 1 if you have the `fork' function. */
#define HAVE_FORK 1
/* Define to 1 if fseeko (and ftello) are declared in stdio.h. */
/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
#define HAVE_FSEEKO 1
/* Define to 1 if you have the 'fsync' function. */
/* Define to 1 if you have the `fsync' function. */
#define HAVE_FSYNC 1
/* Whether getaddrinfo is available */
#define HAVE_GETADDRINFO 1
/* Define to 1 if you have the 'getauxval' function. */
/* Define to 1 if you have the `getauxval' function. */
/* #undef HAVE_GETAUXVAL */
/* Define to 1 if you have the 'getentropy' function. */
/* Define to 1 if you have the `getentropy' function. */
/* #undef HAVE_GETENTROPY */
/* Define to 1 if you have the 'getifaddrs' function. */
/* Define to 1 if you have the `getifaddrs' function. */
#define HAVE_GETIFADDRS 1
/* Define to 1 if you have the <getopt.h> header file. */
#define HAVE_GETOPT_H 1
/* Define to 1 if you have the 'getpwnam' function. */
/* Define to 1 if you have the `getpwnam' function. */
#define HAVE_GETPWNAM 1
/* Define to 1 if you have the 'getrlimit' function. */
/* Define to 1 if you have the `getrlimit' function. */
#define HAVE_GETRLIMIT 1
/* Define to 1 if you have the 'gettid' function. */
/* Define to 1 if you have the `gettid' function. */
/* #undef HAVE_GETTID */
/* Define to 1 if you have the 'glob' function. */
/* Define to 1 if you have the `glob' function. */
#define HAVE_GLOB 1
/* Define to 1 if you have the <glob.h> header file. */
#define HAVE_GLOB_H 1
/* Define to 1 if you have the 'gmtime_r' function. */
/* Define to 1 if you have the `gmtime_r' function. */
#define HAVE_GMTIME_R 1
/* Define to 1 if you have the <grp.h> header file. */
@@ -354,7 +354,7 @@
/* Define to 1 if you have the <hiredis/hiredis.h> header file. */
/* #undef HAVE_HIREDIS_HIREDIS_H */
/* Define to 1 if you have the 'HMAC_Init_ex' function. */
/* Define to 1 if you have the `HMAC_Init_ex' function. */
#define HAVE_HMAC_INIT_EX 1
/* If we have htobe64 */
@@ -363,19 +363,19 @@
/* Define to 1 if you have the <ifaddrs.h> header file. */
#define HAVE_IFADDRS_H 1
/* Define to 1 if you have the 'if_nametoindex' function. */
/* Define to 1 if you have the `if_nametoindex' function. */
#define HAVE_IF_NAMETOINDEX 1
/* Define to 1 if you have the 'inet_aton' function. */
/* Define to 1 if you have the `inet_aton' function. */
#define HAVE_INET_ATON 1
/* Define to 1 if you have the 'inet_ntop' function. */
/* Define to 1 if you have the `inet_ntop' function. */
#define HAVE_INET_NTOP 1
/* Define to 1 if you have the 'inet_pton' function. */
/* Define to 1 if you have the `inet_pton' function. */
#define HAVE_INET_PTON 1
/* Define to 1 if you have the 'initgroups' function. */
/* Define to 1 if you have the `initgroups' function. */
#define HAVE_INITGROUPS 1
/* Define to 1 if you have the <inttypes.h> header file. */
@@ -387,10 +387,10 @@
/* Define to 1 if you have the <iphlpapi.h> header file. */
/* #undef HAVE_IPHLPAPI_H */
/* Define to 1 if you have the 'isblank' function. */
/* Define to 1 if you have the `isblank' function. */
#define HAVE_ISBLANK 1
/* Define to 1 if you have the 'kill' function. */
/* Define to 1 if you have the `kill' function. */
#define HAVE_KILL 1
/* Use portable libbsd functions */
@@ -408,7 +408,7 @@
/* Define to 1 if you have the <linux/net_tstamp.h> header file. */
/* #undef HAVE_LINUX_NET_TSTAMP_H */
/* Define to 1 if you have the 'localtime_r' function. */
/* Define to 1 if you have the `localtime_r' function. */
#define HAVE_LOCALTIME_R 1
/* Define to 1 if you have the <login_cap.h> header file. */
@@ -417,7 +417,7 @@
/* If have GNU libc compatible malloc */
#define HAVE_MALLOC 1
/* Define to 1 if you have the 'memmove' function. */
/* Define to 1 if you have the `memmove' function. */
#define HAVE_MEMMOVE 1
/* Define to 1 if you have the <minix/config.h> header file. */
@@ -459,52 +459,52 @@
/* Define this to use ngtcp2. */
/* #undef HAVE_NGTCP2 */
/* Define to 1 if you have the 'ngtcp2_ccerr_default' function. */
/* Define to 1 if you have the `ngtcp2_ccerr_default' function. */
/* #undef HAVE_NGTCP2_CCERR_DEFAULT */
/* Define to 1 if you have the 'ngtcp2_conn_encode_0rtt_transport_params'
/* Define to 1 if you have the `ngtcp2_conn_encode_0rtt_transport_params'
function. */
/* #undef HAVE_NGTCP2_CONN_ENCODE_0RTT_TRANSPORT_PARAMS */
/* Define to 1 if you have the 'ngtcp2_conn_get_max_local_streams_uni'
/* Define to 1 if you have the `ngtcp2_conn_get_max_local_streams_uni'
function. */
/* #undef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI */
/* Define to 1 if you have the 'ngtcp2_conn_get_num_scid' function. */
/* Define to 1 if you have the `ngtcp2_conn_get_num_scid' function. */
/* #undef HAVE_NGTCP2_CONN_GET_NUM_SCID */
/* Define to 1 if you have the 'ngtcp2_conn_in_closing_period' function. */
/* Define to 1 if you have the `ngtcp2_conn_in_closing_period' function. */
/* #undef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD */
/* Define to 1 if you have the 'ngtcp2_conn_in_draining_period' function. */
/* Define to 1 if you have the `ngtcp2_conn_in_draining_period' function. */
/* #undef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD */
/* Define if ngtcp2_conn_shutdown_stream has 4 arguments. */
/* #undef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4 */
/* Define to 1 if you have the 'ngtcp2_conn_tls_early_data_rejected' function.
/* Define to 1 if you have the `ngtcp2_conn_tls_early_data_rejected' function.
*/
/* #undef HAVE_NGTCP2_CONN_TLS_EARLY_DATA_REJECTED */
/* Define to 1 if you have the 'ngtcp2_crypto_encrypt_cb' function. */
/* Define to 1 if you have the `ngtcp2_crypto_encrypt_cb' function. */
/* #undef HAVE_NGTCP2_CRYPTO_ENCRYPT_CB */
/* Define to 1 if you have the
'ngtcp2_crypto_quictls_configure_client_context' function. */
`ngtcp2_crypto_quictls_configure_client_context' function. */
/* #undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_CLIENT_CONTEXT */
/* Define to 1 if you have the
'ngtcp2_crypto_quictls_configure_server_context' function. */
`ngtcp2_crypto_quictls_configure_server_context' function. */
/* #undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT */
/* Define to 1 if you have the
'ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
`ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
/* #undef HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL */
/* Define to 1 if you have the 'ngtcp2_crypto_quictls_init' function. */
/* Define to 1 if you have the `ngtcp2_crypto_quictls_init' function. */
/* #undef HAVE_NGTCP2_CRYPTO_QUICTLS_INIT */
/* Define to 1 if the system has the type 'ngtcp2_encryption_level'. */
/* Define to 1 if the system has the type `ngtcp2_encryption_level'. */
/* #undef HAVE_NGTCP2_ENCRYPTION_LEVEL */
/* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_openssl.h> header file.
@@ -524,16 +524,16 @@
/* Use libnss for crypto */
/* #undef HAVE_NSS */
/* Define to 1 if you have the 'OpenSSL_add_all_digests' function. */
/* Define to 1 if you have the `OpenSSL_add_all_digests' function. */
/* #undef HAVE_OPENSSL_ADD_ALL_DIGESTS */
/* Define to 1 if you have the <openssl/bn.h> header file. */
#define HAVE_OPENSSL_BN_H 1
/* Define to 1 if you have the 'OPENSSL_cleanup' function. */
/* Define to 1 if you have the `OPENSSL_cleanup' function. */
#define HAVE_OPENSSL_CLEANUP 1
/* Define to 1 if you have the 'OPENSSL_config' function. */
/* Define to 1 if you have the `OPENSSL_config' function. */
#define HAVE_OPENSSL_CONFIG 1
/* Define to 1 if you have the <openssl/conf.h> header file. */
@@ -554,10 +554,10 @@
/* Define to 1 if you have the <openssl/err.h> header file. */
#define HAVE_OPENSSL_ERR_H 1
/* Define to 1 if you have the 'OPENSSL_init_crypto' function. */
/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
#define HAVE_OPENSSL_INIT_CRYPTO 1
/* Define to 1 if you have the 'OPENSSL_init_ssl' function. */
/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
#define HAVE_OPENSSL_INIT_SSL 1
/* Define to 1 if you have the <openssl/param_build.h> header file. */
@@ -572,10 +572,10 @@
/* Define to 1 if you have the <openssl/ssl.h> header file. */
#define HAVE_OPENSSL_SSL_H 1
/* Define to 1 if you have the 'OSSL_PARAM_BLD_new' function. */
/* Define to 1 if you have the `OSSL_PARAM_BLD_new' function. */
#define HAVE_OSSL_PARAM_BLD_NEW 1
/* Define to 1 if you have the 'poll' function. */
/* Define to 1 if you have the `poll' function. */
#define HAVE_POLL 1
/* Define to 1 if you have the <poll.h> header file. */
@@ -590,7 +590,7 @@
/* Have PTHREAD_PRIO_INHERIT. */
#define HAVE_PTHREAD_PRIO_INHERIT 1
/* Define to 1 if the system has the type 'pthread_rwlock_t'. */
/* Define to 1 if the system has the type `pthread_rwlock_t'. */
#define HAVE_PTHREAD_RWLOCK_T 1
/* Define if pthread_setname_np has the common 2 arguments. */
@@ -605,7 +605,7 @@
/* Define if pthread_setname_np exists as pthread_set_name_np instead. */
#define HAVE_PTHREAD_SET_NAME_NP 1
/* Define to 1 if the system has the type 'pthread_spinlock_t'. */
/* Define to 1 if the system has the type `pthread_spinlock_t'. */
#define HAVE_PTHREAD_SPINLOCK_T 1
/* Define to 1 if you have the <pwd.h> header file. */
@@ -614,104 +614,104 @@
/* Define if you have Python libraries and header files. */
/* #undef HAVE_PYTHON */
/* Define to 1 if you have the 'random' function. */
/* Define to 1 if you have the `random' function. */
#define HAVE_RANDOM 1
/* Define to 1 if you have the 'RAND_cleanup' function. */
/* Define to 1 if you have the `RAND_cleanup' function. */
/* #undef HAVE_RAND_CLEANUP */
/* If we have reallocarray(3) */
#define HAVE_REALLOCARRAY 1
/* Define to 1 if you have the 'recvmsg' function. */
/* Define to 1 if you have the `recvmsg' function. */
#define HAVE_RECVMSG 1
/* Define to 1 if you have the 'sendmsg' function. */
/* Define to 1 if you have the `sendmsg' function. */
#define HAVE_SENDMSG 1
/* Define to 1 if you have the 'setregid' function. */
/* Define to 1 if you have the `setregid' function. */
/* #undef HAVE_SETREGID */
/* Define to 1 if you have the 'setresgid' function. */
/* Define to 1 if you have the `setresgid' function. */
#define HAVE_SETRESGID 1
/* Define to 1 if you have the 'setresuid' function. */
/* Define to 1 if you have the `setresuid' function. */
#define HAVE_SETRESUID 1
/* Define to 1 if you have the 'setreuid' function. */
/* Define to 1 if you have the `setreuid' function. */
/* #undef HAVE_SETREUID */
/* Define to 1 if you have the 'setrlimit' function. */
/* Define to 1 if you have the `setrlimit' function. */
#define HAVE_SETRLIMIT 1
/* Define to 1 if you have the 'setsid' function. */
/* Define to 1 if you have the `setsid' function. */
#define HAVE_SETSID 1
/* Define to 1 if you have the 'setusercontext' function. */
/* Define to 1 if you have the `setusercontext' function. */
#define HAVE_SETUSERCONTEXT 1
/* Define to 1 if you have the 'SHA512_Update' function. */
/* Define to 1 if you have the `SHA512_Update' function. */
/* #undef HAVE_SHA512_UPDATE */
/* Define to 1 if you have the 'shmget' function. */
/* Define to 1 if you have the `shmget' function. */
#define HAVE_SHMGET 1
/* Define to 1 if you have the 'sigprocmask' function. */
/* Define to 1 if you have the `sigprocmask' function. */
#define HAVE_SIGPROCMASK 1
/* Define to 1 if you have the 'sleep' function. */
/* Define to 1 if you have the `sleep' function. */
#define HAVE_SLEEP 1
/* Define to 1 if you have the 'snprintf' function. */
/* Define to 1 if you have the `snprintf' function. */
#define HAVE_SNPRINTF 1
/* Define to 1 if you have the 'socketpair' function. */
/* Define to 1 if you have the `socketpair' function. */
#define HAVE_SOCKETPAIR 1
/* Using Solaris threads */
/* #undef HAVE_SOLARIS_THREADS */
/* Define to 1 if you have the 'srandom' function. */
/* Define to 1 if you have the `srandom' function. */
#define HAVE_SRANDOM 1
/* Define if you have the SSL libraries installed. */
#define HAVE_SSL /**/
/* Define to 1 if you have the 'SSL_CTX_set_alpn_protos' function. */
/* Define to 1 if you have the `SSL_CTX_set_alpn_protos' function. */
#define HAVE_SSL_CTX_SET_ALPN_PROTOS 1
/* Define to 1 if you have the 'SSL_CTX_set_alpn_select_cb' function. */
/* Define to 1 if you have the `SSL_CTX_set_alpn_select_cb' function. */
#define HAVE_SSL_CTX_SET_ALPN_SELECT_CB 1
/* Define to 1 if you have the 'SSL_CTX_set_ciphersuites' function. */
/* Define to 1 if you have the `SSL_CTX_set_ciphersuites' function. */
#define HAVE_SSL_CTX_SET_CIPHERSUITES 1
/* Define to 1 if you have the 'SSL_CTX_set_security_level' function. */
/* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
#define HAVE_SSL_CTX_SET_SECURITY_LEVEL 1
/* Define to 1 if you have the 'SSL_CTX_set_tlsext_ticket_key_evp_cb'
/* Define to 1 if you have the `SSL_CTX_set_tlsext_ticket_key_evp_cb'
function. */
#define HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB 1
/* Define to 1 if you have the 'SSL_get0_alpn_selected' function. */
/* Define to 1 if you have the `SSL_get0_alpn_selected' function. */
#define HAVE_SSL_GET0_ALPN_SELECTED 1
/* Define to 1 if you have the 'SSL_get0_peername' function. */
/* Define to 1 if you have the `SSL_get0_peername' function. */
#define HAVE_SSL_GET0_PEERNAME 1
/* Define to 1 if you have the 'SSL_get1_peer_certificate' function. */
/* Define to 1 if you have the `SSL_get1_peer_certificate' function. */
#define HAVE_SSL_GET1_PEER_CERTIFICATE 1
/* Define to 1 if you have the 'SSL_is_quic' function. */
/* Define to 1 if you have the `SSL_is_quic' function. */
/* #undef HAVE_SSL_IS_QUIC */
/* Define to 1 if you have the 'SSL_set1_dnsname' function. */
/* Define to 1 if you have the `SSL_set1_dnsname' function. */
/* #undef HAVE_SSL_SET1_DNSNAME */
/* Define to 1 if you have the 'SSL_set1_host' function. */
/* Define to 1 if you have the `SSL_set1_host' function. */
#define HAVE_SSL_SET1_HOST 1
/* Define to 1 if you have the 'SSL_set_quic_tls_early_data_enabled' function.
/* Define to 1 if you have the `SSL_set_quic_tls_early_data_enabled' function.
*/
/* #undef HAVE_SSL_SET_QUIC_TLS_EARLY_DATA_ENABLED */
@@ -733,7 +733,7 @@
/* Define to 1 if you have the <stdlib.h> header file. */
#define HAVE_STDLIB_H 1
/* Define to 1 if you have the 'strftime' function. */
/* Define to 1 if you have the `strftime' function. */
#define HAVE_STRFTIME 1
/* Define to 1 if you have the <strings.h> header file. */
@@ -742,45 +742,45 @@
/* Define to 1 if you have the <string.h> header file. */
#define HAVE_STRING_H 1
/* Define to 1 if you have the 'strlcat' function. */
/* Define to 1 if you have the `strlcat' function. */
#define HAVE_STRLCAT 1
/* Define to 1 if you have the 'strlcpy' function. */
/* Define to 1 if you have the `strlcpy' function. */
#define HAVE_STRLCPY 1
/* Define to 1 if you have the 'strptime' function. */
/* Define to 1 if you have the `strptime' function. */
#define HAVE_STRPTIME 1
/* Define to 1 if you have the 'strsep' function. */
/* Define to 1 if you have the `strsep' function. */
#define HAVE_STRSEP 1
/* Define to 1 if 'ipi_spec_dst' is a member of 'struct in_pktinfo'. */
/* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
/* #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST */
/* Define to 1 if 'tokenlen' is a member of 'struct ngtcp2_pkt_hd'. */
/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_pkt_hd'. */
/* #undef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN */
/* Define to 1 if 'max_tx_udp_payload_size' is a member of 'struct
/* Define to 1 if `max_tx_udp_payload_size' is a member of `struct
ngtcp2_settings'. */
/* #undef HAVE_STRUCT_NGTCP2_SETTINGS_MAX_TX_UDP_PAYLOAD_SIZE */
/* Define to 1 if 'tokenlen' is a member of 'struct ngtcp2_settings'. */
/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_settings'. */
/* #undef HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN */
/* Define to 1 if 'original_dcid_present' is a member of 'struct
/* Define to 1 if `original_dcid_present' is a member of `struct
ngtcp2_transport_params'. */
/* #undef HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT */
/* Define to 1 if the system has the type 'struct ngtcp2_version_cid'. */
/* Define to 1 if the system has the type `struct ngtcp2_version_cid'. */
/* #undef HAVE_STRUCT_NGTCP2_VERSION_CID */
/* Define to 1 if 'sun_len' is a member of 'struct sockaddr_un'. */
/* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
#define HAVE_STRUCT_SOCKADDR_UN_SUN_LEN 1
/* Define to 1 if 'st_mtimensec' is a member of 'struct stat'. */
/* Define to 1 if `st_mtimensec' is a member of `struct stat'. */
#define HAVE_STRUCT_STAT_ST_MTIMENSEC 1
/* Define to 1 if 'st_mtim.tv_nsec' is a member of 'struct stat'. */
/* Define to 1 if `st_mtim.tv_nsec' is a member of `struct stat'. */
#define HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC 1
/* Define if you have Swig libraries and header files. */
@@ -840,16 +840,16 @@
/* Define to 1 if you have the <time.h> header file. */
#define HAVE_TIME_H 1
/* Define to 1 if you have the 'tzset' function. */
/* Define to 1 if you have the `tzset' function. */
#define HAVE_TZSET 1
/* Define to 1 if you have the <unistd.h> header file. */
#define HAVE_UNISTD_H 1
/* Define to 1 if you have the 'usleep' function. */
/* Define to 1 if you have the `usleep' function. */
#define HAVE_USLEEP 1
/* Define to 1 if you have the 'vfork' function. */
/* Define to 1 if you have the `vfork' function. */
#define HAVE_VFORK 1
/* Define to 1 if you have the <vfork.h> header file. */
@@ -867,28 +867,28 @@
/* Define to 1 if you have the <winsock2.h> header file. */
/* #undef HAVE_WINSOCK2_H */
/* Define to 1 if 'fork' works. */
/* Define to 1 if `fork' works. */
#define HAVE_WORKING_FORK 1
/* Define to 1 if 'vfork' works. */
/* Define to 1 if `vfork' works. */
#define HAVE_WORKING_VFORK 1
/* Define to 1 if you have the 'writev' function. */
/* Define to 1 if you have the `writev' function. */
#define HAVE_WRITEV 1
/* Define to 1 if you have the <ws2tcpip.h> header file. */
/* #undef HAVE_WS2TCPIP_H */
/* Define to 1 if you have the 'X509_get_key_usage' function. */
/* Define to 1 if you have the `X509_get_key_usage' function. */
#define HAVE_X509_GET_KEY_USAGE 1
/* Define to 1 if you have the 'X509_NAME_get_text_by_NID' function. */
/* Define to 1 if you have the `X509_NAME_get_text_by_NID' function. */
#define HAVE_X509_NAME_GET_TEXT_BY_NID 1
/* Define to 1 if you have the 'X509_VERIFY_PARAM_set1_host' function. */
/* Define to 1 if you have the `X509_VERIFY_PARAM_set1_host' function. */
#define HAVE_X509_VERIFY_PARAM_SET1_HOST 1
/* Define to 1 if you have the '_beginthreadex' function. */
/* Define to 1 if you have the `_beginthreadex' function. */
/* #undef HAVE__BEGINTHREADEX */
/* If HMAC_Init_ex() returns void */
@@ -947,7 +947,7 @@
#define PACKAGE_NAME "unbound"
/* Define to the full name and version of this package. */
#define PACKAGE_STRING "unbound 1.26.0"
#define PACKAGE_STRING "unbound 1.26.1"
/* Define to the one symbol short name of this package. */
#define PACKAGE_TARNAME "unbound"
@@ -956,7 +956,7 @@
#define PACKAGE_URL ""
/* Define to the version of this package. */
#define PACKAGE_VERSION "1.26.0"
#define PACKAGE_VERSION "1.26.1"
/* default pidfile location */
#define PIDFILE "/var/unbound/unbound.pid"
@@ -979,7 +979,7 @@
#define ROOT_CERT_FILE "/var/unbound/icannbundle.pem"
/* version number for resource files */
#define RSRC_PACKAGE_VERSION 1,26,0,0
#define RSRC_PACKAGE_VERSION 1,26,1,0
/* Directory to chdir to */
#define RUN_DIR "/var/unbound"
@@ -987,16 +987,16 @@
/* Shared data */
#define SHARE_DIR "/var/unbound"
/* The size of 'pthread_t', as computed by sizeof. */
/* The size of `pthread_t', as computed by sizeof. */
#define SIZEOF_PTHREAD_T 8
/* The size of 'size_t', as computed by sizeof. */
/* The size of `size_t', as computed by sizeof. */
#define SIZEOF_SIZE_T 8
/* The size of 'time_t', as computed by sizeof. */
/* The size of `time_t', as computed by sizeof. */
#define SIZEOF_TIME_T 8
/* The size of 'unsigned long', as computed by sizeof. */
/* The size of `unsigned long', as computed by sizeof. */
#define SIZEOF_UNSIGNED_LONG 8
/* define if (v)snprintf does not return length needed, (but length used) */
@@ -1005,7 +1005,7 @@
/* Define to 1 if libsodium supports sodium_set_misuse_handler */
/* #undef SODIUM_MISUSE_HANDLER */
/* Define to 1 if all of the C89 standard headers exist (not just the ones
/* Define to 1 if all of the C90 standard headers exist (not just the ones
required in a freestanding environment). This macro is provided for
backward compatibility; new code need not use it. */
#define STDC_HEADERS 1
@@ -1102,7 +1102,7 @@
/* Define this to enable SHA256 and SHA512 support. */
#define USE_SHA2 1
/* Enable extensions on AIX, Interix, z/OS. */
/* Enable extensions on AIX 3, Interix. */
#ifndef _ALL_SOURCE
# define _ALL_SOURCE 1
#endif
@@ -1163,15 +1163,11 @@
#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
# define __STDC_WANT_IEC_60559_DFP_EXT__ 1
#endif
/* Enable extensions specified by C23 Annex F. */
#ifndef __STDC_WANT_IEC_60559_EXT__
# define __STDC_WANT_IEC_60559_EXT__ 1
#endif
/* Enable extensions specified by ISO/IEC TS 18661-4:2015. */
#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
# define __STDC_WANT_IEC_60559_FUNCS_EXT__ 1
#endif
/* Enable extensions specified by C23 Annex H and ISO/IEC TS 18661-3:2015. */
/* Enable extensions specified by ISO/IEC TS 18661-3:2015. */
#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
# define __STDC_WANT_IEC_60559_TYPES_EXT__ 1
#endif
@@ -1212,36 +1208,30 @@
/* Define if you want PyUnbound. */
/* #undef WITH_PYUNBOUND */
/* Define to 1 if 'lex' declares 'yytext' as a 'char *' by default, not a
'char[]'. */
/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
`char[]'. */
#define YYTEXT_POINTER 1
/* Number of bits in a file offset, on hosts where this is settable. */
/* #undef _FILE_OFFSET_BITS */
/* Define to 1 if necessary to make fseeko visible. */
/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
/* #undef _LARGEFILE_SOURCE */
/* Define to 1 on platforms where this makes off_t a 64-bit type. */
/* Define for large files, on AIX-style hosts. */
/* #undef _LARGE_FILES */
/* Enable for compile on Minix */
#define _NETBSD_SOURCE 1
/* Number of bits in time_t, on hosts where this is settable. */
/* #undef _TIME_BITS */
/* Define to 1 on platforms where this makes time_t a 64-bit type. */
/* #undef __MINGW_USE_VC2005_COMPAT */
/* defined to use gcc ansi snprintf and sscanf that understands %lld when
compiled for windows. */
/* #undef __USE_MINGW_ANSI_STDIO */
/* Define to empty if 'const' does not conform to ANSI C. */
/* Define to empty if `const' does not conform to ANSI C. */
/* #undef const */
/* Define as 'int' if <sys/types.h> doesn't define. */
/* Define to `int' if <sys/types.h> doesn't define. */
/* #undef gid_t */
/* in_addr_t */
@@ -1250,28 +1240,28 @@
/* in_port_t */
/* #undef in_port_t */
/* Define to '__inline__' or '__inline' if that's what the C compiler
/* Define to `__inline__' or `__inline' if that's what the C compiler
calls it, or to nothing if 'inline' is not supported under any name. */
#ifndef __cplusplus
/* #undef inline */
#endif
/* Define to 'short' if <sys/types.h> does not define. */
/* Define to `short' if <sys/types.h> does not define. */
/* #undef int16_t */
/* Define to 'int' if <sys/types.h> does not define. */
/* Define to `int' if <sys/types.h> does not define. */
/* #undef int32_t */
/* Define to 'long long' if <sys/types.h> does not define. */
/* Define to `long long' if <sys/types.h> does not define. */
/* #undef int64_t */
/* Define to 'signed char' if <sys/types.h> does not define. */
/* Define to `signed char' if <sys/types.h> does not define. */
/* #undef int8_t */
/* Define if replacement function should be used. */
/* #undef malloc */
/* Define to 'long int' if <sys/types.h> does not define. */
/* Define to `long int' if <sys/types.h> does not define. */
/* #undef off_t */
/* Define as a signed integer type capable of holding a process identifier. */
@@ -1280,34 +1270,34 @@
/* Define to 'int' if not defined */
/* #undef rlim_t */
/* Define as 'unsigned int' if <stddef.h> doesn't define. */
/* Define to `unsigned int' if <sys/types.h> does not define. */
/* #undef size_t */
/* Define to 'int' if not defined */
/* #undef socklen_t */
/* Define to 'int' if <sys/types.h> does not define. */
/* Define to `int' if <sys/types.h> does not define. */
/* #undef ssize_t */
/* Define to 'unsigned char if not defined */
/* #undef u_char */
/* Define as 'int' if <sys/types.h> doesn't define. */
/* Define to `int' if <sys/types.h> doesn't define. */
/* #undef uid_t */
/* Define to 'unsigned short' if <sys/types.h> does not define. */
/* Define to `unsigned short' if <sys/types.h> does not define. */
/* #undef uint16_t */
/* Define to 'unsigned int' if <sys/types.h> does not define. */
/* Define to `unsigned int' if <sys/types.h> does not define. */
/* #undef uint32_t */
/* Define to 'unsigned long long' if <sys/types.h> does not define. */
/* Define to `unsigned long long' if <sys/types.h> does not define. */
/* #undef uint64_t */
/* Define to 'unsigned char' if <sys/types.h> does not define. */
/* Define to `unsigned char' if <sys/types.h> does not define. */
/* #undef uint8_t */
/* Define as 'fork' if 'vfork' does not work. */
/* Define as `fork' if `vfork' does not work. */
/* #undef vfork */
#if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE)