WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-07 18:37:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1 from NLnetLabs/master

Browse Source 
synchronize the code.
This commit is contained in:
yunwei
2021-02-10 09:03:38 +08:00
committed by GitHub
parent 0215500261 e0d426ebb1
commit 5d5e4579de
59 changed files with 6736 additions and 4587 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile.in
+2 -1
View File
@@ -248,6 +248,7 @@ DNSTAP_SOCKET_SRC=dnstap/unbound-dnstap-socket.c
DNSTAP_SOCKET_OBJ=unbound-dnstap-socket.lo
DNSTAP_SOCKET_OBJ_LINK=$(DNSTAP_SOCKET_OBJ) $(COMMON_OBJ) \
$(COMPAT_OBJ) $(SLDNS_OBJ)
DNSTAP_SOCKET_TESTBIN=@DNSTAP_SOCKET_TESTBIN@
LIBUNBOUND_SRC=libunbound/context.c libunbound/libunbound.c \
libunbound/libworker.c
LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo ub_event_pluggable.lo
@@ -323,7 +324,7 @@ rsrc_unbound_checkconf.o: $(srcdir)/winrc/rsrc_unbound_checkconf.rc config.h
TEST_BIN=asynclook$(EXEEXT) delayer$(EXEEXT) \
lock-verify$(EXEEXT) memstats$(EXEEXT) perf$(EXEEXT) \
petal$(EXEEXT) pktview$(EXEEXT) streamtcp$(EXEEXT) \
unbound-dnstap-socket$(EXEEXT) dohclient$(EXEEXT) \
$(DNSTAP_SOCKET_TESTBIN) dohclient$(EXEEXT) \
testbound$(EXEEXT) unittest$(EXEEXT)
tests: all $(TEST_BIN)
cachedb/cachedb.c
+1
View File
@@ -465,6 +465,7 @@ packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
data->rr_ttl[i] -= subtract;
else data->rr_ttl[i] = 0;
}
data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;
}
/* Adjust the TTL of a DNS message and its RRs by 'adjust'. If 'adjust' is
configure
Vendored
+77 -13
View File
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for unbound 1.13.1.
# Generated by GNU Autoconf 2.69 for unbound 1.13.2.
#
# Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
#
@@ -591,8 +591,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='unbound'
PACKAGE_TARNAME='unbound'
PACKAGE_VERSION='1.13.1'
PACKAGE_STRING='unbound 1.13.1'
PACKAGE_VERSION='1.13.2'
PACKAGE_STRING='unbound 1.13.2'
PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
PACKAGE_URL=''
@@ -649,6 +649,7 @@ ENABLE_DNSCRYPT
ENABLE_DNSCRYPT_XCHACHA20
DNSTAP_OBJ
DNSTAP_SRC
DNSTAP_SOCKET_TESTBIN
DNSTAP_SOCKET_PATH
opt_dnstap_socket_path
ENABLE_DNSTAP
@@ -1459,7 +1460,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures unbound 1.13.1 to adapt to many kinds of systems.
\`configure' configures unbound 1.13.2 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1524,7 +1525,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of unbound 1.13.1:";;
short | recursive ) echo "Configuration of unbound 1.13.2:";;
esac
cat <<\_ACEOF
@@ -1752,7 +1753,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
unbound configure 1.13.1
unbound configure 1.13.2
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2461,7 +2462,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by unbound $as_me 1.13.1, which was
It was created by unbound $as_me 1.13.2, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
@@ -2813,11 +2814,11 @@ UNBOUND_VERSION_MAJOR=1
UNBOUND_VERSION_MINOR=13
UNBOUND_VERSION_MICRO=1
UNBOUND_VERSION_MICRO=2
LIBUNBOUND_CURRENT=9
LIBUNBOUND_REVISION=12
LIBUNBOUND_REVISION=13
LIBUNBOUND_AGE=1
# 1.0.0 had 0:12:0
# 1.0.1 had 0:13:0
@@ -2897,6 +2898,7 @@ LIBUNBOUND_AGE=1
# 1.12.0 had 9:10:1
# 1.13.0 had 9:11:1
# 1.13.1 had 9:12:1
# 1.13.2 had 9:13:1
# Current -- the number of the binary API that we're implementing
# Revision -- which iteration of the implementation of the binary
@@ -17235,7 +17237,66 @@ $as_echo "#define WITH_DYNLIBMODULE 1" >>confdefs.h
DYNLIBMOD_HEADER='$(srcdir)/dynlibmod/dynlibmod.h'
if test $on_mingw = "no"; then
DYNLIBMOD_EXTRALIBS="-ldl -export-dynamic"
# link with -ldl if not already there, for all executables because
# dlopen call is in the dynlib module. For unbound executable, also
# export symbols.
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing dlopen" >&5
$as_echo_n "checking for library containing dlopen... " >&6; }
if ${ac_cv_search_dlopen+:} false; then :
$as_echo_n "(cached) " >&6
else
ac_func_search_save_LIBS=$LIBS
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
Use char because int might match the return type of a GCC
builtin and then its argument prototype would still apply. */
#ifdef __cplusplus
extern "C"
#endif
char dlopen ();
int
main ()
{
return dlopen ();
;
return 0;
}
_ACEOF
for ac_lib in '' dl; do
if test -z "$ac_lib"; then
ac_res="none required"
else
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
if ac_fn_c_try_link "$LINENO"; then :
ac_cv_search_dlopen=$ac_res
fi
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext
if ${ac_cv_search_dlopen+:} false; then :
break
fi
done
if ${ac_cv_search_dlopen+:} false; then :
else
ac_cv_search_dlopen=no
fi
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_dlopen" >&5
$as_echo "$ac_cv_search_dlopen" >&6; }
ac_res=$ac_cv_search_dlopen
if test "$ac_res" != no; then :
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
DYNLIBMOD_EXTRALIBS="-export-dynamic"
else
DYNLIBMOD_EXTRALIBS="-Wl,--export-all-symbols,--out-implib,libunbound.dll.a"
fi
@@ -19765,6 +19826,7 @@ if test x_$enable_static_exe = x_yes; then
LIBS="$LIBS -lgdi32"
fi
LIBS="$LIBS -lz"
LIBS="$LIBS -l:libssp.a"
fi
fi
@@ -19784,6 +19846,7 @@ if test x_$enable_fully_static = x_yes; then
LIBS="$LIBS -lgdi32"
fi
LIBS="$LIBS -lz"
LIBS="$LIBS -l:libssp.a"
fi
fi
@@ -21191,6 +21254,7 @@ _ACEOF
DNSTAP_SOCKET_PATH="$hdr_dnstap_socket_path"
DNSTAP_SOCKET_TESTBIN='unbound-dnstap-socket$(EXEEXT)'
DNSTAP_SRC="dnstap/dnstap.c dnstap/dnstap.pb-c.c dnstap/dnstap_fstrm.c dnstap/dtstream.c"
@@ -21697,7 +21761,7 @@ _ACEOF
version=1.13.1
version=1.13.2
date=`date +'%b %e, %Y'`
@@ -22216,7 +22280,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by unbound $as_me 1.13.1, which was
This file was extended by unbound $as_me 1.13.2, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -22282,7 +22346,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
unbound config.status 1.13.1
unbound config.status 1.13.2
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"
configure.ac
+11 -4
View File
@@ -11,14 +11,14 @@ sinclude(dnscrypt/dnscrypt.m4)
# must be numbers. ac_defun because of later processing
m4_define([VERSION_MAJOR],[1])
m4_define([VERSION_MINOR],[13])
m4_define([VERSION_MICRO],[1])
m4_define([VERSION_MICRO],[2])
AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
LIBUNBOUND_CURRENT=9
LIBUNBOUND_REVISION=12
LIBUNBOUND_REVISION=13
LIBUNBOUND_AGE=1
# 1.0.0 had 0:12:0
# 1.0.1 had 0:13:0
@@ -98,6 +98,7 @@ LIBUNBOUND_AGE=1
# 1.12.0 had 9:10:1
# 1.13.0 had 9:11:1
# 1.13.1 had 9:12:1
# 1.13.2 had 9:13:1
# Current -- the number of the binary API that we're implementing
# Revision -- which iteration of the implementation of the binary
@@ -642,7 +643,11 @@ if test x_$withval != x_no; then
DYNLIBMOD_HEADER='$(srcdir)/dynlibmod/dynlibmod.h'
AC_SUBST(DYNLIBMOD_HEADER)
if test $on_mingw = "no"; then
DYNLIBMOD_EXTRALIBS="-ldl -export-dynamic"
# link with -ldl if not already there, for all executables because
# dlopen call is in the dynlib module. For unbound executable, also
# export symbols.
AC_SEARCH_LIBS([dlopen], [dl])
DYNLIBMOD_EXTRALIBS="-export-dynamic"
else
DYNLIBMOD_EXTRALIBS="-Wl,--export-all-symbols,--out-implib,libunbound.dll.a"
fi
@@ -1438,6 +1443,7 @@ if test x_$enable_static_exe = x_yes; then
LIBS="$LIBS -lgdi32"
fi
LIBS="$LIBS -lz"
LIBS="$LIBS -l:libssp.a"
fi
fi
@@ -1454,6 +1460,7 @@ if test x_$enable_fully_static = x_yes; then
LIBS="$LIBS -lgdi32"
fi
LIBS="$LIBS -lz"
LIBS="$LIBS -l:libssp.a"
fi
fi
@@ -1743,7 +1750,7 @@ dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
AC_DEFINE_UNQUOTED(DNSTAP_SOCKET_PATH,
["$hdr_dnstap_socket_path"], [default dnstap socket path])
AC_SUBST(DNSTAP_SOCKET_PATH,["$hdr_dnstap_socket_path"])
AC_SUBST(DNSTAP_SOCKET_TESTBIN,['unbound-dnstap-socket$(EXEEXT)'])
AC_SUBST([DNSTAP_SRC], ["dnstap/dnstap.c dnstap/dnstap.pb-c.c dnstap/dnstap_fstrm.c dnstap/dtstream.c"])
AC_SUBST([DNSTAP_OBJ], ["dnstap.lo dnstap.pb-c.lo dnstap_fstrm.lo dtstream.lo"])
],
daemon/worker.c
+1
View File
@@ -1289,6 +1289,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
edns.udp_size = EDNS_ADVERTISED_SIZE;
edns.bits &= EDNS_DO;
edns.opt_list = NULL;
edns.padding_block_size = 0;
verbose(VERB_ALGO, "query with bad edns version.");
log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
error_encode(c->buffer, EDNS_RCODE_BADVERS&0xf, &qinfo,
dns64/dns64.c
+1 -1
View File
@@ -727,7 +727,7 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
*dd_out = NULL;
return; /* integer overflow protection in alloc */
}
if (!(dd = *dd_out = regional_alloc(region,
if (!(dd = *dd_out = regional_alloc_zero(region,
sizeof(struct packed_rrset_data)
+ fd->count * (sizeof(size_t) + sizeof(time_t) +
sizeof(uint8_t*) + 2 + 16)))) {
doc/Changelog
+55 -4
View File
@@ -1,3 +1,58 @@
9 February 2021: Wouter
- Fix for Python 3.9, no longer use deprecated functions of
PyEval_CallObject (now PyObject_Call), PyEval_InitThreads (now
none), PyParser_SimpleParseFile (now Py_CompileString).
4 February 2021: Wouter
- release 1.13.1rc2 tag on branch-1.13.1 with added changes of 2 feb.
This became 1.13.1 release tag on 9 feb. The main branch is set
to version 1.13.2.
2 February 2021: Wouter
- branch-1.13.1 is created, with release-1.13.1rc1 tag.
- Fix dynlibmod link on rhel8 for -ldl inclusion.
- Fix windows dependency on libssp.dll because of default stack
protector in mingw.
- Fix indentation of root anchor for use by windows install script.
1 February 2021: George
- Attempt to fix NULL keys in the reuse_tcp tree; relates to #411.
29 January 2021: Wouter
- Fix for doxygen 1.8.20 compatibility.
28 January 2021: Wouter
- Annotate that we ignore the return value of if_indextoname.
- Fix to use correct type for label count in rpz routine.
- Fix empty clause warning in config_file nsid parse.
- Fix to use correct type for label count in ipdnametoaddr rpz routine.
- Fix empty clause warning in edns pass for padding.
- Fix fwd ancil test post script when not supported.
26 January 2021: George
- Merge PR #408 from fobser: Prevent a few more yacc clashes.
- Merge PR #275 from Roland van Rijswijk-Deij: Add feature to return the
original instead of a decrementing TTL ('serve-original-ttl')
- Merge PR #355 from noloader: Make ICANN Update CA and DS Trust Anchor
static data.
- Ignore cache blacklisting when trying to reply with expired data from
cache (#394).
26 January 2021: Wouter
- Fix compile of unbound-dnstap-socket without dnstap installed.
22 January 2021: Willem
- Padding of queries and responses with DNS over TLS as specified in
RFC7830 and RFC8467.
22 January 2021: George
- Fix TTL of SOA record for negative answers (localzone and
authzone data) to be the minimum of the SOA TTL and the SOA.MINIMUM.
19 January 2021: Willem
- Support for RFC5001: DNS Name Server Identifier (NSID) Option
with the nsid: option in unbound.conf
18 January 2021: Wouter
- Fix #404: DNS query with small edns bufsize fail.
- Fix declaration before statement and signed comparison warning in
@@ -75,10 +130,6 @@
- Fix for #283: fix stream reuse and tcp fast open.
- Fix update, with write event check with streamreuse and fastopen.
2 December 2020: Willem
- Support for RFC5001: DNS Name Server Identifier (NSID) Option
with the nsid: option in unbound.conf
1 December 2020: Wouter
- Fix #358: Squelch udp connect 'no route to host' errors on low
verbosity.
doc/example.conf.in
+19
View File
@@ -598,6 +598,13 @@ server:
# A recommended value is 1800.
# serve-expired-client-timeout: 0
# Return the original TTL as received from the upstream name server rather
# than the decrementing TTL as stored in the cache. Enabling this feature
# does not impact cache expiry, it only changes the TTL unbound embeds in
# responses to queries. Note that enabling this feature implicitly disables
# enforcement of the configured minimum and maximum TTL.
# serve-original-ttl: no
# Have the validator log failed validations for your diagnosis.
# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
# val-log-level: 0
@@ -758,6 +765,12 @@ server:
# cipher setting for TLSv1.3
# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
# Pad responses to padded queries received over TLS
# pad-responses: yes
# Padded responses will be padded to the closest multiple of this size.
# pad-responses-block-size: 468
# Use the SNI extension for TLS connections. Default is yes.
# Changing the value requires a reload.
# tls-use-sni: yes
@@ -780,6 +793,12 @@ server:
# Add system certs to the cert bundle, from the Windows Cert Store
# tls-win-cert: no
# Pad queries over TLS upstreams
# pad-queries: yes
# Padded queries will be padded to the closest multiple of this size.
# pad-queries-block-size: 128
# Also serve tls on these port numbers (eg. 443, ...), by listing
# tls-additional-port: portno for each of the port numbers.
doc/unbound.conf.5.in
+32
View File
@@ -564,6 +564,25 @@ and that is the default.
Set the list of ciphersuites to allow when serving TLS. This is for newer
TLS 1.3 connections. Use "" for defaults, and that is the default.
.TP
.B pad\-responses: \fI<yes or no>
If enabled, TLS serviced queries that contained an EDNS Padding option will
cause responses padded to the closest multiple of the size specified in
\fBpad\-responses\-block\-size\fR.
Default is yes.
.TP
.B pad\-responses\-block\-size: \fI<number>
The block size with which to pad responses serviced over TLS. Only responses
to padded queries will be padded.
Default is 468.
.TP
.B pad\-queries: \fI<yes or no>
If enabled, all queries sent over TLS upstreams will be padded to the closest
multiple of the size specified in \fBpad\-queries\-block\-size\fR.
Default is yes.
.TP
.B pad\-queries\-block\-size: \fI<number>
The block size with which to pad queries sent over TLS upstreams.
Default is 128.
.B tls\-use\-sni: \fI<yes or no>
Enable or disable sending the SNI extension on TLS connections.
Default is yes.
@@ -1167,6 +1186,19 @@ responding with expired data. A recommended value per
RFC 8767 is 1800. Setting this to 0 will disable this
behavior. Default is 0.
.TP
.B serve\-original\-ttl: \fI<yes or no>
If enabled, unbound will always return the original TTL as received from
the upstream name server rather than the decrementing TTL as
stored in the cache. This feature may be useful if unbound serves as a
front-end to a hidden authoritative name server. Enabling this feature does
not impact cache expiry, it only changes the TTL unbound embeds in responses to
queries. Note that enabling this feature implicitly disables enforcement of
the configured minimum and maximum TTL, as it is assumed users who enable this
feature do not want unbound to change the TTL obtained from an upstream server.
Thus, the values set using \fBcache\-min\-ttl\fR and \fBcache\-max\-ttl\fR are
ignored.
Default is "no".
.TP
.B val\-nsec3\-keysize\-iterations: \fI<"list of values">
List of keysize and iteration count values, separated by spaces, surrounded
by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
doc/unbound.doxygen
+3 -3
View File
@@ -1143,7 +1143,7 @@ COMPACT_LATEX = NO
# by the printer. Possible values are: a4, a4wide, letter, legal and
# executive. If left blank a4wide will be used.
PAPER_TYPE = a4wide
#PAPER_TYPE = a4wide
# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX
# packages that should be included in the LaTeX output.
@@ -1451,7 +1451,7 @@ EXTERNAL_GROUPS = YES
# The PERL_PATH should be the absolute path and name of the perl script
# interpreter (i.e. the result of `which perl').
PERL_PATH = /usr/bin/perl
#PERL_PATH = /usr/bin/perl
#---------------------------------------------------------------------------
# Configuration options related to the dot tool
@@ -1473,7 +1473,7 @@ CLASS_DIAGRAMS = YES
# the mscgen tool resides. If left empty the tool is assumed to be found in the
# default search path.
MSCGEN_PATH =
#MSCGEN_PATH =
# If set to YES, the inheritance and collaboration graphs will hide
# inheritance and usage relations if the target is undocumented
libunbound/libworker.c
+1
View File
@@ -577,6 +577,7 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
edns->edns_version = 0;
edns->bits = EDNS_DO;
edns->opt_list = NULL;
edns->padding_block_size = 0;
if(sldns_buffer_capacity(w->back->udp_buff) < 65535)
edns->udp_size = (uint16_t)sldns_buffer_capacity(
w->back->udp_buff);
libunbound/python/libunbound.i
+6
View File
@@ -916,7 +916,13 @@ int _ub_resolve_async(struct ub_ctx* ctx, char* name, int rrtype, int rrclass, v
struct cb_data* id;
id = (struct cb_data*) iddata;
arglist = Py_BuildValue("(OiO)",id->data,status, SWIG_NewPointerObj(SWIG_as_voidptr(result), SWIGTYPE_p_ub_result, 0 | 0 )); // Build argument list
#if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
/* for python before 3.9 */
fresult = PyEval_CallObject(id->func,arglist); // Call Python
#else
/* for python 3.9 and newer */
fresult = PyObject_Call(id->func,arglist,NULL);
#endif
Py_DECREF(id->func);
Py_DECREF(id->data);
free(id);
makedist.sh
+5
View File
@@ -412,6 +412,11 @@ if [ "$DOWIN" = "yes" ]; then
cp ../unbound.exe ../unbound-anchor.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-control-setup.cmd ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt ../contrib/create_unbound_ad_servers.cmd ../contrib/warmup.cmd ../contrib/unbound_cache.cmd .
mkdir libunbound
cp ../../unbound_shared/unbound.h ../../unbound_shared/.libs/libunbound*.dll ../../unbound_shared/.libs/libunbound.dll.a ../../unbound_shared/.libs/libunbound.a ../../unbound_shared/.libs/libunbound*.def ../../sslsharedinstall/lib/libcrypto.dll.a ../../sslsharedinstall/lib/libssl.dll.a ../../sslsharedinstall/bin/libcrypto*.dll ../../sslsharedinstall/bin/libssl*.dll ../../wxpinstall/bin/libexpat*.dll ../../wxpinstall/lib/libexpat.dll.a libunbound/.
if test "$W64" = "no"; then
cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libssp-0.dll libunbound/.
else
cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll libunbound/.
fi
# zipfile
zip -r ../$file LICENSE README.txt unbound.exe unbound-anchor.exe unbound-host.exe unbound-control.exe unbound-checkconf.exe unbound-service-install.exe unbound-service-remove.exe unbound-control-setup.cmd example.conf service.conf root.key unbound-website.url create_unbound_ad_servers.cmd warmup.cmd unbound_cache.cmd Changelog libunbound
info "Testing $file"
pythonmod/pythonmod.c
+41
View File
@@ -299,7 +299,10 @@ int pythonmod_init(struct module_env* env, int id)
PyImport_AppendInittab(SWIG_name, (void*)SWIG_init);
#endif
Py_Initialize();
#if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION <= 6)
/* initthreads only for python 3.6 and older */
PyEval_InitThreads();
#endif
SWIG_init();
mainthr = PyEval_SaveThread();
}
@@ -354,6 +357,8 @@ int pythonmod_init(struct module_env* env, int id)
/* TODO: deallocation of pe->... if an error occurs */
if (PyRun_SimpleFile(script_py, pe->fname) < 0) {
#if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
/* for python before 3.9 */
log_err("pythonmod: can't parse Python script %s", pe->fname);
/* print the error to logs too, run it again */
fseek(script_py, 0, SEEK_SET);
@@ -369,9 +374,45 @@ int pythonmod_init(struct module_env* env, int id)
/* ignore the NULL return of _node, it is NULL due to the parse failure
* that we are expecting */
(void)PyParser_SimpleParseFile(script_py, pe->fname, Py_file_input);
#else
/* for python 3.9 and newer */
char* fstr = NULL;
size_t flen = 0;
log_err("pythonmod: can't parse Python script %s", pe->fname);
/* print the error to logs too, run it again */
fseek(script_py, 0, SEEK_END);
flen = (size_t)ftell(script_py);
fstr = malloc(flen+1);
if(!fstr) {
log_err("malloc failure to print parse error");
PyGILState_Release(gil);
fclose(script_py);
return 0;
}
fseek(script_py, 0, SEEK_SET);
if(fread(fstr, flen, 1, script_py) < 1) {
log_err("file read failed to print parse error: %s: %s",
pe->fname, strerror(errno));
PyGILState_Release(gil);
fclose(script_py);
free(fstr);
return 0;
}
fstr[flen] = 0;
/* we compile the string, but do not run it, to stop side-effects */
/* ignore the NULL return of _node, it is NULL due to the parse failure
* that we are expecting */
(void)Py_CompileString(fstr, pe->fname, Py_file_input);
#endif
log_py_err();
PyGILState_Release(gil);
fclose(script_py);
#if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
/* no cleanup needed for python before 3.9 */
#else
/* cleanup for python 3.9 and newer */
free(fstr);
#endif
return 0;
}
#if PY_MAJOR_VERSION < 3
respip/respip.c
+1 -1
View File
@@ -523,7 +523,7 @@ copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
return NULL; /* guard against integer overflow */
dsize += data->rr_len[i];
}
d = regional_alloc(region, dsize);
d = regional_alloc_zero(region, dsize);
if(!d)
return NULL;
*d = *data;
services/authzone.c
+9 -4
View File
@@ -2331,7 +2331,8 @@ static int
az_add_negative_soa(struct auth_zone* z, struct regional* region,
struct dns_msg* msg)
{
uint32_t minimum;
time_t minimum;
size_t i;
struct packed_rrset_data* d;
struct auth_rrset* soa;
struct auth_data* apex = az_find_name(z, z->name, z->namelen);
@@ -2348,9 +2349,11 @@ az_add_negative_soa(struct auth_zone* z, struct regional* region,
/* last 4 bytes are minimum ttl in network format */
if(d->count == 0) return 0;
if(d->rr_len[0] < 2+4) return 0;
minimum = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-4));
d->ttl = (time_t)minimum;
d->rr_ttl[0] = (time_t)minimum;
minimum = (time_t)sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-4));
minimum = d->ttl<minimum?d->ttl:minimum;
d->ttl = minimum;
for(i=0; i < d->count + d->rrsig_count; i++)
d->rr_ttl[i] = minimum;
msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]);
msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
@@ -5107,6 +5110,7 @@ xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env)
edns.edns_version = 0;
edns.bits = EDNS_DO;
edns.opt_list = NULL;
edns.padding_block_size = 0;
if(sldns_buffer_capacity(buf) < 65535)
edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
else edns.udp_size = 65535;
@@ -6295,6 +6299,7 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
edns.edns_version = 0;
edns.bits = EDNS_DO;
edns.opt_list = NULL;
edns.padding_block_size = 0;
if(sldns_buffer_capacity(buf) < 65535)
edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
else edns.udp_size = 65535;
services/cache/rrset.c
Vendored
+2
View File
@@ -45,6 +45,7 @@
#include "util/config_file.h"
#include "util/data/packed_rrset.h"
#include "util/data/msgreply.h"
#include "util/data/msgparse.h"
#include "util/regional.h"
#include "util/alloc.h"
#include "util/net_help.h"
@@ -396,6 +397,7 @@ rrset_update_sec_status(struct rrset_cache* r,
cachedata->ttl = updata->ttl + now;
for(i=0; i<cachedata->count+cachedata->rrsig_count; i++)
cachedata->rr_ttl[i] = updata->rr_ttl[i]+now;
cachedata->ttl_add = now;
}
}
lock_rw_unlock(&e->lock);
services/listen_dnsport.c
+1 -1
View File
@@ -1456,7 +1456,7 @@ resolve_ifa_name(struct ifaddrs *ifas, const char *search_ifa, char ***ip_addres
log_err("inet_ntop failed");
return 0;
}
if_indextoname(in6->sin6_scope_id,
(void)if_indextoname(in6->sin6_scope_id,
(char *)if_index_name);
if (strlen(if_index_name) != 0) {
snprintf(addr_buf, sizeof(addr_buf),
services/localzone.c
+53 -7
View File
@@ -463,6 +463,48 @@ lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen,
return 1;
}
/* Mark the SOA record for the zone. This only marks the SOA rrset; the data
* for the RR is entered later on local_zone_enter_rr() as with the other
* records. An artifical soa_negative record with a modified TTL (minimum of
* the TTL and the SOA.MINIMUM) is also created and marked for usage with
* negative answers and to avoid allocations during those answers. */
static int
lz_mark_soa_for_zone(struct local_zone* z, struct ub_packed_rrset_key* soa_rrset,
uint8_t* rdata, size_t rdata_len, time_t ttl, const char* rrstr)
{
struct packed_rrset_data* pd = (struct packed_rrset_data*)
regional_alloc_zero(z->region, sizeof(*pd));
struct ub_packed_rrset_key* rrset_negative = (struct ub_packed_rrset_key*)
regional_alloc_zero(z->region, sizeof(*rrset_negative));
time_t minimum;
if(!rrset_negative||!pd) {
log_err("out of memory");
return 0;
}
/* Mark the original SOA record and then continue with the negative one. */
z->soa = soa_rrset;
rrset_negative->entry.key = rrset_negative;
pd->trust = rrset_trust_prim_noglue;
pd->security = sec_status_insecure;
rrset_negative->entry.data = pd;
rrset_negative->rk.dname = soa_rrset->rk.dname;
rrset_negative->rk.dname_len = soa_rrset->rk.dname_len;
rrset_negative->rk.type = soa_rrset->rk.type;
rrset_negative->rk.rrset_class = soa_rrset->rk.rrset_class;
if(!rrset_insert_rr(z->region, pd, rdata, rdata_len, ttl, rrstr))
return 0;
/* last 4 bytes are minimum ttl in network format */
if(pd->count == 0 || pd->rr_len[0] < 2+4)
return 0;
minimum = (time_t)sldns_read_uint32(pd->rr_data[0]+(pd->rr_len[0]-4));
minimum = ttl<minimum?ttl:minimum;
pd->ttl = minimum;
pd->rr_ttl[0] = minimum;
z->soa_negative = rrset_negative;
return 1;
}
int
local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl,
@@ -502,8 +544,10 @@ local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
if(query_dname_compare(node->name, z->name) == 0) {
if(rrtype == LDNS_RR_TYPE_NSEC)
rrset->rrset->rk.flags = PACKED_RRSET_NSEC_AT_APEX;
if(rrtype == LDNS_RR_TYPE_SOA)
z->soa = rrset->rrset;
if(rrtype == LDNS_RR_TYPE_SOA &&
!lz_mark_soa_for_zone(z, rrset->rrset, rdata, rdata_len, ttl,
rrstr))
return 0;
}
}
pd = (struct packed_rrset_data*)rrset->rrset->entry.data;
@@ -1548,9 +1592,9 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
lz_type == local_zone_inform_redirect ||
lz_type == local_zone_always_nodata)?
LDNS_RCODE_NOERROR:LDNS_RCODE_NXDOMAIN;
if(z->soa)
if(z->soa && z->soa_negative)
return local_encode(qinfo, env, edns, repinfo, buf, temp,
z->soa, 0, rcode);
z->soa_negative, 0, rcode);
local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
(rcode|BIT_AA));
return 1;
@@ -1605,9 +1649,9 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env,
* does not, then we should make this noerror/nodata */
if(ld && ld->rrsets) {
int rcode = LDNS_RCODE_NOERROR;
if(z->soa)
if(z->soa && z->soa_negative)
return local_encode(qinfo, env, edns, repinfo, buf, temp,
z->soa, 0, rcode);
z->soa_negative, 0, rcode);
local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
(rcode|BIT_AA));
return 1;
@@ -2043,8 +2087,10 @@ void local_zones_del_data(struct local_zones* zones,
/* no memory recycling for zone deletions ... */
d->rrsets = NULL;
/* did we delete the soa record ? */
if(query_dname_compare(d->name, z->name) == 0)
if(query_dname_compare(d->name, z->name) == 0) {
z->soa = NULL;
z->soa_negative = NULL;
}
/* cleanup the empty nonterminals for this name */
del_empty_term(z, d, name, len, labs);
services/localzone.h
+4
View File
@@ -158,6 +158,10 @@ struct local_zone {
rbtree_type data;
/** if data contains zone apex SOA data, this is a ptr to it. */
struct ub_packed_rrset_key* soa;
/** if data contains zone apex SOA data, this is a prt to an
* artificial negative SOA rrset (TTL is the minimum of the TTL and the
* SOA.MINIMUM). */
struct ub_packed_rrset_key* soa_negative;
};
/**
services/mesh.c
+3 -1
View File
@@ -1929,7 +1929,9 @@ mesh_serve_expired_callback(void* arg)
verbose(VERB_ALGO, "Serve expired: Trying to reply with expired data");
comm_timer_delete(qstate->serve_expired_data->timer);
qstate->serve_expired_data->timer = NULL;
if(qstate->blacklist || qstate->no_cache_lookup || qstate->is_drop) {
/* If is_drop or no_cache_lookup (modules that handle their own cache e.g.,
* subnetmod) ignore stale data from the main cache. */
if(qstate->no_cache_lookup || qstate->is_drop) {
verbose(VERB_ALGO,
"Serve expired: Not allowed to look into cache for stale");
return;
services/outside_network.c
+36 -6
View File
@@ -90,6 +90,10 @@ static int randomize_and_send_udp(struct pending* pend, sldns_buffer* packet,
static void waiting_list_remove(struct outside_network* outnet,
struct waiting_tcp* w);
/** remove reused element from tree and lru list */
static void reuse_tcp_remove_tree_list(struct outside_network* outnet,
struct reuse_tcp* reuse);
int
pending_cmp(const void* key1, const void* key2)
{
@@ -424,8 +428,11 @@ static int
reuse_tcp_insert(struct outside_network* outnet, struct pending_tcp* pend_tcp)
{
log_reuse_tcp(VERB_CLIENT, "reuse_tcp_insert", &pend_tcp->reuse);
if(pend_tcp->reuse.item_on_lru_list)
if(pend_tcp->reuse.item_on_lru_list) {
if(!pend_tcp->reuse.node.key)
log_err("internal error: reuse_tcp_insert: on lru list without key");
return 1;
}
pend_tcp->reuse.node.key = &pend_tcp->reuse;
pend_tcp->reuse.pending = pend_tcp;
if(!rbtree_insert(&outnet->tcp_reuse, &pend_tcp->reuse.node)) {
@@ -477,7 +484,7 @@ reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr,
if(outnet->tcp_reuse.root == NULL ||
outnet->tcp_reuse.root == RBTREE_NULL)
return NULL;
if(rbtree_find_less_equal(&outnet->tcp_reuse, &key_p.reuse.node,
if(rbtree_find_less_equal(&outnet->tcp_reuse, &key_p.reuse,
&result)) {
/* exact match */
/* but the key is on stack, and ptr is compared, impossible */
@@ -661,6 +668,14 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
pend->reuse.cp_more_write_again = 0;
memcpy(&pend->c->repinfo.addr, &w->addr, w->addrlen);
pend->reuse.pending = pend;
/* Remove from tree in case the is_ssl will be different and causes the
* identity of the reuse_tcp to change; could result in nodes not being
* deleted from the tree (because the new identity does not match the
* previous node) but their ->key would be changed to NULL. */
if(pend->reuse.node.key)
reuse_tcp_remove_tree_list(w->outnet, &pend->reuse);
if(pend->c->ssl)
pend->reuse.is_ssl = 1;
else pend->reuse.is_ssl = 0;
@@ -677,8 +692,10 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
static void
reuse_tcp_lru_touch(struct outside_network* outnet, struct reuse_tcp* reuse)
{
if(!reuse->item_on_lru_list)
if(!reuse->item_on_lru_list) {
log_err("internal error: we need to touch the lru_list but item not in list");
return; /* not on the list, no lru to modify */
}
if(!reuse->lru_prev)
return; /* already first in the list */
/* remove at current position */
@@ -847,7 +864,7 @@ reuse_tcp_remove_tree_list(struct outside_network* outnet,
verbose(VERB_CLIENT, "reuse_tcp_remove_tree_list");
if(reuse->node.key) {
/* delete it from reuse tree */
(void)rbtree_delete(&outnet->tcp_reuse, &reuse->node);
(void)rbtree_delete(&outnet->tcp_reuse, reuse);
reuse->node.key = NULL;
}
/* delete from reuse list */
@@ -2242,7 +2259,8 @@ static struct serviced_query*
serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
int want_dnssec, int nocaps, int tcp_upstream, int ssl_upstream,
char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list)
uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list,
size_t pad_queries_block_size)
{
struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
#ifdef UNBOUND_DEBUG
@@ -2300,6 +2318,7 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
sq->status = serviced_initial;
sq->retry = 0;
sq->to_be_deleted = 0;
sq->padding_block_size = pad_queries_block_size;
#ifdef UNBOUND_DEBUG
ins =
#else
@@ -2481,6 +2500,7 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
if(with_edns) {
/* add edns section */
struct edns_data edns;
struct edns_option padding_option;
edns.edns_present = 1;
edns.ext_rcode = 0;
edns.edns_version = EDNS_ADVERTISED_VERSION;
@@ -2503,6 +2523,14 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
edns.bits = EDNS_DO;
if(sq->dnssec & BIT_CD)
LDNS_CD_SET(sldns_buffer_begin(buff));
if (sq->ssl_upstream && sq->padding_block_size) {
padding_option.opt_code = LDNS_EDNS_PADDING;
padding_option.opt_len = 0;
padding_option.opt_data = NULL;
padding_option.next = edns.opt_list;
edns.opt_list = &padding_option;
edns.padding_block_size = sq->padding_block_size;
}
attach_edns_record(buff, &edns);
}
}
@@ -3026,7 +3054,9 @@ outnet_serviced_query(struct outside_network* outnet,
sq = serviced_create(outnet, buff, dnssec, want_dnssec, nocaps,
tcp_upstream, ssl_upstream, tls_auth_name, addr,
addrlen, zone, zonelen, (int)qinfo->qtype,
qstate->edns_opts_back_out);
qstate->edns_opts_back_out,
( ssl_upstream && env->cfg->pad_queries
? env->cfg->pad_queries_block_size : 0 ));
if(!sq) {
free(cb);
return NULL;
services/outside_network.h
+2
View File
@@ -502,6 +502,8 @@ struct serviced_query {
struct service_callback* cblist;
/** the UDP or TCP query that is pending, see status which */
void* pending;
/** block size with which to pad encrypted queries (default: 128) */
size_t padding_block_size;
};
/**
services/rpz.c
+2 -1
View File
@@ -668,7 +668,8 @@ rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
int only_exact, int wr, int zones_keep_lock)
{
uint8_t* ce;
size_t ce_len, ce_labs;
size_t ce_len;
int ce_labs;
uint8_t wc[LDNS_MAX_DOMAINLEN+1];
int exact;
struct local_zone* z = NULL;
smallapp/unbound-anchor.c
+35 -32
View File
@@ -155,6 +155,36 @@
char* wsa_strerror(int err);
#endif
static const char ICANN_UPDATE_CA[] =
/* The ICANN CA fetched at 24 Sep 2010. Valid to 2028 */
"-----BEGIN CERTIFICATE-----\n"
"MIIDdzCCAl+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO\n"
"TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV\n"
"BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTA5MTIyMzA0MTkxMloX\n"
"DTI5MTIxODA0MTkxMlowXTEOMAwGA1UEChMFSUNBTk4xJjAkBgNVBAsTHUlDQU5O\n"
"IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYwFAYDVQQDEw1JQ0FOTiBSb290IENB\n"
"MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKDb\n"
"cLhPNNqc1NB+u+oVvOnJESofYS9qub0/PXagmgr37pNublVThIzyLPGCJ8gPms9S\n"
"G1TaKNIsMI7d+5IgMy3WyPEOECGIcfqEIktdR1YWfJufXcMReZwU4v/AdKzdOdfg\n"
"ONiwc6r70duEr1IiqPbVm5T05l1e6D+HkAvHGnf1LtOPGs4CHQdpIUcy2kauAEy2\n"
"paKcOcHASvbTHK7TbbvHGPB+7faAztABLoneErruEcumetcNfPMIjXKdv1V1E3C7\n"
"MSJKy+jAqqQJqjZoQGB0necZgUMiUv7JK1IPQRM2CXJllcyJrm9WFxY0c1KjBO29\n"
"iIKK69fcglKcBuFShUECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B\n"
"Af8EBAMCAf4wHQYDVR0OBBYEFLpS6UmDJIZSL8eZzfyNa2kITcBQMA0GCSqGSIb3\n"
"DQEBCwUAA4IBAQAP8emCogqHny2UYFqywEuhLys7R9UKmYY4suzGO4nkbgfPFMfH\n"
"6M+Zj6owwxlwueZt1j/IaCayoKU3QsrYYoDRolpILh+FPwx7wseUEV8ZKpWsoDoD\n"
"2JFbLg2cfB8u/OlE4RYmcxxFSmXBg0yQ8/IoQt/bxOcEEhhiQ168H2yE5rxJMt9h\n"
"15nu5JBSewrCkYqYYmaxyOC3WrVGfHZxVI7MpIFcGdvSb2a1uyuua8l0BKgk3ujF\n"
"0/wsHNeP22qNyVO+XVBzrM8fk8BSUFuiT/6tZTYXRtEt5aKQZgXbKU5dUF3jT9qg\n"
"j/Br5BZw3X/zd325TvnswzMC1+ljLzHnQGGk\n"
"-----END CERTIFICATE-----\n";
static const char DS_TRUST_ANCHOR[] =
/* The anchors must start on a new line with ". IN DS and end with \n"[;]
* because the makedist script greps on the source here */
/* anchor 20326 is from 2017 */
". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D\n";
/** verbosity for this application */
static int verb = 0;
@@ -213,48 +243,21 @@ usage(void)
static const char*
get_builtin_cert(void)
{
return
/* The ICANN CA fetched at 24 Sep 2010. Valid to 2028 */
"-----BEGIN CERTIFICATE-----\n"
"MIIDdzCCAl+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO\n"
"TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV\n"
"BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTA5MTIyMzA0MTkxMloX\n"
"DTI5MTIxODA0MTkxMlowXTEOMAwGA1UEChMFSUNBTk4xJjAkBgNVBAsTHUlDQU5O\n"
"IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYwFAYDVQQDEw1JQ0FOTiBSb290IENB\n"
"MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKDb\n"
"cLhPNNqc1NB+u+oVvOnJESofYS9qub0/PXagmgr37pNublVThIzyLPGCJ8gPms9S\n"
"G1TaKNIsMI7d+5IgMy3WyPEOECGIcfqEIktdR1YWfJufXcMReZwU4v/AdKzdOdfg\n"
"ONiwc6r70duEr1IiqPbVm5T05l1e6D+HkAvHGnf1LtOPGs4CHQdpIUcy2kauAEy2\n"
"paKcOcHASvbTHK7TbbvHGPB+7faAztABLoneErruEcumetcNfPMIjXKdv1V1E3C7\n"
"MSJKy+jAqqQJqjZoQGB0necZgUMiUv7JK1IPQRM2CXJllcyJrm9WFxY0c1KjBO29\n"
"iIKK69fcglKcBuFShUECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B\n"
"Af8EBAMCAf4wHQYDVR0OBBYEFLpS6UmDJIZSL8eZzfyNa2kITcBQMA0GCSqGSIb3\n"
"DQEBCwUAA4IBAQAP8emCogqHny2UYFqywEuhLys7R9UKmYY4suzGO4nkbgfPFMfH\n"
"6M+Zj6owwxlwueZt1j/IaCayoKU3QsrYYoDRolpILh+FPwx7wseUEV8ZKpWsoDoD\n"
"2JFbLg2cfB8u/OlE4RYmcxxFSmXBg0yQ8/IoQt/bxOcEEhhiQ168H2yE5rxJMt9h\n"
"15nu5JBSewrCkYqYYmaxyOC3WrVGfHZxVI7MpIFcGdvSb2a1uyuua8l0BKgk3ujF\n"
"0/wsHNeP22qNyVO+XVBzrM8fk8BSUFuiT/6tZTYXRtEt5aKQZgXbKU5dUF3jT9qg\n"
"j/Br5BZw3X/zd325TvnswzMC1+ljLzHnQGGk\n"
"-----END CERTIFICATE-----\n"
;
return ICANN_UPDATE_CA;
}
/** return the built in root DS trust anchor */
static const char*
get_builtin_ds(void)
{
return
/* The anchors must start on a new line with ". IN DS and end with \n"[;]
* because the makedist script greps on the source here */
/* anchor 20326 is from 2017 */
". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D\n";
return DS_TRUST_ANCHOR;
}
/** print hex data */
static void
print_data(const char* msg, const char* data, int len)
print_data(const char* msg, const char* data, size_t len)
{
int i;
size_t i;
printf("%s: ", msg);
for(i=0; i<len; i++) {
printf(" %2.2x", (unsigned char)data[i]);
@@ -1110,7 +1113,7 @@ read_http_result(SSL* ssl)
data = read_data_chunk(ssl, len);
}
if(!data) return NULL;
if(verb >= 4) print_data("read data", data, (int)len);
if(verb >= 4) print_data("read data", data, len);
m = BIO_new(BIO_s_mem());
if(!m) {
if(verb) printf("out of memory\n");
testcode/fake_event.c
+1
View File
@@ -1229,6 +1229,7 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
edns.bits = 0;
if(dnssec)
edns.bits = EDNS_DO;
edns.padding_block_size = 0;
if((client_string_addr = edns_string_addr_lookup(
&env->edns_strings->client_strings,
addr, addrlen))) {
testdata/auth_zonefile_down.rpl
Vendored
+156 -1
View File
@@ -1,6 +1,12 @@
; config options
server:
target-fetch-policy: "0 0 0 0 0"
; Options for signed zone. The zone is partially copied from val_negcache_nxdomain.rpl
trust-anchor: "testzone.nlnetlabs.nl. IN DS 2926 8 2 6f8512d1e82eecbd684fc4a76f39f8c5b411af385494873bdead663ddb78a88b"
val-override-date: "20180213111425"
qname-minimisation: "no"
trust-anchor-signaling: no
aggressive-nsec: yes
auth-zone:
name: "example.com."
@@ -41,6 +47,50 @@ ns1 3600 IN A 1.2.3.4
ns2 3600 IN AAAA ::2
TEMPFILE_END
auth-zone:
name: "soa.high.com."
for-downstream: yes
for-upstream: no
zonefile:
TEMPFILE_NAME soa.high.com
TEMPFILE_CONTENTS soa.high.com
$ORIGIN high.com.
soa 500 IN SOA dns.example.de. hostmaster.dns.example.de. (
1379078166 28800 7200 604800 200 )
3600 IN NS ns1.example.com.
3600 IN NS ns2.example.com.
TEMPFILE_END
auth-zone:
name: "soa.low.com."
for-downstream: yes
for-upstream: no
zonefile:
TEMPFILE_NAME soa.low.com
TEMPFILE_CONTENTS soa.low.com
$ORIGIN low.com.
soa 200 IN SOA dns.example.de. hostmaster.dns.example.de. (
1379078166 28800 7200 604800 500 )
3600 IN NS ns1.example.com.
3600 IN NS ns2.example.com.
TEMPFILE_END
auth-zone:
name: "testzone.nlnetlabs.nl."
for-downstream: yes
for-upstream: no
zonefile:
TEMPFILE_NAME testzone.nlnetlabs.nl
TEMPFILE_CONTENTS testzone.nlnetlabs.nl
$ORIGIN testzone.nlnetlabs.nl.
testzone.nlnetlabs.nl. 3600 IN NSEC alligator.testzone.nlnetlabs.nl. NS SOA RRSIG NSEC DNSKEY
testzone.nlnetlabs.nl. 3600 IN RRSIG NSEC 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. gTKn6U1nal9oA79IRxLa/7zexl6A0yJZzeEGBbZ5rh5feyAr2X4LTR9bPCgcHeMVggf4FP+kD1L/sxzj/YLwB1ZKGKlwnzsHtPFTlmvDClaqQ76DRZq5Vejr2ZfnclBUb2vtxaXywTRW8oueaaq9flcShEQ/cQ+KRU8sc344qd0=
alligator.testzone.nlnetlabs.nl. 3600 IN NSEC cheetah.testzone.nlnetlabs.nl. TXT RRSIG NSEC
alligator.testzone.nlnetlabs.nl. 3600 IN RRSIG NSEC 8 4 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. QAgQ0AsMoYG02+VPfoOctSPlTHdQOkQt5fFkSkzIbVhUzNOqa+dB/Qkc81AwFeJosA+PvYjt6utcVkIWmK2Djy9eXC49gILtVF79vUe4G7ZrybO5NXjqNa5ANoUGM+yew4wkjeNOMVAsvs+1kvFY7S8RAa/0AIYlZHQ8vNBPNaI=
testzone.nlnetlabs.nl. 4600 IN SOA ns.nlnetlabs.nl. ralph.nlnetlabs.nl. 1 14400 3600 604800 3600
testzone.nlnetlabs.nl. 4600 IN RRSIG SOA 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. GhmXNFQktZIgaBpGKwj9Q2mfq5+jcbRPK+PPgtRVicUPZga/d/iGEL8PV/8DzGwkaZbM14pamSUMgdJibW4zNhLz/ukjPilbjoj6giH1jtbdZLAQ6iK9pZ/4jKUEq4txviTczZNnDeolgPEEl4xo4NclQmi7zj1XBlQRbjvG0/0=
TEMPFILE_END
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
@@ -50,7 +100,7 @@ SCENARIO_BEGIN Test authority zone with zonefile for downstream responses
; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
ADDRESS 193.0.14.129
ADDRESS 193.0.14.129
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
@@ -182,4 +232,109 @@ SECTION ANSWER
www.example.com. IN A 1.2.3.4
ENTRY_END
; check SOA TTL to be the minimum of the SOA.minimum and the SOA TTL
STEP 30 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
nonexistent.soa.high.com. IN A
ENTRY_END
STEP 31 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD RA AA NXDOMAIN
SECTION QUESTION
nonexistent.soa.high.com IN A
SECTION AUTHORITY
soa.high.com. 200 IN SOA dns.example.de. hostmaster.dns.example.de. 1379078166 28800 7200 604800 200
ENTRY_END
; check that the original SOA is also returned
STEP 32 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
soa.high.com. IN SOA
ENTRY_END
STEP 33 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD RA AA NOERROR
SECTION QUESTION
soa.high.com. IN SOA
SECTION ANSWER
soa.high.com. 500 IN SOA dns.example.de. hostmaster.dns.example.de. 1379078166 28800 7200 604800 200
ENTRY_END
; check SOA TTL to be the minimum of the SOA.minimum and the SOA TTL
STEP 40 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
nonexistent.soa.low.com. IN A
ENTRY_END
STEP 41 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD RA AA NXDOMAIN
SECTION QUESTION
nonexistent.soa.low.com. IN A
SECTION AUTHORITY
soa.low.com. 200 IN SOA dns.example.de. hostmaster.dns.example.de. 1379078166 28800 7200 604800 500
ENTRY_END
; check that the original SOA is also returned
STEP 42 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
soa.low.com. IN SOA
ENTRY_END
STEP 43 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD RA AA NOERROR
SECTION QUESTION
soa.low.com. IN SOA
SECTION ANSWER
soa.low.com. 200 IN SOA dns.example.de. hostmaster.dns.example.de. 1379078166 28800 7200 604800 500
ENTRY_END
; check SOA TTL to be minimum of the SOA.minimum and the SOA TTL for DNSSEC
STEP 50 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
ant.testzone.nlnetlabs.nl. IN A
ENTRY_END
STEP 51 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD DO RA AA NXDOMAIN
SECTION QUESTION
ant.testzone.nlnetlabs.nl. IN A
SECTION AUTHORITY
testzone.nlnetlabs.nl. 3600 IN SOA ns.nlnetlabs.nl. ralph.nlnetlabs.nl. 1 14400 3600 604800 3600
testzone.nlnetlabs.nl. 3600 IN RRSIG SOA 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. GhmXNFQktZIgaBpGKwj9Q2mfq5+jcbRPK+PPgtRVicUPZga/d/iGEL8PV/8DzGwkaZbM14pamSUMgdJibW4zNhLz/ukjPilbjoj6giH1jtbdZLAQ6iK9pZ/4jKUEq4txviTczZNnDeolgPEEl4xo4NclQmi7zj1XBlQRbjvG0/0=
alligator.testzone.nlnetlabs.nl. 3600 IN NSEC cheetah.testzone.nlnetlabs.nl. TXT RRSIG NSEC
alligator.testzone.nlnetlabs.nl. 3600 IN RRSIG NSEC 8 4 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. QAgQ0AsMoYG02+VPfoOctSPlTHdQOkQt5fFkSkzIbVhUzNOqa+dB/Qkc81AwFeJosA+PvYjt6utcVkIWmK2Djy9eXC49gILtVF79vUe4G7ZrybO5NXjqNa5ANoUGM+yew4wkjeNOMVAsvs+1kvFY7S8RAa/0AIYlZHQ8vNBPNaI=
testzone.nlnetlabs.nl. 3600 IN NSEC alligator.testzone.nlnetlabs.nl. NS SOA RRSIG NSEC DNSKEY
testzone.nlnetlabs.nl. 3600 IN RRSIG NSEC 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. gTKn6U1nal9oA79IRxLa/7zexl6A0yJZzeEGBbZ5rh5feyAr2X4LTR9bPCgcHeMVggf4FP+kD1L/sxzj/YLwB1ZKGKlwnzsHtPFTlmvDClaqQ76DRZq5Vejr2ZfnclBUb2vtxaXywTRW8oueaaq9flcShEQ/cQ+KRU8sc344qd0=
ENTRY_END
; check that the original SOA is also returned
STEP 52 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
testzone.nlnetlabs.nl. IN SOA
ENTRY_END
STEP 53 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD DO RA AA NOERROR
SECTION QUESTION
testzone.nlnetlabs.nl. IN SOA
SECTION ANSWER
testzone.nlnetlabs.nl. 4600 IN SOA ns.nlnetlabs.nl. ralph.nlnetlabs.nl. 1 14400 3600 604800 3600
testzone.nlnetlabs.nl. 4600 IN RRSIG SOA 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. GhmXNFQktZIgaBpGKwj9Q2mfq5+jcbRPK+PPgtRVicUPZga/d/iGEL8PV/8DzGwkaZbM14pamSUMgdJibW4zNhLz/ukjPilbjoj6giH1jtbdZLAQ6iK9pZ/4jKUEq4txviTczZNnDeolgPEEl4xo4NclQmi7zj1XBlQRbjvG0/0=
ENTRY_END
SCENARIO_END
testdata/fwd_ancil.tdir/fwd_ancil.post
Vendored
+5 -1
View File
@@ -14,5 +14,9 @@ fi
kill_pid $FWD_PID
if fgrep "service stopped" unbound.log; then
exit 0
fi
fi
if fgrep "disable interface-automatic" unbound.log; then
echo "skip test"
exit 0
fi
kill_pid $UNBOUND_PID
testdata/localdata.rpl
Vendored
+9 -9
View File
@@ -88,12 +88,12 @@ local. IN A
ENTRY_END
STEP 6 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
MATCH all ttl
REPLY QR RA AA
SECTION QUESTION
local. IN A
SECTION AUTHORITY
local. 3600 IN SOA nobody nobody 1 2 3 4 5
local. 5 IN SOA nobody nobody 1 2 3 4 5
ENTRY_END
; positive SOA
@@ -104,7 +104,7 @@ local. IN SOA
ENTRY_END
STEP 8 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
MATCH all ttl
REPLY QR RA AA
SECTION QUESTION
local. IN SOA
@@ -136,12 +136,12 @@ serv.local. IN MX
ENTRY_END
STEP 12 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
MATCH all ttl
REPLY QR RA AA
SECTION QUESTION
serv.local. IN MX
SECTION AUTHORITY
local. 3600 IN SOA nobody nobody 1 2 3 4 5
local. 5 IN SOA nobody nobody 1 2 3 4 5
ENTRY_END
; no such type, empty nonterminal
@@ -152,12 +152,12 @@ bla.local. IN MX
ENTRY_END
STEP 14 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
MATCH all ttl
REPLY QR RA AA
SECTION QUESTION
bla.local. IN MX
SECTION AUTHORITY
local. 3600 IN SOA nobody nobody 1 2 3 4 5
local. 5 IN SOA nobody nobody 1 2 3 4 5
ENTRY_END
; nxdomain with SOA
@@ -168,12 +168,12 @@ doing.local. IN MX
ENTRY_END
STEP 16 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
MATCH all ttl
REPLY QR RA AA NXDOMAIN
SECTION QUESTION
doing.local. IN MX
SECTION AUTHORITY
local. 3600 IN SOA nobody nobody 1 2 3 4 5
local. 5 IN SOA nobody nobody 1 2 3 4 5
ENTRY_END
; nxdomain without SOA
testdata/padding.tdir/padding.conf
Vendored
+27
View File
@@ -0,0 +1,27 @@
server:
interface: 127.0.0.1
port: @PORT@
use-syslog: no
directory: .
pidfile: "unbound.pid"
chroot: ""
username: ""
do-not-query-localhost: no
tls-cert-bundle: "unbound_server.pem"
tls-upstream: yes
remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-port: @CONTROL_PORT@
server-key-file: "unbound_server.key"
server-cert-file: "unbound_server.pem"
control-key-file: "unbound_control.key"
control-cert-file: "unbound_control.pem"
forward-zone:
name: "."
forward-addr: "127.0.0.1@@TOPORT@#unbound"
testdata/padding.tdir/padding.conf2
Vendored
+47
View File
@@ -0,0 +1,47 @@
# this is the upstream server that has pipelining and responds to queries.
server:
verbosity: 1
# num-threads: 1
interface: 127.0.0.1@@PORT@
port: @PORT@
use-syslog: no
directory: .
pidfile: "unbound2.pid"
chroot: ""
username: ""
do-not-query-localhost: no
tls-port: @PORT@
tls-service-key: "unbound_server.key"
tls-service-pem: "unbound_server.pem"
tcp-idle-timeout: 10000
log-queries: yes
log-replies: yes
log-identity: "upstream"
remote-control:
control-enable: yes
control-interface: 127.0.0.1
# control-interface: ::1
control-port: @CONTROL_PORT2@
server-key-file: "unbound_server.key"
server-cert-file: "unbound_server.pem"
control-key-file: "unbound_control.key"
control-cert-file: "unbound_control.pem"
forward-zone:
name: "."
forward-addr: "127.0.0.1@@TOPORT@"
dnstap:
dnstap-enable: yes
dnstap-socket-path: "dnstap.socket"
dnstap-send-identity: yes
dnstap-send-version: yes
#dnstap-identity
#dnstap-version
dnstap-log-resolver-query-messages: no
dnstap-log-resolver-response-messages: no
dnstap-log-client-query-messages: yes
dnstap-log-client-response-messages: yes
dnstap-log-forwarder-query-messages: no
dnstap-log-forwarder-response-messages: no
testdata/padding.tdir/padding.dsc
Vendored
+16
View File
@@ -0,0 +1,16 @@
BaseName: padding
Version: 1.0
Description: Test EDNS0 padding option (RFC7830 and RFC8467).
CreationDate: Sun Jan 24 16:41:42 CET 2021
Maintainer: Willem Toorop
Category:
Component:
CmdDepends:
Depends:
Help:
Pre: padding.pre
Post: padding.post
Test: padding.test
AuxFiles:
Passed:
Failure:
testdata/padding.tdir/padding.msgsizes
Vendored
+20
View File
@@ -0,0 +1,20 @@
;; MSG SIZE rcvd: 128
;; MSG SIZE rcvd: 468
;; MSG SIZE rcvd: 128
;; MSG SIZE rcvd: 936
;; MSG SIZE rcvd: 128
;; MSG SIZE rcvd: 60
;; MSG SIZE rcvd: 128
;; MSG SIZE rcvd: 502
;; MSG SIZE rcvd: 44
;; MSG SIZE rcvd: 60
;; MSG SIZE rcvd: 44
;; MSG SIZE rcvd: 502
;; MSG SIZE rcvd: 48
;; MSG SIZE rcvd: 64
;; MSG SIZE rcvd: 48
;; MSG SIZE rcvd: 512
;; MSG SIZE rcvd: 48
;; MSG SIZE rcvd: 512
;; MSG SIZE rcvd: 48
;; MSG SIZE rcvd: 512
testdata/padding.tdir/padding.post
Vendored
+23
View File
@@ -0,0 +1,23 @@
# #-- padding.post --#
# source the master var file when it's there
[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
# source the test var file when it's there
[ -f .tpkg.var.test ] && source .tpkg.var.test
#
# do your teardown here
. ../common.sh
PRE="../.."
if grep "define USE_DNSTAP 1" $PRE/config.h; then echo test enabled; else echo test skipped; exit 0; fi
kill_pid $DNSTAP_SOCKET_PID
kill_pid $FWD_PID
kill_pid `cat unbound2.pid`
if test -f unbound2.log; then
echo ">>> upstream log"
cat unbound2.log
fi
#kill_pid $UNBOUND_PID
kill_pid `cat unbound.pid`
if test -f unbound.log; then
echo ">>> unbound log"
cat unbound.log
fi
testdata/padding.tdir/padding.pre
Vendored
+69
View File
@@ -0,0 +1,69 @@
# #-- padding.pre--#
# source the master var file when it's there
[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
# use .tpkg.var.test for in test variable passing
[ -f .tpkg.var.test ] && source .tpkg.var.test
PRE="../.."
. ../common.sh
if grep "define USE_DNSTAP 1" $PRE/config.h; then echo test enabled; else echo test skipped; exit 0; fi
get_random_port 5
UNBOUND_PORT=$RND_PORT
UPSTREAM_PORT=$(($RND_PORT + 1))
FWD_PORT=$(($RND_PORT + 2))
CONTROL_PORT=$(($RND_PORT + 3))
CONTROL_PORT2=$(($RND_PORT + 4))
echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
echo "UPSTREAM_PORT=$UPSTREAM_PORT" >> .tpkg.var.test
echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
echo "CONTROL_PORT2=$CONTROL_PORT2" >> .tpkg.var.test
# start ldns-testnd
get_ldns_testns
$LDNS_TESTNS -p $FWD_PORT padding.testns >fwd.log 2>&1 &
FWD_PID=$!
echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
# start the dnstap log server
# the -vvvv flag prints protocol and connection information from the
# unbound-dnstap-socket server.
# the -l flag prints the DNS info in the DNSTAP packet in multiline output.
# stderr is the '-vvvv' server logs and errors.
# stdout is the one-line packet logs (or with -l, multiline).
$PRE/unbound-dnstap-socket -u dnstap.socket -l -vvvv 2>tap.errlog >tap.log &
if test $? -ne 0; then
echo "could not start unbound-dnstap-socket server"
exit 1
fi
DNSTAP_SOCKET_PID=$!
echo "DNSTAP_SOCKET_PID=$DNSTAP_SOCKET_PID" >> .tpkg.var.test
# wait for the server to go up and make the dnstap.socket file
wait_server_up "tap.errlog" "creating unix socket"
if test ! -S dnstap.socket; then
echo "the dnstap.socket file does not exist!"
fi
# make config file
sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$UPSTREAM_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < padding.conf > ub.conf
# start unbound in the background
$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
#$PRE/unbound -d -c ub.conf 2>&1 | tee unbound.log &
UNBOUND_PID=$!
echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
# make upstream config file
sed -e 's/@PORT\@/'$UPSTREAM_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@CONTROL_PORT2\@/'$CONTROL_PORT2'/' < padding.conf2 > ub2.conf
# start upstream unbound in the background
$PRE/unbound -d -c ub2.conf >unbound2.log 2>&1 &
#$PRE/unbound -d -c ub2.conf 2>&1 | tee unbound2.log &
UPSTREAM_PID=$!
echo "UPSTREAM_PID=$UPSTREAM_PID" >> .tpkg.var.test
wait_ldns_testns_up fwd.log
wait_unbound_up unbound.log
wait_unbound_up unbound2.log
cat .tpkg.var.test
testdata/padding.tdir/padding.test
Vendored
+170
View File
@@ -0,0 +1,170 @@
echo There we go...
# #-- padding.test --#
# source the master var file when it's there
[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
# use .tpkg.var.test for in test variable passing
[ -f .tpkg.var.test ] && source .tpkg.var.test
PRE="../.."
. ../common.sh
if grep "define USE_DNSTAP 1" $PRE/config.h; then echo test enabled; else echo test skipped; exit 0; fi
echo "> query www.example.com. A"
dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
echo "> check answer"
if grep "10.20.30.40" outfile; then
echo "OK"
else
echo "> cat logfiles"
cat tap.log
cat tap.errlog
cat fwd.log
cat unbound2.log
cat unbound.log
echo "Not OK"
exit 1
fi
echo "> wait for log to happen on timer"
sleep 3
echo "> check tap.log for dnstap info"
# see if it logged the information in tap.log
# wait for a moment for filesystem to catch up.
if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "www.example.com" tap.log >/dev/null; then :; else sleep 10; fi
if grep "www.example.com" tap.log; then echo "yes it is in tap.log";
else
echo "information not in tap.log"
echo "failed"
echo "> cat logfiles"
cat tap.log
cat tap.errlog
cat fwd.log
cat unbound.log
echo "Not OK"
exit 1
fi
echo "> query txt.example.com. TXT"
dig @127.0.0.1 -p $UNBOUND_PORT txt.example.com. TXT | tee outfile
echo "> check answer"
if grep "Lorem ipsum" outfile; then
echo "OK"
else
echo "> cat logfiles"
cat tap.log
cat tap.errlog
cat fwd.log
cat unbound2.log
cat unbound.log
echo "Not OK"
exit 1
fi
echo "> check tap.log for dnstap info"
# see if it logged the information in tap.log
# wait for a moment for filesystem to catch up.
if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 10; fi
if grep "txt.example.com" tap.log; then echo "yes it is in tap.log";
else
echo "information not in tap.log"
echo "failed"
echo "> cat logfiles"
cat tap.log
cat tap.errlog
cat fwd.log
cat unbound.log
echo "Not OK"
exit 1
fi
echo "> flush cache entries."
$PRE/unbound-control -c ub.conf flush_type www.example.com A
$PRE/unbound-control -c ub.conf flush_type txt.example.com TXT
echo "> disable padding of responses."
$PRE/unbound-control -c ub2.conf set_option pad-responses: no
echo "> query www.example.com. A"
dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile
echo "> query txt.example.com. TXT"
dig @127.0.0.1 -p $UNBOUND_PORT txt.example.com. TXT | tee outfile
echo "> flush cache entries."
$PRE/unbound-control -c ub.conf flush_type www.example.com A
$PRE/unbound-control -c ub.conf flush_type txt.example.com TXT
echo "> enable padding of responses."
$PRE/unbound-control -c ub2.conf set_option pad-responses: yes
echo "> set pad responses block size to 64"
$PRE/unbound-control -c ub2.conf set_option pad-responses-block-size: 64
echo "> disable padding of queries."
$PRE/unbound-control -c ub.conf set_option pad-queries: no
echo "> query www.example.com. A"
dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile
echo "> query txt.example.com. TXT"
dig @127.0.0.1 -p $UNBOUND_PORT txt.example.com. TXT | tee outfile
echo "> flush cache entries."
$PRE/unbound-control -c ub.conf flush_type www.example.com A
$PRE/unbound-control -c ub.conf flush_type txt.example.com TXT
echo "> enable padding of queries."
$PRE/unbound-control -c ub.conf set_option pad-queries: yes
echo "> set pad queries block size to 48"
$PRE/unbound-control -c ub.conf set_option pad-queries-block-size: 48
echo "> query www.example.com. A"
dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile
echo "> query txt.example.com. TXT"
dig @127.0.0.1 -p $UNBOUND_PORT txt.example.com. TXT | tee outfile
echo "> flush cache entries."
$PRE/unbound-control -c ub.conf flush_type www.example.com A
$PRE/unbound-control -c ub.conf flush_type txt.example.com TXT
echo "> set pad responses block size to 512"
$PRE/unbound-control -c ub2.conf set_option pad-responses-block-size: 512
echo "> query www.example.com. A"
dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. A | tee outfile
echo "> query fin.example.com. TXT"
dig @127.0.0.1 -p $UNBOUND_PORT fin.example.com. TXT | tee outfile
echo "> check tap.log for dnstap info"
# see if it logged the information in tap.log
# wait for a moment for filesystem to catch up.
if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
if grep "fini" tap.log >/dev/null; then :; else sleep 10; fi
if grep "fini" tap.log; then echo "yes it is in tap.log";
else
echo "information not in tap.log"
echo "failed"
echo "> cat logfiles"
cat tap.log
cat tap.errlog
cat fwd.log
cat unbound.log
echo "Not OK"
exit 1
fi
grep '^;; MSG SIZE rcvd: ' tap.log > message.sizes
if diff message.sizes padding.msgsizes
then
echo "OK - Message sizes matched expected sizes"
exit 0
else
echo "unexpected message sizes"
echo "failed"
echo "> cat logfiles"
cat tap.log
cat tap.errlog
cat fwd.log
cat unbound.log
echo "Not OK"
exit 1
fi
testdata/padding.tdir/padding.testns
Vendored
+34
View File
@@ -0,0 +1,34 @@
; nameserver test file
$ORIGIN example.com.
$TTL 3600
ENTRY_BEGIN
MATCH opcode qtype qname
REPLY QR AA NOERROR
ADJUST copy_id
SECTION QUESTION
www IN A
SECTION ANSWER
www IN A 10.20.30.40
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
REPLY QR AA NOERROR
ADJUST copy_id
SECTION QUESTION
txt IN TXT
SECTION ANSWER
txt IN TXT "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua." "Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." "Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur." "Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum."
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
REPLY QR AA NOERROR
ADJUST copy_id
SECTION QUESTION
fin IN TXT
SECTION ANSWER
fin IN TXT "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua." "Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat." "Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur." "Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum." "fini"
ENTRY_END
testdata/padding.tdir/unbound_control.key
Vendored
+39
View File
@@ -0,0 +1,39 @@
-----BEGIN RSA PRIVATE KEY-----
MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
-----END RSA PRIVATE KEY-----
testdata/padding.tdir/unbound_control.pem
Vendored
+22
View File
@@ -0,0 +1,22 @@
-----BEGIN CERTIFICATE-----
MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
+i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
-----END CERTIFICATE-----
testdata/padding.tdir/unbound_server.key
Vendored
+39
View File
@@ -0,0 +1,39 @@
-----BEGIN RSA PRIVATE KEY-----
MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
-----END RSA PRIVATE KEY-----
testdata/padding.tdir/unbound_server.pem
Vendored
+22
View File
@@ -0,0 +1,22 @@
-----BEGIN CERTIFICATE-----
MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
-----END CERTIFICATE-----
testdata/serve_original_ttl.rpl
Vendored
+136
View File
@@ -0,0 +1,136 @@
; config options
server:
access-control: 127.0.0.1 allow_snoop
module-config: "validator iterator"
qname-minimisation: "no"
minimal-responses: no
serve-original-ttl: yes
cache-max-ttl: 1000
cache-min-ttl: 20
serve-expired: yes
serve-expired-reply-ttl: 123
stub-zone:
name: "example.com"
stub-addr: 1.2.3.4
CONFIG_END
SCENARIO_BEGIN Test serve-original-ttl
; Scenario overview:
; - query for example.com. IN A
; - check that we get an answer for example.com. IN A with the correct TTL
; - query again after a couple seconds and check that we get the original TTL
; (next steps are combination with serve-expired)
; - query again after the TTL expired
; - check that we get the expired cached answer with the original TTL
; ns.example.com.
RANGE_BEGIN 0 100
ADDRESS 1.2.3.4
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.com. IN NS
SECTION ANSWER
example.com. IN NS ns.example.com.
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.com. IN A
SECTION ANSWER
example.com. 10 IN A 5.6.7.8
SECTION AUTHORITY
example.com. IN NS ns.example.com.
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ENTRY_END
RANGE_END
; Query with RD flag
STEP 1 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
example.com. IN A
ENTRY_END
; Check that we got the correct answer (should be cached)
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RD RA NOERROR
SECTION QUESTION
example.com. IN A
SECTION ANSWER
example.com. 10 IN A 5.6.7.8
SECTION AUTHORITY
example.com. IN NS ns.example.com.
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ENTRY_END
; Wait a couple of seconds (< 10)
STEP 11 TIME_PASSES ELAPSE 5
; Query again
STEP 20 QUERY
ENTRY_BEGIN
REPLY
SECTION QUESTION
example.com. IN A
ENTRY_END
; Check that we got the cached answer with the original TTL
; (Passively checks that minimum and maximum TTLs are ignored)
STEP 30 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RA NOERROR
SECTION QUESTION
example.com. IN A
SECTION ANSWER
example.com. 10 A 5.6.7.8
SECTION AUTHORITY
example.com. 3600 NS ns.example.com.
SECTION ADDITIONAL
ns.example.com. 3600 A 1.2.3.4
ENTRY_END
; Wait for the TTL to expire
STEP 31 TIME_PASSES ELAPSE 3601
; Query again
STEP 40 QUERY
ENTRY_BEGIN
REPLY
SECTION QUESTION
example.com. IN A
ENTRY_END
; Check that we got a stale answer with the original TTL
STEP 50 CHECK_ANSWER
ENTRY_BEGIN
MATCH all ttl
REPLY QR RA NOERROR
SECTION QUESTION
example.com. IN A
SECTION ANSWER
example.com. 10 A 5.6.7.8
SECTION AUTHORITY
example.com. NS ns.example.com.
SECTION ADDITIONAL
ns.example.com. A 1.2.3.4
ENTRY_END
; Give time for the pending query to get answered
STEP 51 TRAFFIC
SCENARIO_END
util/config_file.c
+18 -1
View File
@@ -261,6 +261,7 @@ config_create(void)
cfg->serve_expired_ttl_reset = 0;
cfg->serve_expired_reply_ttl = 30;
cfg->serve_expired_client_timeout = 0;
cfg->serve_original_ttl = 0;
cfg->add_holddown = 30*24*3600;
cfg->del_holddown = 30*24*3600;
cfg->keep_missing = 366*24*3600; /* one year plus a little leeway */
@@ -338,6 +339,10 @@ config_create(void)
cfg->dnscrypt_shared_secret_cache_slabs = 4;
cfg->dnscrypt_nonce_cache_size = 4*1024*1024;
cfg->dnscrypt_nonce_cache_slabs = 4;
cfg->pad_responses = 1;
cfg->pad_responses_block_size = 468; /* from RFC8467 */
cfg->pad_queries = 1;
cfg->pad_queries_block_size = 128; /* from RFC8467 */
#ifdef USE_IPSECMOD
cfg->ipsecmod_enabled = 1;
cfg->ipsecmod_ignore_bogus = 0;
@@ -642,6 +647,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
else if(strcmp(opt, "serve-expired-reply-ttl:") == 0)
{ IS_NUMBER_OR_ZERO; cfg->serve_expired_reply_ttl = atoi(val); SERVE_EXPIRED_REPLY_TTL=(time_t)cfg->serve_expired_reply_ttl;}
else S_NUMBER_OR_ZERO("serve-expired-client-timeout:", serve_expired_client_timeout)
else S_YNO("serve-original-ttl:", serve_original_ttl)
else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
else S_UNSIGNED_OR_ZERO("add-holddown:", add_holddown)
else S_UNSIGNED_OR_ZERO("del-holddown:", del_holddown)
@@ -737,6 +743,10 @@ int config_set_option(struct config_file* cfg, const char* opt,
else S_NUMBER_OR_ZERO("fast-server-permil:", fast_server_permil)
else S_YNO("qname-minimisation:", qname_minimisation)
else S_YNO("qname-minimisation-strict:", qname_minimisation_strict)
else S_YNO("pad-responses:", pad_responses)
else S_SIZET_NONZERO("pad-responses-block-size:", pad_responses_block_size)
else S_YNO("pad-queries:", pad_queries)
else S_SIZET_NONZERO("pad-queries-block-size:", pad_queries_block_size)
#ifdef USE_IPSECMOD
else S_YNO("ipsecmod-enabled:", ipsecmod_enabled)
else S_YNO("ipsecmod-ignore-bogus:", ipsecmod_ignore_bogus)
@@ -1058,6 +1068,7 @@ config_get_option(struct config_file* cfg, const char* opt,
else O_YNO(opt, "serve-expired-ttl-reset", serve_expired_ttl_reset)
else O_DEC(opt, "serve-expired-reply-ttl", serve_expired_reply_ttl)
else O_DEC(opt, "serve-expired-client-timeout", serve_expired_client_timeout)
else O_YNO(opt, "serve-original-ttl", serve_original_ttl)
else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
else O_UNS(opt, "add-holddown", add_holddown)
else O_UNS(opt, "del-holddown", del_holddown)
@@ -1177,6 +1188,10 @@ config_get_option(struct config_file* cfg, const char* opt,
else O_LS3(opt, "access-control-tag-action", acl_tag_actions)
else O_LS3(opt, "access-control-tag-data", acl_tag_datas)
else O_LS2(opt, "access-control-view", acl_view)
else O_YNO(opt, "pad-responses", pad_responses)
else O_DEC(opt, "pad-responses-block-size", pad_responses_block_size)
else O_YNO(opt, "pad-queries", pad_queries)
else O_DEC(opt, "pad-queries-block-size", pad_queries_block_size)
else O_LS2(opt, "edns-client-strings", edns_client_strings)
#ifdef USE_IPSECMOD
else O_YNO(opt, "ipsecmod-enabled", ipsecmod_enabled)
@@ -2049,8 +2064,9 @@ uint8_t* cfg_parse_nsid(const char* str, uint16_t* nsid_len)
if ((nsid = (uint8_t *)strdup(str + 6)))
*nsid_len = strlen(str + 6);
} else if (strlen(str) % 2)
} else if (strlen(str) % 2) {
; /* hex string has even number of characters */
}
else if (*str && (nsid = calloc(1, strlen(str) / 2))) {
const char *ch;
@@ -2114,6 +2130,7 @@ config_apply(struct config_file* config)
SERVE_EXPIRED = config->serve_expired;
SERVE_EXPIRED_TTL = (time_t)config->serve_expired_ttl;
SERVE_EXPIRED_REPLY_TTL = (time_t)config->serve_expired_reply_ttl;
SERVE_ORIGINAL_TTL = config->serve_original_ttl;
MAX_NEG_TTL = (time_t)config->max_negative_ttl;
RTT_MIN_TIMEOUT = config->infra_cache_min_rtt;
EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
util/config_file.h
+13
View File
@@ -392,6 +392,8 @@ struct config_file {
/** serve expired entries only after trying to update the entries and this
* timeout (in milliseconds) is reached */
int serve_expired_client_timeout;
/** serve original TTLs rather than decrementing ones */
int serve_original_ttl;
/** nsec3 maximum iterations per key size, string */
char* val_nsec3_key_iterations;
/** autotrust add holddown time, in seconds */
@@ -600,6 +602,17 @@ struct config_file {
size_t dnscrypt_nonce_cache_size;
/** number of slabs for dnscrypt nonces cache */
size_t dnscrypt_nonce_cache_slabs;
/** EDNS padding according to RFC7830 and RFC8467 */
/** true to enable padding of responses (default: on) */
int pad_responses;
/** block size with which to pad encrypted responses (default: 468) */
size_t pad_responses_block_size;
/** true to enable padding of queries (default: on) */
int pad_queries;
/** block size with which to pad encrypted queries (default: 128) */
size_t pad_queries_block_size;
/** IPsec module */
#ifdef USE_IPSECMOD
/** false to bypass the IPsec module */
util/configlexer.c
+2555 -2488
View File
File diff suppressed because it is too large Load Diff
util/configlexer.lex
+5
View File
@@ -392,6 +392,7 @@ serve-expired-ttl{COLON} { YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
serve-expired-ttl-reset{COLON} { YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }
serve-expired-reply-ttl{COLON} { YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) }
serve-expired-client-timeout{COLON} { YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) }
serve-original-ttl{COLON} { YDVAR(1, VAR_SERVE_ORIGINAL_TTL) }
fake-dsa{COLON} { YDVAR(1, VAR_FAKE_DSA) }
fake-sha1{COLON} { YDVAR(1, VAR_FAKE_SHA1) }
val-log-level{COLON} { YDVAR(1, VAR_VAL_LOG_LEVEL) }
@@ -510,6 +511,10 @@ dnscrypt-shared-secret-cache-slabs{COLON} {
YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) }
dnscrypt-nonce-cache-size{COLON} { YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) }
dnscrypt-nonce-cache-slabs{COLON} { YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) }
pad-responses{COLON} { YDVAR(1, VAR_PAD_RESPONSES) }
pad-responses-block-size{COLON} { YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) }
pad-queries{COLON} { YDVAR(1, VAR_PAD_QUERIES) }
pad-queries-block-size{COLON} { YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) }
ipsecmod-enabled{COLON} { YDVAR(1, VAR_IPSECMOD_ENABLED) }
ipsecmod-ignore-bogus{COLON} { YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
ipsecmod-hook{COLON} { YDVAR(1, VAR_IPSECMOD_HOOK) }
util/configparser.c
+2592 -1830
View File
File diff suppressed because it is too large Load Diff
util/configparser.h
+162 -152
View File
@@ -1,4 +1,4 @@
/* A Bison parser, made by GNU Bison 3.7. */
/* A Bison parser, made by GNU Bison 3.6.4. */
/* Bison interface for Yacc-like parsers in C
@@ -280,81 +280,86 @@ extern int yydebug;
VAR_SERVE_EXPIRED_TTL_RESET = 481, /* VAR_SERVE_EXPIRED_TTL_RESET */
VAR_SERVE_EXPIRED_REPLY_TTL = 482, /* VAR_SERVE_EXPIRED_REPLY_TTL */
VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 483, /* VAR_SERVE_EXPIRED_CLIENT_TIMEOUT */
VAR_FAKE_DSA = 484, /* VAR_FAKE_DSA */
VAR_FAKE_SHA1 = 485, /* VAR_FAKE_SHA1 */
VAR_LOG_IDENTITY = 486, /* VAR_LOG_IDENTITY */
VAR_HIDE_TRUSTANCHOR = 487, /* VAR_HIDE_TRUSTANCHOR */
VAR_TRUST_ANCHOR_SIGNALING = 488, /* VAR_TRUST_ANCHOR_SIGNALING */
VAR_AGGRESSIVE_NSEC = 489, /* VAR_AGGRESSIVE_NSEC */
VAR_USE_SYSTEMD = 490, /* VAR_USE_SYSTEMD */
VAR_SHM_ENABLE = 491, /* VAR_SHM_ENABLE */
VAR_SHM_KEY = 492, /* VAR_SHM_KEY */
VAR_ROOT_KEY_SENTINEL = 493, /* VAR_ROOT_KEY_SENTINEL */
VAR_DNSCRYPT = 494, /* VAR_DNSCRYPT */
VAR_DNSCRYPT_ENABLE = 495, /* VAR_DNSCRYPT_ENABLE */
VAR_DNSCRYPT_PORT = 496, /* VAR_DNSCRYPT_PORT */
VAR_DNSCRYPT_PROVIDER = 497, /* VAR_DNSCRYPT_PROVIDER */
VAR_DNSCRYPT_SECRET_KEY = 498, /* VAR_DNSCRYPT_SECRET_KEY */
VAR_DNSCRYPT_PROVIDER_CERT = 499, /* VAR_DNSCRYPT_PROVIDER_CERT */
VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 500, /* VAR_DNSCRYPT_PROVIDER_CERT_ROTATED */
VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 501, /* VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE */
VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 502, /* VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS */
VAR_DNSCRYPT_NONCE_CACHE_SIZE = 503, /* VAR_DNSCRYPT_NONCE_CACHE_SIZE */
VAR_DNSCRYPT_NONCE_CACHE_SLABS = 504, /* VAR_DNSCRYPT_NONCE_CACHE_SLABS */
VAR_IPSECMOD_ENABLED = 505, /* VAR_IPSECMOD_ENABLED */
VAR_IPSECMOD_HOOK = 506, /* VAR_IPSECMOD_HOOK */
VAR_IPSECMOD_IGNORE_BOGUS = 507, /* VAR_IPSECMOD_IGNORE_BOGUS */
VAR_IPSECMOD_MAX_TTL = 508, /* VAR_IPSECMOD_MAX_TTL */
VAR_IPSECMOD_WHITELIST = 509, /* VAR_IPSECMOD_WHITELIST */
VAR_IPSECMOD_STRICT = 510, /* VAR_IPSECMOD_STRICT */
VAR_CACHEDB = 511, /* VAR_CACHEDB */
VAR_CACHEDB_BACKEND = 512, /* VAR_CACHEDB_BACKEND */
VAR_CACHEDB_SECRETSEED = 513, /* VAR_CACHEDB_SECRETSEED */
VAR_CACHEDB_REDISHOST = 514, /* VAR_CACHEDB_REDISHOST */
VAR_CACHEDB_REDISPORT = 515, /* VAR_CACHEDB_REDISPORT */
VAR_CACHEDB_REDISTIMEOUT = 516, /* VAR_CACHEDB_REDISTIMEOUT */
VAR_CACHEDB_REDISEXPIRERECORDS = 517, /* VAR_CACHEDB_REDISEXPIRERECORDS */
VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 518, /* VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM */
VAR_FOR_UPSTREAM = 519, /* VAR_FOR_UPSTREAM */
VAR_AUTH_ZONE = 520, /* VAR_AUTH_ZONE */
VAR_ZONEFILE = 521, /* VAR_ZONEFILE */
VAR_MASTER = 522, /* VAR_MASTER */
VAR_URL = 523, /* VAR_URL */
VAR_FOR_DOWNSTREAM = 524, /* VAR_FOR_DOWNSTREAM */
VAR_FALLBACK_ENABLED = 525, /* VAR_FALLBACK_ENABLED */
VAR_TLS_ADDITIONAL_PORT = 526, /* VAR_TLS_ADDITIONAL_PORT */
VAR_LOW_RTT = 527, /* VAR_LOW_RTT */
VAR_LOW_RTT_PERMIL = 528, /* VAR_LOW_RTT_PERMIL */
VAR_FAST_SERVER_PERMIL = 529, /* VAR_FAST_SERVER_PERMIL */
VAR_FAST_SERVER_NUM = 530, /* VAR_FAST_SERVER_NUM */
VAR_ALLOW_NOTIFY = 531, /* VAR_ALLOW_NOTIFY */
VAR_TLS_WIN_CERT = 532, /* VAR_TLS_WIN_CERT */
VAR_TCP_CONNECTION_LIMIT = 533, /* VAR_TCP_CONNECTION_LIMIT */
VAR_FORWARD_NO_CACHE = 534, /* VAR_FORWARD_NO_CACHE */
VAR_STUB_NO_CACHE = 535, /* VAR_STUB_NO_CACHE */
VAR_LOG_SERVFAIL = 536, /* VAR_LOG_SERVFAIL */
VAR_DENY_ANY = 537, /* VAR_DENY_ANY */
VAR_UNKNOWN_SERVER_TIME_LIMIT = 538, /* VAR_UNKNOWN_SERVER_TIME_LIMIT */
VAR_LOG_TAG_QUERYREPLY = 539, /* VAR_LOG_TAG_QUERYREPLY */
VAR_STREAM_WAIT_SIZE = 540, /* VAR_STREAM_WAIT_SIZE */
VAR_TLS_CIPHERS = 541, /* VAR_TLS_CIPHERS */
VAR_TLS_CIPHERSUITES = 542, /* VAR_TLS_CIPHERSUITES */
VAR_TLS_USE_SNI = 543, /* VAR_TLS_USE_SNI */
VAR_IPSET = 544, /* VAR_IPSET */
VAR_IPSET_NAME_V4 = 545, /* VAR_IPSET_NAME_V4 */
VAR_IPSET_NAME_V6 = 546, /* VAR_IPSET_NAME_V6 */
VAR_TLS_SESSION_TICKET_KEYS = 547, /* VAR_TLS_SESSION_TICKET_KEYS */
VAR_RPZ = 548, /* VAR_RPZ */
VAR_TAGS = 549, /* VAR_TAGS */
VAR_RPZ_ACTION_OVERRIDE = 550, /* VAR_RPZ_ACTION_OVERRIDE */
VAR_RPZ_CNAME_OVERRIDE = 551, /* VAR_RPZ_CNAME_OVERRIDE */
VAR_RPZ_LOG = 552, /* VAR_RPZ_LOG */
VAR_RPZ_LOG_NAME = 553, /* VAR_RPZ_LOG_NAME */
VAR_DYNLIB = 554, /* VAR_DYNLIB */
VAR_DYNLIB_FILE = 555, /* VAR_DYNLIB_FILE */
VAR_EDNS_CLIENT_STRING = 556, /* VAR_EDNS_CLIENT_STRING */
VAR_EDNS_CLIENT_STRING_OPCODE = 557, /* VAR_EDNS_CLIENT_STRING_OPCODE */
VAR_NSID = 558 /* VAR_NSID */
VAR_SERVE_ORIGINAL_TTL = 484, /* VAR_SERVE_ORIGINAL_TTL */
VAR_FAKE_DSA = 485, /* VAR_FAKE_DSA */
VAR_FAKE_SHA1 = 486, /* VAR_FAKE_SHA1 */
VAR_LOG_IDENTITY = 487, /* VAR_LOG_IDENTITY */
VAR_HIDE_TRUSTANCHOR = 488, /* VAR_HIDE_TRUSTANCHOR */
VAR_TRUST_ANCHOR_SIGNALING = 489, /* VAR_TRUST_ANCHOR_SIGNALING */
VAR_AGGRESSIVE_NSEC = 490, /* VAR_AGGRESSIVE_NSEC */
VAR_USE_SYSTEMD = 491, /* VAR_USE_SYSTEMD */
VAR_SHM_ENABLE = 492, /* VAR_SHM_ENABLE */
VAR_SHM_KEY = 493, /* VAR_SHM_KEY */
VAR_ROOT_KEY_SENTINEL = 494, /* VAR_ROOT_KEY_SENTINEL */
VAR_DNSCRYPT = 495, /* VAR_DNSCRYPT */
VAR_DNSCRYPT_ENABLE = 496, /* VAR_DNSCRYPT_ENABLE */
VAR_DNSCRYPT_PORT = 497, /* VAR_DNSCRYPT_PORT */
VAR_DNSCRYPT_PROVIDER = 498, /* VAR_DNSCRYPT_PROVIDER */
VAR_DNSCRYPT_SECRET_KEY = 499, /* VAR_DNSCRYPT_SECRET_KEY */
VAR_DNSCRYPT_PROVIDER_CERT = 500, /* VAR_DNSCRYPT_PROVIDER_CERT */
VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 501, /* VAR_DNSCRYPT_PROVIDER_CERT_ROTATED */
VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 502, /* VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE */
VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 503, /* VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS */
VAR_DNSCRYPT_NONCE_CACHE_SIZE = 504, /* VAR_DNSCRYPT_NONCE_CACHE_SIZE */
VAR_DNSCRYPT_NONCE_CACHE_SLABS = 505, /* VAR_DNSCRYPT_NONCE_CACHE_SLABS */
VAR_PAD_RESPONSES = 506, /* VAR_PAD_RESPONSES */
VAR_PAD_RESPONSES_BLOCK_SIZE = 507, /* VAR_PAD_RESPONSES_BLOCK_SIZE */
VAR_PAD_QUERIES = 508, /* VAR_PAD_QUERIES */
VAR_PAD_QUERIES_BLOCK_SIZE = 509, /* VAR_PAD_QUERIES_BLOCK_SIZE */
VAR_IPSECMOD_ENABLED = 510, /* VAR_IPSECMOD_ENABLED */
VAR_IPSECMOD_HOOK = 511, /* VAR_IPSECMOD_HOOK */
VAR_IPSECMOD_IGNORE_BOGUS = 512, /* VAR_IPSECMOD_IGNORE_BOGUS */
VAR_IPSECMOD_MAX_TTL = 513, /* VAR_IPSECMOD_MAX_TTL */
VAR_IPSECMOD_WHITELIST = 514, /* VAR_IPSECMOD_WHITELIST */
VAR_IPSECMOD_STRICT = 515, /* VAR_IPSECMOD_STRICT */
VAR_CACHEDB = 516, /* VAR_CACHEDB */
VAR_CACHEDB_BACKEND = 517, /* VAR_CACHEDB_BACKEND */
VAR_CACHEDB_SECRETSEED = 518, /* VAR_CACHEDB_SECRETSEED */
VAR_CACHEDB_REDISHOST = 519, /* VAR_CACHEDB_REDISHOST */
VAR_CACHEDB_REDISPORT = 520, /* VAR_CACHEDB_REDISPORT */
VAR_CACHEDB_REDISTIMEOUT = 521, /* VAR_CACHEDB_REDISTIMEOUT */
VAR_CACHEDB_REDISEXPIRERECORDS = 522, /* VAR_CACHEDB_REDISEXPIRERECORDS */
VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 523, /* VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM */
VAR_FOR_UPSTREAM = 524, /* VAR_FOR_UPSTREAM */
VAR_AUTH_ZONE = 525, /* VAR_AUTH_ZONE */
VAR_ZONEFILE = 526, /* VAR_ZONEFILE */
VAR_MASTER = 527, /* VAR_MASTER */
VAR_URL = 528, /* VAR_URL */
VAR_FOR_DOWNSTREAM = 529, /* VAR_FOR_DOWNSTREAM */
VAR_FALLBACK_ENABLED = 530, /* VAR_FALLBACK_ENABLED */
VAR_TLS_ADDITIONAL_PORT = 531, /* VAR_TLS_ADDITIONAL_PORT */
VAR_LOW_RTT = 532, /* VAR_LOW_RTT */
VAR_LOW_RTT_PERMIL = 533, /* VAR_LOW_RTT_PERMIL */
VAR_FAST_SERVER_PERMIL = 534, /* VAR_FAST_SERVER_PERMIL */
VAR_FAST_SERVER_NUM = 535, /* VAR_FAST_SERVER_NUM */
VAR_ALLOW_NOTIFY = 536, /* VAR_ALLOW_NOTIFY */
VAR_TLS_WIN_CERT = 537, /* VAR_TLS_WIN_CERT */
VAR_TCP_CONNECTION_LIMIT = 538, /* VAR_TCP_CONNECTION_LIMIT */
VAR_FORWARD_NO_CACHE = 539, /* VAR_FORWARD_NO_CACHE */
VAR_STUB_NO_CACHE = 540, /* VAR_STUB_NO_CACHE */
VAR_LOG_SERVFAIL = 541, /* VAR_LOG_SERVFAIL */
VAR_DENY_ANY = 542, /* VAR_DENY_ANY */
VAR_UNKNOWN_SERVER_TIME_LIMIT = 543, /* VAR_UNKNOWN_SERVER_TIME_LIMIT */
VAR_LOG_TAG_QUERYREPLY = 544, /* VAR_LOG_TAG_QUERYREPLY */
VAR_STREAM_WAIT_SIZE = 545, /* VAR_STREAM_WAIT_SIZE */
VAR_TLS_CIPHERS = 546, /* VAR_TLS_CIPHERS */
VAR_TLS_CIPHERSUITES = 547, /* VAR_TLS_CIPHERSUITES */
VAR_TLS_USE_SNI = 548, /* VAR_TLS_USE_SNI */
VAR_IPSET = 549, /* VAR_IPSET */
VAR_IPSET_NAME_V4 = 550, /* VAR_IPSET_NAME_V4 */
VAR_IPSET_NAME_V6 = 551, /* VAR_IPSET_NAME_V6 */
VAR_TLS_SESSION_TICKET_KEYS = 552, /* VAR_TLS_SESSION_TICKET_KEYS */
VAR_RPZ = 553, /* VAR_RPZ */
VAR_TAGS = 554, /* VAR_TAGS */
VAR_RPZ_ACTION_OVERRIDE = 555, /* VAR_RPZ_ACTION_OVERRIDE */
VAR_RPZ_CNAME_OVERRIDE = 556, /* VAR_RPZ_CNAME_OVERRIDE */
VAR_RPZ_LOG = 557, /* VAR_RPZ_LOG */
VAR_RPZ_LOG_NAME = 558, /* VAR_RPZ_LOG_NAME */
VAR_DYNLIB = 559, /* VAR_DYNLIB */
VAR_DYNLIB_FILE = 560, /* VAR_DYNLIB_FILE */
VAR_EDNS_CLIENT_STRING = 561, /* VAR_EDNS_CLIENT_STRING */
VAR_EDNS_CLIENT_STRING_OPCODE = 562, /* VAR_EDNS_CLIENT_STRING_OPCODE */
VAR_NSID = 563 /* VAR_NSID */
};
typedef enum yytokentype yytoken_kind_t;
#endif
@@ -588,81 +593,86 @@ extern int yydebug;
#define VAR_SERVE_EXPIRED_TTL_RESET 481
#define VAR_SERVE_EXPIRED_REPLY_TTL 482
#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 483
#define VAR_FAKE_DSA 484
#define VAR_FAKE_SHA1 485
#define VAR_LOG_IDENTITY 486
#define VAR_HIDE_TRUSTANCHOR 487
#define VAR_TRUST_ANCHOR_SIGNALING 488
#define VAR_AGGRESSIVE_NSEC 489
#define VAR_USE_SYSTEMD 490
#define VAR_SHM_ENABLE 491
#define VAR_SHM_KEY 492
#define VAR_ROOT_KEY_SENTINEL 493
#define VAR_DNSCRYPT 494
#define VAR_DNSCRYPT_ENABLE 495
#define VAR_DNSCRYPT_PORT 496
#define VAR_DNSCRYPT_PROVIDER 497
#define VAR_DNSCRYPT_SECRET_KEY 498
#define VAR_DNSCRYPT_PROVIDER_CERT 499
#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 500
#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 501
#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 502
#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 503
#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 504
#define VAR_IPSECMOD_ENABLED 505
#define VAR_IPSECMOD_HOOK 506
#define VAR_IPSECMOD_IGNORE_BOGUS 507
#define VAR_IPSECMOD_MAX_TTL 508
#define VAR_IPSECMOD_WHITELIST 509
#define VAR_IPSECMOD_STRICT 510
#define VAR_CACHEDB 511
#define VAR_CACHEDB_BACKEND 512
#define VAR_CACHEDB_SECRETSEED 513
#define VAR_CACHEDB_REDISHOST 514
#define VAR_CACHEDB_REDISPORT 515
#define VAR_CACHEDB_REDISTIMEOUT 516
#define VAR_CACHEDB_REDISEXPIRERECORDS 517
#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 518
#define VAR_FOR_UPSTREAM 519
#define VAR_AUTH_ZONE 520
#define VAR_ZONEFILE 521
#define VAR_MASTER 522
#define VAR_URL 523
#define VAR_FOR_DOWNSTREAM 524
#define VAR_FALLBACK_ENABLED 525
#define VAR_TLS_ADDITIONAL_PORT 526
#define VAR_LOW_RTT 527
#define VAR_LOW_RTT_PERMIL 528
#define VAR_FAST_SERVER_PERMIL 529
#define VAR_FAST_SERVER_NUM 530
#define VAR_ALLOW_NOTIFY 531
#define VAR_TLS_WIN_CERT 532
#define VAR_TCP_CONNECTION_LIMIT 533
#define VAR_FORWARD_NO_CACHE 534
#define VAR_STUB_NO_CACHE 535
#define VAR_LOG_SERVFAIL 536
#define VAR_DENY_ANY 537
#define VAR_UNKNOWN_SERVER_TIME_LIMIT 538
#define VAR_LOG_TAG_QUERYREPLY 539
#define VAR_STREAM_WAIT_SIZE 540
#define VAR_TLS_CIPHERS 541
#define VAR_TLS_CIPHERSUITES 542
#define VAR_TLS_USE_SNI 543
#define VAR_IPSET 544
#define VAR_IPSET_NAME_V4 545
#define VAR_IPSET_NAME_V6 546
#define VAR_TLS_SESSION_TICKET_KEYS 547
#define VAR_RPZ 548
#define VAR_TAGS 549
#define VAR_RPZ_ACTION_OVERRIDE 550
#define VAR_RPZ_CNAME_OVERRIDE 551
#define VAR_RPZ_LOG 552
#define VAR_RPZ_LOG_NAME 553
#define VAR_DYNLIB 554
#define VAR_DYNLIB_FILE 555
#define VAR_EDNS_CLIENT_STRING 556
#define VAR_EDNS_CLIENT_STRING_OPCODE 557
#define VAR_NSID 558
#define VAR_SERVE_ORIGINAL_TTL 484
#define VAR_FAKE_DSA 485
#define VAR_FAKE_SHA1 486
#define VAR_LOG_IDENTITY 487
#define VAR_HIDE_TRUSTANCHOR 488
#define VAR_TRUST_ANCHOR_SIGNALING 489
#define VAR_AGGRESSIVE_NSEC 490
#define VAR_USE_SYSTEMD 491
#define VAR_SHM_ENABLE 492
#define VAR_SHM_KEY 493
#define VAR_ROOT_KEY_SENTINEL 494
#define VAR_DNSCRYPT 495
#define VAR_DNSCRYPT_ENABLE 496
#define VAR_DNSCRYPT_PORT 497
#define VAR_DNSCRYPT_PROVIDER 498
#define VAR_DNSCRYPT_SECRET_KEY 499
#define VAR_DNSCRYPT_PROVIDER_CERT 500
#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 501
#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 502
#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 503
#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 504
#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 505
#define VAR_PAD_RESPONSES 506
#define VAR_PAD_RESPONSES_BLOCK_SIZE 507
#define VAR_PAD_QUERIES 508
#define VAR_PAD_QUERIES_BLOCK_SIZE 509
#define VAR_IPSECMOD_ENABLED 510
#define VAR_IPSECMOD_HOOK 511
#define VAR_IPSECMOD_IGNORE_BOGUS 512
#define VAR_IPSECMOD_MAX_TTL 513
#define VAR_IPSECMOD_WHITELIST 514
#define VAR_IPSECMOD_STRICT 515
#define VAR_CACHEDB 516
#define VAR_CACHEDB_BACKEND 517
#define VAR_CACHEDB_SECRETSEED 518
#define VAR_CACHEDB_REDISHOST 519
#define VAR_CACHEDB_REDISPORT 520
#define VAR_CACHEDB_REDISTIMEOUT 521
#define VAR_CACHEDB_REDISEXPIRERECORDS 522
#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 523
#define VAR_FOR_UPSTREAM 524
#define VAR_AUTH_ZONE 525
#define VAR_ZONEFILE 526
#define VAR_MASTER 527
#define VAR_URL 528
#define VAR_FOR_DOWNSTREAM 529
#define VAR_FALLBACK_ENABLED 530
#define VAR_TLS_ADDITIONAL_PORT 531
#define VAR_LOW_RTT 532
#define VAR_LOW_RTT_PERMIL 533
#define VAR_FAST_SERVER_PERMIL 534
#define VAR_FAST_SERVER_NUM 535
#define VAR_ALLOW_NOTIFY 536
#define VAR_TLS_WIN_CERT 537
#define VAR_TCP_CONNECTION_LIMIT 538
#define VAR_FORWARD_NO_CACHE 539
#define VAR_STUB_NO_CACHE 540
#define VAR_LOG_SERVFAIL 541
#define VAR_DENY_ANY 542
#define VAR_UNKNOWN_SERVER_TIME_LIMIT 543
#define VAR_LOG_TAG_QUERYREPLY 544
#define VAR_STREAM_WAIT_SIZE 545
#define VAR_TLS_CIPHERS 546
#define VAR_TLS_CIPHERSUITES 547
#define VAR_TLS_USE_SNI 548
#define VAR_IPSET 549
#define VAR_IPSET_NAME_V4 550
#define VAR_IPSET_NAME_V6 551
#define VAR_TLS_SESSION_TICKET_KEYS 552
#define VAR_RPZ 553
#define VAR_TAGS 554
#define VAR_RPZ_ACTION_OVERRIDE 555
#define VAR_RPZ_CNAME_OVERRIDE 556
#define VAR_RPZ_LOG 557
#define VAR_RPZ_LOG_NAME 558
#define VAR_DYNLIB 559
#define VAR_DYNLIB_FILE 560
#define VAR_EDNS_CLIENT_STRING 561
#define VAR_EDNS_CLIENT_STRING_OPCODE 562
#define VAR_NSID 563
/* Value type. */
#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
@@ -672,7 +682,7 @@ union YYSTYPE
char* str;
#line 676 "util/configparser.h"
#line 686 "util/configparser.h"
};
typedef union YYSTYPE YYSTYPE;
util/configparser.y
+56 -3
View File
@@ -151,7 +151,7 @@ extern struct config_parser_state* cfg_parser;
%token VAR_ACCESS_CONTROL_TAG_DATA VAR_VIEW VAR_ACCESS_CONTROL_VIEW
%token VAR_VIEW_FIRST VAR_SERVE_EXPIRED VAR_SERVE_EXPIRED_TTL
%token VAR_SERVE_EXPIRED_TTL_RESET VAR_SERVE_EXPIRED_REPLY_TTL
%token VAR_SERVE_EXPIRED_CLIENT_TIMEOUT VAR_FAKE_DSA
%token VAR_SERVE_EXPIRED_CLIENT_TIMEOUT VAR_SERVE_ORIGINAL_TTL VAR_FAKE_DSA
%token VAR_FAKE_SHA1 VAR_LOG_IDENTITY VAR_HIDE_TRUSTANCHOR
%token VAR_TRUST_ANCHOR_SIGNALING VAR_AGGRESSIVE_NSEC VAR_USE_SYSTEMD
%token VAR_SHM_ENABLE VAR_SHM_KEY VAR_ROOT_KEY_SENTINEL
@@ -162,6 +162,8 @@ extern struct config_parser_state* cfg_parser;
%token VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS
%token VAR_DNSCRYPT_NONCE_CACHE_SIZE
%token VAR_DNSCRYPT_NONCE_CACHE_SLABS
%token VAR_PAD_RESPONSES VAR_PAD_RESPONSES_BLOCK_SIZE
%token VAR_PAD_QUERIES VAR_PAD_QUERIES_BLOCK_SIZE
%token VAR_IPSECMOD_ENABLED VAR_IPSECMOD_HOOK VAR_IPSECMOD_IGNORE_BOGUS
%token VAR_IPSECMOD_MAX_TTL VAR_IPSECMOD_WHITELIST VAR_IPSECMOD_STRICT
%token VAR_CACHEDB VAR_CACHEDB_BACKEND VAR_CACHEDB_SECRETSEED
@@ -274,10 +276,14 @@ content_server: server_num_threads | server_verbosity | server_port |
server_disable_dnssec_lame_check | server_access_control_tag |
server_local_zone_override | server_access_control_tag_action |
server_access_control_tag_data | server_access_control_view |
server_qname_minimisation_strict | server_serve_expired |
server_qname_minimisation_strict |
server_pad_responses | server_pad_responses_block_size |
server_pad_queries | server_pad_queries_block_size |
server_serve_expired |
server_serve_expired_ttl | server_serve_expired_ttl_reset |
server_serve_expired_reply_ttl | server_serve_expired_client_timeout |
server_fake_dsa | server_log_identity | server_use_systemd |
server_serve_original_ttl | server_fake_dsa |
server_log_identity | server_use_systemd |
server_response_ip_tag | server_response_ip | server_response_ip_data |
server_shm_enable | server_shm_key | server_fake_sha1 |
server_hide_trustanchor | server_trust_anchor_signaling |
@@ -1929,6 +1935,15 @@ server_serve_expired_client_timeout: VAR_SERVE_EXPIRED_CLIENT_TIMEOUT STRING_ARG
free($2);
}
;
server_serve_original_ttl: VAR_SERVE_ORIGINAL_TTL STRING_ARG
{
OUTYY(("P(server_serve_original_ttl:%s)\n", $2));
if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
yyerror("expected yes or no.");
else cfg_parser->cfg->serve_original_ttl = (strcmp($2, "yes")==0);
free($2);
}
;
server_fake_dsa: VAR_FAKE_DSA STRING_ARG
{
OUTYY(("P(server_fake_dsa:%s)\n", $2));
@@ -2436,6 +2451,44 @@ server_qname_minimisation_strict: VAR_QNAME_MINIMISATION_STRICT STRING_ARG
free($2);
}
;
server_pad_responses: VAR_PAD_RESPONSES STRING_ARG
{
OUTYY(("P(server_pad_responses:%s)\n", $2));
if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
yyerror("expected yes or no.");
else cfg_parser->cfg->pad_responses =
(strcmp($2, "yes")==0);
free($2);
}
;
server_pad_responses_block_size: VAR_PAD_RESPONSES_BLOCK_SIZE STRING_ARG
{
OUTYY(("P(server_pad_responses_block_size:%s)\n", $2));
if(atoi($2) == 0)
yyerror("number expected");
else cfg_parser->cfg->pad_responses_block_size = atoi($2);
free($2);
}
;
server_pad_queries: VAR_PAD_QUERIES STRING_ARG
{
OUTYY(("P(server_pad_queries:%s)\n", $2));
if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
yyerror("expected yes or no.");
else cfg_parser->cfg->pad_queries =
(strcmp($2, "yes")==0);
free($2);
}
;
server_pad_queries_block_size: VAR_PAD_QUERIES_BLOCK_SIZE STRING_ARG
{
OUTYY(("P(server_pad_queries_block_size:%s)\n", $2));
if(atoi($2) == 0)
yyerror("number expected");
else cfg_parser->cfg->pad_queries_block_size = atoi($2);
free($2);
}
;
server_ipsecmod_enabled: VAR_IPSECMOD_ENABLED STRING_ARG
{
#ifdef USE_IPSECMOD
util/configyyrename.h
+6
View File
@@ -84,5 +84,11 @@
#define yyget_leng ub_c_get_leng
#define yylineno ub_c_lineno
#define yyget_text ub_c_get_text
#define yyss ub_c_ss
#define yysslim ub_c_sslim
#define yyssp ub_c_ssp
#define yystacksize ub_c_stacksize
#define yyvs ub_c_vs
#define yyvsp ub_c_vsp
#endif /* UTIL_CONFIGYYRENAME_H */
util/data/msgencode.c
+50 -13
View File
@@ -454,6 +454,7 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
size_t i, j, owner_pos;
int r, owner_labs;
uint16_t owner_ptr = 0;
time_t adjust = 0;
struct packed_rrset_data* data = (struct packed_rrset_data*)
key->entry.data;
@@ -464,9 +465,12 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
owner_labs = dname_count_labels(key->rk.dname);
owner_pos = sldns_buffer_position(pkt);
/* For an rrset with a fixed TTL, use the rrset's TTL as given */
/** Determine relative time adjustment for TTL values.
* For an rrset with a fixed TTL, use the rrset's TTL as given. */
if((key->rk.flags & PACKED_RRSET_FIXEDTTL) != 0)
timenow = 0;
adjust = 0;
else
adjust = SERVE_ORIGINAL_TTL ? data->ttl_add : timenow;
if(do_data) {
const sldns_rr_descriptor* c = type_rdata_compressable(key);
@@ -479,11 +483,10 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
return r;
sldns_buffer_write(pkt, &key->rk.type, 2);
sldns_buffer_write(pkt, &key->rk.rrset_class, 2);
if(data->rr_ttl[j] < timenow)
if(data->rr_ttl[j] < adjust)
sldns_buffer_write_u32(pkt,
SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0);
else sldns_buffer_write_u32(pkt,
data->rr_ttl[j]-timenow);
else sldns_buffer_write_u32(pkt, data->rr_ttl[j]-adjust);
if(c) {
if((r=compress_rdata(pkt, data->rr_data[j],
data->rr_len[j], region, tree, c))
@@ -517,11 +520,10 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
}
sldns_buffer_write_u16(pkt, LDNS_RR_TYPE_RRSIG);
sldns_buffer_write(pkt, &key->rk.rrset_class, 2);
if(data->rr_ttl[i] < timenow)
if(data->rr_ttl[i] < adjust)
sldns_buffer_write_u32(pkt,
SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0);
else sldns_buffer_write_u32(pkt,
data->rr_ttl[i]-timenow);
else sldns_buffer_write_u32(pkt, data->rr_ttl[i]-adjust);
/* rrsig rdata cannot be compressed, perform 100+ byte
* memcopy. */
sldns_buffer_write(pkt, data->rr_data[i],
@@ -801,14 +803,14 @@ calc_edns_field_size(struct edns_data* edns)
return 1 + 2 + 2 + 4 + 2 + rdatalen;
}
void
attach_edns_record(sldns_buffer* pkt, struct edns_data* edns)
static void
attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns,
uint16_t max_msg_sz)
{
size_t len;
size_t rdatapos;
struct edns_option* opt;
if(!edns || !edns->edns_present)
return;
struct edns_option* padding_option = NULL;
/* inc additional count */
sldns_buffer_write_u16_at(pkt, 10,
sldns_buffer_read_u16_at(pkt, 10) + 1);
@@ -826,17 +828,52 @@ attach_edns_record(sldns_buffer* pkt, struct edns_data* edns)
sldns_buffer_write_u16(pkt, 0); /* rdatalen */
/* write rdata */
for(opt=edns->opt_list; opt; opt=opt->next) {
if (opt->opt_code == LDNS_EDNS_PADDING) {
padding_option = opt;
continue;
}
sldns_buffer_write_u16(pkt, opt->opt_code);
sldns_buffer_write_u16(pkt, opt->opt_len);
if(opt->opt_len != 0)
sldns_buffer_write(pkt, opt->opt_data, opt->opt_len);
}
if (padding_option && edns->padding_block_size ) {
size_t pad_pos = sldns_buffer_position(pkt);
size_t msg_sz = ((pad_pos + 3) / edns->padding_block_size + 1)
* edns->padding_block_size;
size_t pad_sz;
if (msg_sz > max_msg_sz)
msg_sz = max_msg_sz;
/* By use of calc_edns_field_size, calling functions should
* have made sure that there is enough space for at least a
* zero sized padding option.
*/
log_assert(pad_pos + 4 <= msg_sz);
pad_sz = msg_sz - pad_pos - 4;
sldns_buffer_write_u16(pkt, LDNS_EDNS_PADDING);
sldns_buffer_write_u16(pkt, pad_sz);
if (pad_sz) {
memset(sldns_buffer_current(pkt), 0, pad_sz);
sldns_buffer_skip(pkt, pad_sz);
}
}
if(edns->opt_list)
sldns_buffer_write_u16_at(pkt, rdatapos,
sldns_buffer_position(pkt)-rdatapos-2);
sldns_buffer_flip(pkt);
}
void
attach_edns_record(sldns_buffer* pkt, struct edns_data* edns)
{
if(!edns || !edns->edns_present)
return;
attach_edns_record_max_msg_sz(pkt, edns, edns->udp_size);
}
int
reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
uint16_t id, uint16_t qflags, sldns_buffer* pkt, time_t timenow,
@@ -885,7 +922,7 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
}
if(attach_edns && sldns_buffer_capacity(pkt) >=
sldns_buffer_limit(pkt)+attach_edns)
attach_edns_record(pkt, edns);
attach_edns_record_max_msg_sz(pkt, edns, udpsize+attach_edns);
return 1;
}
util/data/msgparse.c
+2
View File
@@ -1020,6 +1020,7 @@ parse_extract_edns(struct msg_parse* msg, struct edns_data* edns,
edns->bits = sldns_read_uint16(&found->rr_last->ttl_data[2]);
edns->udp_size = ntohs(found->rrset_class);
edns->opt_list = NULL;
edns->padding_block_size = 0;
/* take the options */
rdata_len = found->rr_first->size-2;
@@ -1093,6 +1094,7 @@ parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns,
edns->edns_version = sldns_buffer_read_u8(pkt);
edns->bits = sldns_buffer_read_u16(pkt);
edns->opt_list = NULL;
edns->padding_block_size = 0;
/* take the options */
rdata_len = sldns_buffer_read_u16(pkt);
util/data/msgparse.h
+4
View File
@@ -87,6 +87,8 @@ extern time_t SERVE_EXPIRED_TTL;
extern time_t SERVE_EXPIRED_REPLY_TTL;
/** Negative cache time (for entries without any RRs.) */
#define NORR_TTL 5 /* seconds */
/** If we serve the original TTL or decrementing TTLs */
extern int SERVE_ORIGINAL_TTL;
/**
* Data stored in scratch pad memory during parsing.
@@ -225,6 +227,8 @@ struct edns_data {
uint16_t udp_size;
/** rdata element list, or NULL if none */
struct edns_option* opt_list;
/** block size to pad */
uint16_t padding_block_size;
};
/**
util/data/msgreply.c
+7 -4
View File
@@ -67,6 +67,8 @@ int SERVE_EXPIRED = 0;
time_t SERVE_EXPIRED_TTL = 0;
/** TTL to use for expired records */
time_t SERVE_EXPIRED_REPLY_TTL = 30;
/** If we serve the original TTL or decrementing TTLs */
int SERVE_ORIGINAL_TTL = 0;
/** allocate qinfo, return 0 on error */
static int
@@ -197,9 +199,9 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
if(*rr_ttl > MAX_NEG_TTL)
*rr_ttl = MAX_NEG_TTL;
}
if(*rr_ttl < MIN_TTL)
if(!SERVE_ORIGINAL_TTL && (*rr_ttl < MIN_TTL))
*rr_ttl = MIN_TTL;
if(*rr_ttl > MAX_TTL)
if(!SERVE_ORIGINAL_TTL && (*rr_ttl > MAX_TTL))
*rr_ttl = MAX_TTL;
if(*rr_ttl < data->ttl)
data->ttl = *rr_ttl;
@@ -321,8 +323,8 @@ parse_create_rrset(sldns_buffer* pkt, struct rrset_parse* pset,
(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)) +
pset->size;
if(region)
*data = regional_alloc(region, s);
else *data = malloc(s);
*data = regional_alloc_zero(region, s);
else *data = calloc(1, s);
if(!*data)
return 0;
/* copy & decompress */
@@ -526,6 +528,7 @@ reply_info_set_ttls(struct reply_info* rep, time_t timenow)
for(j=0; j<data->count + data->rrsig_count; j++) {
data->rr_ttl[j] += timenow;
}
data->ttl_add = timenow;
}
}
util/data/packed_rrset.c
+12 -5
View File
@@ -220,6 +220,7 @@ packed_rrset_ttl_add(struct packed_rrset_data* data, time_t add)
{
size_t i;
size_t total = data->count + data->rrsig_count;
data->ttl_add = add;
data->ttl += add;
for(i=0; i<total; i++)
data->rr_ttl[i] += add;
@@ -275,6 +276,7 @@ int packed_rr_to_string(struct ub_packed_rrset_key* rrset, size_t i,
entry.data;
uint8_t rr[65535];
size_t rlen = rrset->rk.dname_len + 2 + 2 + 4 + d->rr_len[i];
time_t adjust = 0;
log_assert(dest_len > 0 && dest);
if(rlen > dest_len) {
dest[0] = 0;
@@ -285,8 +287,10 @@ int packed_rr_to_string(struct ub_packed_rrset_key* rrset, size_t i,
memmove(rr+rrset->rk.dname_len, &rrset->rk.type, 2);
else sldns_write_uint16(rr+rrset->rk.dname_len, LDNS_RR_TYPE_RRSIG);
memmove(rr+rrset->rk.dname_len+2, &rrset->rk.rrset_class, 2);
adjust = SERVE_ORIGINAL_TTL ? d->ttl_add : now;
if (d->rr_ttl[i] < adjust) adjust = d->rr_ttl[i]; /* Prevent negative TTL overflow */
sldns_write_uint32(rr+rrset->rk.dname_len+4,
(uint32_t)(d->rr_ttl[i]-now));
(uint32_t)(d->rr_ttl[i]-adjust));
memmove(rr+rrset->rk.dname_len+8, d->rr_data[i], d->rr_len[i]);
if(sldns_wire2str_rr_buf(rr, rlen, dest, dest_len) == -1) {
log_info("rrbuf failure %d %s", (int)d->rr_len[i], dest);
@@ -332,6 +336,7 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
struct packed_rrset_data* data = (struct packed_rrset_data*)
key->entry.data;
size_t dsize, i;
time_t adjust = 0;
if(!ck)
return NULL;
ck->id = key->id;
@@ -350,14 +355,16 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
ck->entry.data = d;
packed_rrset_ptr_fixup(d);
/* make TTLs relative - once per rrset */
adjust = SERVE_ORIGINAL_TTL ? data->ttl_add : now;
for(i=0; i<d->count + d->rrsig_count; i++) {
if(d->rr_ttl[i] < now)
if(d->rr_ttl[i] < adjust)
d->rr_ttl[i] = SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0;
else d->rr_ttl[i] -= now;
else d->rr_ttl[i] -= adjust;
}
if(d->ttl < now)
if(d->ttl < adjust)
d->ttl = SERVE_EXPIRED?SERVE_EXPIRED_REPLY_TTL:0;
else d->ttl -= now;
else d->ttl -= adjust;
d->ttl_add = 0; /* TTLs have been made relative */
return ck;
}
util/data/packed_rrset.h
+3
View File
@@ -233,6 +233,9 @@ enum sec_status {
* the ttl value to send changes due to time.
*/
struct packed_rrset_data {
/** Timestamp added to TTLs in the packed data.
* Needed to support serving original TTLs. */
time_t ttl_add;
/** TTL (in seconds like time()) of the rrset.
* Same for all RRs see rfc2181(5.2). */
time_t ttl;
util/edns.c
+11
View File
@@ -165,5 +165,16 @@ int apply_edns_options(struct edns_data* edns_out, struct edns_data* edns_in,
LDNS_EDNS_NSID, cfg->nsid_len, cfg->nsid, region))
return 0;
if(!cfg->pad_responses || c->type != comm_tcp || !c->ssl
|| !edns_opt_list_find(edns_in->opt_list, LDNS_EDNS_PADDING)) {
; /* pass */
}
else if(!edns_opt_list_append(&edns_out->opt_list, LDNS_EDNS_PADDING
, 0, NULL, region))
return 0;
else
edns_out->padding_block_size = cfg->pad_responses_block_size;
return 1;
}
util/net_help.c
+1 -1
View File
@@ -321,7 +321,7 @@ static int ipdnametoaddr(uint8_t* dname, size_t dnamelen,
struct sockaddr_storage* addr, socklen_t* addrlen, int* af)
{
uint8_t* ia;
size_t dnamelabs = dname_count_labels(dname);
int dnamelabs = dname_count_labels(dname);
uint8_t lablen;
char* e = NULL;
int z = 0;
validator/autotrust.c
+1
View File
@@ -2365,6 +2365,7 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp)
edns.edns_version = 0;
edns.bits = EDNS_DO;
edns.opt_list = NULL;
edns.padding_block_size = 0;
if(sldns_buffer_capacity(buf) < 65535)
edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
else edns.udp_size = 65535;