In LibreSSL 3.5, DSA and RSA internals will become opaque, so they can
no longer be accessed directly and the libunbound build will break. The
required API, DSA_set0_pqg(), DSA_set0_key() as well as RSA_set0_key(),
has been available since LibreSSL 2.7, so this change should not affect
any users.
From Theo Buehler.
For example, this makes
forward-zone:
name: "."
forward-addr: fe80::20d:b9ff:fe46:c7f4%vio0
forward-first: yes
work instead of fe80::20d:b9ff:fe46:c7f4%1.
The original algorithm assumed that any prefix length would be valid
and did not skip over bits 64 to 71 and set them to zero.
This means that only dns64 prefixes with length 32 and 96 generated
embedded addresses according to RFC6052, cf. Figure 1 in 2.2.
On some operating systems, for example OpenBSD since some decades, the
kernel binds to a random source port if asked for any port (port
number 0). There is no need to replicate this functionality in
userland.
With this the neg and key caches can be shared between multiple
libunbound contexts.
The msg and rrset caches already allowed this since context_finalize()
did not touch those if they are already available and have the correct
size.
Care must be taken to properly unhook the caches from the validator
environment before calling ub_ctx_delete() otherwise one risks double
free or use after free bugs.
