Expose symbols

Makefile.in

@@ -128,7 +128,7 @@ util/config_file.c util/configlexer.c util/configparser.c \
 util/shm_side/shm_main.c services/authzone.c \
 util/fptr_wlist.c util/locks.c util/log.c util/mini_event.c util/module.c \
 util/netevent.c util/net_help.c util/random.c util/rbtree.c util/regional.c \
-util/rtt.c util/siphash.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
+util/rtt.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
 util/storage/lruhash.c util/storage/slabhash.c util/tcp_conn_limit.c \
 util/timehist.c util/tube.c util/proxy_protocol.c \
 util/ub_event.c util/ub_event_pluggable.c util/winsock_event.c \
@@ -145,7 +145,7 @@ as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
 iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
 iter_scrub.lo iter_utils.lo localzone.lo mesh.lo modstack.lo view.lo \
 outbound_list.lo alloc.lo config_file.lo configlexer.lo configparser.lo \
-fptr_wlist.lo siphash.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \
+fptr_wlist.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \
 random.lo rbtree.lo regional.lo rtt.lo dnstree.lo lookup3.lo lruhash.lo \
 slabhash.lo tcp_conn_limit.lo timehist.lo tube.lo winsock_event.lo \
 autotrust.lo val_anchor.lo rpz.lo proxy_protocol.lo \
@@ -915,8 +915,7 @@ config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/ut
 configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \
  $(srcdir)/util/config_file.h util/configparser.h
 configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
- $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/str2wire.h \
- $(srcdir)/sldns/rrdef.h
+ $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h
 shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/util/shm_side/shm_main.h \
  $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
  $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
@@ -1007,7 +1006,6 @@ rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h $(srcdir)/itera
  $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \
  $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h
-siphash.lo siphash.o: $(srcdir)/util/siphash.c
 edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h \
  $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/regional.h \

daemon/acl_list.c

@@ -109,8 +109,6 @@ parse_acl_access(const char* str, enum acl_access* control)
 		*control = acl_allow_snoop;
 	else if(strcmp(str, "allow_setrd") == 0)
 		*control = acl_allow_setrd;
-	else if (strcmp(str, "allow_cookie") == 0)
-		*control = acl_allow_cookie;
 	else {
 		log_err("access control type %s unknown", str);
 		return 0;

daemon/acl_list.h

@@ -65,9 +65,7 @@ enum acl_access {
 	/** allow full access for all queries, recursion and cache snooping */
 	acl_allow_snoop,
 	/** allow full access for recursion queries and set RD flag regardless of request */
-	acl_allow_setrd,
-	/** allow full access if valid cookie present or stateful transport */
-	acl_allow_cookie
+	acl_allow_setrd
 };
 
 /**

daemon/worker.c

@@ -1455,16 +1455,16 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		}
 		goto send_reply;
 	}
-	if((ret=parse_edns_from_query_pkt(
-			c->buffer, &edns, worker->env.cfg, c, repinfo,
-			(worker->env.now ? *worker->env.now : time(NULL)),
-			worker->scratchpad)) != 0) {
+	if((ret=parse_edns_from_query_pkt(c->buffer, &edns, worker->env.cfg, c,
+					worker->scratchpad)) != 0) {
 		struct edns_data reply_edns;
 		verbose(VERB_ALGO, "worker parse edns: formerror.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
 		memset(&reply_edns, 0, sizeof(reply_edns));
 		reply_edns.edns_present = 1;
+		reply_edns.udp_size = EDNS_ADVERTISED_SIZE;
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), ret);
 		error_encode(c->buffer, ret, &qinfo,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &reply_edns);
@@ -1473,15 +1473,23 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 	if(edns.edns_present) {
 		if(edns.edns_version != 0) {
+			edns.ext_rcode = (uint8_t)(EDNS_RCODE_BADVERS>>4);
+			edns.edns_version = EDNS_ADVERTISED_VERSION;
+			edns.udp_size = EDNS_ADVERTISED_SIZE;
+			edns.bits &= EDNS_DO;
 			edns.opt_list_in = NULL;
 			edns.opt_list_out = NULL;
 			edns.opt_list_inplace_cb_out = NULL;
+			edns.padding_block_size = 0;
 			verbose(VERB_ALGO, "query with bad edns version.");
-			log_addr( VERB_CLIENT, "from",&repinfo->remote_addr
-			                             , repinfo->remote_addrlen);
-			extended_error_encode(c->buffer, EDNS_RCODE_BADVERS, &qinfo,
+			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
+				repinfo->client_addrlen);
+			error_encode(c->buffer, EDNS_RCODE_BADVERS&0xf, &qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
-				sldns_buffer_read_u16_at(c->buffer, 2), 0, &edns);
+				sldns_buffer_read_u16_at(c->buffer, 2), NULL);
+			if(sldns_buffer_capacity(c->buffer) >=
+			   sldns_buffer_limit(c->buffer)+calc_edns_field_size(&edns))
+				attach_edns_record(c->buffer, &edns);
 			regional_free_all(worker->scratchpad);
 			goto send_reply;
 		}
@@ -1494,44 +1502,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			edns.udp_size = NORMAL_UDP_SIZE;
 		}
 	}
-	/* "if, else if" sequence below deals with downstream DNS Cookies */
-	if (acl != acl_allow_cookie)
-		; /* pass; No cookie downstream processing whatsoever */
-
-	else if (edns.cookie_valid)
-		; /* pass; Valid cookie is good! */
-
-	else if (c->type != comm_udp)
-		; /* pass; Stateful transport */
-
-	else if (edns.cookie_present) {
-		/* Cookie present, but not valid: Cookie was bad! */
-		extended_error_encode(c->buffer,
-			LDNS_EXT_RCODE_BADCOOKIE, &qinfo,
-			*(uint16_t*)(void *)
-			sldns_buffer_begin(c->buffer),
-			sldns_buffer_read_u16_at(c->buffer, 2),
-			0, &edns);
-		regional_free_all(worker->scratchpad);
-		goto send_reply;
-	} else {
-		/* Cookie requered, but no cookie present on UDP */
-		verbose(VERB_ALGO, "worker request: "
-			"need cookie or stateful transport");
-		log_addr(VERB_ALGO, "from",&repinfo->remote_addr
-		                          , repinfo->remote_addrlen);
-		EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
-			worker->scratchpad, LDNS_EDE_OTHER,
-			"DNS Cookie needed for UDP replies");
-		error_encode(c->buffer,
-			(LDNS_RCODE_REFUSED|BIT_TC), &qinfo,
-			*(uint16_t*)(void *)
-			sldns_buffer_begin(c->buffer),
-			sldns_buffer_read_u16_at(c->buffer, 2),
-			&edns);
-		regional_free_all(worker->scratchpad);
-		goto send_reply;
-	}
 	if(edns.udp_size > worker->daemon->cfg->max_udp_size &&
 		c->type == comm_udp) {
 		verbose(VERB_QUERY,

doc/unbound.conf.5.in

@@ -507,15 +507,6 @@ Enable udp upstream even if do-udp is no.  Default is no, and this does not
 change anything.  Useful for TLS service providers, that want no udp downstream
 but use udp to fetch data upstream.
 .TP
-.B upstream-cookies: \fI<yes or no>
-Enable EDNS cookies from upstream connections. DNS Cookies, as specified in 
-RFC 7873 and 9018 provide a limited-protection transaction security mechanism.
-Once a cookie has been exchanged, the resolver and upstream are known to each
-other and requests to the upstream can be exempted from rate limiting, for
-example. Note that RFC9018 specifies that cookies should not be reused for
-multiple outgoing interfaces, which is not supported at this time. The default
-is no.
-.TP
 .B tls\-upstream: \fI<yes or no>
 Enabled or disable whether the upstream queries use TLS only for transport.
 Default is no.  Useful in tunneling scenarios.  The TLS contains plain DNS in
@@ -693,9 +684,9 @@ This option is experimental at this time.
 .B access\-control: \fI<IP netblock> <action>
 The netblock is given as an IP4 or IP6 address with /size appended for a
 classless network block. The action can be \fIdeny\fR, \fIrefuse\fR,
-\fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIallow_cookie\fR,
-\fIdeny_non_local\fR or \fIrefuse_non_local\fR.
-The most specific netblock match is used, if none match \fIdeny\fR is used.
+\fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or
+\fIrefuse_non_local\fR.
+The most specific netblock match is used, if none match \fIrefuse\fR is used.
 The order of the access\-control statements therefore does not matter.
 .IP
 The action \fIdeny\fR stops queries from hosts from that netblock.
@@ -730,14 +721,6 @@ the cache contents (for malicious acts).  However, nonrecursive queries can
 also be a valuable debugging tool (when you want to examine the cache
 contents). In that case use \fIallow_snoop\fR for your administration host.
 .IP
-When the \fBanswer\-cookie\fR option is enabled, the \fIallow_cookie\fR action
-will allow access to UDP queries that contain a valid Server Cookie as
-specified in RFC 7873 and RFC9018. UDP queries containing only a Client Cookie
-and no Server Cookie, will receive a BADCOOKIE response including a Server
-Cookie, allow clients to retry with that Server Cookie. The \fIallow_cookie\fR
-will also accept requests over statefull transports, regardless of the precence
-of a Cookie and regardless the \fBanswer\-cookie\fR setting.
-.IP
 By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd.
 The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS
 protocol is not designed to handle dropped packets due to policy, and
@@ -1852,15 +1835,6 @@ Set the number of servers that should be used for fast server selection. Only
 use the fastest specified number of servers with the fast\-server\-permil
 option, that turns this on or off. The default is to use the fastest 3 servers.
 .TP 5
-.B answer\-cookie: \fI<yes or no>
-Enable to answer to requests containig DNS Cookies as specified in RFC7873 and
-RFC9018. Default is no.
-.TP 5
-.B cookie\-secret: \fI<128 bit hex string>
-Server's in an Anycast deployment need to be able to verify each other's
-Server Cookies. For this they need to share the secret used to construct
-and verify the Server Cookies.
-Default is a 128 bits random secret generated at startup time.
 .B edns\-client\-string: \fI<IP netblock> <string>
 Include an EDNS0 option containing configured ascii string in queries with
 destination address matching the configured IP netblock.  This configuration

iterator/iterator.c

@@ -68,7 +68,6 @@
 #include "sldns/str2wire.h"
 #include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
-#include "daemon/worker.h"
 
 /* in msec */
 int UNKNOWN_SERVER_NICENESS = 376;
@@ -3945,79 +3944,6 @@ process_request(struct module_qstate* qstate, struct iter_qstate* iq,
 	iter_handle(qstate, iq, ie, id);
 }
 
-
-
-/** find the bound addr in the list of interfaces */
-static int
-get_bound_ip_if(struct outside_network* outnet,
-	struct sockaddr_storage *bound_addr, socklen_t bound_addrlen,
-	struct port_if* pif_return)
-{
-	int i = 0;
-	struct port_if* pif_list;
-	int pif_list_len;
-
-	/* Get the list of interfaces and check that that list isn't just the
-	 * "any" address  */
-	if(addr_is_ip6(bound_addr, bound_addrlen)) {
-		pif_list = outnet->ip6_ifs;
-		pif_list_len = outnet->num_ip6;
-
-		// @TODO fix IPv6
-	} else {
-		pif_list = outnet->ip4_ifs;
-		pif_list_len = outnet->num_ip4;
-		struct sockaddr_storage addr_any;
-		socklen_t addr_any_len = 0;
-
-		struct sockaddr_storage addr_new;
-		socklen_t addr_new_len = 0;
-
-		if (!ipstrtoaddr("0.0.0.0", 0, &addr_any, &addr_any_len)) {
-			/* this shouldn't fail */
-			return 0;
-		}
-
-		log_addr(VERB_DETAIL, "!!!!! outnet->ip4_ifs->addr", &outnet->ip4_ifs->addr, bound_addrlen);
-		log_addr(VERB_DETAIL, "!!!!! addr_any", &addr_any, addr_any_len);
-
-		/* if we let the kernel decide the IP, fill in
-		 * the previously used */
-		if (pif_list_len == 1 &&
-			sockaddr_cmp_addr(&outnet->ip4_ifs->addr, outnet->ip4_ifs->addrlen,
-				&addr_any, addr_any_len) == 0) {
-
-			/* return the interface from the list, but substitute the
-			 * previously used address */
-			memcpy(pif_return, outnet->ip4_ifs, sizeof(struct port_if));
-			memcpy(&pif_return->addr, &addr_new, addr_new_len);
-			pif_return->addrlen = addr_new_len;
-
-			log_addr(VERB_DETAIL, "!!!!! get_bound_ip_if: addr from"
-				" ip4_ifs == 0.0.0.0, new is:", &pif_return->addr, outnet->ip4_ifs->addrlen);
-
-			return 1;
-		}
-	}
-
-	if (pif_list_len == 0) {
-		return 0;
-	}
-
-	for (i = 0; i < pif_list_len; i++) {
-		struct port_if *iface = &pif_list[i];
-
-		if (iface->addrlen == bound_addrlen &&
-			memcmp(&iface->addr, bound_addr, bound_addrlen)) {
-			memcpy(pif_return, iface, sizeof(struct port_if));
-
-			return 1;
-		}
-	}
-
-	return 0;
-}
-
 /** process authoritative server reply */
 static void
 process_response(struct module_qstate* qstate, struct iter_qstate* iq, 
@@ -4026,34 +3952,11 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 {
 	struct msg_parse* prs;
 	struct edns_data edns;
-	struct edns_option* cookie;
 	sldns_buffer* pkt;
 
 	verbose(VERB_ALGO, "process_response: new external response event");
 	iq->response = NULL;
 	iq->state = QUERY_RESP_STATE;
-
-
-	if (event == module_event_interface_not_available) {
-		log_err("!!!!! process_response:event == module_event_interface_not_available");
-	}
-	if (!qstate->reply) {
-		log_err("!!!!! !qstate->reply");
-	}
-
-	// @TODO set renewed cookie here with infra_set_server_cookie, then bail out
-	if(qstate->env->cfg->upstream_cookies && event == module_event_interface_not_available) {
-		struct edns_cookie cookie;
-		// @TODO make into renew cookie function
-		infra_get_cookie(qstate->env->infra_cache, &qstate->reply->remote_addr,
-		qstate->reply->remote_addrlen, iq->dp->name, iq->dp->namelen,
-			*qstate->env->now, &cookie, 1);
-
-		log_err("!!!!!! interface unavailbale, renewing cookie");
-		
-		goto handle_it;
-	}
-
 	if(event == module_event_noreply || event == module_event_error) {
 		if(event == module_event_noreply && iq->timeout_count >= 3 &&
 			qstate->env->cfg->use_caps_bits_for_id &&
@@ -4074,8 +3977,8 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		goto handle_it;
 	}
-	if( (event != module_event_reply && event != module_event_capsfail
-		&& event != module_event_interface_not_available) || !qstate->reply) {
+	if( (event != module_event_reply && event != module_event_capsfail)
+		|| !qstate->reply) {
 		log_err("Bad event combined with response");
 		outbound_list_remove(&iq->outlist, outbound);
 		errinf(qstate, "module iterator received wrong internal event with a response message");
@@ -4108,61 +4011,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 		goto handle_it;
 	}
 
-	/* handle the upstream response cookie if enabled */
-	if(qstate->env->cfg->upstream_cookies) {
-		if (edns.opt_list_in &&
-			(cookie = edns_list_get_option(edns.opt_list_in,
-				LDNS_EDNS_COOKIE))){
-			struct sockaddr_storage bound_addr;
-			socklen_t bound_addrlen = sizeof(struct sockaddr);
-			struct port_if pif;
-			struct port_if *pif_ptr = &pif;
-
-			/* Get the outgoing interface to store with the cookie */
-			if(event != module_event_interface_not_available &&
-				getsockname(qstate->reply->c->fd,
-				(struct sockaddr *) &bound_addr,
-					&bound_addrlen) != -1) {
-
-				log_addr(VERB_DETAIL, "!!!!! iterator:udp socket:", &bound_addr, bound_addrlen);
-
-				if (!(get_bound_ip_if(qstate->env->worker->back,
-					&bound_addr, bound_addrlen, pif_ptr))) {
-					pif.addrlen = 0;
-				}
-
-				log_addr(VERB_DETAIL, "!!!!! iterator:pif addr:", &pif.addr, pif.addrlen);
-
-			} else {
-				/* Set to zero so the cookie gets renewed */
-				pif.addrlen = 0;
-			}
-
-			/* verify this is a 'complete cookie' (client+server)
-			 * (RFC9018) with the length and store the complete
-			 * cookie in the infra_cache. Do nothing when the cookie
-			 * is already known and update when the server cookie
-			 * changed */
-			if (cookie->opt_len == 24 &&
-				infra_set_server_cookie(qstate->env->infra_cache,
-					&qstate->reply->remote_addr,
-					qstate->reply->remote_addrlen,
-					iq->dp->name, iq->dp->namelen, pif_ptr,
-					cookie) >= 0) {
-				// @TODO do something
-			} else {
-				log_info("upstream response server cookie is not "
-					"added to cache; dropping response");
-				goto handle_it;
-			}
-		} else {
-			//@TODO think about what we do if we did send a cookie
-			// but did not get one back? for now we log_err()
-			log_err("upstream has not responded with a cookie");
-		}
-	}
-
-	/* Copy the edns options we may have gotten from the back end */
+	/* Copy the edns options we may got from the back end */
 	if(edns.opt_list_in) {
 		qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list_in,
 			qstate->region);

libunbound/context.c

@@ -53,6 +53,7 @@
 #include "util/storage/slabhash.h"
 #include "util/edns.h"
 #include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
 
 int 
 context_finalize(struct ub_ctx* ctx)
@@ -144,9 +145,17 @@ find_id(struct ub_ctx* ctx, int* id)
 
 struct ctx_query* 
 context_new(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass, 
-	ub_callback_type cb, ub_event_callback_type cb_event, void* cbarg)
+	ub_callback_type cb, ub_event_callback_type cb_event, void* cbarg,
+	const uint8_t* qbuf, size_t qbuf_len)
 {
 	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
+	char qname_str_buf[1024];
+	char *qname_str = qname_str_buf;
+	size_t qname_str_len = sizeof(qname_str_buf);
+	uint8_t *qname;
+	size_t qname_len;
+	int comprloop;
+
 	if(!q) return NULL;
 	lock_basic_lock(&ctx->cfglock);
 	if(!find_id(ctx, &q->querynum)) {
@@ -165,6 +174,32 @@ context_new(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass,
 		free(q);
 		return NULL;
 	}
+	if(!name && qbuf) {
+		if(qbuf_len < 12) {
+			free(q->res);
+			free(q);
+			return NULL;
+		}
+		qname = (uint8_t* )qbuf + 12;
+		qname_len = qbuf_len - 12;
+		comprloop = 0;
+
+		/* get query name from the input buffer */
+		sldns_wire2str_dname_scan(
+				&qname, &qname_len,
+				&qname_str, &qname_str_len,
+				(uint8_t *)qbuf, qbuf_len,
+				&comprloop);
+		*qname_str = 0;
+		name = qname_str_buf;
+		if (qname_len < 4) {
+			free(q->res);
+			free(q);
+			return NULL;
+		}
+		rrtype = sldns_read_uint16(qname);
+		rrclass = sldns_read_uint16(qname + 2);
+	}
 	q->res->qname = strdup(name);
 	if(!q->res->qname) {
 		free(q->res);

libunbound/context.h

@@ -171,6 +171,11 @@ struct ctx_query {
 	/** store libworker that is handling this query */
 	struct libworker* w;
 
+	/** raw query packet */
+	const uint8_t *qbuf;
+	/** length of raw query packet */
+	size_t qbuf_len;
+
 	/** result structure, also contains original query, type, class.
 	 * malloced ptr ready to hand to the client. */
 	struct ub_result* res;
@@ -224,7 +229,7 @@ void context_query_delete(struct ctx_query* q);
  */
 struct ctx_query* context_new(struct ub_ctx* ctx, const char* name, int rrtype,
         int rrclass,  ub_callback_type cb, ub_event_callback_type cb_event,
-	void* cbarg);
+	void* cbarg, const uint8_t* qbuf, size_t qbuf_len);
 
 /**
  * Get a new alloc. Creates a new one or uses a cached one.

libunbound/libunbound.c

@@ -714,7 +714,8 @@ ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
 	}
 	/* create new ctx_query and attempt to add to the list */
 	lock_basic_unlock(&ctx->cfglock);
-	q = context_new(ctx, name, rrtype, rrclass, NULL, NULL, NULL);
+	q = context_new(ctx, name, rrtype, rrclass,
+			NULL, NULL, NULL, NULL, 0);
 	if(!q)
 		return UB_NOMEM;
 	/* become a resolver thread for a bit */
@@ -771,7 +772,8 @@ ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 	ub_comm_base_now(ctx->event_worker->base);
 
 	/* create new ctx_query and attempt to add to the list */
-	q = context_new(ctx, name, rrtype, rrclass, NULL, callback, mydata);
+	q = context_new(ctx, name, rrtype, rrclass,
+			NULL, callback, mydata, NULL, 0);
 	if(!q)
 		return UB_NOMEM;
 
@@ -816,7 +818,8 @@ ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	}
 
 	/* create new ctx_query and attempt to add to the list */
-	q = context_new(ctx, name, rrtype, rrclass, callback, NULL, mydata);
+	q = context_new(ctx, name, rrtype, rrclass,
+			callback, NULL, mydata, NULL, 0);
 	if(!q)
 		return UB_NOMEM;
 
@@ -845,6 +848,116 @@ ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	return UB_NOERROR;
 }
 
+int
+ub_send(struct ub_ctx* ctx, const char* packet, int length,
+        struct ub_result** result)
+{
+	struct ctx_query* q;
+	int r;
+	*result = NULL;
+
+	lock_basic_lock(&ctx->cfglock);
+	if(!ctx->finalized) {
+		r = context_finalize(ctx);
+		if(r) {
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	}
+	/* create new ctx_query and attempt to add to the list */
+	lock_basic_unlock(&ctx->cfglock);
+	q = context_new(ctx, NULL, 0, 0,
+			NULL, NULL, NULL, (const uint8_t *)packet, length);
+	if(!q)
+		return UB_NOMEM;
+	/* become a resolver thread for a bit */
+
+	r = libworker_fg(ctx, q);
+	if(r) {
+		lock_basic_lock(&ctx->cfglock);
+		(void)rbtree_delete(&ctx->queries, q->node.key);
+		context_query_delete(q);
+		lock_basic_unlock(&ctx->cfglock);
+		return r;
+	}
+	q->res->answer_packet = q->msg;
+	q->res->answer_len = (int)q->msg_len;
+	q->msg = NULL;
+	*result = q->res;
+	q->res = NULL;
+
+	lock_basic_lock(&ctx->cfglock);
+	(void)rbtree_delete(&ctx->queries, q->node.key);
+	context_query_delete(q);
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_send_async(struct ub_ctx* ctx, const char* packet, int length,
+		void* mydata, ub_callback_type callback, int* async_id)
+{
+	struct ctx_query* q;
+	uint8_t* msg = NULL;
+	uint32_t len = 0;
+
+	if(async_id)
+		*async_id = 0;
+	lock_basic_lock(&ctx->cfglock);
+	if(!ctx->finalized) {
+		int r = context_finalize(ctx);
+		if(r) {
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	}
+	if(!ctx->created_bg) {
+		int r;
+		ctx->created_bg = 1;
+		lock_basic_unlock(&ctx->cfglock);
+		r = libworker_bg(ctx);
+		if(r) {
+			lock_basic_lock(&ctx->cfglock);
+			ctx->created_bg = 0;
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	} else {
+		lock_basic_unlock(&ctx->cfglock);
+	}
+
+	/* create new ctx_query and attempt to add to the list */
+	q = context_new(ctx, NULL, 0, 0, callback, NULL,
+			mydata, (const uint8_t*)packet, length);
+	if(!q)
+		return UB_NOMEM;
+
+	/* write over pipe to background worker */
+	lock_basic_lock(&ctx->cfglock);
+	msg = context_serialize_new_query(q, &len);
+	if(!msg) {
+		(void)rbtree_delete(&ctx->queries, q->node.key);
+		ctx->num_async--;
+		context_query_delete(q);
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOMEM;
+	}
+	if(async_id)
+		*async_id = q->querynum;
+	lock_basic_unlock(&ctx->cfglock);
+	
+	lock_basic_lock(&ctx->qqpipe_lock);
+	if(!tube_write_msg(ctx->qq_pipe, msg, len, 0)) {
+		lock_basic_unlock(&ctx->qqpipe_lock);
+		free(msg);
+		return UB_PIPE;
+	}
+	lock_basic_unlock(&ctx->qqpipe_lock);
+	free(msg);
+	return UB_NOERROR;
+}
+
+
 int 
 ub_cancel(struct ub_ctx* ctx, int async_id)
 {

libunbound/libworker.c

@@ -596,6 +596,8 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	if(!qinfo->qname) {
 		return 0;
 	}
+	qinfo->qbuf = q->qbuf;
+	qinfo->qbuf_len = q->qbuf_len;
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
@@ -604,8 +606,6 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	edns->opt_list_out = NULL;
 	edns->opt_list_inplace_cb_out = NULL;
 	edns->padding_block_size = 0;
-	edns->cookie_present = 0;
-	edns->cookie_valid = 0;
 	if(sldns_buffer_capacity(w->back->udp_buff) < 65535)
 		edns->udp_size = (uint16_t)sldns_buffer_capacity(
 			w->back->udp_buff);

libunbound/ubsyms.def

@@ -31,6 +31,8 @@ ub_resolve
 ub_resolve_async
 ub_resolve_event
 ub_resolve_free
+ub_send
+ub_send_async
 ub_strerror
 ub_version
 ub_wait

libunbound/unbound.h

@@ -568,6 +568,50 @@ int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
 int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, 
 	int rrclass, void* mydata, ub_callback_type callback, int* async_id);
 
+/**
+* Transmit a wire-encoded query packet directly to a nameserver.
+* @param ctx: context.
+* 	The context is finalized, and can no longer accept config changes.
+* @param packet: wire-encoded query packet.
+* @param length: length of encoded query packet.
+* @param result: the reply packet, together with its validation status,
+* 	is returned in a newly allocated result structure.
+* 	May be NULL on return, in which case an error code is returned.
+* @return 0 if OK, else error.
+*/
+int ub_send(struct ub_ctx* ctx, const char* packet, int length,
+	struct ub_result** result);
+
+/**
+* Transmit a wire-encoded query packet directly to a nameserver.
+* Asynchronous, after a while, the callback will be called with your
+* data and the result.
+* @param ctx: context.
+* 	If no thread or process has been created yet to perform the
+* 	work in the background, it is created now.
+* 	The context is finalized, and can no longer accept config changes.
+* @param packet: wire-encoded query packet.
+* @param length: length of encoded query packet.
+* @param mydata: this data is your own data (you can pass NULL),
+* 	and is passed on to the callback function.
+* @param callback: this is called on completion of the resolution.
+* 	It is called as:
+* 	void callback(void* mydata, int err, struct ub_result* result)
+* 	with mydata: the same as passed here, you may pass NULL,
+* 	with err: is 0 when a result has been found.
+* 	with result: a newly allocated result structure.
+* 		The result may be NULL, in that case err is set.
+*
+* 	If an error happens during processing, your callback will be called
+* 	with error set to a nonzero value (and result==NULL).
+* @param async_id: if you pass a non-NULL value, an identifier number is
+* 	returned for the query as it is in progress. It can be used to
+* 	cancel the query.
+* @return 0 if OK, else error.
+*/
+int ub_send_async(struct ub_ctx* ctx, const char* packet, int length,
+	void* mydata, ub_callback_type callback, int* async_id);
+
 /**
  * Cancel an async query in progress.
  * Its callback will not be called.

services/authzone.c

@@ -5419,8 +5419,6 @@ xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env)
 	edns.opt_list_out = NULL;
 	edns.opt_list_inplace_cb_out = NULL;
 	edns.padding_block_size = 0;
-	edns.cookie_present = 0;
-	edns.cookie_valid = 0;
 	if(sldns_buffer_capacity(buf) < 65535)
 		edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
 	else	edns.udp_size = 65535;
@@ -6614,8 +6612,6 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
 	edns.opt_list_out = NULL;
 	edns.opt_list_inplace_cb_out = NULL;
 	edns.padding_block_size = 0;
-	edns.cookie_present = 0;
-	edns.cookie_valid = 0;
 	if(sldns_buffer_capacity(buf) < 65535)
 		edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
 	else	edns.udp_size = 65535;

services/cache/infra.c

@@ -230,7 +230,7 @@ setup_domain_limits(struct infra_cache* infra, struct config_file* cfg)
 }
 
 struct infra_cache* 
-infra_create(struct config_file* cfg, struct ub_randstate* rnd)
+infra_create(struct config_file* cfg)
 {
 	struct infra_cache* infra = (struct infra_cache*)calloc(1, 
 		sizeof(struct infra_cache));
@@ -270,11 +270,6 @@ infra_create(struct config_file* cfg, struct ub_randstate* rnd)
 		infra_delete(infra);
 		return NULL;
 	}
-	if (!rnd) {
-		infra_delete(infra);
-		return NULL;
-	}
-	infra->random_state = rnd;
 	return infra;
 }
 
@@ -304,7 +299,7 @@ infra_adjust(struct infra_cache* infra, struct config_file* cfg)
 {
 	size_t maxmem;
 	if(!infra)
-		return infra_create(cfg, ub_initstate(NULL));
+		return infra_create(cfg);
 	infra->host_ttl = cfg->host_ttl;
 	infra->infra_keep_probing = cfg->infra_keep_probing;
 	infra_dp_ratelimit = cfg->ratelimit;
@@ -320,7 +315,7 @@ infra_adjust(struct infra_cache* infra, struct config_file* cfg)
 	   !slabhash_is_size(infra->client_ip_rates, cfg->ip_ratelimit_size,
 	   	cfg->ip_ratelimit_slabs)) {
 		infra_delete(infra);
-		infra = infra_create(cfg, ub_initstate(NULL));
+		infra = infra_create(cfg);
 	} else {
 		/* reapply domain limits */
 		traverse_postorder(&infra->domain_limits, domain_limit_free,
@@ -383,36 +378,17 @@ infra_lookup_nottl(struct infra_cache* infra, struct sockaddr_storage* addr,
 	return slabhash_lookup(infra->hosts, k.entry.hash, &k, wr);
 }
 
-/* helper function to fill in random data into the client cookie*/
-void infra_fill_client_cookie_random(struct infra_cache* infra,
-	uint8_t* data) {
-	int i;
-
-	for (i = 0; i < 8; i++) {
-		data[i] = ub_random_max(infra->random_state, 256);
-	}
-}
-
 /** init the data elements */
 static void
 data_entry_init(struct infra_cache* infra, struct lruhash_entry* e, 
 	time_t timenow)
 {
-	struct infra_data* data;
-	uint8_t client_cookie_data[8] = {0,0,0,0,0,0,0,0};
-
-	infra_fill_client_cookie_random(infra, client_cookie_data);
-
-	data = (struct infra_data*)e->data;
+	struct infra_data* data = (struct infra_data*)e->data;
 	data->ttl = timenow + infra->host_ttl;
 	rtt_init(&data->rtt);
 	data->edns_version = 0;
 	data->edns_lame_known = 0;
 	data->probedelay = 0;
-	/* set EDNS cookie to zero, as this also sets the starting state*/
-	memset(&data->cookie, 0, sizeof(struct edns_cookie));
-	data->cookie.pif.out = NULL;
-	memcpy(data->cookie.data.cookie, client_cookie_data, 8);
 	data->isdnsseclame = 0;
 	data->rec_lame = 0;
 	data->lame_type_A = 0;
@@ -483,11 +459,7 @@ infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 		if(e) {
 			/* if its still there we have a writelock, init */
 			/* re-initialise */
-
-			// @TODO check if "do not touch lameness" is still true
-			/* do not touch lameness, it may be valid still.
-			 * Also don't touch the cookie, as the cookie logic
-			 * will be handled by the server. */
+			/* do not touch lameness, it may be valid still */
 			data_entry_init(infra, e, timenow);
 			wr = 1;
 			/* TOP_TIMEOUT remains on reuse */
@@ -713,170 +685,6 @@ infra_edns_update(struct infra_cache* infra, struct sockaddr_storage* addr,
 	return 1;
 }
 
-int
-infra_get_cookie(struct infra_cache* infra, struct sockaddr_storage* addr,
-	socklen_t addrlen, uint8_t* name, size_t namelen,
-	time_t timenow, struct edns_cookie* cookie, int renew)
-{
-	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
-		name, namelen, 1);
-	struct infra_data* data;
-	int needtoinsert = 0;
-
-	if(!e) {
-		if(!(e = new_entry(infra, addr, addrlen, name, namelen, timenow))) {
-			return 0;
-		}
-		needtoinsert = 1;
-	} else if(((struct infra_data*)e->data)->ttl < timenow) {
-		/* EDNS cookies have their own timeout logic controlled by the
-		 * upstream, so we just copy the cookie from the old cache entry */
-		struct edns_cookie c = ((struct infra_data*)e->data)->cookie;
-
-		/* create new cookie if the cache TTL expired, keep the cookie */
-		data_entry_init(infra, e, timenow);
-		((struct infra_data*)e->data)->cookie = c;
-	}
-
-	data = (struct infra_data*) e->data;
-
-	/* renew cookie if the address that is stored isn't available */
-	if (renew == 1 || (data->cookie.pif.addrlen == 0 &&
-		data->cookie.state == SERVER_COOKIE_LEARNED)) {
-		infra_fill_client_cookie_random(infra, (uint8_t*) &data->cookie.data);
-		data->cookie.state = SERVER_COOKIE_UNKNOWN;
-	}
-
-	memcpy(cookie, &data->cookie, sizeof(struct edns_cookie));
-
-	if(needtoinsert) {
-		slabhash_insert(infra->hosts, e->hash, e, e->data, NULL);
-	} else {
-		lock_rw_unlock(&e->lock);
-	}
-
-	return 1;
-}
-
-int 
-infra_set_server_cookie(struct infra_cache* infra, struct sockaddr_storage* addr,
-        socklen_t addrlen, uint8_t* name, size_t namelen, struct port_if *pif,
-        struct edns_option* cookie)
-{
-	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
-		name, namelen, 1);
-	struct infra_data* data;
-
-	/* cookie length verification should be checked and handled by caller */
-	assert(cookie->opt_len == 24);
-
-	/* the client cookie was set on the outgoing upstream, so the entry
-	 * should exists here. This can be false if the cookie has fallen
-	 * out of cache */
-	if (!(e)) {
-		/* No need to insert a new cookie/entry here, this will be
-		 * done with an outgoing request */
-		return 0;
-	}
-
-	data = (struct infra_data*) e->data;
-
-	if (data->cookie.state == COOKIE_NOT_SUPPORTED) {
-		/* we known this upstream doesn't support cookies; the state
-		 * remains unchanged */
-		lock_rw_unlock(&e->lock);
-		return 1;
-	} else if (data->cookie.state == SERVER_COOKIE_LEARNED) {
-		/* wrong client cookie; don't store the server cookie */
-		if (!(memcmp(data->cookie.data.cookie,
-			cookie->opt_data+4, 8))) {
-			/* the state of the cookie remains unchanged as we will
-			 * drop this upstream response */
-
-			verbose(VERB_ALGO, "wrong client cookie from upstream"
-				" with previously seen cookie");
-			lock_rw_unlock(&e->lock);
-			return -1;
-		}
-
-		/* We set the local pif addrlen to 0 if the interface is not found
-		 * so it must be unequal to the stored addrlen */
-		if (data->cookie.pif.addrlen != pif->addrlen &&
-			pif->addrlen == 0){
-			/* don't change the status, but change to cookie length
-			 * so it gets renewed during the lookup (which is 
-			 * where all the cookie creation happens) */
-			data->cookie.pif.addrlen = 0;
-			lock_rw_unlock(&e->lock);
-			log_info("the interface to the upstream response server "
-				"that was bound to this EDNS cookie has changed;"
-				" renewing cookie");
-			return 0;
-		}
-
-		/* the server cookie has changed, but the client cookie has not
-		 * so we update the server cookie */
-		if (memcmp(data->cookie.data.cookie+8,
-				cookie->opt_data+12, 16) != 0) {
-			memcpy(data->cookie.data.cookie, cookie->opt_data, 24);
-			/* the cookie state remains unchanged*/
-
-			verbose(VERB_ALGO, "update new server cookie from upstream");
-			lock_rw_unlock(&e->lock);
-
-			/* log_hex() uses the verbosity levels of verbose() */
-			log_hex("complete cookie: ", cookie->opt_data,
-				cookie->opt_len);
-
-			return 1;
-		}
-
-		/* both the complete cookies are identical, so the state
-		 * remains unchanged */
-		verbose(VERB_ALGO, "correctly received indentical cookie from"
-			" upstream; don't update");
-
-		lock_rw_unlock(&e->lock);
-
-		/* log_hex() uses the verbosity levels of verbose() */
-				log_hex("complete cookie: ", cookie->opt_data,
-					cookie->opt_len);
-
-		return 1;
-	} else { /* cookie state == SERVER_COOKIE_UNKNOWN */
-
-		/* wrong client cookie; don't store the server cookie */
-		if (!(memcmp(data->cookie.data.cookie,
-			cookie->opt_data+4, 8))) {
-			/* the state of the cookie remains unchanged as we will
-			 * drop this upstream response */
-
-			verbose(VERB_ALGO, "wrong client cookie from upstream");
-			lock_rw_unlock(&e->lock);
-			return -1;
-		}
-
-		/* store the server cookie */
-		memcpy(data->cookie.data.cookie, cookie->opt_data, 24);
-		data->cookie.state = SERVER_COOKIE_LEARNED;
-
-		/* store the inbound interface we receive this cookie on */
-		if (pif->addrlen > 0) {
-			memcpy(&data->cookie.pif,
-				pif, sizeof(struct port_if));
-			data->cookie.pif.addrlen = pif->addrlen;
-		}
-		verbose(VERB_QUERY, "storing received server cookie from upstream");
-		lock_rw_unlock(&e->lock);
-
-		/* log_hex() uses the verbosity levels of verbose() */
-		log_hex("complete cookie: ", cookie->opt_data,
-			cookie->opt_len);
-		return 1;
-	}
-
-}
-
 int
 infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,

services/cache/infra.h

@@ -49,51 +49,9 @@
 #include "util/rtt.h"
 #include "util/netevent.h"
 #include "util/data/msgreply.h"
-#include "services/outside_network.h"
 struct slabhash;
 struct config_file;
 
-/* COOKIE @TODO move this to correct spot */
-
-/**
- * The actual EDNS cookie data. Note that the cookie can be filled with the 
- * just 'client' section, or with the 'complete' cookie depending on the state
- * governed by the edns_cookie_state.
- * The commented struct provides insight on how the bytes in the struct are
- * structured.
- */
-struct edns_cookie_data {
-        uint8_t cookie[24];
-        /* struct {
-                uint8_t client[8];
-                uint8_t version;
-                uint8_t reserved[3];
-                uint32_t timestamp;
-                uint8_t hash[8];
-        } components; */
-};
-
-/**
- * The different states the EDNS cookie can be in
- */
-enum edns_cookie_state
-{
-        SERVER_COOKIE_UNKNOWN = 0, /* server cookie unknown, client cookie known */
-        SERVER_COOKIE_LEARNED = 1, /* server (and client) cookie known */
-        COOKIE_NOT_SUPPORTED = 2, /* upstream does not supported EDNS/cookies */
-};
-
-/**
- * Structure for an EDNS cookie (RFC9018), it's internal state, and the
- * the outgoing address that we bind this cookie to for privacy (RFC9018)
- */
-struct edns_cookie {
-        enum edns_cookie_state state;
-        struct edns_cookie_data data;
-        struct port_if pif;
-};
-
-
 /**
  * Host information kept for every server, per zone.
  */
@@ -130,9 +88,6 @@ struct infra_data {
 	 * and cause a timeout */
 	uint8_t edns_lame_known;
 
-        /* The EDNS cookie containing the cookie and the internal state */
-        struct edns_cookie cookie;
-
 	/** is the host lame (does not serve the zone authoritatively),
 	 * or is the host dnssec lame (does not serve DNSSEC data) */
 	uint8_t isdnsseclame;
@@ -167,8 +122,6 @@ struct infra_cache {
 	rbtree_type domain_limits;
 	/** hash table with query rates per client ip: ip_rate_key, ip_rate_data */
 	struct slabhash* client_ip_rates;
-        /** random state used in new entries for creating EDNS cookies (RFC9018) */
-        struct ub_randstate* random_state;
 };
 
 /** ratelimit, unless overridden by domain_limits, 0 is off */
@@ -243,7 +196,7 @@ struct rate_data {
  * @param cfg: config parameters or NULL for defaults.
  * @return: new infra cache, or NULL.
  */
-struct infra_cache* infra_create(struct config_file* cfg, struct ub_randstate* rnd);
+struct infra_cache* infra_create(struct config_file* cfg);
 
 /**
  * Delete infra cache.
@@ -365,44 +318,6 @@ int infra_edns_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
 	uint8_t* name, size_t namelen, int edns_version, time_t timenow);
 
-/**
- * Find and return the cookie from the infra cache data. Creates an entry in
- * the cache if there isn't one.
- * @param infra: infrastructure cache.
- * @param addr: host address.
- * @param addrlen: length of addr.
- * @param name: name of zone
- * @param namelen: length of name
- * @param timenow: what time it is now.
- * @param pif: the interface which contains the outgoing address that we bind to
- * @param cookie: the cookie that is retrieved from cache on success.
- * @return: 0 on error, cookie pointer remains unchanged then.
- */
-int infra_get_cookie(struct infra_cache* infra, struct sockaddr_storage* addr,
-        socklen_t addrlen, uint8_t* name, size_t namelen,
-        time_t timenow, struct edns_cookie* cookie, int renew); //@TODO fix/remove renew?
-
-/**
- * Find the cookie entry in the cache and update it with to make a 'complete cookie'
- * (client+server) (RFC9018). This function asserts that the cookie param contains
- * a complete cookie with a length of 24 bytes. If the cache entry isn't found
- * a new one will be inserted.
- * @param infra: infrastructure cache.
- * @param addr: host address.
- * @param addrlen: length of addr.
- * @param name: name of zone
- * @param namelen: length of name
- * @param timenow: what time it is now.
- * @param pif: the interface which contains the outgoing address that we bind to
- * @param cookie: the EDNS cookie option we want to store.
- * @return -1 if the wrong client cookie is found, 0 if the entry isn't found in
- *      the cache and a new one is inserted, 1 if the complete cookie is inserted
- *      or unchanged.
- */
-int infra_set_server_cookie(struct infra_cache* infra, struct sockaddr_storage* addr,
-        socklen_t addrlen, uint8_t* name, size_t namelen, struct port_if *pif,
-        struct edns_option* cookie);
-
 /**
  * Get Lameness information and average RTT if host is in the cache.
  * This information is to be used for server selection.

services/listen_dnsport.c

@@ -639,7 +639,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			&& !(errno == EADDRNOTAVAIL && verbosity < 4 && !listen)
 #endif
 			) {
-			log_err_addr("1can't bind socket", strerror(errno),
+			log_err_addr("can't bind socket", strerror(errno),
 				(struct sockaddr_storage*)addr, addrlen);
 		}
 #endif /* EADDRINUSE */
@@ -647,7 +647,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		if(WSAGetLastError() != WSAEADDRINUSE &&
 			WSAGetLastError() != WSAEADDRNOTAVAIL &&
 			!(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) {
-			log_err_addr("2can't bind socket", 
+			log_err_addr("can't bind socket", 
 				wsa_strerror(WSAGetLastError()),
 				(struct sockaddr_storage*)addr, addrlen);
 		}
@@ -840,12 +840,12 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 		if(addr->ai_family==AF_INET6 && errno==EINVAL)
 			*noproto = 1;
 		else {
-			log_err_addr("3can't bind socket", strerror(errno),
+			log_err_addr("can't bind socket", strerror(errno),
 				(struct sockaddr_storage*)addr->ai_addr,
 				addr->ai_addrlen);
 		}
 #else
-		log_err_addr("4can't bind socket", 
+		log_err_addr("can't bind socket", 
 			wsa_strerror(WSAGetLastError()),
 			(struct sockaddr_storage*)addr->ai_addr,
 			addr->ai_addrlen);

services/mesh.c

@@ -886,8 +886,6 @@ void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
 		event = module_event_noreply;
 		if(what == NETEVENT_CAPSFAIL)
 			event = module_event_capsfail;
-		if(what == NETEVENT_BOUND_INTERFACE_NOT_AVAILABLE)
-			event = module_event_interface_not_available;
 	}
 	mesh_run(mesh, e->qstate->mesh_info, event, e);
 }

services/outside_network.c

@@ -1073,8 +1073,7 @@ reuse_tcp_remove_tree_list(struct outside_network* outnet,
 			char buf[256];
 			addr_to_str(&reuse->addr, reuse->addrlen, buf,
 				sizeof(buf));
-			log_err("reuse tcp delete: node not present, internal error, %s ssl "
-				"%d lru %d", buf, reuse->is_ssl, reuse->item_on_lru_list);
+			log_err("reuse tcp delete: node not present, internal error, %s ssl %d lru %d", buf, reuse->is_ssl, reuse->item_on_lru_list);
 		}
 		reuse->node.key = NULL;
 		/* defend against loops on broken tree by zeroing the
@@ -1419,7 +1418,6 @@ outnet_send_wait_udp(struct outside_network* outnet)
 		pend->pkt_len = 0;
 		log_assert(!pend->sq->busy);
 		pend->sq->busy = 1;
-
 		if(!randomize_and_send_udp(pend, outnet->udp_buff,
 			pend->timeout)) {
 			/* callback error on pending */
@@ -1444,11 +1442,6 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	struct pending* p;
 	verbose(VERB_ALGO, "answer cb");
 
-
-	log_err("!!!!! outnet_udp_cb: HERE, error: %d", error);
-
-	// @TODO this is the function where we find the failed kernel call
-
 	if(error != NETEVENT_NOERROR) {
 		verbose(VERB_QUERY, "outnetudp got udp error %d", error);
 		return 0;
@@ -1490,7 +1483,6 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 
 	verbose(VERB_ALGO, "received udp reply.");
 	log_buf(VERB_ALGO, "udp message", c->buffer);
-
 	if(p->pc->cp != c) {
 		verbose(VERB_QUERY, "received reply id,addr on wrong port. "
 			"dropped.");
@@ -1981,9 +1973,6 @@ udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int pfxlen,
 	int port, int* inuse, struct ub_randstate* rnd, int dscp)
 {
 	int fd, noproto;
-
-	log_err("!!!!! udp_sockport: HERE!");
-
 	if(addr_is_ip6(addr, addrlen)) {
 		int freebind = 0;
 		struct sockaddr_in6 sa = *(struct sockaddr_in6*)addr;
@@ -2064,6 +2053,7 @@ static int udp_connect_needs_log(int err)
 	return 1;
 }
 
+
 /** Select random interface and port */
 static int
 select_ifport(struct outside_network* outnet, struct pending* pend,
@@ -2077,21 +2067,11 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 			"outgoing interfaces of that family");
 		return 0;
 	}
-
 	log_assert(outnet->unused_fds);
 	tries = 0;
 	while(1) {
-		/* if we have a bound IP address for the EDNS cookie in the
-		 * message, use that interface */
-		if (!(pend->sq->bound_interface)) {
-			my_if = ub_random_max(outnet->rnd, num_if);
-			pif = &ifs[my_if];
-		} else {
-			pif = pend->sq->bound_interface;
-			log_err("!!!!! select_ifport:bound_addrlen: %d", pif->addrlen);
-			log_addr(VERB_OPS, "!!!!! select_ifport:bound_addrlen:", &pif->addr, pif->addrlen);
-		}
-
+		my_if = ub_random_max(outnet->rnd, num_if);
+		pif = &ifs[my_if];
 #ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
 		if(outnet->udp_connect) {
 			/* if we connect() we cannot reuse fds for a port */
@@ -2114,9 +2094,6 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 				break;
 			}
 		}
-
-		log_err("!!!!! select_ifport:pif->inuse: %d, pif->maxout: %d", pif->inuse, pif->maxout);
-
 		/* try to open new port, if fails, loop to try again */
 		log_assert(pif->inuse < pif->maxout);
 		portno = pif->avail_ports[my_port - pif->inuse];
@@ -2126,15 +2103,6 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 		fd = udp_sockport(&pif->addr, pif->addrlen, pif->pfxlen,
 			portno, &inuse, outnet->rnd, outnet->ip_dscp);
 		if(fd == -1 && !inuse) {
-			log_err("!!!! select_ifport:nonrecoverable error making socket");
-
-			/* we need to retry sending this message with a cookie
-			 * without a bound interface. The cookie needs to be
-			 * changed as to not leak the client cookie part that
-			 * is linked to this outgoing interface. */
-			if (pend->sq->bound_interface != NULL) {
-				pend->sq->bound_interface_failed = 1;
-			}
 			/* nonrecoverable error making socket */
 			return 0;
 		}
@@ -2261,7 +2229,6 @@ pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet,
 	pend->cb = cb;
 	pend->cb_arg = cb_arg;
 	pend->node.key = pend;
-
 	pend->timer = comm_timer_create(sq->outnet->base, pending_udp_timer_cb,
 		pend);
 	if(!pend->timer) {
@@ -2598,7 +2565,6 @@ serviced_timer_cb(void* arg)
 	 * will get attached by the time we get an answer. */
 	return;
 delete:
-	log_err("!!!!! serviced_timer_cb:delete serviced_udp_send");
 	serviced_callbacks(sq, NETEVENT_CLOSED, NULL, NULL);
 }
 
@@ -2608,8 +2574,9 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	int want_dnssec, int nocaps, int tcp_upstream, int ssl_upstream,
 	char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
 	uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list,
+	const uint8_t* raw_qbuf, size_t raw_qbuf_len,
 	size_t pad_queries_block_size, struct alloc_cache* alloc,
-	struct port_if* bound_interface, struct regional* region)
+	struct regional* region)
 {
 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
 	struct timeval t;
@@ -2631,6 +2598,8 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 		return NULL;
 	}
 	sq->qbuflen = sldns_buffer_limit(buff);
+	sq->raw_qbuf = raw_qbuf;
+	sq->raw_qbuf_len = raw_qbuf_len;
 	sq->zone = regional_alloc_init(region, zone, zonelen);
 	if(!sq->zone) {
 		alloc_reg_release(alloc, region);
@@ -2672,18 +2641,6 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	sq->status = serviced_initial;
 	sq->retry = 0;
 	sq->to_be_deleted = 0;
-	if (bound_interface != NULL) {
-		sq->bound_interface = regional_alloc_init(region,
-			bound_interface, sizeof(struct port_if));
-		if (!sq->bound_interface) {
-			alloc_reg_release(alloc, region);
-			free(sq);
-			return NULL;
-		}
-	} else {
-		sq->bound_interface = NULL;
-	}
-	sq->bound_interface_failed = 0;
 	sq->padding_block_size = pad_queries_block_size;
 #ifdef UNBOUND_DEBUG
 	ins =
@@ -2846,6 +2803,13 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
 	if(sq->outnet->use_caps_for_id && !sq->nocaps) {
 		serviced_perturb_qname(sq->outnet->rnd, sq->qbuf, sq->qbuflen);
 	}
+	if (sq->raw_qbuf) {
+		/* use the raw packet from libunbound's ub_send */
+		sldns_buffer_clear(buff);
+		sldns_buffer_write(buff, sq->raw_qbuf, sq->raw_qbuf_len);
+		sldns_buffer_flip(buff);
+		return;
+	}
 	/* generate query */
 	sldns_buffer_clear(buff);
 	sldns_buffer_write_u16(buff, 0); /* id placeholder */
@@ -3050,12 +3014,6 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 		}
 		sq->outnet->svcd_overhead = backlen;
 	}
-
-	/* set the error to retry the cookie with a new client cookie set */
-	if (sq->bound_interface != NULL && sq->bound_interface_failed) {
-		error = NETEVENT_BOUND_INTERFACE_NOT_AVAILABLE;
-	}
-
 	/* test the actual sq->cblist, because the next elem could be deleted*/
 	while((p=sq->cblist) != NULL) {
 		sq->cblist = p->next; /* remove this element */
@@ -3422,11 +3380,9 @@ outnet_serviced_query(struct outside_network* outnet,
 	struct service_callback* cb;
 	struct edns_string_addr* client_string_addr;
 	struct regional* region;
-	struct edns_cookie cookie;
 	struct edns_option* backed_up_opt_list = qstate->edns_opts_back_out;
 	struct edns_option* per_upstream_opt_list = NULL;
 	time_t timenow = 0;
-	struct port_if* pif = NULL;
 
 	/* If we have an already populated EDNS option list make a copy since
 	 * we may now add upstream specific EDNS options. */
@@ -3463,28 +3419,6 @@ outnet_serviced_query(struct outside_network* outnet,
 			client_string_addr->string, region);
 	}
 
-	if (env->cfg->upstream_cookies &&
-		infra_get_cookie(env->infra_cache, addr, addrlen, zone, zonelen,
-			*env->now, &cookie, 0)) {
-
-		if (cookie.state == SERVER_COOKIE_LEARNED) {
-			/* We known the complete cookie, so we attach it */
-			edns_opt_list_append(&per_upstream_opt_list, LDNS_EDNS_COOKIE,
-				24, cookie.data.cookie, region);
-
-			if (cookie.pif.addrlen > 0) {
-				pif = &cookie.pif;
-
-				log_addr(VERB_DETAIL, "!!!!! outnet_serviced_query:pif addr:", &cookie.pif.addr, cookie.pif.addrlen);
-			}
-		} else if (cookie.state == SERVER_COOKIE_UNKNOWN) {
-			/* We know just client cookie, so we attach it */
-			edns_opt_list_append(&per_upstream_opt_list, LDNS_EDNS_COOKIE,
-				8, cookie.data.cookie, region);
-		} /* We ignore COOKIE_NOT_SUPPORTED */
-
-	}
-
 	serviced_gen_query(buff, qinfo->qname, qinfo->qname_len, qinfo->qtype,
 		qinfo->qclass, flags);
 	sq = lookup_serviced(outnet, buff, dnssec, addr, addrlen,
@@ -3515,9 +3449,10 @@ outnet_serviced_query(struct outside_network* outnet,
 			tcp_upstream, ssl_upstream, tls_auth_name, addr,
 			addrlen, zone, zonelen, (int)qinfo->qtype,
 			per_upstream_opt_list,
+			qinfo->qbuf, qinfo->qbuf_len,
 			( ssl_upstream && env->cfg->pad_queries
 			? env->cfg->pad_queries_block_size : 0 ),
-			env->alloc, pif, region);
+			env->alloc, region);
 		if(!sq) {
 			if(check_ratelimit) {
 				infra_ratelimit_dec(env->infra_cache,
@@ -3607,8 +3542,7 @@ fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
 			if(outnet->num_ip6 == 0) {
 				char to[64];
 				addr_to_str(to_addr, to_addrlen, to, sizeof(to));
-				verbose(VERB_QUERY, "need ipv6 to send, but no ipv6 outgoing "
-					"interfaces, for %s", to);
+				verbose(VERB_QUERY, "need ipv6 to send, but no ipv6 outgoing interfaces, for %s", to);
 				return -1;
 			}
 			i = ub_random_max(outnet->rnd, outnet->num_ip6);
@@ -3617,8 +3551,7 @@ fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
 			if(outnet->num_ip4 == 0) {
 				char to[64];
 				addr_to_str(to_addr, to_addrlen, to, sizeof(to));
-				verbose(VERB_QUERY, "need ipv4 to send, but no ipv4 outgoing "
-					"interfaces, for %s", to);
+				verbose(VERB_QUERY, "need ipv4 to send, but no ipv4 outgoing interfaces, for %s", to);
 				return -1;
 			}
 			i = ub_random_max(outnet->rnd, outnet->num_ip4);

services/outside_network.h

@@ -456,6 +456,10 @@ struct serviced_query {
 	uint8_t* qbuf;
 	/** length of qbuf. */
 	size_t qbuflen;
+	/** raw_qbuf for sending precreated packets */
+	const uint8_t *raw_qbuf;
+	/** Precreated packet length */
+	size_t raw_qbuf_len;
 	/** If an EDNS section is included, the DO/CD bit will be turned on. */
 	int dnssec;
 	/** We want signatures, or else the answer is likely useless */
@@ -527,13 +531,6 @@ struct serviced_query {
 	struct comm_timer* timer;
 	/** true if serviced_query is currently doing net I/O and may block */
 	int busy;
-	/** interface bound to the EDNS cookie @TODO fix this */
-	struct port_if* bound_interface;
-	/** flag to create a retry when the opening of the socket on the
-	 * bound interface failed. This enables rewriting of the cookie without 
-	 * leaking the previously sent client cookie */
-	int bound_interface_failed;
-
 };
 
 /**

sldns/rrdef.h

@@ -433,7 +433,6 @@ enum sldns_enum_edns_option
 	LDNS_EDNS_DHU = 6, /* RFC6975 */
 	LDNS_EDNS_N3U = 7, /* RFC6975 */
 	LDNS_EDNS_CLIENT_SUBNET = 8, /* RFC7871 */
-	LDNS_EDNS_COOKIE = 10, /* RFC7873 */
 	LDNS_EDNS_KEEPALIVE = 11, /* draft-ietf-dnsop-edns-tcp-keepalive*/
 	LDNS_EDNS_PADDING = 12, /* RFC7830 */
 	LDNS_EDNS_EDE = 15, /* RFC8914 */
@@ -483,9 +482,6 @@ typedef enum sldns_enum_ede_code sldns_ede_code;
 #define LDNS_TSIG_ERROR_BADNAME  20
 #define LDNS_TSIG_ERROR_BADALG   21
 
-/** DNS Cookie extended rcode */
-#define LDNS_EXT_RCODE_BADCOOKIE 23
-
 /**
  * Contains all information about resource record types.
  *

sldns/wire2str.c

@@ -192,7 +192,6 @@ static sldns_lookup_table sldns_edns_options_data[] = {
 	{ 6, "DHU" },
 	{ 7, "N3U" },
 	{ 8, "edns-client-subnet" },
-	{ 10, "Cookie" },
 	{ 11, "edns-tcp-keepalive"},
 	{ 12, "Padding" },
 	{ 15, "EDE"},

testcode/fake_event.c

@@ -1228,9 +1228,6 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 		struct edns_option* backed_up_opt_list =
 			qstate->edns_opts_back_out;
 		struct edns_option* per_upstream_opt_list = NULL;
-		struct edns_cookie cookie;
-		struct port_if* pif;
-
 		/* If we have an already populated EDNS option list make a copy
 		 * since we may now add upstream specific EDNS options. */
 		if(qstate->edns_opts_back_out) {
@@ -1259,25 +1256,6 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 				client_string_addr->string_len,
 				client_string_addr->string, qstate->region);
 		}
-
-		if (qstate->env->cfg->upstream_cookies &&
-			infra_get_cookie(env->infra_cache, addr, addrlen,
-				zone, zonelen, *env->now, outnet, &pif, &cookie)) {
-
-			if (cookie.state == SERVER_COOKIE_LEARNED) {
-				/* We known the complete cookie, so we attach it */
-				edns_opt_list_append(&per_upstream_opt_list,
-					LDNS_EDNS_COOKIE, 24, cookie.data.cookie,
-					qstate->region);
-			} else if (cookie.state == SERVER_COOKIE_UNKNOWN) {
-				/* We know just client cookie, so we attach it */
-				edns_opt_list_append(&per_upstream_opt_list,
-					LDNS_EDNS_COOKIE, 8,
-					cookie.data.cookie,
-					qstate->region);
-			} /* We ignore COOKIE_NOT_SUPPORTED */
-		}
-
 		/* add edns */
 		edns.edns_present = 1;
 		edns.ext_rcode = 0;
@@ -1287,8 +1265,6 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 		if(dnssec)
 			edns.bits = EDNS_DO;
 		edns.padding_block_size = 0;
-		edns.cookie_present = 0;
-		edns.cookie_valid = 0;
 		edns.opt_list_in = NULL;
 		edns.opt_list_out = per_upstream_opt_list;
 		edns.opt_list_inplace_cb_out = NULL;

testcode/testpkts.c

@@ -25,7 +25,6 @@ struct sockaddr_storage;
 #include <errno.h>
 #include <stdarg.h>
 #include <ctype.h>
-#include <time.h>
 #include "testcode/testpkts.h"
 #include "util/net_help.h"
 #include "sldns/sbuffer.h"
@@ -40,8 +39,6 @@ struct sockaddr_storage;
 #define MAX_LINE   10240	
 /** string to show in warnings and errors */
 static const char* prog_name = "testpkts";
-/** hardcoded EDNS server cookie (RFC7876) */
-static const char* hardcoded_server_cookie = "7e8b5fcc6a4bc7bc";
 
 #ifndef UTIL_LOG_H
 /** verbosity definition for compat */
@@ -143,13 +140,6 @@ static void matchline(char* line, struct entry* e)
 			e->match_noedns = 1;
 		} else if(str_keyword(&parse, "ednsdata")) {
 			e->match_ednsdata_raw = 1;
-		} else if(str_keyword(&parse, "random_client_cookie")) {
-			e->match_random_client_cookie = 1;
-		} else if (str_keyword(&parse, "random_complete_cookie_renewed")) {
-			e->match_random_complete_cookie = 1;
-			e->match_random_complete_cookie_renewed = 1;
-		} else if(str_keyword(&parse, "random_complete_cookie")) {
-			e->match_random_complete_cookie = 1;
 		} else if(str_keyword(&parse, "UDP")) {
 			e->match_transport = transport_udp;
 		} else if(str_keyword(&parse, "TCP")) {
@@ -273,11 +263,6 @@ static void adjustline(char* line, struct entry* e,
 			pkt->packet_sleep = (unsigned int) strtol(parse, (char**)&parse, 10);
 			while(isspace((unsigned char)*parse)) 
 				parse++;
-		} else if (str_keyword(&parse, "server_cookie_renew")) {
-			e->server_cookie = 1;
-			e->server_cookie_renew = 1;
-		} else if (str_keyword(&parse, "server_cookie")) {
-			e->server_cookie = 1;
 		} else {
 			error("could not parse ADJUST: '%s'", parse);
 		}
@@ -314,8 +299,6 @@ static struct entry* new_entry(void)
 	e->copy_ednsdata_assume_clientsubnet = 0;
 	e->increment_ecs_scope = 0;
 	e->sleeptime = 0;
-	e->server_cookie = 0;
-	e->server_cookie_renew = 0;
 	e->next = NULL;
 	return e;
 }
@@ -1516,110 +1499,6 @@ match_ednsdata(uint8_t* q, size_t qlen, uint8_t* p, size_t plen)
 	return (memcmp(walk_p+8, walk_q+8, walk_qlen-8) == 0);
 }
 
-/** verify that a client cookie of length 8 is in the EDNS data of the query */
-static int
-match_random_client_cookie(uint8_t* query, size_t query_len)
-{
-	uint8_t* walk_query = query;
-	size_t walk_query_len = query_len;
-
-	if(!pkt_find_edns_opt(&walk_query, &walk_query_len)) {
-		walk_query_len = 0;
-		log_err("no edns found");
-	}
-
-	/* class + ttl + rdlen = 8 */
-	if (walk_query_len <= 8) {
-		verbose(3, "No correct EDNS record found, so no cookie");
-		return 0;
-	}
-
-	/* class + ttl + rdlen + opt_code + opt_len = 12 */
-	if (walk_query_len < 12) {
-		verbose(3, "No EDNS opt found, so no cookie");
-		return 0;
-	}
-
-	if (sldns_read_uint16(walk_query+8) != 10 /* LDNS_EDNS_COOKIE */) {
-		verbose(3, "EDNS option is not a cookie");
-		return 0;
-	}
-	if (sldns_read_uint16(walk_query+10) != 8) {
-		verbose(3, "EDNS cookie is not 8 bytes, so not a correct client cookie");
-		return 0;
-	}
-
-	return 1;
-}
-
-/** verify that a complete EDNS cookie (client+server) (RFC9018) of length 24
-  * is in the EDNS data of the query and the hardcoded cookie is the same */
-static int
-match_random_complete_cookie(uint8_t* query, size_t query_len, struct entry* p)
-{
-	uint8_t* walk_query = query;
-	size_t walk_query_len = query_len;
-
-	if(!pkt_find_edns_opt(&walk_query, &walk_query_len)) {
-		walk_query_len = 0;
-		log_err("no edns found");
-	}
-
-	/* class + ttl + rdlen = 8 */
-	if(walk_query_len <= 8) {
-		verbose(3, "No correct EDNS record , so no cookie");
-		return 0;
-	}
-
-	walk_query += 8;
-	walk_query_len -= 8;
-
-	/* opt_code + opt_len = 4 */
-	if (walk_query_len < 4) {
-		verbose(3, "No EDNS opt found, so no cookie");
-		return 0;
-	}
-
-	if (sldns_read_uint16(walk_query) != 10 /* LDNS_EDNS_COOKIE */) {
-		verbose(3, "EDNS option is not a cookie");
-		return 0;
-	}
-	if (sldns_read_uint16(walk_query+2) != 24) {
-		verbose(3, "EDNS cookie is not 24 bytes, so not a correct complete cookie");
-		return 0;
-	}
-
-	/* opt_code + opt_len + cookie_data = 28 */
-	if (walk_query_len < 28) {
-		verbose(3, "No complete cookie found in the packet");
-		return 0;
-	}
-
-	if (p->match_random_complete_cookie_renewed) {
-		uint8_t renewed_cookie[16];
-
-		/* shuffle the hardcoded cookie like adjust_packet() does */
-		memcpy(renewed_cookie, hardcoded_server_cookie+8, 8);
-		memcpy(renewed_cookie+8, hardcoded_server_cookie, 8);
-		
-		/* client_cookie = 8 */
-		if (!(memcmp(walk_query+8, renewed_cookie, 16))) {
-			verbose(3, "EDNS server cookie does not match the renewed"
-				"cookie, so not a correct complete cookie");
-		return 0;
-		}
-	}
-
-	/* client_cookie = 8 */
-	if (!(memcmp(walk_query+8, hardcoded_server_cookie, 16))) {
-		verbose(3, "EDNS server cookie does not match the hardcoded cookie, "
-			"so not a correct complete cookie");
-		return 0;
-	}
-
-	return 1;
-}
-
 /* finds entry in list, or returns NULL */
 struct entry* 
 find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
@@ -1715,16 +1594,6 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 			verbose(3, "bad EDNS data match.\n");
 			continue;
 		}
-		if (p->match_random_client_cookie &&
-				!match_random_client_cookie(query_pkt, len)) {
-			verbose(3, "bad client cookie match.\n");
-			continue;
-		}
-		if (p->match_random_complete_cookie &&
-				!match_random_complete_cookie(query_pkt, len, p)) {
-			verbose(3, "bad complete cookie match.\n");
-			continue;
-		}
 		if(p->match_transport != transport_any && p->match_transport != transport) {
 			verbose(3, "bad transport\n");
 			continue;
@@ -1821,118 +1690,6 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 	if(match->copy_id && reslen >= 1 && query_len >= 1)
 		res[0] = query_pkt[0];
 
-	if(match->server_cookie) {
-		/** Find the cookie option and add the server cookie if 
-		 * the client cookie is present and not already there */
-		uint8_t* walk_query = query_pkt;
-		size_t walk_query_len = query_len;
-		uint8_t* walk_response;
-		size_t walk_response_len;
-
-		uint8_t* rdlen_ptr_response;
-
-		/* create space for the server cookie in the response packet */
-		res = realloc(res, reslen + 28);
-		reslen += 28;
-
-		walk_response = res;
-		walk_response_len = reslen;
-
-		if (!(walk_response)) {
-			log_err("testbound: out of memory; send without cookie");
-			return;
-		}
-
-		/* verify that we have a EDNS record */
-		if(!pkt_find_edns_opt(&walk_query, &walk_query_len)) {
-			walk_query_len = 0;
-			log_err("testbound: no EDNS in the query packet when "
-				"trying to attach a EDNS cookie");
-		}
-		if(!pkt_find_edns_opt(&walk_response, &walk_response_len)) {
-			walk_response_len = 0;
-			log_err("testbound: no EDNS in the response packet when"
-				 "trying to attach a EDNS cookie");
-		}
-
-		/* verify that we have a EDNS option */
-		if (walk_query_len < 12) /* class + ttl + rdlen + opt_code + opt_len */ {
-			/* invalid or no (OPT) record in the query */
-			walk_query_len = 0;
-			log_err("testbound: invalid or no OPT record in the query packet");
-		}
-		if (walk_response_len < 8) /* class + ttl + rdlen */ {
-			walk_response_len = 0;
-			log_err("testbound: invalid OPT record in the response packet");
-		}
-
-		/* store the location of the rdlen */
-		rdlen_ptr_response = walk_response + 6;
-
-		/* skip past the OPT record to get to the option */
-		walk_query += 8;
-		walk_query_len -= 8;
-		walk_response += 8;
-		walk_response_len -= 8;
-
-		/* verify that the client cookie exists */
-		if (walk_query_len < 12 /* opt_code + opt_len + client cookie */) {
-			walk_query_len = 0;
-			log_err("testbound: no EDNS cookie in the query packet");
-		}
-
-		/* assume one record in the query */
-		if (sldns_read_uint16(walk_query) != 10 /* LDNS_EDNS_COOKIE */ ||
-			!(sldns_read_uint16(walk_query+2) == 8 || /* client cookie length */
-			sldns_read_uint16(walk_query+2) == 24)) { /* client+server cookie */
-			/* incorrect cookie */
-			walk_query_len = 0;
-			log_err("testbound: invalid EDNS cookie in the query packet");
-		}
-
-		if (walk_query_len > 0 && walk_response_len > 0) {
-			/* create space for the cookie, as the length of the
-			 * rest of the response is 0 */
-
-			/* depending on the incoming cookie, add the server cookie
-			 * or copy the complete cookie to the response */
-			if (sldns_read_uint16(walk_query+2) == 8) {
-				/* copy the EDNS client cookie from the query
-				 * packet to the response */
-				memmove(walk_response, walk_query, 12);
-
-				/* add the server cookie to the client cookie to make it
-				 * 'complete'. we fake the siphash specified in RFC9018
-				 * by hardcoding the server cookie */
-				memmove(walk_response+12, hardcoded_server_cookie, 16);
-
-				/* update the RDLEN and OPTLEN */
-				sldns_write_uint16(rdlen_ptr_response, 28);
-				sldns_write_uint16(walk_response+2, 24);
-			} else if (sldns_read_uint16(walk_query+2) == 24) {
-				/* update the RDLEN */
-				sldns_write_uint16(rdlen_ptr_response, 28);
-
-				/* we fake verification of the cookie and send
-				 * it back like it's still valid. We renew the cookie
-				 * if this desired */
-				if (match->server_cookie_renew) {
-					/* copy the cookie from the response but add a
-					 * different cookie (by reshuffeling server cookie) */
-					memmove(walk_response, walk_query, 12);
-					memmove(walk_response+12, walk_query+12+8, 8);
-					memmove(walk_response+12+8, walk_query+12, 8);
-				} else {
-					memmove(walk_response, walk_query, 28);
-				}
-			} else {
-				log_err("testbound: the incoming EDNS cookie has the wrong length");
-			}
-		} else {
-			log_err("testbound: an error has occured while parsing the EDNS cookie");
-		}
-	}
-
 	if(match->copy_ednsdata_assume_clientsubnet) {
 		/** Assume there is only one EDNS option, which is ECS.
 		 * Copy source mask from query to scope mask in reply. Assume

testcode/testpkts.h

@@ -214,14 +214,6 @@ struct entry {
 	uint8_t match_noedns;
 	/** match edns data field given in hex */
 	uint8_t match_ednsdata_raw;
-	/** match an EDNS cookie (RFC7873) of length 8*/
-	uint8_t match_random_client_cookie;
-	/** match an EDNS cookie (RFC7873) of length 24, we call
-	 * this "complete" (RFC9018) */
-	uint8_t match_random_complete_cookie;
-	/** match an EDNS compelete cookie (RFC7873) of length 24, which cannot be
-	 * the same as the hardcoded client cookie */
-	uint8_t match_random_complete_cookie_renewed;
 	/** match query serial with this value. */
 	uint32_t ixfr_soa_serial;
 	/** match on UDP/TCP */
@@ -245,14 +237,6 @@ struct entry {
 	/** in seconds */
 	unsigned int sleeptime; 
 
-	/** add a server cookie (RFC9018) to the response (provided the query
-	 * contains a client cookie) */
-	uint8_t server_cookie;
-	/** renew the server cookie (RFC9018) to the response (provided the query
-	 * contains a client cookie) by shuffling the bytes in the server cookie
-	 * Note that this also sets "server_cookie" to 1*/
-	uint8_t server_cookie_renew;
-
 	/** some number that names this entry, line number in file or so */
 	int lineno;
 

testcode/unitmain.c

@@ -469,12 +469,11 @@ infra_test(void)
 	struct infra_key* k;
 	struct infra_data* d;
 	int init = 376;
-	struct ub_randstate* rnd = ub_initstate(NULL);
 
 	unit_show_feature("infra cache");
 	unit_assert(ipstrtoaddr("127.0.0.1", 53, &one, &onelen));
 
-	slab = infra_create(cfg, rnd);
+	slab = infra_create(cfg);
 	unit_assert( infra_host(slab, &one, onelen, zone, zonelen, now,
 		&vs, &edns_lame, &to) );
 	unit_assert( vs == 0 && to == init && edns_lame == 0 );
@@ -529,7 +528,6 @@ infra_test(void)
 
 	infra_delete(slab);
 	config_delete(cfg);
-	ub_randfree(rnd);
 }
 
 #include "util/random.h"

testdata/edns_upstream_cookies.rpl

@@ -1,234 +0,0 @@
-; config options
-server:
-	upstream-cookies: yes
-
-stub-zone:
-	name: example.com
-	stub-addr: 1.1.1.1
-
-CONFIG_END
-
-SCENARIO_BEGIN Test edns-upstream-cookies
-; Scenario overview:
-; - Send a client cookie to the upstream and receive one back and store it
-; - Send the client+server (complete) cookie and receive it back.
-; - pass time and send the old complete cookie and receive a new one back
-
-
-; Client query for upstream to Unbound
-STEP 1 QUERY
-ENTRY_BEGIN
-	REPLY RD
-	SECTION QUESTION
-		a.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-; Check that we send a server cookie to the upstream
-STEP 2 CHECK_OUT_QUERY
-ENTRY_BEGIN
-	MATCH qname qtype random_client_cookie
-	SECTION QUESTION
-		a.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-; Reply with a server cookie
-STEP 3 REPLY
-ENTRY_BEGIN
-	REPLY QR NOERROR
-	ADJUST copy_id server_cookie
-	SECTION QUESTION
-		a.example.com. IN A
-	SECTION ANSWER
-		a.example.com. IN A 1.2.3.4
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-
-; Check the answer from Unbound for the client
-STEP 4 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all
-	REPLY QR RA RD NOERROR
-	SECTION QUESTION
-		a.example.com. IN A
-	SECTION ANSWER
-		a.example.com. IN A 1.2.3.4
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-
-; Query a second time to verify that we have the server cookie stored
-
-; Client query for upstream to Unbound
-STEP 11 QUERY
-ENTRY_BEGIN
-	REPLY RD
-	SECTION QUESTION
-		b.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-; Check that we send a server cookie to the upstream
-STEP 12 CHECK_OUT_QUERY
-ENTRY_BEGIN
-	MATCH qname qtype random_complete_cookie
-	SECTION QUESTION
-		b.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-; Reply with a server cookie
-STEP 13 REPLY
-ENTRY_BEGIN
-	REPLY QR NOERROR
-	ADJUST copy_id server_cookie
-	SECTION QUESTION
-		b.example.com. IN A
-	SECTION ANSWER
-		b.example.com. IN A 1.2.3.4
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-
-; Check the answer from Unbound for the client
-STEP 14 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all
-	REPLY QR RA RD NOERROR
-	SECTION QUESTION
-		b.example.com. IN A
-	SECTION ANSWER
-		b.example.com. IN A 1.2.3.4
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-
-; Query a third time while waiting more than hour + 5 minutes, so we should
-; have a new cookie
-
-STEP 20 TIME_PASSES ELAPSE 4000
-
-; Client query for upstream to Unbound
-STEP 21 QUERY
-ENTRY_BEGIN
-	REPLY RD
-	SECTION QUESTION
-		c.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-; Check that we send a server cookie to the upstream
-STEP 22 CHECK_OUT_QUERY
-ENTRY_BEGIN
-	MATCH qname qtype random_complete_cookie
-	SECTION QUESTION
-		c.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-; Reply with an updated server cookie that
-STEP 23 REPLY
-ENTRY_BEGIN
-	REPLY QR NOERROR
-	ADJUST copy_id server_cookie_renew
-	SECTION QUESTION
-		c.example.com. IN A
-	SECTION ANSWER
-		c.example.com. IN A 1.2.3.4
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-
-; Check the answer from Unbound for the client
-STEP 24 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all
-	REPLY QR RA RD NOERROR
-	SECTION QUESTION
-		c.example.com. IN A
-	SECTION ANSWER
-		c.example.com. IN A 1.2.3.4
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-
-; Verify that the cookie was updated since the timestep
-
-; Client query for upstream to Unbound
-STEP 31 QUERY
-ENTRY_BEGIN
-	REPLY RD
-	SECTION QUESTION
-		d.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-; Check that we send a server cookie to the upstream
-STEP 32 CHECK_OUT_QUERY
-ENTRY_BEGIN
-	MATCH qname qtype random_complete_cookie_renewed
-	SECTION QUESTION
-		d.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-; Reply with an updated server cookie that
-STEP 33 REPLY
-ENTRY_BEGIN
-	REPLY QR NOERROR
-	ADJUST copy_id server_cookie_renew
-	SECTION QUESTION
-		d.example.com. IN A
-	SECTION ANSWER
-		d.example.com. IN A 1.2.3.4
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-
-; Check the answer from Unbound for the client
-STEP 34 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all
-	REPLY QR RA RD NOERROR
-	SECTION QUESTION
-		d.example.com. IN A
-	SECTION ANSWER
-		d.example.com. IN A 1.2.3.4
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-	    HEX_EDNSDATA_END
-ENTRY_END
-
-SCENARIO_END

testdata/edns_upstream_cookies.tdir/edns_upstream_cookies.dsc

@@ -1,16 +0,0 @@
-BaseName: edns_upstream_cookies
-Version: 1.0
-Description: Test Upstream cookies with changing interfaces
-CreationDate: Fri Aug 20 15:42:11 UTC 2021
-Maintainer: Tom Carpay
-Category: 
-Component:
-CmdDepends: 
-Depends:
-Help:
-Pre: edns_upstream_cookies.pre
-Post: edns_upstream_cookies.post
-Test: edns_upstream_cookies.test
-AuxFiles: 
-Passed:
-Failure:

testdata/edns_upstream_cookies.tdir/edns_upstream_cookies.post

@@ -1,13 +0,0 @@
-# #-- edns_upstream_cookies.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-# teardown
-. ../common.sh
-kill_pid $UNBOUND_PID
-kill_pid $UNBOUND_PID2
-
-# remove virtual interface
-ip link del veth0 type veth peer name veth1

testdata/edns_upstream_cookies.tdir/edns_upstream_cookies.pre

@@ -1,52 +0,0 @@
-# #-- edns_upstream_cookies.pre --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-. ../common.sh
-get_random_port 2
-UNBOUND_PORT=$RND_PORT
-UNBOUND2_PORT=$(($RND_PORT + 1))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "NSD_PORT=$NSD_PORT" >> .tpkg.var.test
-
-UPSTREAM_IP=10.0.0.1
-UB_IP1=192.128.123.121
-UB_IP2=192.128.123.122
-
-echo "UPSTREAM_IP=$UPSTREAM_IP" >> .tpkg.var.test
-echo "UB_IP1=$UB_IP1" >> .tpkg.var.test
-echo "UB_IP2=$UB_IP2" >> .tpkg.var.test
-
-
-# rewrite config file with created ports
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' < unbound.conf > ub.conf
-sed -e 's/@PORT2\@/'$UNBOUND2_PORT'/' < unbound_auth.conf > temp2.conf
-sed -e 's/@IP2\@/'$UPSTREAM_IP'/' < temp2.conf > ub2.conf
-
-
-# create virtual interfaces
-ip link add veth0 type veth peer name veth1
-ip link add veth0 type veth peer name veth1
-ip link set dev veth0 up
-ip link set dev veth1 up
-
-ip addr add $UPSTREAM_IP dev veth0
-ip addr add $UB_IP1 dev veth1
-
-# start unbound in the background
-PRE="../.."
-$PRE/unbound -d -c ub.conf > unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-
-# start nsd in the background (for downstream cookies)
-$PRE/unbound -d -c ub2.conf > unbound2.log 2>&1 &
-UNBOUND_PID2=$!
-echo "UNBOUND_PID2=$UNBOUND_PID2" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_unbound_up unbound.log
-wait_unbound_up unbound2.log
-

testdata/edns_upstream_cookies.tdir/edns_upstream_cookies.test

@@ -1,102 +0,0 @@
-# #-- edns_upstream_cookies.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-# The problem of this test lies in that we want to look at the connection between
-# the resolver and the upstream. I cannot think of a way for this to be done
-# without either tcpdump or looking at the logs of the upstream.
-
-# Plan of action
-# @TODO Merge upstream cookies into this branch
-
-# Create two IP addresses on 1 interface. Put one of them up and one of them down
-# Start Unbound on this interface
-# Get Unbound to send an upstream query (with a cookie)
-# check the (complete) cookie in the log of the upstream and store the outgoing interface
-# Send another query where we check that it is the same cookie
-# verify that it is the same cookie and verify that the interface is the same
-# @TODO we could do the time skip here as well. see edns_upstream_cookies.rpl
-# take the interface down, send the query again
-# Verify there is a different (client) cookie and that the interface has changed
-# @TODO There could be a logic mishap in the final step as the flow is quite difficult now
-
-
-#NSD_IP=192.128.123.120
-
-# UB_IP3=192.128.123.123
-# UB_IP4=192.128.123.124
-# ip addr add $UB_IP2 dev veth1
-# ip addr add $UB_IP3 dev veth1
-# ip addr add $UB_IP4 dev veth1
-
-# start cookie connection by sending first message
-dig @$UNBOUND -p 9999 example.nl
-
-# check Unbound logs that we got a "complete" (client+server) cookie back
-sed -n "s/^.*complete cookie: \[24:0\] *//p" unbound.log > first_query.txt
-if ! grep -e "complete cookie: [24:0] " grep_test.txt
-then
-	echo "No complete cookie in the response to the first upstream query"
-	exit 1
-fi
-# check on which interface
-IFACE=sed -n -e "s/^.*\!\!\!\!\! iterator:udp socket: *//" -e "s/ port.*//p" unbound.log
-
-# flush unbound log
-echo > unbound.log
-
-
-# bring up second interface so we verify it keep using the first interface
-ip addr add $UB_IP2 dev veth1
-
-
-# send second query with the previous complete cookie attached
-dig @$UNBOUND -p 9999 example.nl
-
-# check logs that we get the same complete cookie back
-sed -n "s/^.*complete cookie: \[24:0\] *//p" unbound.log > second_query.txt
-if ! grep -e "complete cookie: [24:0] " grep_test.txt
-then
-	echo "No complete cookie in the response to the second upstream query"
-	exit 1
-fi
-
-if [ "$(md5sum < first_query.txt)" != "$(md5sum < second_query.txt)" ]; then
-    echo "Cookies from the first and second query do not match"
-    cat first_query.txt
-    cat second_query.txt
-    exit 1
-fi
-# check on which interface, MUST be the same as last time
-if [ "$(sed -n -e "s/^.*\!\!\!\!\! iterator:udp socket: *//" -e "s/ port.*//p" unbound.log) != $IFACE" ]
-
-
-# remove the first interface so the kernel will have to use the second interface
-ip addr del $UB_IP1 dev veth1
-
-# flush unbound log
-echo > unbound.log
-
-
-dig @$UNBOUND -p 9999 example.nl
-
-# check logs that we get the same complete cookie back
-sed -n "s/^.*complete cookie: \[24:0\] *//p" unbound.log > second_query.txt
-if ! grep -e "complete cookie: [24:0] " grep_test.txt
-then
-	echo "No complete cookie in the response to the second upstream query"
-	exit 1
-fi
-
-# !!!!!! interface unavailable, renewing cookie
-
-
-
-
-
-# send query (on different interface) with different (!) client cookie
-
-# verify that we get a different client cookie in the complete cookie response
-# verify that the cookie was indeed sent on a different interface

testdata/edns_upstream_cookies.tdir/example.nl.zone

@@ -1,16 +0,0 @@
-$ORIGIN example.nl.
-$TTL 86400 ; default time-to-live for this zone
-
-example.nl.   IN  SOA     ns.example.nl. noc.dns.icann.org. (
-        2020080302  ;Serial
-        7200        ;Refresh
-        3600        ;Retry
-        1209600     ;Expire
-        3600        ;Negative response caching TTL
-)
-
-; The nameserver that are authoritative for this zone.
-		NS      example.nl.
-
-; these A records below are equivalent
-example.nl.    A       1.2.3.4

testdata/edns_upstream_cookies.tdir/unbound.conf

@@ -1,17 +0,0 @@
-server:
-    verbosity: 2
-    use-syslog: no
-    chroot: ""
-    username: ""
-    directory: ""
-	pidfile: "unbound.pid"
-	interface: 127.0.0.1
-    port: @PORT1@
-
-    val-log-level: 2
-	upstream-cookies: yes
-
-forward-zone:
-	name: "example.nl"
-	forward-addr: 127.0.0.1@9998
-	forward-no-cache: yes

testdata/edns_upstream_cookies.tdir/unbound_auth.conf

@@ -1,16 +0,0 @@
-server:
-    verbosity: 1
-    use-syslog: no
-    chroot: ""
-    username: ""
-    directory: ""
-    pidfile: "unbound2.pid"
-    interface: @UPSTREAM_IP@
-    port: @PORT2@
-
-    answer-cookie: yes
-    cookie-secret: "e5e973e5a6b2a43f48e7dc849e37bfcf"
-
-auth-zone:
-    name: example.nl
-    zonefile: example.nl.zone

util/config_file.c

@@ -55,7 +55,6 @@
 #include "util/regional.h"
 #include "util/fptr_wlist.h"
 #include "util/data/dname.h"
-#include "util/random.h"
 #include "util/rtt.h"
 #include "services/cache/infra.h"
 #include "sldns/wire2str.h"
@@ -88,9 +87,6 @@ struct config_parser_state* cfg_parser = 0;
 /** init ports possible for use */
 static void init_outgoing_availports(int* array, int num);
 
-/** init cookie with random data */
-static void init_cookie_secret(uint8_t* cookie_secret,size_t cookie_secret_len);
-
 struct config_file* 
 config_create(void)
 {
@@ -368,10 +364,6 @@ config_create(void)
 	cfg->ipsecmod_whitelist = NULL;
 	cfg->ipsecmod_strict = 0;
 #endif
-	cfg->do_answer_cookie = 0;
-	memset(cfg->cookie_secret, 0, sizeof(cfg->cookie_secret));
-	cfg->cookie_secret_len = 16;
-	init_cookie_secret(cfg->cookie_secret, cfg->cookie_secret_len);
 #ifdef USE_CACHEDB
 	if(!(cfg->cachedb_backend = strdup("testframe"))) goto error_exit;
 	if(!(cfg->cachedb_secret = strdup("default"))) goto error_exit;
@@ -387,7 +379,6 @@ config_create(void)
 	cfg->ipset_name_v6 = NULL;
 #endif
 	cfg->ede = 0;
-	cfg->upstream_cookies = 0;
 	return cfg;
 error_exit:
 	config_delete(cfg);
@@ -1672,21 +1663,6 @@ config_delete(struct config_file* cfg)
 	free(cfg);
 }
 
-static void
-init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len)
-{
-	struct ub_randstate *rand = ub_initstate(NULL);
-
-	if (!rand)
-		fatal_exit("could not init random generator");
-	while (cookie_secret_len) {
-		*cookie_secret++ = (uint8_t)ub_random(rand);
-		cookie_secret_len--;
-	}
-	ub_randfree(rand);
-}
-
-
 static void 
 init_outgoing_availports(int* a, int num)
 {

util/config_file.h

@@ -690,13 +690,6 @@ struct config_file {
 	int redis_expire_records;
 #endif
 #endif
-	/** Downstream DNS Cookies */
-	/** do answer with server cookie when request contained cookie option */
-	int do_answer_cookie;
-	/** cookie secret */
-	uint8_t cookie_secret[40];
-	/** cookie secret length */
-	size_t  cookie_secret_len;
 
 	/* ipset module */
 #ifdef USE_IPSET
@@ -705,8 +698,6 @@ struct config_file {
 #endif
 	/** respond with Extended DNS Errors (RFC8914) */
 	int ede;
-	/** Send EDNS cookies to the upstream and keep their state(RFC7873-RFC9018) */
-	int upstream_cookies;
 };
 
 /** from cfg username, after daemonize setup performed */

util/configlexer.lex

@@ -558,13 +558,10 @@ name-v4{COLON}			{ YDVAR(1, VAR_IPSET_NAME_V4) }
 name-v6{COLON}			{ YDVAR(1, VAR_IPSET_NAME_V6) }
 udp-upstream-without-downstream{COLON} { YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) }
 tcp-connection-limit{COLON}	{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) }
-answer-cookie{COLON}		{ YDVAR(1, VAR_ANSWER_COOKIE ) }
-cookie-secret{COLON}		{ YDVAR(1, VAR_COOKIE_SECRET) }
 edns-client-string{COLON}	{ YDVAR(2, VAR_EDNS_CLIENT_STRING) }
 edns-client-string-opcode{COLON} { YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) }
 nsid{COLON}			{ YDVAR(1, VAR_NSID ) }
 ede{COLON}			{ YDVAR(1, VAR_EDE ) }
-upstream-cookies{COLON}		{ YDVAR(1, VAR_UPSTREAM_COOKIES ) }
 proxy-protocol-port{COLON}	{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
 <INITIAL,val>{NEWLINE}		{ LEXOUT(("NL\n")); cfg_parser->line++; }
 

util/configparser.h

@@ -1,14 +1,14 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
+/* A Bison parser, made by GNU Bison 3.8.2.  */
 
-/* Skeleton interface for Bison's Yacc-like parsers in C
+/* Bison interface for Yacc-like parsers in C
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
-   Free Software Foundation, Inc.
+   Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2021 Free Software Foundation,
+   Inc.
 
-   This program is free software; you can redistribute it and/or modify
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -16,9 +16,7 @@
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -33,349 +31,368 @@
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
-/* Tokens.  */
+/* DO NOT RELY ON FEATURES THAT ARE NOT DOCUMENTED in the manual,
+   especially those whose name start with YY_ or yy_.  They are
+   private implementation details that can be changed or removed.  */
+
+#ifndef YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
+# define YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
+/* Debug traces.  */
+#ifndef YYDEBUG
+# define YYDEBUG 0
+#endif
+#if YYDEBUG
+extern int yydebug;
+#endif
+
+/* Token kinds.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     SPACE = 258,
-     LETTER = 259,
-     NEWLINE = 260,
-     COMMENT = 261,
-     COLON = 262,
-     ANY = 263,
-     ZONESTR = 264,
-     STRING_ARG = 265,
-     VAR_FORCE_TOPLEVEL = 266,
-     VAR_SERVER = 267,
-     VAR_VERBOSITY = 268,
-     VAR_NUM_THREADS = 269,
-     VAR_PORT = 270,
-     VAR_OUTGOING_RANGE = 271,
-     VAR_INTERFACE = 272,
-     VAR_PREFER_IP4 = 273,
-     VAR_DO_IP4 = 274,
-     VAR_DO_IP6 = 275,
-     VAR_PREFER_IP6 = 276,
-     VAR_DO_UDP = 277,
-     VAR_DO_TCP = 278,
-     VAR_TCP_MSS = 279,
-     VAR_OUTGOING_TCP_MSS = 280,
-     VAR_TCP_IDLE_TIMEOUT = 281,
-     VAR_EDNS_TCP_KEEPALIVE = 282,
-     VAR_EDNS_TCP_KEEPALIVE_TIMEOUT = 283,
-     VAR_CHROOT = 284,
-     VAR_USERNAME = 285,
-     VAR_DIRECTORY = 286,
-     VAR_LOGFILE = 287,
-     VAR_PIDFILE = 288,
-     VAR_MSG_CACHE_SIZE = 289,
-     VAR_MSG_CACHE_SLABS = 290,
-     VAR_NUM_QUERIES_PER_THREAD = 291,
-     VAR_RRSET_CACHE_SIZE = 292,
-     VAR_RRSET_CACHE_SLABS = 293,
-     VAR_OUTGOING_NUM_TCP = 294,
-     VAR_INFRA_HOST_TTL = 295,
-     VAR_INFRA_LAME_TTL = 296,
-     VAR_INFRA_CACHE_SLABS = 297,
-     VAR_INFRA_CACHE_NUMHOSTS = 298,
-     VAR_INFRA_CACHE_LAME_SIZE = 299,
-     VAR_NAME = 300,
-     VAR_STUB_ZONE = 301,
-     VAR_STUB_HOST = 302,
-     VAR_STUB_ADDR = 303,
-     VAR_TARGET_FETCH_POLICY = 304,
-     VAR_HARDEN_SHORT_BUFSIZE = 305,
-     VAR_HARDEN_LARGE_QUERIES = 306,
-     VAR_FORWARD_ZONE = 307,
-     VAR_FORWARD_HOST = 308,
-     VAR_FORWARD_ADDR = 309,
-     VAR_DO_NOT_QUERY_ADDRESS = 310,
-     VAR_HIDE_IDENTITY = 311,
-     VAR_HIDE_VERSION = 312,
-     VAR_IDENTITY = 313,
-     VAR_VERSION = 314,
-     VAR_HARDEN_GLUE = 315,
-     VAR_MODULE_CONF = 316,
-     VAR_TRUST_ANCHOR_FILE = 317,
-     VAR_TRUST_ANCHOR = 318,
-     VAR_VAL_OVERRIDE_DATE = 319,
-     VAR_BOGUS_TTL = 320,
-     VAR_VAL_CLEAN_ADDITIONAL = 321,
-     VAR_VAL_PERMISSIVE_MODE = 322,
-     VAR_INCOMING_NUM_TCP = 323,
-     VAR_MSG_BUFFER_SIZE = 324,
-     VAR_KEY_CACHE_SIZE = 325,
-     VAR_KEY_CACHE_SLABS = 326,
-     VAR_TRUSTED_KEYS_FILE = 327,
-     VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 328,
-     VAR_USE_SYSLOG = 329,
-     VAR_OUTGOING_INTERFACE = 330,
-     VAR_ROOT_HINTS = 331,
-     VAR_DO_NOT_QUERY_LOCALHOST = 332,
-     VAR_CACHE_MAX_TTL = 333,
-     VAR_HARDEN_DNSSEC_STRIPPED = 334,
-     VAR_ACCESS_CONTROL = 335,
-     VAR_LOCAL_ZONE = 336,
-     VAR_LOCAL_DATA = 337,
-     VAR_INTERFACE_AUTOMATIC = 338,
-     VAR_STATISTICS_INTERVAL = 339,
-     VAR_DO_DAEMONIZE = 340,
-     VAR_USE_CAPS_FOR_ID = 341,
-     VAR_STATISTICS_CUMULATIVE = 342,
-     VAR_OUTGOING_PORT_PERMIT = 343,
-     VAR_OUTGOING_PORT_AVOID = 344,
-     VAR_DLV_ANCHOR_FILE = 345,
-     VAR_DLV_ANCHOR = 346,
-     VAR_NEG_CACHE_SIZE = 347,
-     VAR_HARDEN_REFERRAL_PATH = 348,
-     VAR_PRIVATE_ADDRESS = 349,
-     VAR_PRIVATE_DOMAIN = 350,
-     VAR_REMOTE_CONTROL = 351,
-     VAR_CONTROL_ENABLE = 352,
-     VAR_CONTROL_INTERFACE = 353,
-     VAR_CONTROL_PORT = 354,
-     VAR_SERVER_KEY_FILE = 355,
-     VAR_SERVER_CERT_FILE = 356,
-     VAR_CONTROL_KEY_FILE = 357,
-     VAR_CONTROL_CERT_FILE = 358,
-     VAR_CONTROL_USE_CERT = 359,
-     VAR_TCP_REUSE_TIMEOUT = 360,
-     VAR_MAX_REUSE_TCP_QUERIES = 361,
-     VAR_EXTENDED_STATISTICS = 362,
-     VAR_LOCAL_DATA_PTR = 363,
-     VAR_JOSTLE_TIMEOUT = 364,
-     VAR_STUB_PRIME = 365,
-     VAR_UNWANTED_REPLY_THRESHOLD = 366,
-     VAR_LOG_TIME_ASCII = 367,
-     VAR_DOMAIN_INSECURE = 368,
-     VAR_PYTHON = 369,
-     VAR_PYTHON_SCRIPT = 370,
-     VAR_VAL_SIG_SKEW_MIN = 371,
-     VAR_VAL_SIG_SKEW_MAX = 372,
-     VAR_VAL_MAX_RESTART = 373,
-     VAR_CACHE_MIN_TTL = 374,
-     VAR_VAL_LOG_LEVEL = 375,
-     VAR_AUTO_TRUST_ANCHOR_FILE = 376,
-     VAR_KEEP_MISSING = 377,
-     VAR_ADD_HOLDDOWN = 378,
-     VAR_DEL_HOLDDOWN = 379,
-     VAR_SO_RCVBUF = 380,
-     VAR_EDNS_BUFFER_SIZE = 381,
-     VAR_PREFETCH = 382,
-     VAR_PREFETCH_KEY = 383,
-     VAR_SO_SNDBUF = 384,
-     VAR_SO_REUSEPORT = 385,
-     VAR_HARDEN_BELOW_NXDOMAIN = 386,
-     VAR_IGNORE_CD_FLAG = 387,
-     VAR_LOG_QUERIES = 388,
-     VAR_LOG_REPLIES = 389,
-     VAR_LOG_LOCAL_ACTIONS = 390,
-     VAR_TCP_UPSTREAM = 391,
-     VAR_SSL_UPSTREAM = 392,
-     VAR_TCP_AUTH_QUERY_TIMEOUT = 393,
-     VAR_SSL_SERVICE_KEY = 394,
-     VAR_SSL_SERVICE_PEM = 395,
-     VAR_SSL_PORT = 396,
-     VAR_FORWARD_FIRST = 397,
-     VAR_STUB_SSL_UPSTREAM = 398,
-     VAR_FORWARD_SSL_UPSTREAM = 399,
-     VAR_TLS_CERT_BUNDLE = 400,
-     VAR_STUB_TCP_UPSTREAM = 401,
-     VAR_FORWARD_TCP_UPSTREAM = 402,
-     VAR_HTTPS_PORT = 403,
-     VAR_HTTP_ENDPOINT = 404,
-     VAR_HTTP_MAX_STREAMS = 405,
-     VAR_HTTP_QUERY_BUFFER_SIZE = 406,
-     VAR_HTTP_RESPONSE_BUFFER_SIZE = 407,
-     VAR_HTTP_NODELAY = 408,
-     VAR_HTTP_NOTLS_DOWNSTREAM = 409,
-     VAR_STUB_FIRST = 410,
-     VAR_MINIMAL_RESPONSES = 411,
-     VAR_RRSET_ROUNDROBIN = 412,
-     VAR_MAX_UDP_SIZE = 413,
-     VAR_DELAY_CLOSE = 414,
-     VAR_UDP_CONNECT = 415,
-     VAR_UNBLOCK_LAN_ZONES = 416,
-     VAR_INSECURE_LAN_ZONES = 417,
-     VAR_INFRA_CACHE_MIN_RTT = 418,
-     VAR_INFRA_CACHE_MAX_RTT = 419,
-     VAR_INFRA_KEEP_PROBING = 420,
-     VAR_DNS64_PREFIX = 421,
-     VAR_DNS64_SYNTHALL = 422,
-     VAR_DNS64_IGNORE_AAAA = 423,
-     VAR_DNSTAP = 424,
-     VAR_DNSTAP_ENABLE = 425,
-     VAR_DNSTAP_SOCKET_PATH = 426,
-     VAR_DNSTAP_IP = 427,
-     VAR_DNSTAP_TLS = 428,
-     VAR_DNSTAP_TLS_SERVER_NAME = 429,
-     VAR_DNSTAP_TLS_CERT_BUNDLE = 430,
-     VAR_DNSTAP_TLS_CLIENT_KEY_FILE = 431,
-     VAR_DNSTAP_TLS_CLIENT_CERT_FILE = 432,
-     VAR_DNSTAP_SEND_IDENTITY = 433,
-     VAR_DNSTAP_SEND_VERSION = 434,
-     VAR_DNSTAP_BIDIRECTIONAL = 435,
-     VAR_DNSTAP_IDENTITY = 436,
-     VAR_DNSTAP_VERSION = 437,
-     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 438,
-     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 439,
-     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 440,
-     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 441,
-     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 442,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 443,
-     VAR_RESPONSE_IP_TAG = 444,
-     VAR_RESPONSE_IP = 445,
-     VAR_RESPONSE_IP_DATA = 446,
-     VAR_HARDEN_ALGO_DOWNGRADE = 447,
-     VAR_IP_TRANSPARENT = 448,
-     VAR_IP_DSCP = 449,
-     VAR_DISABLE_DNSSEC_LAME_CHECK = 450,
-     VAR_IP_RATELIMIT = 451,
-     VAR_IP_RATELIMIT_SLABS = 452,
-     VAR_IP_RATELIMIT_SIZE = 453,
-     VAR_RATELIMIT = 454,
-     VAR_RATELIMIT_SLABS = 455,
-     VAR_RATELIMIT_SIZE = 456,
-     VAR_OUTBOUND_MSG_RETRY = 457,
-     VAR_RATELIMIT_FOR_DOMAIN = 458,
-     VAR_RATELIMIT_BELOW_DOMAIN = 459,
-     VAR_IP_RATELIMIT_FACTOR = 460,
-     VAR_RATELIMIT_FACTOR = 461,
-     VAR_IP_RATELIMIT_BACKOFF = 462,
-     VAR_RATELIMIT_BACKOFF = 463,
-     VAR_SEND_CLIENT_SUBNET = 464,
-     VAR_CLIENT_SUBNET_ZONE = 465,
-     VAR_CLIENT_SUBNET_ALWAYS_FORWARD = 466,
-     VAR_CLIENT_SUBNET_OPCODE = 467,
-     VAR_MAX_CLIENT_SUBNET_IPV4 = 468,
-     VAR_MAX_CLIENT_SUBNET_IPV6 = 469,
-     VAR_MIN_CLIENT_SUBNET_IPV4 = 470,
-     VAR_MIN_CLIENT_SUBNET_IPV6 = 471,
-     VAR_MAX_ECS_TREE_SIZE_IPV4 = 472,
-     VAR_MAX_ECS_TREE_SIZE_IPV6 = 473,
-     VAR_CAPS_WHITELIST = 474,
-     VAR_CACHE_MAX_NEGATIVE_TTL = 475,
-     VAR_PERMIT_SMALL_HOLDDOWN = 476,
-     VAR_QNAME_MINIMISATION = 477,
-     VAR_QNAME_MINIMISATION_STRICT = 478,
-     VAR_IP_FREEBIND = 479,
-     VAR_DEFINE_TAG = 480,
-     VAR_LOCAL_ZONE_TAG = 481,
-     VAR_ACCESS_CONTROL_TAG = 482,
-     VAR_LOCAL_ZONE_OVERRIDE = 483,
-     VAR_ACCESS_CONTROL_TAG_ACTION = 484,
-     VAR_ACCESS_CONTROL_TAG_DATA = 485,
-     VAR_VIEW = 486,
-     VAR_ACCESS_CONTROL_VIEW = 487,
-     VAR_VIEW_FIRST = 488,
-     VAR_SERVE_EXPIRED = 489,
-     VAR_SERVE_EXPIRED_TTL = 490,
-     VAR_SERVE_EXPIRED_TTL_RESET = 491,
-     VAR_SERVE_EXPIRED_REPLY_TTL = 492,
-     VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 493,
-     VAR_EDE_SERVE_EXPIRED = 494,
-     VAR_SERVE_ORIGINAL_TTL = 495,
-     VAR_FAKE_DSA = 496,
-     VAR_FAKE_SHA1 = 497,
-     VAR_LOG_IDENTITY = 498,
-     VAR_HIDE_TRUSTANCHOR = 499,
-     VAR_HIDE_HTTP_USER_AGENT = 500,
-     VAR_HTTP_USER_AGENT = 501,
-     VAR_TRUST_ANCHOR_SIGNALING = 502,
-     VAR_AGGRESSIVE_NSEC = 503,
-     VAR_USE_SYSTEMD = 504,
-     VAR_SHM_ENABLE = 505,
-     VAR_SHM_KEY = 506,
-     VAR_ROOT_KEY_SENTINEL = 507,
-     VAR_DNSCRYPT = 508,
-     VAR_DNSCRYPT_ENABLE = 509,
-     VAR_DNSCRYPT_PORT = 510,
-     VAR_DNSCRYPT_PROVIDER = 511,
-     VAR_DNSCRYPT_SECRET_KEY = 512,
-     VAR_DNSCRYPT_PROVIDER_CERT = 513,
-     VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 514,
-     VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 515,
-     VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 516,
-     VAR_DNSCRYPT_NONCE_CACHE_SIZE = 517,
-     VAR_DNSCRYPT_NONCE_CACHE_SLABS = 518,
-     VAR_PAD_RESPONSES = 519,
-     VAR_PAD_RESPONSES_BLOCK_SIZE = 520,
-     VAR_PAD_QUERIES = 521,
-     VAR_PAD_QUERIES_BLOCK_SIZE = 522,
-     VAR_IPSECMOD_ENABLED = 523,
-     VAR_IPSECMOD_HOOK = 524,
-     VAR_IPSECMOD_IGNORE_BOGUS = 525,
-     VAR_IPSECMOD_MAX_TTL = 526,
-     VAR_IPSECMOD_WHITELIST = 527,
-     VAR_IPSECMOD_STRICT = 528,
-     VAR_CACHEDB = 529,
-     VAR_CACHEDB_BACKEND = 530,
-     VAR_CACHEDB_SECRETSEED = 531,
-     VAR_CACHEDB_REDISHOST = 532,
-     VAR_CACHEDB_REDISPORT = 533,
-     VAR_CACHEDB_REDISTIMEOUT = 534,
-     VAR_CACHEDB_REDISEXPIRERECORDS = 535,
-     VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 536,
-     VAR_FOR_UPSTREAM = 537,
-     VAR_AUTH_ZONE = 538,
-     VAR_ZONEFILE = 539,
-     VAR_MASTER = 540,
-     VAR_URL = 541,
-     VAR_FOR_DOWNSTREAM = 542,
-     VAR_FALLBACK_ENABLED = 543,
-     VAR_TLS_ADDITIONAL_PORT = 544,
-     VAR_LOW_RTT = 545,
-     VAR_LOW_RTT_PERMIL = 546,
-     VAR_FAST_SERVER_PERMIL = 547,
-     VAR_FAST_SERVER_NUM = 548,
-     VAR_ALLOW_NOTIFY = 549,
-     VAR_TLS_WIN_CERT = 550,
-     VAR_TCP_CONNECTION_LIMIT = 551,
-     VAR_ANSWER_COOKIE = 552,
-     VAR_COOKIE_SECRET = 553,
-     VAR_FORWARD_NO_CACHE = 554,
-     VAR_STUB_NO_CACHE = 555,
-     VAR_LOG_SERVFAIL = 556,
-     VAR_DENY_ANY = 557,
-     VAR_UNKNOWN_SERVER_TIME_LIMIT = 558,
-     VAR_LOG_TAG_QUERYREPLY = 559,
-     VAR_STREAM_WAIT_SIZE = 560,
-     VAR_TLS_CIPHERS = 561,
-     VAR_TLS_CIPHERSUITES = 562,
-     VAR_TLS_USE_SNI = 563,
-     VAR_IPSET = 564,
-     VAR_IPSET_NAME_V4 = 565,
-     VAR_IPSET_NAME_V6 = 566,
-     VAR_TLS_SESSION_TICKET_KEYS = 567,
-     VAR_RPZ = 568,
-     VAR_TAGS = 569,
-     VAR_RPZ_ACTION_OVERRIDE = 570,
-     VAR_RPZ_CNAME_OVERRIDE = 571,
-     VAR_RPZ_LOG = 572,
-     VAR_RPZ_LOG_NAME = 573,
-     VAR_DYNLIB = 574,
-     VAR_DYNLIB_FILE = 575,
-     VAR_EDNS_CLIENT_STRING = 576,
-     VAR_EDNS_CLIENT_STRING_OPCODE = 577,
-     VAR_NSID = 578,
-     VAR_ZONEMD_PERMISSIVE_MODE = 579,
-     VAR_ZONEMD_CHECK = 580,
-     VAR_ZONEMD_REJECT_ABSENCE = 581,
-     VAR_RPZ_SIGNAL_NXDOMAIN_RA = 582,
-     VAR_INTERFACE_AUTOMATIC_PORTS = 583,
-     VAR_EDE = 584,
-     VAR_UPSTREAM_COOKIES = 585,
-     VAR_INTERFACE_ACTION = 586,
-     VAR_INTERFACE_VIEW = 587,
-     VAR_INTERFACE_TAG = 588,
-     VAR_INTERFACE_TAG_ACTION = 589,
-     VAR_INTERFACE_TAG_DATA = 590,
-     VAR_PROXY_PROTOCOL_PORT = 591
-   };
+  enum yytokentype
+  {
+    YYEMPTY = -2,
+    YYEOF = 0,                     /* "end of file"  */
+    YYerror = 256,                 /* error  */
+    YYUNDEF = 257,                 /* "invalid token"  */
+    SPACE = 258,                   /* SPACE  */
+    LETTER = 259,                  /* LETTER  */
+    NEWLINE = 260,                 /* NEWLINE  */
+    COMMENT = 261,                 /* COMMENT  */
+    COLON = 262,                   /* COLON  */
+    ANY = 263,                     /* ANY  */
+    ZONESTR = 264,                 /* ZONESTR  */
+    STRING_ARG = 265,              /* STRING_ARG  */
+    VAR_FORCE_TOPLEVEL = 266,      /* VAR_FORCE_TOPLEVEL  */
+    VAR_SERVER = 267,              /* VAR_SERVER  */
+    VAR_VERBOSITY = 268,           /* VAR_VERBOSITY  */
+    VAR_NUM_THREADS = 269,         /* VAR_NUM_THREADS  */
+    VAR_PORT = 270,                /* VAR_PORT  */
+    VAR_OUTGOING_RANGE = 271,      /* VAR_OUTGOING_RANGE  */
+    VAR_INTERFACE = 272,           /* VAR_INTERFACE  */
+    VAR_PREFER_IP4 = 273,          /* VAR_PREFER_IP4  */
+    VAR_DO_IP4 = 274,              /* VAR_DO_IP4  */
+    VAR_DO_IP6 = 275,              /* VAR_DO_IP6  */
+    VAR_PREFER_IP6 = 276,          /* VAR_PREFER_IP6  */
+    VAR_DO_UDP = 277,              /* VAR_DO_UDP  */
+    VAR_DO_TCP = 278,              /* VAR_DO_TCP  */
+    VAR_TCP_MSS = 279,             /* VAR_TCP_MSS  */
+    VAR_OUTGOING_TCP_MSS = 280,    /* VAR_OUTGOING_TCP_MSS  */
+    VAR_TCP_IDLE_TIMEOUT = 281,    /* VAR_TCP_IDLE_TIMEOUT  */
+    VAR_EDNS_TCP_KEEPALIVE = 282,  /* VAR_EDNS_TCP_KEEPALIVE  */
+    VAR_EDNS_TCP_KEEPALIVE_TIMEOUT = 283, /* VAR_EDNS_TCP_KEEPALIVE_TIMEOUT  */
+    VAR_CHROOT = 284,              /* VAR_CHROOT  */
+    VAR_USERNAME = 285,            /* VAR_USERNAME  */
+    VAR_DIRECTORY = 286,           /* VAR_DIRECTORY  */
+    VAR_LOGFILE = 287,             /* VAR_LOGFILE  */
+    VAR_PIDFILE = 288,             /* VAR_PIDFILE  */
+    VAR_MSG_CACHE_SIZE = 289,      /* VAR_MSG_CACHE_SIZE  */
+    VAR_MSG_CACHE_SLABS = 290,     /* VAR_MSG_CACHE_SLABS  */
+    VAR_NUM_QUERIES_PER_THREAD = 291, /* VAR_NUM_QUERIES_PER_THREAD  */
+    VAR_RRSET_CACHE_SIZE = 292,    /* VAR_RRSET_CACHE_SIZE  */
+    VAR_RRSET_CACHE_SLABS = 293,   /* VAR_RRSET_CACHE_SLABS  */
+    VAR_OUTGOING_NUM_TCP = 294,    /* VAR_OUTGOING_NUM_TCP  */
+    VAR_INFRA_HOST_TTL = 295,      /* VAR_INFRA_HOST_TTL  */
+    VAR_INFRA_LAME_TTL = 296,      /* VAR_INFRA_LAME_TTL  */
+    VAR_INFRA_CACHE_SLABS = 297,   /* VAR_INFRA_CACHE_SLABS  */
+    VAR_INFRA_CACHE_NUMHOSTS = 298, /* VAR_INFRA_CACHE_NUMHOSTS  */
+    VAR_INFRA_CACHE_LAME_SIZE = 299, /* VAR_INFRA_CACHE_LAME_SIZE  */
+    VAR_NAME = 300,                /* VAR_NAME  */
+    VAR_STUB_ZONE = 301,           /* VAR_STUB_ZONE  */
+    VAR_STUB_HOST = 302,           /* VAR_STUB_HOST  */
+    VAR_STUB_ADDR = 303,           /* VAR_STUB_ADDR  */
+    VAR_TARGET_FETCH_POLICY = 304, /* VAR_TARGET_FETCH_POLICY  */
+    VAR_HARDEN_SHORT_BUFSIZE = 305, /* VAR_HARDEN_SHORT_BUFSIZE  */
+    VAR_HARDEN_LARGE_QUERIES = 306, /* VAR_HARDEN_LARGE_QUERIES  */
+    VAR_FORWARD_ZONE = 307,        /* VAR_FORWARD_ZONE  */
+    VAR_FORWARD_HOST = 308,        /* VAR_FORWARD_HOST  */
+    VAR_FORWARD_ADDR = 309,        /* VAR_FORWARD_ADDR  */
+    VAR_DO_NOT_QUERY_ADDRESS = 310, /* VAR_DO_NOT_QUERY_ADDRESS  */
+    VAR_HIDE_IDENTITY = 311,       /* VAR_HIDE_IDENTITY  */
+    VAR_HIDE_VERSION = 312,        /* VAR_HIDE_VERSION  */
+    VAR_IDENTITY = 313,            /* VAR_IDENTITY  */
+    VAR_VERSION = 314,             /* VAR_VERSION  */
+    VAR_HARDEN_GLUE = 315,         /* VAR_HARDEN_GLUE  */
+    VAR_MODULE_CONF = 316,         /* VAR_MODULE_CONF  */
+    VAR_TRUST_ANCHOR_FILE = 317,   /* VAR_TRUST_ANCHOR_FILE  */
+    VAR_TRUST_ANCHOR = 318,        /* VAR_TRUST_ANCHOR  */
+    VAR_VAL_OVERRIDE_DATE = 319,   /* VAR_VAL_OVERRIDE_DATE  */
+    VAR_BOGUS_TTL = 320,           /* VAR_BOGUS_TTL  */
+    VAR_VAL_CLEAN_ADDITIONAL = 321, /* VAR_VAL_CLEAN_ADDITIONAL  */
+    VAR_VAL_PERMISSIVE_MODE = 322, /* VAR_VAL_PERMISSIVE_MODE  */
+    VAR_INCOMING_NUM_TCP = 323,    /* VAR_INCOMING_NUM_TCP  */
+    VAR_MSG_BUFFER_SIZE = 324,     /* VAR_MSG_BUFFER_SIZE  */
+    VAR_KEY_CACHE_SIZE = 325,      /* VAR_KEY_CACHE_SIZE  */
+    VAR_KEY_CACHE_SLABS = 326,     /* VAR_KEY_CACHE_SLABS  */
+    VAR_TRUSTED_KEYS_FILE = 327,   /* VAR_TRUSTED_KEYS_FILE  */
+    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 328, /* VAR_VAL_NSEC3_KEYSIZE_ITERATIONS  */
+    VAR_USE_SYSLOG = 329,          /* VAR_USE_SYSLOG  */
+    VAR_OUTGOING_INTERFACE = 330,  /* VAR_OUTGOING_INTERFACE  */
+    VAR_ROOT_HINTS = 331,          /* VAR_ROOT_HINTS  */
+    VAR_DO_NOT_QUERY_LOCALHOST = 332, /* VAR_DO_NOT_QUERY_LOCALHOST  */
+    VAR_CACHE_MAX_TTL = 333,       /* VAR_CACHE_MAX_TTL  */
+    VAR_HARDEN_DNSSEC_STRIPPED = 334, /* VAR_HARDEN_DNSSEC_STRIPPED  */
+    VAR_ACCESS_CONTROL = 335,      /* VAR_ACCESS_CONTROL  */
+    VAR_LOCAL_ZONE = 336,          /* VAR_LOCAL_ZONE  */
+    VAR_LOCAL_DATA = 337,          /* VAR_LOCAL_DATA  */
+    VAR_INTERFACE_AUTOMATIC = 338, /* VAR_INTERFACE_AUTOMATIC  */
+    VAR_STATISTICS_INTERVAL = 339, /* VAR_STATISTICS_INTERVAL  */
+    VAR_DO_DAEMONIZE = 340,        /* VAR_DO_DAEMONIZE  */
+    VAR_USE_CAPS_FOR_ID = 341,     /* VAR_USE_CAPS_FOR_ID  */
+    VAR_STATISTICS_CUMULATIVE = 342, /* VAR_STATISTICS_CUMULATIVE  */
+    VAR_OUTGOING_PORT_PERMIT = 343, /* VAR_OUTGOING_PORT_PERMIT  */
+    VAR_OUTGOING_PORT_AVOID = 344, /* VAR_OUTGOING_PORT_AVOID  */
+    VAR_DLV_ANCHOR_FILE = 345,     /* VAR_DLV_ANCHOR_FILE  */
+    VAR_DLV_ANCHOR = 346,          /* VAR_DLV_ANCHOR  */
+    VAR_NEG_CACHE_SIZE = 347,      /* VAR_NEG_CACHE_SIZE  */
+    VAR_HARDEN_REFERRAL_PATH = 348, /* VAR_HARDEN_REFERRAL_PATH  */
+    VAR_PRIVATE_ADDRESS = 349,     /* VAR_PRIVATE_ADDRESS  */
+    VAR_PRIVATE_DOMAIN = 350,      /* VAR_PRIVATE_DOMAIN  */
+    VAR_REMOTE_CONTROL = 351,      /* VAR_REMOTE_CONTROL  */
+    VAR_CONTROL_ENABLE = 352,      /* VAR_CONTROL_ENABLE  */
+    VAR_CONTROL_INTERFACE = 353,   /* VAR_CONTROL_INTERFACE  */
+    VAR_CONTROL_PORT = 354,        /* VAR_CONTROL_PORT  */
+    VAR_SERVER_KEY_FILE = 355,     /* VAR_SERVER_KEY_FILE  */
+    VAR_SERVER_CERT_FILE = 356,    /* VAR_SERVER_CERT_FILE  */
+    VAR_CONTROL_KEY_FILE = 357,    /* VAR_CONTROL_KEY_FILE  */
+    VAR_CONTROL_CERT_FILE = 358,   /* VAR_CONTROL_CERT_FILE  */
+    VAR_CONTROL_USE_CERT = 359,    /* VAR_CONTROL_USE_CERT  */
+    VAR_TCP_REUSE_TIMEOUT = 360,   /* VAR_TCP_REUSE_TIMEOUT  */
+    VAR_MAX_REUSE_TCP_QUERIES = 361, /* VAR_MAX_REUSE_TCP_QUERIES  */
+    VAR_EXTENDED_STATISTICS = 362, /* VAR_EXTENDED_STATISTICS  */
+    VAR_LOCAL_DATA_PTR = 363,      /* VAR_LOCAL_DATA_PTR  */
+    VAR_JOSTLE_TIMEOUT = 364,      /* VAR_JOSTLE_TIMEOUT  */
+    VAR_STUB_PRIME = 365,          /* VAR_STUB_PRIME  */
+    VAR_UNWANTED_REPLY_THRESHOLD = 366, /* VAR_UNWANTED_REPLY_THRESHOLD  */
+    VAR_LOG_TIME_ASCII = 367,      /* VAR_LOG_TIME_ASCII  */
+    VAR_DOMAIN_INSECURE = 368,     /* VAR_DOMAIN_INSECURE  */
+    VAR_PYTHON = 369,              /* VAR_PYTHON  */
+    VAR_PYTHON_SCRIPT = 370,       /* VAR_PYTHON_SCRIPT  */
+    VAR_VAL_SIG_SKEW_MIN = 371,    /* VAR_VAL_SIG_SKEW_MIN  */
+    VAR_VAL_SIG_SKEW_MAX = 372,    /* VAR_VAL_SIG_SKEW_MAX  */
+    VAR_VAL_MAX_RESTART = 373,     /* VAR_VAL_MAX_RESTART  */
+    VAR_CACHE_MIN_TTL = 374,       /* VAR_CACHE_MIN_TTL  */
+    VAR_VAL_LOG_LEVEL = 375,       /* VAR_VAL_LOG_LEVEL  */
+    VAR_AUTO_TRUST_ANCHOR_FILE = 376, /* VAR_AUTO_TRUST_ANCHOR_FILE  */
+    VAR_KEEP_MISSING = 377,        /* VAR_KEEP_MISSING  */
+    VAR_ADD_HOLDDOWN = 378,        /* VAR_ADD_HOLDDOWN  */
+    VAR_DEL_HOLDDOWN = 379,        /* VAR_DEL_HOLDDOWN  */
+    VAR_SO_RCVBUF = 380,           /* VAR_SO_RCVBUF  */
+    VAR_EDNS_BUFFER_SIZE = 381,    /* VAR_EDNS_BUFFER_SIZE  */
+    VAR_PREFETCH = 382,            /* VAR_PREFETCH  */
+    VAR_PREFETCH_KEY = 383,        /* VAR_PREFETCH_KEY  */
+    VAR_SO_SNDBUF = 384,           /* VAR_SO_SNDBUF  */
+    VAR_SO_REUSEPORT = 385,        /* VAR_SO_REUSEPORT  */
+    VAR_HARDEN_BELOW_NXDOMAIN = 386, /* VAR_HARDEN_BELOW_NXDOMAIN  */
+    VAR_IGNORE_CD_FLAG = 387,      /* VAR_IGNORE_CD_FLAG  */
+    VAR_LOG_QUERIES = 388,         /* VAR_LOG_QUERIES  */
+    VAR_LOG_REPLIES = 389,         /* VAR_LOG_REPLIES  */
+    VAR_LOG_LOCAL_ACTIONS = 390,   /* VAR_LOG_LOCAL_ACTIONS  */
+    VAR_TCP_UPSTREAM = 391,        /* VAR_TCP_UPSTREAM  */
+    VAR_SSL_UPSTREAM = 392,        /* VAR_SSL_UPSTREAM  */
+    VAR_TCP_AUTH_QUERY_TIMEOUT = 393, /* VAR_TCP_AUTH_QUERY_TIMEOUT  */
+    VAR_SSL_SERVICE_KEY = 394,     /* VAR_SSL_SERVICE_KEY  */
+    VAR_SSL_SERVICE_PEM = 395,     /* VAR_SSL_SERVICE_PEM  */
+    VAR_SSL_PORT = 396,            /* VAR_SSL_PORT  */
+    VAR_FORWARD_FIRST = 397,       /* VAR_FORWARD_FIRST  */
+    VAR_STUB_SSL_UPSTREAM = 398,   /* VAR_STUB_SSL_UPSTREAM  */
+    VAR_FORWARD_SSL_UPSTREAM = 399, /* VAR_FORWARD_SSL_UPSTREAM  */
+    VAR_TLS_CERT_BUNDLE = 400,     /* VAR_TLS_CERT_BUNDLE  */
+    VAR_STUB_TCP_UPSTREAM = 401,   /* VAR_STUB_TCP_UPSTREAM  */
+    VAR_FORWARD_TCP_UPSTREAM = 402, /* VAR_FORWARD_TCP_UPSTREAM  */
+    VAR_HTTPS_PORT = 403,          /* VAR_HTTPS_PORT  */
+    VAR_HTTP_ENDPOINT = 404,       /* VAR_HTTP_ENDPOINT  */
+    VAR_HTTP_MAX_STREAMS = 405,    /* VAR_HTTP_MAX_STREAMS  */
+    VAR_HTTP_QUERY_BUFFER_SIZE = 406, /* VAR_HTTP_QUERY_BUFFER_SIZE  */
+    VAR_HTTP_RESPONSE_BUFFER_SIZE = 407, /* VAR_HTTP_RESPONSE_BUFFER_SIZE  */
+    VAR_HTTP_NODELAY = 408,        /* VAR_HTTP_NODELAY  */
+    VAR_HTTP_NOTLS_DOWNSTREAM = 409, /* VAR_HTTP_NOTLS_DOWNSTREAM  */
+    VAR_STUB_FIRST = 410,          /* VAR_STUB_FIRST  */
+    VAR_MINIMAL_RESPONSES = 411,   /* VAR_MINIMAL_RESPONSES  */
+    VAR_RRSET_ROUNDROBIN = 412,    /* VAR_RRSET_ROUNDROBIN  */
+    VAR_MAX_UDP_SIZE = 413,        /* VAR_MAX_UDP_SIZE  */
+    VAR_DELAY_CLOSE = 414,         /* VAR_DELAY_CLOSE  */
+    VAR_UDP_CONNECT = 415,         /* VAR_UDP_CONNECT  */
+    VAR_UNBLOCK_LAN_ZONES = 416,   /* VAR_UNBLOCK_LAN_ZONES  */
+    VAR_INSECURE_LAN_ZONES = 417,  /* VAR_INSECURE_LAN_ZONES  */
+    VAR_INFRA_CACHE_MIN_RTT = 418, /* VAR_INFRA_CACHE_MIN_RTT  */
+    VAR_INFRA_CACHE_MAX_RTT = 419, /* VAR_INFRA_CACHE_MAX_RTT  */
+    VAR_INFRA_KEEP_PROBING = 420,  /* VAR_INFRA_KEEP_PROBING  */
+    VAR_DNS64_PREFIX = 421,        /* VAR_DNS64_PREFIX  */
+    VAR_DNS64_SYNTHALL = 422,      /* VAR_DNS64_SYNTHALL  */
+    VAR_DNS64_IGNORE_AAAA = 423,   /* VAR_DNS64_IGNORE_AAAA  */
+    VAR_DNSTAP = 424,              /* VAR_DNSTAP  */
+    VAR_DNSTAP_ENABLE = 425,       /* VAR_DNSTAP_ENABLE  */
+    VAR_DNSTAP_SOCKET_PATH = 426,  /* VAR_DNSTAP_SOCKET_PATH  */
+    VAR_DNSTAP_IP = 427,           /* VAR_DNSTAP_IP  */
+    VAR_DNSTAP_TLS = 428,          /* VAR_DNSTAP_TLS  */
+    VAR_DNSTAP_TLS_SERVER_NAME = 429, /* VAR_DNSTAP_TLS_SERVER_NAME  */
+    VAR_DNSTAP_TLS_CERT_BUNDLE = 430, /* VAR_DNSTAP_TLS_CERT_BUNDLE  */
+    VAR_DNSTAP_TLS_CLIENT_KEY_FILE = 431, /* VAR_DNSTAP_TLS_CLIENT_KEY_FILE  */
+    VAR_DNSTAP_TLS_CLIENT_CERT_FILE = 432, /* VAR_DNSTAP_TLS_CLIENT_CERT_FILE  */
+    VAR_DNSTAP_SEND_IDENTITY = 433, /* VAR_DNSTAP_SEND_IDENTITY  */
+    VAR_DNSTAP_SEND_VERSION = 434, /* VAR_DNSTAP_SEND_VERSION  */
+    VAR_DNSTAP_BIDIRECTIONAL = 435, /* VAR_DNSTAP_BIDIRECTIONAL  */
+    VAR_DNSTAP_IDENTITY = 436,     /* VAR_DNSTAP_IDENTITY  */
+    VAR_DNSTAP_VERSION = 437,      /* VAR_DNSTAP_VERSION  */
+    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 438, /* VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES  */
+    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 439, /* VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES  */
+    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 440, /* VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES  */
+    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 441, /* VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES  */
+    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 442, /* VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES  */
+    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 443, /* VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES  */
+    VAR_RESPONSE_IP_TAG = 444,     /* VAR_RESPONSE_IP_TAG  */
+    VAR_RESPONSE_IP = 445,         /* VAR_RESPONSE_IP  */
+    VAR_RESPONSE_IP_DATA = 446,    /* VAR_RESPONSE_IP_DATA  */
+    VAR_HARDEN_ALGO_DOWNGRADE = 447, /* VAR_HARDEN_ALGO_DOWNGRADE  */
+    VAR_IP_TRANSPARENT = 448,      /* VAR_IP_TRANSPARENT  */
+    VAR_IP_DSCP = 449,             /* VAR_IP_DSCP  */
+    VAR_DISABLE_DNSSEC_LAME_CHECK = 450, /* VAR_DISABLE_DNSSEC_LAME_CHECK  */
+    VAR_IP_RATELIMIT = 451,        /* VAR_IP_RATELIMIT  */
+    VAR_IP_RATELIMIT_SLABS = 452,  /* VAR_IP_RATELIMIT_SLABS  */
+    VAR_IP_RATELIMIT_SIZE = 453,   /* VAR_IP_RATELIMIT_SIZE  */
+    VAR_RATELIMIT = 454,           /* VAR_RATELIMIT  */
+    VAR_RATELIMIT_SLABS = 455,     /* VAR_RATELIMIT_SLABS  */
+    VAR_RATELIMIT_SIZE = 456,      /* VAR_RATELIMIT_SIZE  */
+    VAR_OUTBOUND_MSG_RETRY = 457,  /* VAR_OUTBOUND_MSG_RETRY  */
+    VAR_RATELIMIT_FOR_DOMAIN = 458, /* VAR_RATELIMIT_FOR_DOMAIN  */
+    VAR_RATELIMIT_BELOW_DOMAIN = 459, /* VAR_RATELIMIT_BELOW_DOMAIN  */
+    VAR_IP_RATELIMIT_FACTOR = 460, /* VAR_IP_RATELIMIT_FACTOR  */
+    VAR_RATELIMIT_FACTOR = 461,    /* VAR_RATELIMIT_FACTOR  */
+    VAR_IP_RATELIMIT_BACKOFF = 462, /* VAR_IP_RATELIMIT_BACKOFF  */
+    VAR_RATELIMIT_BACKOFF = 463,   /* VAR_RATELIMIT_BACKOFF  */
+    VAR_SEND_CLIENT_SUBNET = 464,  /* VAR_SEND_CLIENT_SUBNET  */
+    VAR_CLIENT_SUBNET_ZONE = 465,  /* VAR_CLIENT_SUBNET_ZONE  */
+    VAR_CLIENT_SUBNET_ALWAYS_FORWARD = 466, /* VAR_CLIENT_SUBNET_ALWAYS_FORWARD  */
+    VAR_CLIENT_SUBNET_OPCODE = 467, /* VAR_CLIENT_SUBNET_OPCODE  */
+    VAR_MAX_CLIENT_SUBNET_IPV4 = 468, /* VAR_MAX_CLIENT_SUBNET_IPV4  */
+    VAR_MAX_CLIENT_SUBNET_IPV6 = 469, /* VAR_MAX_CLIENT_SUBNET_IPV6  */
+    VAR_MIN_CLIENT_SUBNET_IPV4 = 470, /* VAR_MIN_CLIENT_SUBNET_IPV4  */
+    VAR_MIN_CLIENT_SUBNET_IPV6 = 471, /* VAR_MIN_CLIENT_SUBNET_IPV6  */
+    VAR_MAX_ECS_TREE_SIZE_IPV4 = 472, /* VAR_MAX_ECS_TREE_SIZE_IPV4  */
+    VAR_MAX_ECS_TREE_SIZE_IPV6 = 473, /* VAR_MAX_ECS_TREE_SIZE_IPV6  */
+    VAR_CAPS_WHITELIST = 474,      /* VAR_CAPS_WHITELIST  */
+    VAR_CACHE_MAX_NEGATIVE_TTL = 475, /* VAR_CACHE_MAX_NEGATIVE_TTL  */
+    VAR_PERMIT_SMALL_HOLDDOWN = 476, /* VAR_PERMIT_SMALL_HOLDDOWN  */
+    VAR_QNAME_MINIMISATION = 477,  /* VAR_QNAME_MINIMISATION  */
+    VAR_QNAME_MINIMISATION_STRICT = 478, /* VAR_QNAME_MINIMISATION_STRICT  */
+    VAR_IP_FREEBIND = 479,         /* VAR_IP_FREEBIND  */
+    VAR_DEFINE_TAG = 480,          /* VAR_DEFINE_TAG  */
+    VAR_LOCAL_ZONE_TAG = 481,      /* VAR_LOCAL_ZONE_TAG  */
+    VAR_ACCESS_CONTROL_TAG = 482,  /* VAR_ACCESS_CONTROL_TAG  */
+    VAR_LOCAL_ZONE_OVERRIDE = 483, /* VAR_LOCAL_ZONE_OVERRIDE  */
+    VAR_ACCESS_CONTROL_TAG_ACTION = 484, /* VAR_ACCESS_CONTROL_TAG_ACTION  */
+    VAR_ACCESS_CONTROL_TAG_DATA = 485, /* VAR_ACCESS_CONTROL_TAG_DATA  */
+    VAR_VIEW = 486,                /* VAR_VIEW  */
+    VAR_ACCESS_CONTROL_VIEW = 487, /* VAR_ACCESS_CONTROL_VIEW  */
+    VAR_VIEW_FIRST = 488,          /* VAR_VIEW_FIRST  */
+    VAR_SERVE_EXPIRED = 489,       /* VAR_SERVE_EXPIRED  */
+    VAR_SERVE_EXPIRED_TTL = 490,   /* VAR_SERVE_EXPIRED_TTL  */
+    VAR_SERVE_EXPIRED_TTL_RESET = 491, /* VAR_SERVE_EXPIRED_TTL_RESET  */
+    VAR_SERVE_EXPIRED_REPLY_TTL = 492, /* VAR_SERVE_EXPIRED_REPLY_TTL  */
+    VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 493, /* VAR_SERVE_EXPIRED_CLIENT_TIMEOUT  */
+    VAR_EDE_SERVE_EXPIRED = 494,   /* VAR_EDE_SERVE_EXPIRED  */
+    VAR_SERVE_ORIGINAL_TTL = 495,  /* VAR_SERVE_ORIGINAL_TTL  */
+    VAR_FAKE_DSA = 496,            /* VAR_FAKE_DSA  */
+    VAR_FAKE_SHA1 = 497,           /* VAR_FAKE_SHA1  */
+    VAR_LOG_IDENTITY = 498,        /* VAR_LOG_IDENTITY  */
+    VAR_HIDE_TRUSTANCHOR = 499,    /* VAR_HIDE_TRUSTANCHOR  */
+    VAR_HIDE_HTTP_USER_AGENT = 500, /* VAR_HIDE_HTTP_USER_AGENT  */
+    VAR_HTTP_USER_AGENT = 501,     /* VAR_HTTP_USER_AGENT  */
+    VAR_TRUST_ANCHOR_SIGNALING = 502, /* VAR_TRUST_ANCHOR_SIGNALING  */
+    VAR_AGGRESSIVE_NSEC = 503,     /* VAR_AGGRESSIVE_NSEC  */
+    VAR_USE_SYSTEMD = 504,         /* VAR_USE_SYSTEMD  */
+    VAR_SHM_ENABLE = 505,          /* VAR_SHM_ENABLE  */
+    VAR_SHM_KEY = 506,             /* VAR_SHM_KEY  */
+    VAR_ROOT_KEY_SENTINEL = 507,   /* VAR_ROOT_KEY_SENTINEL  */
+    VAR_DNSCRYPT = 508,            /* VAR_DNSCRYPT  */
+    VAR_DNSCRYPT_ENABLE = 509,     /* VAR_DNSCRYPT_ENABLE  */
+    VAR_DNSCRYPT_PORT = 510,       /* VAR_DNSCRYPT_PORT  */
+    VAR_DNSCRYPT_PROVIDER = 511,   /* VAR_DNSCRYPT_PROVIDER  */
+    VAR_DNSCRYPT_SECRET_KEY = 512, /* VAR_DNSCRYPT_SECRET_KEY  */
+    VAR_DNSCRYPT_PROVIDER_CERT = 513, /* VAR_DNSCRYPT_PROVIDER_CERT  */
+    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 514, /* VAR_DNSCRYPT_PROVIDER_CERT_ROTATED  */
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 515, /* VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE  */
+    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 516, /* VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS  */
+    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 517, /* VAR_DNSCRYPT_NONCE_CACHE_SIZE  */
+    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 518, /* VAR_DNSCRYPT_NONCE_CACHE_SLABS  */
+    VAR_PAD_RESPONSES = 519,       /* VAR_PAD_RESPONSES  */
+    VAR_PAD_RESPONSES_BLOCK_SIZE = 520, /* VAR_PAD_RESPONSES_BLOCK_SIZE  */
+    VAR_PAD_QUERIES = 521,         /* VAR_PAD_QUERIES  */
+    VAR_PAD_QUERIES_BLOCK_SIZE = 522, /* VAR_PAD_QUERIES_BLOCK_SIZE  */
+    VAR_IPSECMOD_ENABLED = 523,    /* VAR_IPSECMOD_ENABLED  */
+    VAR_IPSECMOD_HOOK = 524,       /* VAR_IPSECMOD_HOOK  */
+    VAR_IPSECMOD_IGNORE_BOGUS = 525, /* VAR_IPSECMOD_IGNORE_BOGUS  */
+    VAR_IPSECMOD_MAX_TTL = 526,    /* VAR_IPSECMOD_MAX_TTL  */
+    VAR_IPSECMOD_WHITELIST = 527,  /* VAR_IPSECMOD_WHITELIST  */
+    VAR_IPSECMOD_STRICT = 528,     /* VAR_IPSECMOD_STRICT  */
+    VAR_CACHEDB = 529,             /* VAR_CACHEDB  */
+    VAR_CACHEDB_BACKEND = 530,     /* VAR_CACHEDB_BACKEND  */
+    VAR_CACHEDB_SECRETSEED = 531,  /* VAR_CACHEDB_SECRETSEED  */
+    VAR_CACHEDB_REDISHOST = 532,   /* VAR_CACHEDB_REDISHOST  */
+    VAR_CACHEDB_REDISPORT = 533,   /* VAR_CACHEDB_REDISPORT  */
+    VAR_CACHEDB_REDISTIMEOUT = 534, /* VAR_CACHEDB_REDISTIMEOUT  */
+    VAR_CACHEDB_REDISEXPIRERECORDS = 535, /* VAR_CACHEDB_REDISEXPIRERECORDS  */
+    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 536, /* VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM  */
+    VAR_FOR_UPSTREAM = 537,        /* VAR_FOR_UPSTREAM  */
+    VAR_AUTH_ZONE = 538,           /* VAR_AUTH_ZONE  */
+    VAR_ZONEFILE = 539,            /* VAR_ZONEFILE  */
+    VAR_MASTER = 540,              /* VAR_MASTER  */
+    VAR_URL = 541,                 /* VAR_URL  */
+    VAR_FOR_DOWNSTREAM = 542,      /* VAR_FOR_DOWNSTREAM  */
+    VAR_FALLBACK_ENABLED = 543,    /* VAR_FALLBACK_ENABLED  */
+    VAR_TLS_ADDITIONAL_PORT = 544, /* VAR_TLS_ADDITIONAL_PORT  */
+    VAR_LOW_RTT = 545,             /* VAR_LOW_RTT  */
+    VAR_LOW_RTT_PERMIL = 546,      /* VAR_LOW_RTT_PERMIL  */
+    VAR_FAST_SERVER_PERMIL = 547,  /* VAR_FAST_SERVER_PERMIL  */
+    VAR_FAST_SERVER_NUM = 548,     /* VAR_FAST_SERVER_NUM  */
+    VAR_ALLOW_NOTIFY = 549,        /* VAR_ALLOW_NOTIFY  */
+    VAR_TLS_WIN_CERT = 550,        /* VAR_TLS_WIN_CERT  */
+    VAR_TCP_CONNECTION_LIMIT = 551, /* VAR_TCP_CONNECTION_LIMIT  */
+    VAR_FORWARD_NO_CACHE = 552,    /* VAR_FORWARD_NO_CACHE  */
+    VAR_STUB_NO_CACHE = 553,       /* VAR_STUB_NO_CACHE  */
+    VAR_LOG_SERVFAIL = 554,        /* VAR_LOG_SERVFAIL  */
+    VAR_DENY_ANY = 555,            /* VAR_DENY_ANY  */
+    VAR_UNKNOWN_SERVER_TIME_LIMIT = 556, /* VAR_UNKNOWN_SERVER_TIME_LIMIT  */
+    VAR_LOG_TAG_QUERYREPLY = 557,  /* VAR_LOG_TAG_QUERYREPLY  */
+    VAR_STREAM_WAIT_SIZE = 558,    /* VAR_STREAM_WAIT_SIZE  */
+    VAR_TLS_CIPHERS = 559,         /* VAR_TLS_CIPHERS  */
+    VAR_TLS_CIPHERSUITES = 560,    /* VAR_TLS_CIPHERSUITES  */
+    VAR_TLS_USE_SNI = 561,         /* VAR_TLS_USE_SNI  */
+    VAR_IPSET = 562,               /* VAR_IPSET  */
+    VAR_IPSET_NAME_V4 = 563,       /* VAR_IPSET_NAME_V4  */
+    VAR_IPSET_NAME_V6 = 564,       /* VAR_IPSET_NAME_V6  */
+    VAR_TLS_SESSION_TICKET_KEYS = 565, /* VAR_TLS_SESSION_TICKET_KEYS  */
+    VAR_RPZ = 566,                 /* VAR_RPZ  */
+    VAR_TAGS = 567,                /* VAR_TAGS  */
+    VAR_RPZ_ACTION_OVERRIDE = 568, /* VAR_RPZ_ACTION_OVERRIDE  */
+    VAR_RPZ_CNAME_OVERRIDE = 569,  /* VAR_RPZ_CNAME_OVERRIDE  */
+    VAR_RPZ_LOG = 570,             /* VAR_RPZ_LOG  */
+    VAR_RPZ_LOG_NAME = 571,        /* VAR_RPZ_LOG_NAME  */
+    VAR_DYNLIB = 572,              /* VAR_DYNLIB  */
+    VAR_DYNLIB_FILE = 573,         /* VAR_DYNLIB_FILE  */
+    VAR_EDNS_CLIENT_STRING = 574,  /* VAR_EDNS_CLIENT_STRING  */
+    VAR_EDNS_CLIENT_STRING_OPCODE = 575, /* VAR_EDNS_CLIENT_STRING_OPCODE  */
+    VAR_NSID = 576,                /* VAR_NSID  */
+    VAR_ZONEMD_PERMISSIVE_MODE = 577, /* VAR_ZONEMD_PERMISSIVE_MODE  */
+    VAR_ZONEMD_CHECK = 578,        /* VAR_ZONEMD_CHECK  */
+    VAR_ZONEMD_REJECT_ABSENCE = 579, /* VAR_ZONEMD_REJECT_ABSENCE  */
+    VAR_RPZ_SIGNAL_NXDOMAIN_RA = 580, /* VAR_RPZ_SIGNAL_NXDOMAIN_RA  */
+    VAR_INTERFACE_AUTOMATIC_PORTS = 581, /* VAR_INTERFACE_AUTOMATIC_PORTS  */
+    VAR_EDE = 582,                 /* VAR_EDE  */
+    VAR_INTERFACE_ACTION = 583,    /* VAR_INTERFACE_ACTION  */
+    VAR_INTERFACE_VIEW = 584,      /* VAR_INTERFACE_VIEW  */
+    VAR_INTERFACE_TAG = 585,       /* VAR_INTERFACE_TAG  */
+    VAR_INTERFACE_TAG_ACTION = 586, /* VAR_INTERFACE_TAG_ACTION  */
+    VAR_INTERFACE_TAG_DATA = 587,  /* VAR_INTERFACE_TAG_DATA  */
+    VAR_PROXY_PROTOCOL_PORT = 588  /* VAR_PROXY_PROTOCOL_PORT  */
+  };
+  typedef enum yytokentype yytoken_kind_t;
 #endif
-/* Tokens.  */
+/* Token kinds.  */
+#define YYEMPTY -2
+#define YYEOF 0
+#define YYerror 256
+#define YYUNDEF 257
 #define SPACE 258
 #define LETTER 259
 #define NEWLINE 260
@@ -670,63 +687,65 @@
 #define VAR_ALLOW_NOTIFY 549
 #define VAR_TLS_WIN_CERT 550
 #define VAR_TCP_CONNECTION_LIMIT 551
-#define VAR_ANSWER_COOKIE 552
-#define VAR_COOKIE_SECRET 553
-#define VAR_FORWARD_NO_CACHE 554
-#define VAR_STUB_NO_CACHE 555
-#define VAR_LOG_SERVFAIL 556
-#define VAR_DENY_ANY 557
-#define VAR_UNKNOWN_SERVER_TIME_LIMIT 558
-#define VAR_LOG_TAG_QUERYREPLY 559
-#define VAR_STREAM_WAIT_SIZE 560
-#define VAR_TLS_CIPHERS 561
-#define VAR_TLS_CIPHERSUITES 562
-#define VAR_TLS_USE_SNI 563
-#define VAR_IPSET 564
-#define VAR_IPSET_NAME_V4 565
-#define VAR_IPSET_NAME_V6 566
-#define VAR_TLS_SESSION_TICKET_KEYS 567
-#define VAR_RPZ 568
-#define VAR_TAGS 569
-#define VAR_RPZ_ACTION_OVERRIDE 570
-#define VAR_RPZ_CNAME_OVERRIDE 571
-#define VAR_RPZ_LOG 572
-#define VAR_RPZ_LOG_NAME 573
-#define VAR_DYNLIB 574
-#define VAR_DYNLIB_FILE 575
-#define VAR_EDNS_CLIENT_STRING 576
-#define VAR_EDNS_CLIENT_STRING_OPCODE 577
-#define VAR_NSID 578
-#define VAR_ZONEMD_PERMISSIVE_MODE 579
-#define VAR_ZONEMD_CHECK 580
-#define VAR_ZONEMD_REJECT_ABSENCE 581
-#define VAR_RPZ_SIGNAL_NXDOMAIN_RA 582
-#define VAR_INTERFACE_AUTOMATIC_PORTS 583
-#define VAR_EDE 584
-#define VAR_UPSTREAM_COOKIES 585
-#define VAR_INTERFACE_ACTION 586
-#define VAR_INTERFACE_VIEW 587
-#define VAR_INTERFACE_TAG 588
-#define VAR_INTERFACE_TAG_ACTION 589
-#define VAR_INTERFACE_TAG_DATA 590
-#define VAR_PROXY_PROTOCOL_PORT 591
-
-
-
+#define VAR_FORWARD_NO_CACHE 552
+#define VAR_STUB_NO_CACHE 553
+#define VAR_LOG_SERVFAIL 554
+#define VAR_DENY_ANY 555
+#define VAR_UNKNOWN_SERVER_TIME_LIMIT 556
+#define VAR_LOG_TAG_QUERYREPLY 557
+#define VAR_STREAM_WAIT_SIZE 558
+#define VAR_TLS_CIPHERS 559
+#define VAR_TLS_CIPHERSUITES 560
+#define VAR_TLS_USE_SNI 561
+#define VAR_IPSET 562
+#define VAR_IPSET_NAME_V4 563
+#define VAR_IPSET_NAME_V6 564
+#define VAR_TLS_SESSION_TICKET_KEYS 565
+#define VAR_RPZ 566
+#define VAR_TAGS 567
+#define VAR_RPZ_ACTION_OVERRIDE 568
+#define VAR_RPZ_CNAME_OVERRIDE 569
+#define VAR_RPZ_LOG 570
+#define VAR_RPZ_LOG_NAME 571
+#define VAR_DYNLIB 572
+#define VAR_DYNLIB_FILE 573
+#define VAR_EDNS_CLIENT_STRING 574
+#define VAR_EDNS_CLIENT_STRING_OPCODE 575
+#define VAR_NSID 576
+#define VAR_ZONEMD_PERMISSIVE_MODE 577
+#define VAR_ZONEMD_CHECK 578
+#define VAR_ZONEMD_REJECT_ABSENCE 579
+#define VAR_RPZ_SIGNAL_NXDOMAIN_RA 580
+#define VAR_INTERFACE_AUTOMATIC_PORTS 581
+#define VAR_EDE 582
+#define VAR_INTERFACE_ACTION 583
+#define VAR_INTERFACE_VIEW 584
+#define VAR_INTERFACE_TAG 585
+#define VAR_INTERFACE_TAG_ACTION 586
+#define VAR_INTERFACE_TAG_DATA 587
+#define VAR_PROXY_PROTOCOL_PORT 588
 
+/* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-typedef union YYSTYPE
-#line 69 "./util/configparser.y"
+union YYSTYPE
 {
+#line 67 "./util/configparser.y"
+
 	char*	str;
-}
-/* Line 1529 of yacc.c.  */
-#line 725 "util/configparser.h"
-	YYSTYPE;
-# define yystype YYSTYPE /* obsolescent; will be withdrawn */
-# define YYSTYPE_IS_DECLARED 1
+
+#line 737 "util/configparser.h"
+
+};
+typedef union YYSTYPE YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
+# define YYSTYPE_IS_DECLARED 1
 #endif
 
+
 extern YYSTYPE yylval;
 
+
+int yyparse (void);
+
+
+#endif /* !YY_YY_UTIL_CONFIGPARSER_H_INCLUDED  */

util/configparser.y

@@ -42,13 +42,11 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
-#include <time.h>
 #include <assert.h>
 
 #include "util/configyyrename.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
-#include "sldns/str2wire.h"
 
 int ub_c_lex(void);
 void ub_c_error(const char *message);
@@ -183,7 +181,6 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_FALLBACK_ENABLED VAR_TLS_ADDITIONAL_PORT VAR_LOW_RTT VAR_LOW_RTT_PERMIL
 %token VAR_FAST_SERVER_PERMIL VAR_FAST_SERVER_NUM
 %token VAR_ALLOW_NOTIFY VAR_TLS_WIN_CERT VAR_TCP_CONNECTION_LIMIT
-%token VAR_ANSWER_COOKIE VAR_COOKIE_SECRET
 %token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL VAR_DENY_ANY
 %token VAR_UNKNOWN_SERVER_TIME_LIMIT VAR_LOG_TAG_QUERYREPLY
 %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES VAR_TLS_USE_SNI
@@ -194,7 +191,6 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_EDNS_CLIENT_STRING_OPCODE VAR_NSID
 %token VAR_ZONEMD_PERMISSIVE_MODE VAR_ZONEMD_CHECK VAR_ZONEMD_REJECT_ABSENCE
 %token VAR_RPZ_SIGNAL_NXDOMAIN_RA VAR_INTERFACE_AUTOMATIC_PORTS VAR_EDE
-%token VAR_UPSTREAM_COOKIES
 %token VAR_INTERFACE_ACTION VAR_INTERFACE_VIEW VAR_INTERFACE_TAG
 %token VAR_INTERFACE_TAG_ACTION VAR_INTERFACE_TAG_DATA
 %token VAR_PROXY_PROTOCOL_PORT
@@ -321,12 +317,11 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_unknown_server_time_limit | server_log_tag_queryreply |
 	server_stream_wait_size | server_tls_ciphers |
 	server_tls_ciphersuites | server_tls_session_ticket_keys |
-	server_answer_cookie | server_cookie_secret |
 	server_tls_use_sni | server_edns_client_string |
 	server_edns_client_string_opcode | server_nsid |
 	server_zonemd_permissive_mode | server_max_reuse_tcp_queries |
 	server_tcp_reuse_timeout | server_tcp_auth_query_timeout |
-	server_interface_automatic_ports | server_ede | server_upstream_cookies |
+	server_interface_automatic_ports | server_ede |
 	server_proxy_protocol_port
 	;
 stubstart: VAR_STUB_ZONE
@@ -2830,14 +2825,6 @@ server_ede: VAR_EDE STRING_ARG
 		free($2);
 	}
 	;
-server_upstream_cookies: VAR_UPSTREAM_COOKIES STRING_ARG
-	{
-		OUTYY(("P(server_upstream_cookies:%s)\n", $2));
-		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-			yyerror("expected yes or no.");
-		else cfg_parser->cfg->upstream_cookies = (strcmp($2, "yes")==0);
-		free($2);
-	}
 server_proxy_protocol_port: VAR_PROXY_PROTOCOL_PORT STRING_ARG
 	{
 		OUTYY(("P(server_proxy_protocol_port:%s)\n", $2));
@@ -3716,30 +3703,6 @@ server_tcp_connection_limit: VAR_TCP_CONNECTION_LIMIT STRING_ARG STRING_ARG
 		}
 	}
 	;
-server_answer_cookie: VAR_ANSWER_COOKIE STRING_ARG
-	{
-		OUTYY(("P(server_answer_cookie:%s)\n", $2));
-		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-			yyerror("expected yes or no.");
-		else cfg_parser->cfg->do_answer_cookie = (strcmp($2, "yes")==0);
-		free($2);
-	}
-	;
-server_cookie_secret: VAR_COOKIE_SECRET STRING_ARG
-	{
-		uint8_t secret[32];
-		size_t secret_len = sizeof(secret);
-
-		OUTYY(("P(server_cookie_secret:%s)\n", $2));
-		if (sldns_str2wire_hex_buf($2, secret, &secret_len)
-		|| (  secret_len != 16))
-			yyerror("expected 128 bit hex string");
-		else {
-			cfg_parser->cfg->cookie_secret_len = secret_len;
-			memcpy(cfg_parser->cfg->cookie_secret, secret, sizeof(secret));
-		}
-		free($2);
-	}
 	ipsetstart: VAR_IPSET
 		{
 			OUTYY(("\nP(ipset:)\n"));
@@ -3809,11 +3772,10 @@ validate_acl_action(const char* action)
 		strcmp(action, "refuse_non_local")!=0 &&
 		strcmp(action, "allow_setrd")!=0 &&
 		strcmp(action, "allow")!=0 &&
-		strcmp(action, "allow_snoop")!=0 &&
-		strcmp(action, "allow_cookie")!=0)
+		strcmp(action, "allow_snoop")!=0)
 	{
 		yyerror("expected deny, refuse, deny_non_local, "
-			"refuse_non_local, allow, allow_setrd, "
-			"allow_snoop or allow_cookie as access control action");
+			"refuse_non_local, allow, allow_setrd or "
+			"allow_snoop as access control action");
 	}
 }

util/data/msgencode.c

@@ -959,15 +959,14 @@ qinfo_query_encode(sldns_buffer* pkt, struct query_info* qinfo)
 }
 
 void 
-extended_error_encode(sldns_buffer* buf, uint16_t rcode, struct query_info* qinfo,
-	uint16_t qid, uint16_t qflags, uint16_t xflags, struct edns_data* edns)
+error_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
+	uint16_t qid, uint16_t qflags, struct edns_data* edns)
 {
 	uint16_t flags;
 
 	sldns_buffer_clear(buf);
 	sldns_buffer_write(buf, &qid, sizeof(uint16_t));
-	flags = (uint16_t)(BIT_QR | BIT_RA | (rcode & 0xF)); /* QR and retcode*/
-	flags |= xflags;
+	flags = (uint16_t)(BIT_QR | BIT_RA | r); /* QR and retcode*/
 	flags |= (qflags & (BIT_RD|BIT_CD)); /* copy RD and CD bit */
 	sldns_buffer_write_u16(buf, flags);
 	if(qinfo) flags = 1;
@@ -994,7 +993,7 @@ extended_error_encode(sldns_buffer* buf, uint16_t rcode, struct query_info* qinf
 		struct edns_data es = *edns;
 		es.edns_version = EDNS_ADVERTISED_VERSION;
 		es.udp_size = EDNS_ADVERTISED_SIZE;
-		es.ext_rcode = (uint8_t)(rcode >> 4);
+		es.ext_rcode = 0;
 		es.bits &= EDNS_DO;
 		if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) >
 			edns->udp_size)
@@ -1002,12 +1001,3 @@ extended_error_encode(sldns_buffer* buf, uint16_t rcode, struct query_info* qinf
 		attach_edns_record(buf, &es);
 	}
 }
-
-void 
-error_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
-	uint16_t qid, uint16_t qflags, struct edns_data* edns)
-{
-	extended_error_encode(buf, (r & 0x000F), qinfo, qid, qflags
-	                         , (r & 0xFFF0), edns);
-}
-

util/data/msgencode.h

@@ -120,7 +120,7 @@ void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns);
  * Encode an error. With QR and RA set.
  *
  * @param pkt: where to store the packet.
- * @param r: RCODE value to encode (may contain extra flags).
+ * @param r: RCODE value to encode.
  * @param qinfo: if not NULL, the query is included.
  * @param qid: query ID to set in packet. network order.
  * @param qflags: original query flags (to copy RD and CD bits). host order.
@@ -130,21 +130,4 @@ void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns);
 void error_encode(struct sldns_buffer* pkt, int r, struct query_info* qinfo,
 	uint16_t qid, uint16_t qflags, struct edns_data* edns);
 
-/** 
- * Encode an extended error. With QR and RA set.
- *
- * @param pkt: where to store the packet.
- * @param rcode: Extended RCODE value to encode.
- * @param qinfo: if not NULL, the query is included.
- * @param qid: query ID to set in packet. network order.
- * @param qflags: original query flags (to copy RD and CD bits). host order.
- * @param xflags: extra flags to set (such as for example BIT_AA and/or BIT_TC)
- * @param edns: if not NULL, this is the query edns info,
- * 	and an edns reply is attached. Only attached if EDNS record fits reply.
- *      Without edns extended errors (i.e. > 15 )will not be conveyed.
- */
-void extended_error_encode(struct sldns_buffer* pkt, uint16_t rcode,
-	struct query_info* qinfo, uint16_t qid, uint16_t qflags,
-	uint16_t xflags, struct edns_data* edns);
-
 #endif /* UTIL_DATA_MSGENCODE_H */

util/data/msgparse.c

@@ -597,19 +597,6 @@ parse_query_section(sldns_buffer* pkt, struct msg_parse* msg)
 	return 0;
 }
 
-struct edns_option*
-edns_list_get_option(struct edns_option* option, uint16_t code)
-{
-	while (option) {
-		if (option->opt_code == code) {
-			return option;
-		}
-
-		option = option->next;
-	}
-	return NULL;
-}
-
 size_t
 get_rdf_size(sldns_rdf_type rdf)
 {
@@ -964,67 +951,11 @@ edns_opt_list_append_keepalive(struct edns_option** list, int msec,
 			data, region);
 }
 
-int siphash(const uint8_t *in, const size_t inlen,
-		const uint8_t *k, uint8_t *out, const size_t outlen);
-
-/** RFC 1982 comparison, uses unsigned integers, and tries to avoid
- * compiler optimization (eg. by avoiding a-b<0 comparisons),
- * this routine matches compare_serial(), for SOA serial number checks */
-static int
-compare_1982(uint32_t a, uint32_t b)
-{
-	/* for 32 bit values */
-	const uint32_t cutoff = ((uint32_t) 1 << (32 - 1));
-
-	if (a == b) {
-		return 0;
-	} else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) {
-		return -1;
-	} else {
-		return 1;
-	}
-}
-
-/** if we know that b is larger than a, return the difference between them,
- * that is the distance between them. in RFC1982 arith */
-static uint32_t
-subtract_1982(uint32_t a, uint32_t b)
-{
-	/* for 32 bit values */
-	const uint32_t cutoff = ((uint32_t) 1 << (32 - 1));
-
-	if(a == b)
-		return 0;
-	if(a < b && b - a < cutoff) {
-		return b-a;
-	}
-	if(a > b && a - b > cutoff) {
-		return ((uint32_t)0xffffffff) - (a-b-1);
-	}
-	/* wrong case, b smaller than a */
-	return 0;
-}
-
-
-static uint8_t *
-cookie_hash(uint8_t *hash, uint8_t *buf,
-		struct sockaddr_storage *addr, uint8_t *secret)
-{
-	if (addr->ss_family == AF_INET6) {
-		memcpy(buf+16, &((struct sockaddr_in6 *)addr)->sin6_addr, 16);
-		siphash(buf, 32, secret, hash, 8);
-	} else {
-		memcpy(buf+16, &((struct sockaddr_in *)addr)->sin_addr, 4);
-		siphash(buf, 20, secret, hash, 8);
-	}
-	return hash;
-}
-
 /** parse EDNS options from EDNS wireformat rdata */
 static int
 parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 	struct edns_data* edns, struct config_file* cfg, struct comm_point* c,
-	struct comm_reply* repinfo, uint32_t now, struct regional* region)
+	struct regional* region)
 {
 	/* To respond with a Keepalive option, the client connection must have
 	 * received one message with a TCP Keepalive EDNS option, and that
@@ -1048,10 +979,6 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 	while(rdata_len >= 4) {
 		uint16_t opt_code = sldns_read_uint16(rdata_ptr);
 		uint16_t opt_len = sldns_read_uint16(rdata_ptr+2);
-		uint8_t server_cookie[40], hash[8];
-		uint32_t cookie_time, subt_1982;
-		int comp_1982;
-
 		rdata_ptr += 4;
 		rdata_len -= 4;
 		if(opt_len > rdata_len)
@@ -1114,86 +1041,6 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 			edns->padding_block_size = cfg->pad_responses_block_size;
 			break;
 
-		case LDNS_EDNS_COOKIE:
-			if(!cfg || !cfg->do_answer_cookie)
-				break;
-			if(opt_len != 8 && (opt_len < 16 || opt_len > 40)) {
-				verbose(VERB_ALGO, "worker request: "
-						"badly formatted cookie");
-				return LDNS_RCODE_FORMERR;
-			}
-			edns->cookie_present = 1;
-
-			/* Copy client cookie, version and timestamp for
-			 * validation and creation purposes.
-			 */
-			memcpy(server_cookie, rdata_ptr, 16);
-
-			/* In the "if, if else" block below, we validate a
-			 * RFC9018 cookie. If it doesn't match the recipe, or
-			 * if it doesn't validate, or if the cookie is too old
-			 * (< 30 min), a new cookie is generated.
-			 */
-			if (opt_len != 24)
-				; /* RFC9018 cookies are 24 bytes long */
-
-			else if (cfg->cookie_secret_len != 16)
-				; /* RFC9018 cookies have 16 byte secrets */
-
-			else if (rdata_ptr[8] != 1)
-				; /* RFC9018 cookies are cookie version 1 */
-
-			else if ((comp_1982 = compare_1982(now,
-					(cookie_time = sldns_read_uint32(rdata_ptr + 12)))) > 0
-			     &&  (subt_1982 = subtract_1982(cookie_time, now)) > 3600)
-				; /* Cookie is older than 1 hour
-				   * (see RFC9018 Section 4.3.)
-				   */
-
-			else if (comp_1982 <= 0
-			     &&  subtract_1982(now, cookie_time) > 300)
-				; /* Cookie time is more than 5 minutes in the
-				   * future. (see RFC9018 Section 4.3.)
-				   */
-
-			else if (memcmp( cookie_hash( hash, server_cookie
-			                            , &repinfo->remote_addr
-			                            , cfg->cookie_secret)
-			               , rdata_ptr + 16 , 8 ) == 0) {
-
-				/* Cookie is valid! */
-				edns->cookie_valid = 1;
-				if (comp_1982 > 0 && subt_1982 > 1800)
-					; /* But older than 30 minutes,
-					   * so create a new one anyway */
-
-				else if (!edns_opt_list_append( /* Reuse cookie */
-				    &edns->opt_list_out, LDNS_EDNS_COOKIE, opt_len,
-				    rdata_ptr, region)) {
-					log_err("out of memory");
-					return LDNS_RCODE_SERVFAIL;
-				} else
-					/* Cookie to be reused added to
-					 * outgoing options. Done!
-					 */
-					break;
-			}
-			/* Add a new server cookie to outgoing cookies */
-			server_cookie[ 8] = 1;   /* Version */
-			server_cookie[ 9] = 0;   /* Reserved */
-			server_cookie[10] = 0;   /* Reserved */
-			server_cookie[11] = 0;   /* Reserved */
-			sldns_write_uint32(server_cookie + 12, now);
-			cookie_hash( hash, server_cookie, &repinfo->remote_addr
-			           , cfg->cookie_secret);
-			memcpy(server_cookie + 16, hash, 8);
-			if (!edns_opt_list_append( &edns->opt_list_out
-			                         , LDNS_EDNS_COOKIE
-						 , 24, server_cookie, region)) {
-				log_err("out of memory");
-				return LDNS_RCODE_SERVFAIL;
-			}
-			break;
 		default:
 			break;
 		}
@@ -1268,8 +1115,6 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
 	edns->opt_list_out = NULL;
 	edns->opt_list_inplace_cb_out = NULL;
 	edns->padding_block_size = 0;
-	edns->cookie_present = 0;
-	edns->cookie_valid = 0;
 
 	/* take the options */
 	rdata_len = found->rr_first->size-2;
@@ -1325,8 +1170,7 @@ skip_pkt_rrs(sldns_buffer* pkt, int num)
 
 int 
 parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
-	struct config_file* cfg, struct comm_point* c,
-	struct comm_reply* repinfo, time_t now, struct regional* region)
+	struct config_file* cfg, struct comm_point* c, struct regional* region)
 {
 	size_t rdata_len;
 	uint8_t* rdata_ptr;
@@ -1362,8 +1206,6 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
 	edns->opt_list_out = NULL;
 	edns->opt_list_inplace_cb_out = NULL;
 	edns->padding_block_size = 0;
-	edns->cookie_present = 0;
-	edns->cookie_valid = 0;
 
 	/* take the options */
 	rdata_len = sldns_buffer_read_u16(pkt);
@@ -1372,7 +1214,7 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
 	rdata_ptr = sldns_buffer_current(pkt);
 	/* ignore rrsigs */
 	return parse_edns_options_from_query(rdata_ptr, rdata_len, edns, cfg,
-			c, repinfo, now, region);
+			c, region);
 }
 
 void

util/data/msgparse.h

@@ -72,7 +72,6 @@ struct regional;
 struct edns_option;
 struct config_file;
 struct comm_point;
-struct comm_reply;
 
 /** number of buckets in parse rrset hash table. Must be power of 2. */
 #define PARSE_TABLE_SIZE 32
@@ -218,6 +217,8 @@ struct rr_parse {
  * region.
  */
 struct edns_data {
+	/** if EDNS OPT record was present */
+	int edns_present;
 	/** Extended RCODE */
 	uint8_t ext_rcode;
 	/** The EDNS version number */
@@ -237,13 +238,7 @@ struct edns_data {
 	struct edns_option* opt_list_inplace_cb_out;
 	/** block size to pad */
 	uint16_t padding_block_size;
-	/** if EDNS OPT record was present */
-	unsigned int edns_present   : 1;
-	/** if a cookie was present */
-	unsigned int cookie_present : 1;
-	/** if the cookie validated */
-	unsigned int cookie_valid   : 1;
-};	
+};
 
 /**
  * EDNS option
@@ -259,15 +254,6 @@ struct edns_option {
 	uint8_t* opt_data;
 };
 
-
-/**
- * Search through an EDNS list to find if the specified option.
- * @param option: The EDNS list which we search in
- * @param code: the option code that we search for
- * @return: returns the option if it is there, and NULL when it is not
- */
-struct edns_option* edns_list_get_option(struct edns_option* option, uint16_t code);
-
 /**
  * Obtain size in the packet of an rr type, that is before dname type.
  * Do TYPE_DNAME, and type STR, yourself. Gives size for most regular types.
@@ -329,8 +315,7 @@ int skip_pkt_rrs(struct sldns_buffer* pkt, int num);
  *	RCODE formerr if OPT is badly formatted and so on.
  */
 int parse_edns_from_query_pkt(struct sldns_buffer* pkt, struct edns_data* edns,
-	struct config_file* cfg, struct comm_point* c,
-	struct comm_reply* repinfo, time_t now, struct regional* region);
+	struct config_file* cfg, struct comm_point* c, struct regional* region);
 
 /**
  * Calculate hash value for rrset in packet.

util/data/msgreply.h

@@ -97,6 +97,11 @@ struct query_info {
 	 * have to be generated if it has to be kept during iterative
 	 * resolution. */
 	struct local_rrset* local_alias;
+
+	/** raw query packet */
+	const uint8_t *qbuf;
+	/** length of raw query packet */
+	size_t qbuf_len;
 };
 
 /**

util/module.c

@@ -70,8 +70,6 @@ strmodulevent(enum module_ev e)
 	case module_event_noreply: return "module_event_noreply";
 	case module_event_capsfail: return "module_event_capsfail";
 	case module_event_moddone: return "module_event_moddone";
-	case module_event_interface_not_available: return 
-		"module_event_interface_not_available";
 	case module_event_error: return "module_event_error";
 	}
 	return "bad_event_value";

util/module.h

@@ -579,8 +579,6 @@ enum module_ev {
 	module_event_capsfail,
 	/** next module is done, and its reply is awaiting you */
 	module_event_moddone,
-    /** retry of the query is needed with a rewritten (client) cookie */
-    module_event_interface_not_available,
 	/** error */
 	module_event_error
 };

util/netevent.h

@@ -99,10 +99,6 @@ typedef int comm_point_callback_type(struct comm_point*, void*, int,
 /** to pass write of the write packet is done to callback function
  * used when tcp_write_and_read is enabled */
 #define NETEVENT_PKT_WRITTEN -5
-/** to pass a retry event when the bound interface of a cookie has failed
- * and a retry is needed with a rewritten (client) cookie */
-#define NETEVENT_BOUND_INTERFACE_NOT_AVAILABLE -6
-
 
 /** timeout to slow accept calls when not possible, in msec. */
 #define NETEVENT_SLOW_ACCEPT_TIME 2000

util/siphash.c

@@ -1,165 +0,0 @@
-/*
-   SipHash reference C implementation
-
-   Copyright (c) 2012-2016 Jean-Philippe Aumasson
-   <jeanphilippe.aumasson@gmail.com>
-   Copyright (c) 2012-2014 Daniel J. Bernstein <djb@cr.yp.to>
-
-   To the extent possible under law, the author(s) have dedicated all copyright
-   and related and neighboring rights to this software to the public domain
-   worldwide. This software is distributed without any warranty.
-
-   You should have received a copy of the CC0 Public Domain Dedication along
-   with
-   this software. If not, see
-   <http://creativecommons.org/publicdomain/zero/1.0/>.
- */
-#include <assert.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <string.h>
-
-/* default: SipHash-2-4 */
-#define cROUNDS 2
-#define dROUNDS 4
-
-#define ROTL(x, b) (uint64_t)(((x) << (b)) | ((x) >> (64 - (b))))
-
-#define U32TO8_LE(p, v)                                                        \
-    (p)[0] = (uint8_t)((v));                                                   \
-    (p)[1] = (uint8_t)((v) >> 8);                                              \
-    (p)[2] = (uint8_t)((v) >> 16);                                             \
-    (p)[3] = (uint8_t)((v) >> 24);
-
-#define U64TO8_LE(p, v)                                                        \
-    U32TO8_LE((p), (uint32_t)((v)));                                           \
-    U32TO8_LE((p) + 4, (uint32_t)((v) >> 32));
-
-#define U8TO64_LE(p)                                                           \
-    (((uint64_t)((p)[0])) | ((uint64_t)((p)[1]) << 8) |                        \
-     ((uint64_t)((p)[2]) << 16) | ((uint64_t)((p)[3]) << 24) |                 \
-     ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40) |                 \
-     ((uint64_t)((p)[6]) << 48) | ((uint64_t)((p)[7]) << 56))
-
-#define SIPROUND                                                               \
-    do {                                                                       \
-        v0 += v1;                                                              \
-        v1 = ROTL(v1, 13);                                                     \
-        v1 ^= v0;                                                              \
-        v0 = ROTL(v0, 32);                                                     \
-        v2 += v3;                                                              \
-        v3 = ROTL(v3, 16);                                                     \
-        v3 ^= v2;                                                              \
-        v0 += v3;                                                              \
-        v3 = ROTL(v3, 21);                                                     \
-        v3 ^= v0;                                                              \
-        v2 += v1;                                                              \
-        v1 = ROTL(v1, 17);                                                     \
-        v1 ^= v2;                                                              \
-        v2 = ROTL(v2, 32);                                                     \
-    } while (0)
-
-#ifdef DEBUG
-#define TRACE                                                                  \
-    do {                                                                       \
-        printf("(%3d) v0 %08x %08x\n", (int)inlen, (uint32_t)(v0 >> 32),       \
-               (uint32_t)v0);                                                  \
-        printf("(%3d) v1 %08x %08x\n", (int)inlen, (uint32_t)(v1 >> 32),       \
-               (uint32_t)v1);                                                  \
-        printf("(%3d) v2 %08x %08x\n", (int)inlen, (uint32_t)(v2 >> 32),       \
-               (uint32_t)v2);                                                  \
-        printf("(%3d) v3 %08x %08x\n", (int)inlen, (uint32_t)(v3 >> 32),       \
-               (uint32_t)v3);                                                  \
-    } while (0)
-#else
-#define TRACE
-#endif
-
-int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k,
-            uint8_t *out, const size_t outlen) {
-
-    assert((outlen == 8) || (outlen == 16));
-    uint64_t v0 = 0x736f6d6570736575ULL;
-    uint64_t v1 = 0x646f72616e646f6dULL;
-    uint64_t v2 = 0x6c7967656e657261ULL;
-    uint64_t v3 = 0x7465646279746573ULL;
-    uint64_t k0 = U8TO64_LE(k);
-    uint64_t k1 = U8TO64_LE(k + 8);
-    uint64_t m;
-    int i;
-    const uint8_t *end = in + inlen - (inlen % sizeof(uint64_t));
-    const int left = inlen & 7;
-    uint64_t b = ((uint64_t)inlen) << 56;
-    v3 ^= k1;
-    v2 ^= k0;
-    v1 ^= k1;
-    v0 ^= k0;
-
-    if (outlen == 16)
-        v1 ^= 0xee;
-
-    for (; in != end; in += 8) {
-        m = U8TO64_LE(in);
-        v3 ^= m;
-
-        TRACE;
-        for (i = 0; i < cROUNDS; ++i)
-            SIPROUND;
-
-        v0 ^= m;
-    }
-
-    switch (left) {
-    case 7:
-        b |= ((uint64_t)in[6]) << 48;
-    case 6:
-        b |= ((uint64_t)in[5]) << 40;
-    case 5:
-        b |= ((uint64_t)in[4]) << 32;
-    case 4:
-        b |= ((uint64_t)in[3]) << 24;
-    case 3:
-        b |= ((uint64_t)in[2]) << 16;
-    case 2:
-        b |= ((uint64_t)in[1]) << 8;
-    case 1:
-        b |= ((uint64_t)in[0]);
-        break;
-    case 0:
-        break;
-    }
-
-    v3 ^= b;
-
-    TRACE;
-    for (i = 0; i < cROUNDS; ++i)
-        SIPROUND;
-
-    v0 ^= b;
-
-    if (outlen == 16)
-        v2 ^= 0xee;
-    else
-        v2 ^= 0xff;
-
-    TRACE;
-    for (i = 0; i < dROUNDS; ++i)
-        SIPROUND;
-
-    b = v0 ^ v1 ^ v2 ^ v3;
-    U64TO8_LE(out, b);
-
-    if (outlen == 8)
-        return 0;
-
-    v1 ^= 0xdd;
-
-    TRACE;
-    for (i = 0; i < dROUNDS; ++i)
-        SIPROUND;
-
-    b = v0 ^ v1 ^ v2 ^ v3;
-    U64TO8_LE(out + 8, b);
-
-    return 0;
-}

validator/autotrust.c

@@ -2376,8 +2376,6 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp)
 	edns.opt_list_out = NULL;
 	edns.opt_list_inplace_cb_out = NULL;
 	edns.padding_block_size = 0;
-	edns.cookie_present = 0;
-	edns.cookie_valid = 0;
 	if(sldns_buffer_capacity(buf) < 65535)
 		edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
 	else	edns.udp_size = 65535;