intermediate commit V3; Working up to test

doc/unbound.conf.5.in

@@ -507,6 +507,15 @@ Enable udp upstream even if do-udp is no.  Default is no, and this does not
 change anything.  Useful for TLS service providers, that want no udp downstream
 but use udp to fetch data upstream.
 .TP
+.B upstream-cookies: \fI<yes or no>
+Enable EDNS cookies from upstream connections. DNS Cookies, as specified in 
+RFC 7873 and 9018 provide a limited-protection transaction security mechanism.
+Once a cookie has been exchanged, the resolver and upstream are known to each
+other and requests to the upstream can be exempted from rate limiting, for
+example. Note that RFC9018 specifies that cookies should not be reused for
+multiple outgoing interfaces, which is not supported at this time. The default
+is no.
+.TP
 .B tls\-upstream: \fI<yes or no>
 Enabled or disable whether the upstream queries use TLS only for transport.
 Default is no.  Useful in tunneling scenarios.  The TLS contains plain DNS in

iterator/iterator.c

@@ -68,6 +68,7 @@
 #include "sldns/str2wire.h"
 #include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
+#include "daemon/worker.h"
 
 /* in msec */
 int UNKNOWN_SERVER_NICENESS = 376;
@@ -3944,6 +3945,79 @@ process_request(struct module_qstate* qstate, struct iter_qstate* iq,
 	iter_handle(qstate, iq, ie, id);
 }
 
+
+
+/** find the bound addr in the list of interfaces */
+static int
+get_bound_ip_if(struct outside_network* outnet,
+	struct sockaddr_storage *bound_addr, socklen_t bound_addrlen,
+	struct port_if* pif_return)
+{
+	int i = 0;
+	struct port_if* pif_list;
+	int pif_list_len;
+
+	/* Get the list of interfaces and check that that list isn't just the
+	 * "any" address  */
+	if(addr_is_ip6(bound_addr, bound_addrlen)) {
+		pif_list = outnet->ip6_ifs;
+		pif_list_len = outnet->num_ip6;
+
+		// @TODO fix IPv6
+	} else {
+		pif_list = outnet->ip4_ifs;
+		pif_list_len = outnet->num_ip4;
+		struct sockaddr_storage addr_any;
+		socklen_t addr_any_len = 0;
+
+		struct sockaddr_storage addr_new;
+		socklen_t addr_new_len = 0;
+
+		if (!ipstrtoaddr("0.0.0.0", 0, &addr_any, &addr_any_len)) {
+			/* this shouldn't fail */
+			return 0;
+		}
+
+		log_addr(VERB_DETAIL, "!!!!! outnet->ip4_ifs->addr", &outnet->ip4_ifs->addr, bound_addrlen);
+		log_addr(VERB_DETAIL, "!!!!! addr_any", &addr_any, addr_any_len);
+
+		/* if we let the kernel decide the IP, fill in
+		 * the previously used */
+		if (pif_list_len == 1 &&
+			sockaddr_cmp_addr(&outnet->ip4_ifs->addr, outnet->ip4_ifs->addrlen,
+				&addr_any, addr_any_len) == 0) {
+
+			/* return the interface from the list, but substitute the
+			 * previously used address */
+			memcpy(pif_return, outnet->ip4_ifs, sizeof(struct port_if));
+			memcpy(&pif_return->addr, &addr_new, addr_new_len);
+			pif_return->addrlen = addr_new_len;
+
+			log_addr(VERB_DETAIL, "!!!!! get_bound_ip_if: addr from"
+				" ip4_ifs == 0.0.0.0, new is:", &pif_return->addr, outnet->ip4_ifs->addrlen);
+
+			return 1;
+		}
+	}
+
+	if (pif_list_len == 0) {
+		return 0;
+	}
+
+	for (i = 0; i < pif_list_len; i++) {
+		struct port_if *iface = &pif_list[i];
+
+		if (iface->addrlen == bound_addrlen &&
+			memcmp(&iface->addr, bound_addr, bound_addrlen)) {
+			memcpy(pif_return, iface, sizeof(struct port_if));
+
+			return 1;
+		}
+	}
+
+	return 0;
+}
+
 /** process authoritative server reply */
 static void
 process_response(struct module_qstate* qstate, struct iter_qstate* iq, 
@@ -3952,11 +4026,34 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 {
 	struct msg_parse* prs;
 	struct edns_data edns;
+	struct edns_option* cookie;
 	sldns_buffer* pkt;
 
 	verbose(VERB_ALGO, "process_response: new external response event");
 	iq->response = NULL;
 	iq->state = QUERY_RESP_STATE;
+
+
+	if (event == module_event_interface_not_available) {
+		log_err("!!!!! process_response:event == module_event_interface_not_available");
+	}
+	if (!qstate->reply) {
+		log_err("!!!!! !qstate->reply");
+	}
+
+	// @TODO set renewed cookie here with infra_set_server_cookie, then bail out
+	if(qstate->env->cfg->upstream_cookies && event == module_event_interface_not_available) {
+		struct edns_cookie cookie;
+		// @TODO make into renew cookie function
+		infra_get_cookie(qstate->env->infra_cache, &qstate->reply->remote_addr,
+		qstate->reply->remote_addrlen, iq->dp->name, iq->dp->namelen,
+			*qstate->env->now, &cookie, 1);
+
+		log_err("!!!!!! interface unavailbale, renewing cookie");
+		
+		goto handle_it;
+	}
+
 	if(event == module_event_noreply || event == module_event_error) {
 		if(event == module_event_noreply && iq->timeout_count >= 3 &&
 			qstate->env->cfg->use_caps_bits_for_id &&
@@ -3977,8 +4074,8 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		goto handle_it;
 	}
-	if( (event != module_event_reply && event != module_event_capsfail)
-		|| !qstate->reply) {
+	if( (event != module_event_reply && event != module_event_capsfail
+		&& event != module_event_interface_not_available) || !qstate->reply) {
 		log_err("Bad event combined with response");
 		outbound_list_remove(&iq->outlist, outbound);
 		errinf(qstate, "module iterator received wrong internal event with a response message");
@@ -4011,7 +4108,61 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 		goto handle_it;
 	}
 
-	/* Copy the edns options we may got from the back end */
+	/* handle the upstream response cookie if enabled */
+	if(qstate->env->cfg->upstream_cookies) {
+		if (edns.opt_list_in &&
+			(cookie = edns_list_get_option(edns.opt_list_in,
+				LDNS_EDNS_COOKIE))){
+			struct sockaddr_storage bound_addr;
+			socklen_t bound_addrlen = sizeof(struct sockaddr);
+			struct port_if pif;
+			struct port_if *pif_ptr = &pif;
+
+			/* Get the outgoing interface to store with the cookie */
+			if(event != module_event_interface_not_available &&
+				getsockname(qstate->reply->c->fd,
+				(struct sockaddr *) &bound_addr,
+					&bound_addrlen) != -1) {
+
+				log_addr(VERB_DETAIL, "!!!!! iterator:udp socket:", &bound_addr, bound_addrlen);
+
+				if (!(get_bound_ip_if(qstate->env->worker->back,
+					&bound_addr, bound_addrlen, pif_ptr))) {
+					pif.addrlen = 0;
+				}
+
+				log_addr(VERB_DETAIL, "!!!!! iterator:pif addr:", &pif.addr, pif.addrlen);
+
+			} else {
+				/* Set to zero so the cookie gets renewed */
+				pif.addrlen = 0;
+			}
+
+			/* verify this is a 'complete cookie' (client+server)
+			 * (RFC9018) with the length and store the complete
+			 * cookie in the infra_cache. Do nothing when the cookie
+			 * is already known and update when the server cookie
+			 * changed */
+			if (cookie->opt_len == 24 &&
+				infra_set_server_cookie(qstate->env->infra_cache,
+					&qstate->reply->remote_addr,
+					qstate->reply->remote_addrlen,
+					iq->dp->name, iq->dp->namelen, pif_ptr,
+					cookie) >= 0) {
+				// @TODO do something
+			} else {
+				log_info("upstream response server cookie is not "
+					"added to cache; dropping response");
+				goto handle_it;
+			}
+		} else {
+			//@TODO think about what we do if we did send a cookie
+			// but did not get one back? for now we log_err()
+			log_err("upstream has not responded with a cookie");
+		}
+	}
+
+	/* Copy the edns options we may have gotten from the back end */
 	if(edns.opt_list_in) {
 		qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list_in,
 			qstate->region);

services/cache/infra.c

@@ -230,7 +230,7 @@ setup_domain_limits(struct infra_cache* infra, struct config_file* cfg)
 }
 
 struct infra_cache* 
-infra_create(struct config_file* cfg)
+infra_create(struct config_file* cfg, struct ub_randstate* rnd)
 {
 	struct infra_cache* infra = (struct infra_cache*)calloc(1, 
 		sizeof(struct infra_cache));
@@ -270,6 +270,11 @@ infra_create(struct config_file* cfg)
 		infra_delete(infra);
 		return NULL;
 	}
+	if (!rnd) {
+		infra_delete(infra);
+		return NULL;
+	}
+	infra->random_state = rnd;
 	return infra;
 }
 
@@ -299,7 +304,7 @@ infra_adjust(struct infra_cache* infra, struct config_file* cfg)
 {
 	size_t maxmem;
 	if(!infra)
-		return infra_create(cfg);
+		return infra_create(cfg, ub_initstate(NULL));
 	infra->host_ttl = cfg->host_ttl;
 	infra->infra_keep_probing = cfg->infra_keep_probing;
 	infra_dp_ratelimit = cfg->ratelimit;
@@ -315,7 +320,7 @@ infra_adjust(struct infra_cache* infra, struct config_file* cfg)
 	   !slabhash_is_size(infra->client_ip_rates, cfg->ip_ratelimit_size,
 	   	cfg->ip_ratelimit_slabs)) {
 		infra_delete(infra);
-		infra = infra_create(cfg);
+		infra = infra_create(cfg, ub_initstate(NULL));
 	} else {
 		/* reapply domain limits */
 		traverse_postorder(&infra->domain_limits, domain_limit_free,
@@ -378,17 +383,36 @@ infra_lookup_nottl(struct infra_cache* infra, struct sockaddr_storage* addr,
 	return slabhash_lookup(infra->hosts, k.entry.hash, &k, wr);
 }
 
+/* helper function to fill in random data into the client cookie*/
+void infra_fill_client_cookie_random(struct infra_cache* infra,
+	uint8_t* data) {
+	int i;
+
+	for (i = 0; i < 8; i++) {
+		data[i] = ub_random_max(infra->random_state, 256);
+	}
+}
+
 /** init the data elements */
 static void
 data_entry_init(struct infra_cache* infra, struct lruhash_entry* e, 
 	time_t timenow)
 {
-	struct infra_data* data = (struct infra_data*)e->data;
+	struct infra_data* data;
+	uint8_t client_cookie_data[8] = {0,0,0,0,0,0,0,0};
+
+	infra_fill_client_cookie_random(infra, client_cookie_data);
+
+	data = (struct infra_data*)e->data;
 	data->ttl = timenow + infra->host_ttl;
 	rtt_init(&data->rtt);
 	data->edns_version = 0;
 	data->edns_lame_known = 0;
 	data->probedelay = 0;
+	/* set EDNS cookie to zero, as this also sets the starting state*/
+	memset(&data->cookie, 0, sizeof(struct edns_cookie));
+	data->cookie.pif.out = NULL;
+	memcpy(data->cookie.data.cookie, client_cookie_data, 8);
 	data->isdnsseclame = 0;
 	data->rec_lame = 0;
 	data->lame_type_A = 0;
@@ -459,7 +483,11 @@ infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 		if(e) {
 			/* if its still there we have a writelock, init */
 			/* re-initialise */
-			/* do not touch lameness, it may be valid still */
+
+			// @TODO check if "do not touch lameness" is still true
+			/* do not touch lameness, it may be valid still.
+			 * Also don't touch the cookie, as the cookie logic
+			 * will be handled by the server. */
 			data_entry_init(infra, e, timenow);
 			wr = 1;
 			/* TOP_TIMEOUT remains on reuse */
@@ -685,6 +713,170 @@ infra_edns_update(struct infra_cache* infra, struct sockaddr_storage* addr,
 	return 1;
 }
 
+int
+infra_get_cookie(struct infra_cache* infra, struct sockaddr_storage* addr,
+	socklen_t addrlen, uint8_t* name, size_t namelen,
+	time_t timenow, struct edns_cookie* cookie, int renew)
+{
+	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
+		name, namelen, 1);
+	struct infra_data* data;
+	int needtoinsert = 0;
+
+	if(!e) {
+		if(!(e = new_entry(infra, addr, addrlen, name, namelen, timenow))) {
+			return 0;
+		}
+		needtoinsert = 1;
+	} else if(((struct infra_data*)e->data)->ttl < timenow) {
+		/* EDNS cookies have their own timeout logic controlled by the
+		 * upstream, so we just copy the cookie from the old cache entry */
+		struct edns_cookie c = ((struct infra_data*)e->data)->cookie;
+
+		/* create new cookie if the cache TTL expired, keep the cookie */
+		data_entry_init(infra, e, timenow);
+		((struct infra_data*)e->data)->cookie = c;
+	}
+
+	data = (struct infra_data*) e->data;
+
+	/* renew cookie if the address that is stored isn't available */
+	if (renew == 1 || (data->cookie.pif.addrlen == 0 &&
+		data->cookie.state == SERVER_COOKIE_LEARNED)) {
+		infra_fill_client_cookie_random(infra, (uint8_t*) &data->cookie.data);
+		data->cookie.state = SERVER_COOKIE_UNKNOWN;
+	}
+
+	memcpy(cookie, &data->cookie, sizeof(struct edns_cookie));
+
+	if(needtoinsert) {
+		slabhash_insert(infra->hosts, e->hash, e, e->data, NULL);
+	} else {
+		lock_rw_unlock(&e->lock);
+	}
+
+	return 1;
+}
+
+int 
+infra_set_server_cookie(struct infra_cache* infra, struct sockaddr_storage* addr,
+        socklen_t addrlen, uint8_t* name, size_t namelen, struct port_if *pif,
+        struct edns_option* cookie)
+{
+	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
+		name, namelen, 1);
+	struct infra_data* data;
+
+	/* cookie length verification should be checked and handled by caller */
+	assert(cookie->opt_len == 24);
+
+	/* the client cookie was set on the outgoing upstream, so the entry
+	 * should exists here. This can be false if the cookie has fallen
+	 * out of cache */
+	if (!(e)) {
+		/* No need to insert a new cookie/entry here, this will be
+		 * done with an outgoing request */
+		return 0;
+	}
+
+	data = (struct infra_data*) e->data;
+
+	if (data->cookie.state == COOKIE_NOT_SUPPORTED) {
+		/* we known this upstream doesn't support cookies; the state
+		 * remains unchanged */
+		lock_rw_unlock(&e->lock);
+		return 1;
+	} else if (data->cookie.state == SERVER_COOKIE_LEARNED) {
+		/* wrong client cookie; don't store the server cookie */
+		if (!(memcmp(data->cookie.data.cookie,
+			cookie->opt_data+4, 8))) {
+			/* the state of the cookie remains unchanged as we will
+			 * drop this upstream response */
+
+			verbose(VERB_ALGO, "wrong client cookie from upstream"
+				" with previously seen cookie");
+			lock_rw_unlock(&e->lock);
+			return -1;
+		}
+
+		/* We set the local pif addrlen to 0 if the interface is not found
+		 * so it must be unequal to the stored addrlen */
+		if (data->cookie.pif.addrlen != pif->addrlen &&
+			pif->addrlen == 0){
+			/* don't change the status, but change to cookie length
+			 * so it gets renewed during the lookup (which is 
+			 * where all the cookie creation happens) */
+			data->cookie.pif.addrlen = 0;
+			lock_rw_unlock(&e->lock);
+			log_info("the interface to the upstream response server "
+				"that was bound to this EDNS cookie has changed;"
+				" renewing cookie");
+			return 0;
+		}
+
+		/* the server cookie has changed, but the client cookie has not
+		 * so we update the server cookie */
+		if (memcmp(data->cookie.data.cookie+8,
+				cookie->opt_data+12, 16) != 0) {
+			memcpy(data->cookie.data.cookie, cookie->opt_data, 24);
+			/* the cookie state remains unchanged*/
+
+			verbose(VERB_ALGO, "update new server cookie from upstream");
+			lock_rw_unlock(&e->lock);
+
+			/* log_hex() uses the verbosity levels of verbose() */
+			log_hex("complete cookie: ", cookie->opt_data,
+				cookie->opt_len);
+
+			return 1;
+		}
+
+		/* both the complete cookies are identical, so the state
+		 * remains unchanged */
+		verbose(VERB_ALGO, "correctly received indentical cookie from"
+			" upstream; don't update");
+
+		lock_rw_unlock(&e->lock);
+
+		/* log_hex() uses the verbosity levels of verbose() */
+				log_hex("complete cookie: ", cookie->opt_data,
+					cookie->opt_len);
+
+		return 1;
+	} else { /* cookie state == SERVER_COOKIE_UNKNOWN */
+
+		/* wrong client cookie; don't store the server cookie */
+		if (!(memcmp(data->cookie.data.cookie,
+			cookie->opt_data+4, 8))) {
+			/* the state of the cookie remains unchanged as we will
+			 * drop this upstream response */
+
+			verbose(VERB_ALGO, "wrong client cookie from upstream");
+			lock_rw_unlock(&e->lock);
+			return -1;
+		}
+
+		/* store the server cookie */
+		memcpy(data->cookie.data.cookie, cookie->opt_data, 24);
+		data->cookie.state = SERVER_COOKIE_LEARNED;
+
+		/* store the inbound interface we receive this cookie on */
+		if (pif->addrlen > 0) {
+			memcpy(&data->cookie.pif,
+				pif, sizeof(struct port_if));
+			data->cookie.pif.addrlen = pif->addrlen;
+		}
+		verbose(VERB_QUERY, "storing received server cookie from upstream");
+		lock_rw_unlock(&e->lock);
+
+		/* log_hex() uses the verbosity levels of verbose() */
+		log_hex("complete cookie: ", cookie->opt_data,
+			cookie->opt_len);
+		return 1;
+	}
+
+}
+
 int
 infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,

services/cache/infra.h

@@ -49,9 +49,51 @@
 #include "util/rtt.h"
 #include "util/netevent.h"
 #include "util/data/msgreply.h"
+#include "services/outside_network.h"
 struct slabhash;
 struct config_file;
 
+/* COOKIE @TODO move this to correct spot */
+
+/**
+ * The actual EDNS cookie data. Note that the cookie can be filled with the 
+ * just 'client' section, or with the 'complete' cookie depending on the state
+ * governed by the edns_cookie_state.
+ * The commented struct provides insight on how the bytes in the struct are
+ * structured.
+ */
+struct edns_cookie_data {
+        uint8_t cookie[24];
+        /* struct {
+                uint8_t client[8];
+                uint8_t version;
+                uint8_t reserved[3];
+                uint32_t timestamp;
+                uint8_t hash[8];
+        } components; */
+};
+
+/**
+ * The different states the EDNS cookie can be in
+ */
+enum edns_cookie_state
+{
+        SERVER_COOKIE_UNKNOWN = 0, /* server cookie unknown, client cookie known */
+        SERVER_COOKIE_LEARNED = 1, /* server (and client) cookie known */
+        COOKIE_NOT_SUPPORTED = 2, /* upstream does not supported EDNS/cookies */
+};
+
+/**
+ * Structure for an EDNS cookie (RFC9018), it's internal state, and the
+ * the outgoing address that we bind this cookie to for privacy (RFC9018)
+ */
+struct edns_cookie {
+        enum edns_cookie_state state;
+        struct edns_cookie_data data;
+        struct port_if pif;
+};
+
+
 /**
  * Host information kept for every server, per zone.
  */
@@ -88,6 +130,9 @@ struct infra_data {
 	 * and cause a timeout */
 	uint8_t edns_lame_known;
 
+        /* The EDNS cookie containing the cookie and the internal state */
+        struct edns_cookie cookie;
+
 	/** is the host lame (does not serve the zone authoritatively),
 	 * or is the host dnssec lame (does not serve DNSSEC data) */
 	uint8_t isdnsseclame;
@@ -122,6 +167,8 @@ struct infra_cache {
 	rbtree_type domain_limits;
 	/** hash table with query rates per client ip: ip_rate_key, ip_rate_data */
 	struct slabhash* client_ip_rates;
+        /** random state used in new entries for creating EDNS cookies (RFC9018) */
+        struct ub_randstate* random_state;
 };
 
 /** ratelimit, unless overridden by domain_limits, 0 is off */
@@ -196,7 +243,7 @@ struct rate_data {
  * @param cfg: config parameters or NULL for defaults.
  * @return: new infra cache, or NULL.
  */
-struct infra_cache* infra_create(struct config_file* cfg);
+struct infra_cache* infra_create(struct config_file* cfg, struct ub_randstate* rnd);
 
 /**
  * Delete infra cache.
@@ -318,6 +365,44 @@ int infra_edns_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
 	uint8_t* name, size_t namelen, int edns_version, time_t timenow);
 
+/**
+ * Find and return the cookie from the infra cache data. Creates an entry in
+ * the cache if there isn't one.
+ * @param infra: infrastructure cache.
+ * @param addr: host address.
+ * @param addrlen: length of addr.
+ * @param name: name of zone
+ * @param namelen: length of name
+ * @param timenow: what time it is now.
+ * @param pif: the interface which contains the outgoing address that we bind to
+ * @param cookie: the cookie that is retrieved from cache on success.
+ * @return: 0 on error, cookie pointer remains unchanged then.
+ */
+int infra_get_cookie(struct infra_cache* infra, struct sockaddr_storage* addr,
+        socklen_t addrlen, uint8_t* name, size_t namelen,
+        time_t timenow, struct edns_cookie* cookie, int renew); //@TODO fix/remove renew?
+
+/**
+ * Find the cookie entry in the cache and update it with to make a 'complete cookie'
+ * (client+server) (RFC9018). This function asserts that the cookie param contains
+ * a complete cookie with a length of 24 bytes. If the cache entry isn't found
+ * a new one will be inserted.
+ * @param infra: infrastructure cache.
+ * @param addr: host address.
+ * @param addrlen: length of addr.
+ * @param name: name of zone
+ * @param namelen: length of name
+ * @param timenow: what time it is now.
+ * @param pif: the interface which contains the outgoing address that we bind to
+ * @param cookie: the EDNS cookie option we want to store.
+ * @return -1 if the wrong client cookie is found, 0 if the entry isn't found in
+ *      the cache and a new one is inserted, 1 if the complete cookie is inserted
+ *      or unchanged.
+ */
+int infra_set_server_cookie(struct infra_cache* infra, struct sockaddr_storage* addr,
+        socklen_t addrlen, uint8_t* name, size_t namelen, struct port_if *pif,
+        struct edns_option* cookie);
+
 /**
  * Get Lameness information and average RTT if host is in the cache.
  * This information is to be used for server selection.

services/listen_dnsport.c

@@ -639,7 +639,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			&& !(errno == EADDRNOTAVAIL && verbosity < 4 && !listen)
 #endif
 			) {
-			log_err_addr("can't bind socket", strerror(errno),
+			log_err_addr("1can't bind socket", strerror(errno),
 				(struct sockaddr_storage*)addr, addrlen);
 		}
 #endif /* EADDRINUSE */
@@ -647,7 +647,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		if(WSAGetLastError() != WSAEADDRINUSE &&
 			WSAGetLastError() != WSAEADDRNOTAVAIL &&
 			!(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) {
-			log_err_addr("can't bind socket", 
+			log_err_addr("2can't bind socket", 
 				wsa_strerror(WSAGetLastError()),
 				(struct sockaddr_storage*)addr, addrlen);
 		}
@@ -840,12 +840,12 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 		if(addr->ai_family==AF_INET6 && errno==EINVAL)
 			*noproto = 1;
 		else {
-			log_err_addr("can't bind socket", strerror(errno),
+			log_err_addr("3can't bind socket", strerror(errno),
 				(struct sockaddr_storage*)addr->ai_addr,
 				addr->ai_addrlen);
 		}
 #else
-		log_err_addr("can't bind socket", 
+		log_err_addr("4can't bind socket", 
 			wsa_strerror(WSAGetLastError()),
 			(struct sockaddr_storage*)addr->ai_addr,
 			addr->ai_addrlen);

services/mesh.c

@@ -886,6 +886,8 @@ void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
 		event = module_event_noreply;
 		if(what == NETEVENT_CAPSFAIL)
 			event = module_event_capsfail;
+		if(what == NETEVENT_BOUND_INTERFACE_NOT_AVAILABLE)
+			event = module_event_interface_not_available;
 	}
 	mesh_run(mesh, e->qstate->mesh_info, event, e);
 }

services/outside_network.c

@@ -1073,7 +1073,8 @@ reuse_tcp_remove_tree_list(struct outside_network* outnet,
 			char buf[256];
 			addr_to_str(&reuse->addr, reuse->addrlen, buf,
 				sizeof(buf));
-			log_err("reuse tcp delete: node not present, internal error, %s ssl %d lru %d", buf, reuse->is_ssl, reuse->item_on_lru_list);
+			log_err("reuse tcp delete: node not present, internal error, %s ssl "
+				"%d lru %d", buf, reuse->is_ssl, reuse->item_on_lru_list);
 		}
 		reuse->node.key = NULL;
 		/* defend against loops on broken tree by zeroing the
@@ -1418,6 +1419,7 @@ outnet_send_wait_udp(struct outside_network* outnet)
 		pend->pkt_len = 0;
 		log_assert(!pend->sq->busy);
 		pend->sq->busy = 1;
+
 		if(!randomize_and_send_udp(pend, outnet->udp_buff,
 			pend->timeout)) {
 			/* callback error on pending */
@@ -1442,6 +1444,11 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	struct pending* p;
 	verbose(VERB_ALGO, "answer cb");
 
+
+	log_err("!!!!! outnet_udp_cb: HERE, error: %d", error);
+
+	// @TODO this is the function where we find the failed kernel call
+
 	if(error != NETEVENT_NOERROR) {
 		verbose(VERB_QUERY, "outnetudp got udp error %d", error);
 		return 0;
@@ -1483,6 +1490,7 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 
 	verbose(VERB_ALGO, "received udp reply.");
 	log_buf(VERB_ALGO, "udp message", c->buffer);
+
 	if(p->pc->cp != c) {
 		verbose(VERB_QUERY, "received reply id,addr on wrong port. "
 			"dropped.");
@@ -1973,6 +1981,9 @@ udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int pfxlen,
 	int port, int* inuse, struct ub_randstate* rnd, int dscp)
 {
 	int fd, noproto;
+
+	log_err("!!!!! udp_sockport: HERE!");
+
 	if(addr_is_ip6(addr, addrlen)) {
 		int freebind = 0;
 		struct sockaddr_in6 sa = *(struct sockaddr_in6*)addr;
@@ -2053,7 +2064,6 @@ static int udp_connect_needs_log(int err)
 	return 1;
 }
 
-
 /** Select random interface and port */
 static int
 select_ifport(struct outside_network* outnet, struct pending* pend,
@@ -2067,11 +2077,21 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 			"outgoing interfaces of that family");
 		return 0;
 	}
+
 	log_assert(outnet->unused_fds);
 	tries = 0;
 	while(1) {
-		my_if = ub_random_max(outnet->rnd, num_if);
-		pif = &ifs[my_if];
+		/* if we have a bound IP address for the EDNS cookie in the
+		 * message, use that interface */
+		if (!(pend->sq->bound_interface)) {
+			my_if = ub_random_max(outnet->rnd, num_if);
+			pif = &ifs[my_if];
+		} else {
+			pif = pend->sq->bound_interface;
+			log_err("!!!!! select_ifport:bound_addrlen: %d", pif->addrlen);
+			log_addr(VERB_OPS, "!!!!! select_ifport:bound_addrlen:", &pif->addr, pif->addrlen);
+		}
+
 #ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
 		if(outnet->udp_connect) {
 			/* if we connect() we cannot reuse fds for a port */
@@ -2094,6 +2114,9 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 				break;
 			}
 		}
+
+		log_err("!!!!! select_ifport:pif->inuse: %d, pif->maxout: %d", pif->inuse, pif->maxout);
+
 		/* try to open new port, if fails, loop to try again */
 		log_assert(pif->inuse < pif->maxout);
 		portno = pif->avail_ports[my_port - pif->inuse];
@@ -2103,6 +2126,15 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 		fd = udp_sockport(&pif->addr, pif->addrlen, pif->pfxlen,
 			portno, &inuse, outnet->rnd, outnet->ip_dscp);
 		if(fd == -1 && !inuse) {
+			log_err("!!!! select_ifport:nonrecoverable error making socket");
+
+			/* we need to retry sending this message with a cookie
+			 * without a bound interface. The cookie needs to be
+			 * changed as to not leak the client cookie part that
+			 * is linked to this outgoing interface. */
+			if (pend->sq->bound_interface != NULL) {
+				pend->sq->bound_interface_failed = 1;
+			}
 			/* nonrecoverable error making socket */
 			return 0;
 		}
@@ -2229,6 +2261,7 @@ pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet,
 	pend->cb = cb;
 	pend->cb_arg = cb_arg;
 	pend->node.key = pend;
+
 	pend->timer = comm_timer_create(sq->outnet->base, pending_udp_timer_cb,
 		pend);
 	if(!pend->timer) {
@@ -2565,6 +2598,7 @@ serviced_timer_cb(void* arg)
 	 * will get attached by the time we get an answer. */
 	return;
 delete:
+	log_err("!!!!! serviced_timer_cb:delete serviced_udp_send");
 	serviced_callbacks(sq, NETEVENT_CLOSED, NULL, NULL);
 }
 
@@ -2575,7 +2609,7 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	char* tls_auth_name, struct sockaddr_storage* addr, socklen_t addrlen,
 	uint8_t* zone, size_t zonelen, int qtype, struct edns_option* opt_list,
 	size_t pad_queries_block_size, struct alloc_cache* alloc,
-	struct regional* region)
+	struct port_if* bound_interface, struct regional* region)
 {
 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
 	struct timeval t;
@@ -2638,6 +2672,18 @@ serviced_create(struct outside_network* outnet, sldns_buffer* buff, int dnssec,
 	sq->status = serviced_initial;
 	sq->retry = 0;
 	sq->to_be_deleted = 0;
+	if (bound_interface != NULL) {
+		sq->bound_interface = regional_alloc_init(region,
+			bound_interface, sizeof(struct port_if));
+		if (!sq->bound_interface) {
+			alloc_reg_release(alloc, region);
+			free(sq);
+			return NULL;
+		}
+	} else {
+		sq->bound_interface = NULL;
+	}
+	sq->bound_interface_failed = 0;
 	sq->padding_block_size = pad_queries_block_size;
 #ifdef UNBOUND_DEBUG
 	ins =
@@ -3004,6 +3050,12 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 		}
 		sq->outnet->svcd_overhead = backlen;
 	}
+
+	/* set the error to retry the cookie with a new client cookie set */
+	if (sq->bound_interface != NULL && sq->bound_interface_failed) {
+		error = NETEVENT_BOUND_INTERFACE_NOT_AVAILABLE;
+	}
+
 	/* test the actual sq->cblist, because the next elem could be deleted*/
 	while((p=sq->cblist) != NULL) {
 		sq->cblist = p->next; /* remove this element */
@@ -3370,9 +3422,11 @@ outnet_serviced_query(struct outside_network* outnet,
 	struct service_callback* cb;
 	struct edns_string_addr* client_string_addr;
 	struct regional* region;
+	struct edns_cookie cookie;
 	struct edns_option* backed_up_opt_list = qstate->edns_opts_back_out;
 	struct edns_option* per_upstream_opt_list = NULL;
 	time_t timenow = 0;
+	struct port_if* pif = NULL;
 
 	/* If we have an already populated EDNS option list make a copy since
 	 * we may now add upstream specific EDNS options. */
@@ -3409,6 +3463,28 @@ outnet_serviced_query(struct outside_network* outnet,
 			client_string_addr->string, region);
 	}
 
+	if (env->cfg->upstream_cookies &&
+		infra_get_cookie(env->infra_cache, addr, addrlen, zone, zonelen,
+			*env->now, &cookie, 0)) {
+
+		if (cookie.state == SERVER_COOKIE_LEARNED) {
+			/* We known the complete cookie, so we attach it */
+			edns_opt_list_append(&per_upstream_opt_list, LDNS_EDNS_COOKIE,
+				24, cookie.data.cookie, region);
+
+			if (cookie.pif.addrlen > 0) {
+				pif = &cookie.pif;
+
+				log_addr(VERB_DETAIL, "!!!!! outnet_serviced_query:pif addr:", &cookie.pif.addr, cookie.pif.addrlen);
+			}
+		} else if (cookie.state == SERVER_COOKIE_UNKNOWN) {
+			/* We know just client cookie, so we attach it */
+			edns_opt_list_append(&per_upstream_opt_list, LDNS_EDNS_COOKIE,
+				8, cookie.data.cookie, region);
+		} /* We ignore COOKIE_NOT_SUPPORTED */
+
+	}
+
 	serviced_gen_query(buff, qinfo->qname, qinfo->qname_len, qinfo->qtype,
 		qinfo->qclass, flags);
 	sq = lookup_serviced(outnet, buff, dnssec, addr, addrlen,
@@ -3441,7 +3517,7 @@ outnet_serviced_query(struct outside_network* outnet,
 			per_upstream_opt_list,
 			( ssl_upstream && env->cfg->pad_queries
 			? env->cfg->pad_queries_block_size : 0 ),
-			env->alloc, region);
+			env->alloc, pif, region);
 		if(!sq) {
 			if(check_ratelimit) {
 				infra_ratelimit_dec(env->infra_cache,
@@ -3531,7 +3607,8 @@ fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
 			if(outnet->num_ip6 == 0) {
 				char to[64];
 				addr_to_str(to_addr, to_addrlen, to, sizeof(to));
-				verbose(VERB_QUERY, "need ipv6 to send, but no ipv6 outgoing interfaces, for %s", to);
+				verbose(VERB_QUERY, "need ipv6 to send, but no ipv6 outgoing "
+					"interfaces, for %s", to);
 				return -1;
 			}
 			i = ub_random_max(outnet->rnd, outnet->num_ip6);
@@ -3540,7 +3617,8 @@ fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
 			if(outnet->num_ip4 == 0) {
 				char to[64];
 				addr_to_str(to_addr, to_addrlen, to, sizeof(to));
-				verbose(VERB_QUERY, "need ipv4 to send, but no ipv4 outgoing interfaces, for %s", to);
+				verbose(VERB_QUERY, "need ipv4 to send, but no ipv4 outgoing "
+					"interfaces, for %s", to);
 				return -1;
 			}
 			i = ub_random_max(outnet->rnd, outnet->num_ip4);

services/outside_network.h

@@ -527,6 +527,13 @@ struct serviced_query {
 	struct comm_timer* timer;
 	/** true if serviced_query is currently doing net I/O and may block */
 	int busy;
+	/** interface bound to the EDNS cookie @TODO fix this */
+	struct port_if* bound_interface;
+	/** flag to create a retry when the opening of the socket on the
+	 * bound interface failed. This enables rewriting of the cookie without 
+	 * leaking the previously sent client cookie */
+	int bound_interface_failed;
+
 };
 
 /**

sldns/wire2str.c

@@ -192,6 +192,7 @@ static sldns_lookup_table sldns_edns_options_data[] = {
 	{ 6, "DHU" },
 	{ 7, "N3U" },
 	{ 8, "edns-client-subnet" },
+	{ 10, "Cookie" },
 	{ 11, "edns-tcp-keepalive"},
 	{ 12, "Padding" },
 	{ 15, "EDE"},

testcode/fake_event.c

@@ -1228,6 +1228,9 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 		struct edns_option* backed_up_opt_list =
 			qstate->edns_opts_back_out;
 		struct edns_option* per_upstream_opt_list = NULL;
+		struct edns_cookie cookie;
+		struct port_if* pif;
+
 		/* If we have an already populated EDNS option list make a copy
 		 * since we may now add upstream specific EDNS options. */
 		if(qstate->edns_opts_back_out) {
@@ -1256,6 +1259,25 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 				client_string_addr->string_len,
 				client_string_addr->string, qstate->region);
 		}
+
+		if (qstate->env->cfg->upstream_cookies &&
+			infra_get_cookie(env->infra_cache, addr, addrlen,
+				zone, zonelen, *env->now, outnet, &pif, &cookie)) {
+
+			if (cookie.state == SERVER_COOKIE_LEARNED) {
+				/* We known the complete cookie, so we attach it */
+				edns_opt_list_append(&per_upstream_opt_list,
+					LDNS_EDNS_COOKIE, 24, cookie.data.cookie,
+					qstate->region);
+			} else if (cookie.state == SERVER_COOKIE_UNKNOWN) {
+				/* We know just client cookie, so we attach it */
+				edns_opt_list_append(&per_upstream_opt_list,
+					LDNS_EDNS_COOKIE, 8,
+					cookie.data.cookie,
+					qstate->region);
+			} /* We ignore COOKIE_NOT_SUPPORTED */
+		}
+
 		/* add edns */
 		edns.edns_present = 1;
 		edns.ext_rcode = 0;

testcode/testpkts.c

@@ -25,6 +25,7 @@ struct sockaddr_storage;
 #include <errno.h>
 #include <stdarg.h>
 #include <ctype.h>
+#include <time.h>
 #include "testcode/testpkts.h"
 #include "util/net_help.h"
 #include "sldns/sbuffer.h"
@@ -39,6 +40,8 @@ struct sockaddr_storage;
 #define MAX_LINE   10240	
 /** string to show in warnings and errors */
 static const char* prog_name = "testpkts";
+/** hardcoded EDNS server cookie (RFC7876) */
+static const char* hardcoded_server_cookie = "7e8b5fcc6a4bc7bc";
 
 #ifndef UTIL_LOG_H
 /** verbosity definition for compat */
@@ -140,6 +143,13 @@ static void matchline(char* line, struct entry* e)
 			e->match_noedns = 1;
 		} else if(str_keyword(&parse, "ednsdata")) {
 			e->match_ednsdata_raw = 1;
+		} else if(str_keyword(&parse, "random_client_cookie")) {
+			e->match_random_client_cookie = 1;
+		} else if (str_keyword(&parse, "random_complete_cookie_renewed")) {
+			e->match_random_complete_cookie = 1;
+			e->match_random_complete_cookie_renewed = 1;
+		} else if(str_keyword(&parse, "random_complete_cookie")) {
+			e->match_random_complete_cookie = 1;
 		} else if(str_keyword(&parse, "UDP")) {
 			e->match_transport = transport_udp;
 		} else if(str_keyword(&parse, "TCP")) {
@@ -263,6 +273,11 @@ static void adjustline(char* line, struct entry* e,
 			pkt->packet_sleep = (unsigned int) strtol(parse, (char**)&parse, 10);
 			while(isspace((unsigned char)*parse)) 
 				parse++;
+		} else if (str_keyword(&parse, "server_cookie_renew")) {
+			e->server_cookie = 1;
+			e->server_cookie_renew = 1;
+		} else if (str_keyword(&parse, "server_cookie")) {
+			e->server_cookie = 1;
 		} else {
 			error("could not parse ADJUST: '%s'", parse);
 		}
@@ -299,6 +314,8 @@ static struct entry* new_entry(void)
 	e->copy_ednsdata_assume_clientsubnet = 0;
 	e->increment_ecs_scope = 0;
 	e->sleeptime = 0;
+	e->server_cookie = 0;
+	e->server_cookie_renew = 0;
 	e->next = NULL;
 	return e;
 }
@@ -1499,6 +1516,110 @@ match_ednsdata(uint8_t* q, size_t qlen, uint8_t* p, size_t plen)
 	return (memcmp(walk_p+8, walk_q+8, walk_qlen-8) == 0);
 }
 
+/** verify that a client cookie of length 8 is in the EDNS data of the query */
+static int
+match_random_client_cookie(uint8_t* query, size_t query_len)
+{
+	uint8_t* walk_query = query;
+	size_t walk_query_len = query_len;
+
+	if(!pkt_find_edns_opt(&walk_query, &walk_query_len)) {
+		walk_query_len = 0;
+		log_err("no edns found");
+	}
+
+	/* class + ttl + rdlen = 8 */
+	if (walk_query_len <= 8) {
+		verbose(3, "No correct EDNS record found, so no cookie");
+		return 0;
+	}
+
+	/* class + ttl + rdlen + opt_code + opt_len = 12 */
+	if (walk_query_len < 12) {
+		verbose(3, "No EDNS opt found, so no cookie");
+		return 0;
+	}
+
+	if (sldns_read_uint16(walk_query+8) != 10 /* LDNS_EDNS_COOKIE */) {
+		verbose(3, "EDNS option is not a cookie");
+		return 0;
+	}
+	if (sldns_read_uint16(walk_query+10) != 8) {
+		verbose(3, "EDNS cookie is not 8 bytes, so not a correct client cookie");
+		return 0;
+	}
+
+	return 1;
+}
+
+/** verify that a complete EDNS cookie (client+server) (RFC9018) of length 24
+  * is in the EDNS data of the query and the hardcoded cookie is the same */
+static int
+match_random_complete_cookie(uint8_t* query, size_t query_len, struct entry* p)
+{
+	uint8_t* walk_query = query;
+	size_t walk_query_len = query_len;
+
+	if(!pkt_find_edns_opt(&walk_query, &walk_query_len)) {
+		walk_query_len = 0;
+		log_err("no edns found");
+	}
+
+	/* class + ttl + rdlen = 8 */
+	if(walk_query_len <= 8) {
+		verbose(3, "No correct EDNS record , so no cookie");
+		return 0;
+	}
+
+	walk_query += 8;
+	walk_query_len -= 8;
+
+	/* opt_code + opt_len = 4 */
+	if (walk_query_len < 4) {
+		verbose(3, "No EDNS opt found, so no cookie");
+		return 0;
+	}
+
+	if (sldns_read_uint16(walk_query) != 10 /* LDNS_EDNS_COOKIE */) {
+		verbose(3, "EDNS option is not a cookie");
+		return 0;
+	}
+	if (sldns_read_uint16(walk_query+2) != 24) {
+		verbose(3, "EDNS cookie is not 24 bytes, so not a correct complete cookie");
+		return 0;
+	}
+
+	/* opt_code + opt_len + cookie_data = 28 */
+	if (walk_query_len < 28) {
+		verbose(3, "No complete cookie found in the packet");
+		return 0;
+	}
+
+	if (p->match_random_complete_cookie_renewed) {
+		uint8_t renewed_cookie[16];
+
+		/* shuffle the hardcoded cookie like adjust_packet() does */
+		memcpy(renewed_cookie, hardcoded_server_cookie+8, 8);
+		memcpy(renewed_cookie+8, hardcoded_server_cookie, 8);
+		
+		/* client_cookie = 8 */
+		if (!(memcmp(walk_query+8, renewed_cookie, 16))) {
+			verbose(3, "EDNS server cookie does not match the renewed"
+				"cookie, so not a correct complete cookie");
+		return 0;
+		}
+	}
+
+	/* client_cookie = 8 */
+	if (!(memcmp(walk_query+8, hardcoded_server_cookie, 16))) {
+		verbose(3, "EDNS server cookie does not match the hardcoded cookie, "
+			"so not a correct complete cookie");
+		return 0;
+	}
+
+	return 1;
+}
+
 /* finds entry in list, or returns NULL */
 struct entry* 
 find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
@@ -1594,6 +1715,16 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 			verbose(3, "bad EDNS data match.\n");
 			continue;
 		}
+		if (p->match_random_client_cookie &&
+				!match_random_client_cookie(query_pkt, len)) {
+			verbose(3, "bad client cookie match.\n");
+			continue;
+		}
+		if (p->match_random_complete_cookie &&
+				!match_random_complete_cookie(query_pkt, len, p)) {
+			verbose(3, "bad complete cookie match.\n");
+			continue;
+		}
 		if(p->match_transport != transport_any && p->match_transport != transport) {
 			verbose(3, "bad transport\n");
 			continue;
@@ -1690,6 +1821,118 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 	if(match->copy_id && reslen >= 1 && query_len >= 1)
 		res[0] = query_pkt[0];
 
+	if(match->server_cookie) {
+		/** Find the cookie option and add the server cookie if 
+		 * the client cookie is present and not already there */
+		uint8_t* walk_query = query_pkt;
+		size_t walk_query_len = query_len;
+		uint8_t* walk_response;
+		size_t walk_response_len;
+
+		uint8_t* rdlen_ptr_response;
+
+		/* create space for the server cookie in the response packet */
+		res = realloc(res, reslen + 28);
+		reslen += 28;
+
+		walk_response = res;
+		walk_response_len = reslen;
+
+		if (!(walk_response)) {
+			log_err("testbound: out of memory; send without cookie");
+			return;
+		}
+
+		/* verify that we have a EDNS record */
+		if(!pkt_find_edns_opt(&walk_query, &walk_query_len)) {
+			walk_query_len = 0;
+			log_err("testbound: no EDNS in the query packet when "
+				"trying to attach a EDNS cookie");
+		}
+		if(!pkt_find_edns_opt(&walk_response, &walk_response_len)) {
+			walk_response_len = 0;
+			log_err("testbound: no EDNS in the response packet when"
+				 "trying to attach a EDNS cookie");
+		}
+
+		/* verify that we have a EDNS option */
+		if (walk_query_len < 12) /* class + ttl + rdlen + opt_code + opt_len */ {
+			/* invalid or no (OPT) record in the query */
+			walk_query_len = 0;
+			log_err("testbound: invalid or no OPT record in the query packet");
+		}
+		if (walk_response_len < 8) /* class + ttl + rdlen */ {
+			walk_response_len = 0;
+			log_err("testbound: invalid OPT record in the response packet");
+		}
+
+		/* store the location of the rdlen */
+		rdlen_ptr_response = walk_response + 6;
+
+		/* skip past the OPT record to get to the option */
+		walk_query += 8;
+		walk_query_len -= 8;
+		walk_response += 8;
+		walk_response_len -= 8;
+
+		/* verify that the client cookie exists */
+		if (walk_query_len < 12 /* opt_code + opt_len + client cookie */) {
+			walk_query_len = 0;
+			log_err("testbound: no EDNS cookie in the query packet");
+		}
+
+		/* assume one record in the query */
+		if (sldns_read_uint16(walk_query) != 10 /* LDNS_EDNS_COOKIE */ ||
+			!(sldns_read_uint16(walk_query+2) == 8 || /* client cookie length */
+			sldns_read_uint16(walk_query+2) == 24)) { /* client+server cookie */
+			/* incorrect cookie */
+			walk_query_len = 0;
+			log_err("testbound: invalid EDNS cookie in the query packet");
+		}
+
+		if (walk_query_len > 0 && walk_response_len > 0) {
+			/* create space for the cookie, as the length of the
+			 * rest of the response is 0 */
+
+			/* depending on the incoming cookie, add the server cookie
+			 * or copy the complete cookie to the response */
+			if (sldns_read_uint16(walk_query+2) == 8) {
+				/* copy the EDNS client cookie from the query
+				 * packet to the response */
+				memmove(walk_response, walk_query, 12);
+
+				/* add the server cookie to the client cookie to make it
+				 * 'complete'. we fake the siphash specified in RFC9018
+				 * by hardcoding the server cookie */
+				memmove(walk_response+12, hardcoded_server_cookie, 16);
+
+				/* update the RDLEN and OPTLEN */
+				sldns_write_uint16(rdlen_ptr_response, 28);
+				sldns_write_uint16(walk_response+2, 24);
+			} else if (sldns_read_uint16(walk_query+2) == 24) {
+				/* update the RDLEN */
+				sldns_write_uint16(rdlen_ptr_response, 28);
+
+				/* we fake verification of the cookie and send
+				 * it back like it's still valid. We renew the cookie
+				 * if this desired */
+				if (match->server_cookie_renew) {
+					/* copy the cookie from the response but add a
+					 * different cookie (by reshuffeling server cookie) */
+					memmove(walk_response, walk_query, 12);
+					memmove(walk_response+12, walk_query+12+8, 8);
+					memmove(walk_response+12+8, walk_query+12, 8);
+				} else {
+					memmove(walk_response, walk_query, 28);
+				}
+			} else {
+				log_err("testbound: the incoming EDNS cookie has the wrong length");
+			}
+		} else {
+			log_err("testbound: an error has occured while parsing the EDNS cookie");
+		}
+	}
+
 	if(match->copy_ednsdata_assume_clientsubnet) {
 		/** Assume there is only one EDNS option, which is ECS.
 		 * Copy source mask from query to scope mask in reply. Assume

testcode/testpkts.h

@@ -214,6 +214,14 @@ struct entry {
 	uint8_t match_noedns;
 	/** match edns data field given in hex */
 	uint8_t match_ednsdata_raw;
+	/** match an EDNS cookie (RFC7873) of length 8*/
+	uint8_t match_random_client_cookie;
+	/** match an EDNS cookie (RFC7873) of length 24, we call
+	 * this "complete" (RFC9018) */
+	uint8_t match_random_complete_cookie;
+	/** match an EDNS compelete cookie (RFC7873) of length 24, which cannot be
+	 * the same as the hardcoded client cookie */
+	uint8_t match_random_complete_cookie_renewed;
 	/** match query serial with this value. */
 	uint32_t ixfr_soa_serial;
 	/** match on UDP/TCP */
@@ -237,6 +245,14 @@ struct entry {
 	/** in seconds */
 	unsigned int sleeptime; 
 
+	/** add a server cookie (RFC9018) to the response (provided the query
+	 * contains a client cookie) */
+	uint8_t server_cookie;
+	/** renew the server cookie (RFC9018) to the response (provided the query
+	 * contains a client cookie) by shuffling the bytes in the server cookie
+	 * Note that this also sets "server_cookie" to 1*/
+	uint8_t server_cookie_renew;
+
 	/** some number that names this entry, line number in file or so */
 	int lineno;
 

testcode/unitmain.c

@@ -469,11 +469,12 @@ infra_test(void)
 	struct infra_key* k;
 	struct infra_data* d;
 	int init = 376;
+	struct ub_randstate* rnd = ub_initstate(NULL);
 
 	unit_show_feature("infra cache");
 	unit_assert(ipstrtoaddr("127.0.0.1", 53, &one, &onelen));
 
-	slab = infra_create(cfg);
+	slab = infra_create(cfg, rnd);
 	unit_assert( infra_host(slab, &one, onelen, zone, zonelen, now,
 		&vs, &edns_lame, &to) );
 	unit_assert( vs == 0 && to == init && edns_lame == 0 );
@@ -528,6 +529,7 @@ infra_test(void)
 
 	infra_delete(slab);
 	config_delete(cfg);
+	ub_randfree(rnd);
 }
 
 #include "util/random.h"

testdata/edns_upstream_cookies.rpl

@@ -0,0 +1,234 @@
+; config options
+server:
+	upstream-cookies: yes
+
+stub-zone:
+	name: example.com
+	stub-addr: 1.1.1.1
+
+CONFIG_END
+
+SCENARIO_BEGIN Test edns-upstream-cookies
+; Scenario overview:
+; - Send a client cookie to the upstream and receive one back and store it
+; - Send the client+server (complete) cookie and receive it back.
+; - pass time and send the old complete cookie and receive a new one back
+
+
+; Client query for upstream to Unbound
+STEP 1 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		a.example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Check that we send a server cookie to the upstream
+STEP 2 CHECK_OUT_QUERY
+ENTRY_BEGIN
+	MATCH qname qtype random_client_cookie
+	SECTION QUESTION
+		a.example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Reply with a server cookie
+STEP 3 REPLY
+ENTRY_BEGIN
+	REPLY QR NOERROR
+	ADJUST copy_id server_cookie
+	SECTION QUESTION
+		a.example.com. IN A
+	SECTION ANSWER
+		a.example.com. IN A 1.2.3.4
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+
+; Check the answer from Unbound for the client
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all
+	REPLY QR RA RD NOERROR
+	SECTION QUESTION
+		a.example.com. IN A
+	SECTION ANSWER
+		a.example.com. IN A 1.2.3.4
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+
+; Query a second time to verify that we have the server cookie stored
+
+; Client query for upstream to Unbound
+STEP 11 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		b.example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Check that we send a server cookie to the upstream
+STEP 12 CHECK_OUT_QUERY
+ENTRY_BEGIN
+	MATCH qname qtype random_complete_cookie
+	SECTION QUESTION
+		b.example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Reply with a server cookie
+STEP 13 REPLY
+ENTRY_BEGIN
+	REPLY QR NOERROR
+	ADJUST copy_id server_cookie
+	SECTION QUESTION
+		b.example.com. IN A
+	SECTION ANSWER
+		b.example.com. IN A 1.2.3.4
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+
+; Check the answer from Unbound for the client
+STEP 14 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all
+	REPLY QR RA RD NOERROR
+	SECTION QUESTION
+		b.example.com. IN A
+	SECTION ANSWER
+		b.example.com. IN A 1.2.3.4
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+
+; Query a third time while waiting more than hour + 5 minutes, so we should
+; have a new cookie
+
+STEP 20 TIME_PASSES ELAPSE 4000
+
+; Client query for upstream to Unbound
+STEP 21 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		c.example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Check that we send a server cookie to the upstream
+STEP 22 CHECK_OUT_QUERY
+ENTRY_BEGIN
+	MATCH qname qtype random_complete_cookie
+	SECTION QUESTION
+		c.example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Reply with an updated server cookie that
+STEP 23 REPLY
+ENTRY_BEGIN
+	REPLY QR NOERROR
+	ADJUST copy_id server_cookie_renew
+	SECTION QUESTION
+		c.example.com. IN A
+	SECTION ANSWER
+		c.example.com. IN A 1.2.3.4
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+
+; Check the answer from Unbound for the client
+STEP 24 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all
+	REPLY QR RA RD NOERROR
+	SECTION QUESTION
+		c.example.com. IN A
+	SECTION ANSWER
+		c.example.com. IN A 1.2.3.4
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+
+; Verify that the cookie was updated since the timestep
+
+; Client query for upstream to Unbound
+STEP 31 QUERY
+ENTRY_BEGIN
+	REPLY RD
+	SECTION QUESTION
+		d.example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Check that we send a server cookie to the upstream
+STEP 32 CHECK_OUT_QUERY
+ENTRY_BEGIN
+	MATCH qname qtype random_complete_cookie_renewed
+	SECTION QUESTION
+		d.example.com. IN A
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+; Reply with an updated server cookie that
+STEP 33 REPLY
+ENTRY_BEGIN
+	REPLY QR NOERROR
+	ADJUST copy_id server_cookie_renew
+	SECTION QUESTION
+		d.example.com. IN A
+	SECTION ANSWER
+		d.example.com. IN A 1.2.3.4
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+
+; Check the answer from Unbound for the client
+STEP 34 CHECK_ANSWER
+ENTRY_BEGIN
+	MATCH all
+	REPLY QR RA RD NOERROR
+	SECTION QUESTION
+		d.example.com. IN A
+	SECTION ANSWER
+		d.example.com. IN A 1.2.3.4
+	SECTION ADDITIONAL
+		HEX_EDNSDATA_BEGIN
+	    HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END

testdata/edns_upstream_cookies.tdir/edns_upstream_cookies.dsc

@@ -0,0 +1,16 @@
+BaseName: edns_upstream_cookies
+Version: 1.0
+Description: Test Upstream cookies with changing interfaces
+CreationDate: Fri Aug 20 15:42:11 UTC 2021
+Maintainer: Tom Carpay
+Category: 
+Component:
+CmdDepends: 
+Depends:
+Help:
+Pre: edns_upstream_cookies.pre
+Post: edns_upstream_cookies.post
+Test: edns_upstream_cookies.test
+AuxFiles: 
+Passed:
+Failure:

testdata/edns_upstream_cookies.tdir/edns_upstream_cookies.post

@@ -0,0 +1,13 @@
+# #-- edns_upstream_cookies.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+# teardown
+. ../common.sh
+kill_pid $UNBOUND_PID
+kill_pid $UNBOUND_PID2
+
+# remove virtual interface
+ip link del veth0 type veth peer name veth1

testdata/edns_upstream_cookies.tdir/edns_upstream_cookies.pre

@@ -0,0 +1,52 @@
+# #-- edns_upstream_cookies.pre --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+UNBOUND2_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "NSD_PORT=$NSD_PORT" >> .tpkg.var.test
+
+UPSTREAM_IP=10.0.0.1
+UB_IP1=192.128.123.121
+UB_IP2=192.128.123.122
+
+echo "UPSTREAM_IP=$UPSTREAM_IP" >> .tpkg.var.test
+echo "UB_IP1=$UB_IP1" >> .tpkg.var.test
+echo "UB_IP2=$UB_IP2" >> .tpkg.var.test
+
+
+# rewrite config file with created ports
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' < unbound.conf > ub.conf
+sed -e 's/@PORT2\@/'$UNBOUND2_PORT'/' < unbound_auth.conf > temp2.conf
+sed -e 's/@IP2\@/'$UPSTREAM_IP'/' < temp2.conf > ub2.conf
+
+
+# create virtual interfaces
+ip link add veth0 type veth peer name veth1
+ip link add veth0 type veth peer name veth1
+ip link set dev veth0 up
+ip link set dev veth1 up
+
+ip addr add $UPSTREAM_IP dev veth0
+ip addr add $UB_IP1 dev veth1
+
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf > unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+# start nsd in the background (for downstream cookies)
+$PRE/unbound -d -c ub2.conf > unbound2.log 2>&1 &
+UNBOUND_PID2=$!
+echo "UNBOUND_PID2=$UNBOUND_PID2" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_unbound_up unbound.log
+wait_unbound_up unbound2.log
+

testdata/edns_upstream_cookies.tdir/edns_upstream_cookies.test

@@ -0,0 +1,102 @@
+# #-- edns_upstream_cookies.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+# The problem of this test lies in that we want to look at the connection between
+# the resolver and the upstream. I cannot think of a way for this to be done
+# without either tcpdump or looking at the logs of the upstream.
+
+# Plan of action
+# @TODO Merge upstream cookies into this branch
+
+# Create two IP addresses on 1 interface. Put one of them up and one of them down
+# Start Unbound on this interface
+# Get Unbound to send an upstream query (with a cookie)
+# check the (complete) cookie in the log of the upstream and store the outgoing interface
+# Send another query where we check that it is the same cookie
+# verify that it is the same cookie and verify that the interface is the same
+# @TODO we could do the time skip here as well. see edns_upstream_cookies.rpl
+# take the interface down, send the query again
+# Verify there is a different (client) cookie and that the interface has changed
+# @TODO There could be a logic mishap in the final step as the flow is quite difficult now
+
+
+#NSD_IP=192.128.123.120
+
+# UB_IP3=192.128.123.123
+# UB_IP4=192.128.123.124
+# ip addr add $UB_IP2 dev veth1
+# ip addr add $UB_IP3 dev veth1
+# ip addr add $UB_IP4 dev veth1
+
+# start cookie connection by sending first message
+dig @$UNBOUND -p 9999 example.nl
+
+# check Unbound logs that we got a "complete" (client+server) cookie back
+sed -n "s/^.*complete cookie: \[24:0\] *//p" unbound.log > first_query.txt
+if ! grep -e "complete cookie: [24:0] " grep_test.txt
+then
+	echo "No complete cookie in the response to the first upstream query"
+	exit 1
+fi
+# check on which interface
+IFACE=sed -n -e "s/^.*\!\!\!\!\! iterator:udp socket: *//" -e "s/ port.*//p" unbound.log
+
+# flush unbound log
+echo > unbound.log
+
+
+# bring up second interface so we verify it keep using the first interface
+ip addr add $UB_IP2 dev veth1
+
+
+# send second query with the previous complete cookie attached
+dig @$UNBOUND -p 9999 example.nl
+
+# check logs that we get the same complete cookie back
+sed -n "s/^.*complete cookie: \[24:0\] *//p" unbound.log > second_query.txt
+if ! grep -e "complete cookie: [24:0] " grep_test.txt
+then
+	echo "No complete cookie in the response to the second upstream query"
+	exit 1
+fi
+
+if [ "$(md5sum < first_query.txt)" != "$(md5sum < second_query.txt)" ]; then
+    echo "Cookies from the first and second query do not match"
+    cat first_query.txt
+    cat second_query.txt
+    exit 1
+fi
+# check on which interface, MUST be the same as last time
+if [ "$(sed -n -e "s/^.*\!\!\!\!\! iterator:udp socket: *//" -e "s/ port.*//p" unbound.log) != $IFACE" ]
+
+
+# remove the first interface so the kernel will have to use the second interface
+ip addr del $UB_IP1 dev veth1
+
+# flush unbound log
+echo > unbound.log
+
+
+dig @$UNBOUND -p 9999 example.nl
+
+# check logs that we get the same complete cookie back
+sed -n "s/^.*complete cookie: \[24:0\] *//p" unbound.log > second_query.txt
+if ! grep -e "complete cookie: [24:0] " grep_test.txt
+then
+	echo "No complete cookie in the response to the second upstream query"
+	exit 1
+fi
+
+# !!!!!! interface unavailable, renewing cookie
+
+
+
+
+
+# send query (on different interface) with different (!) client cookie
+
+# verify that we get a different client cookie in the complete cookie response
+# verify that the cookie was indeed sent on a different interface

testdata/edns_upstream_cookies.tdir/example.nl.zone

@@ -0,0 +1,16 @@
+$ORIGIN example.nl.
+$TTL 86400 ; default time-to-live for this zone
+
+example.nl.   IN  SOA     ns.example.nl. noc.dns.icann.org. (
+        2020080302  ;Serial
+        7200        ;Refresh
+        3600        ;Retry
+        1209600     ;Expire
+        3600        ;Negative response caching TTL
+)
+
+; The nameserver that are authoritative for this zone.
+		NS      example.nl.
+
+; these A records below are equivalent
+example.nl.    A       1.2.3.4

testdata/edns_upstream_cookies.tdir/unbound.conf

@@ -0,0 +1,17 @@
+server:
+    verbosity: 2
+    use-syslog: no
+    chroot: ""
+    username: ""
+    directory: ""
+	pidfile: "unbound.pid"
+	interface: 127.0.0.1
+    port: @PORT1@
+
+    val-log-level: 2
+	upstream-cookies: yes
+
+forward-zone:
+	name: "example.nl"
+	forward-addr: 127.0.0.1@9998
+	forward-no-cache: yes

testdata/edns_upstream_cookies.tdir/unbound_auth.conf

@@ -0,0 +1,16 @@
+server:
+    verbosity: 1
+    use-syslog: no
+    chroot: ""
+    username: ""
+    directory: ""
+    pidfile: "unbound2.pid"
+    interface: @UPSTREAM_IP@
+    port: @PORT2@
+
+    answer-cookie: yes
+    cookie-secret: "e5e973e5a6b2a43f48e7dc849e37bfcf"
+
+auth-zone:
+    name: example.nl
+    zonefile: example.nl.zone

util/config_file.c

@@ -387,6 +387,7 @@ config_create(void)
 	cfg->ipset_name_v6 = NULL;
 #endif
 	cfg->ede = 0;
+	cfg->upstream_cookies = 0;
 	return cfg;
 error_exit:
 	config_delete(cfg);

util/config_file.h

@@ -705,6 +705,8 @@ struct config_file {
 #endif
 	/** respond with Extended DNS Errors (RFC8914) */
 	int ede;
+	/** Send EDNS cookies to the upstream and keep their state(RFC7873-RFC9018) */
+	int upstream_cookies;
 };
 
 /** from cfg username, after daemonize setup performed */

util/configlexer.lex

@@ -564,6 +564,7 @@ edns-client-string{COLON}	{ YDVAR(2, VAR_EDNS_CLIENT_STRING) }
 edns-client-string-opcode{COLON} { YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) }
 nsid{COLON}			{ YDVAR(1, VAR_NSID ) }
 ede{COLON}			{ YDVAR(1, VAR_EDE ) }
+upstream-cookies{COLON}		{ YDVAR(1, VAR_UPSTREAM_COOKIES ) }
 proxy-protocol-port{COLON}	{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
 <INITIAL,val>{NEWLINE}		{ LEXOUT(("NL\n")); cfg_parser->line++; }
 

util/configparser.h

@@ -1,14 +1,14 @@
-/* A Bison parser, made by GNU Bison 3.8.2.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Bison interface for Yacc-like parsers in C
+/* Skeleton interface for Bison's Yacc-like parsers in C
 
-   Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2021 Free Software Foundation,
-   Inc.
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+   Free Software Foundation, Inc.
 
-   This program is free software: you can redistribute it and/or modify
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -16,7 +16,9 @@
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -31,370 +33,349 @@
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
-/* DO NOT RELY ON FEATURES THAT ARE NOT DOCUMENTED in the manual,
-   especially those whose name start with YY_ or yy_.  They are
-   private implementation details that can be changed or removed.  */
-
-#ifndef YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
-# define YY_YY_UTIL_CONFIGPARSER_H_INCLUDED
-/* Debug traces.  */
-#ifndef YYDEBUG
-# define YYDEBUG 0
-#endif
-#if YYDEBUG
-extern int yydebug;
-#endif
-
-/* Token kinds.  */
+/* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
-  enum yytokentype
-  {
-    YYEMPTY = -2,
-    YYEOF = 0,                     /* "end of file"  */
-    YYerror = 256,                 /* error  */
-    YYUNDEF = 257,                 /* "invalid token"  */
-    SPACE = 258,                   /* SPACE  */
-    LETTER = 259,                  /* LETTER  */
-    NEWLINE = 260,                 /* NEWLINE  */
-    COMMENT = 261,                 /* COMMENT  */
-    COLON = 262,                   /* COLON  */
-    ANY = 263,                     /* ANY  */
-    ZONESTR = 264,                 /* ZONESTR  */
-    STRING_ARG = 265,              /* STRING_ARG  */
-    VAR_FORCE_TOPLEVEL = 266,      /* VAR_FORCE_TOPLEVEL  */
-    VAR_SERVER = 267,              /* VAR_SERVER  */
-    VAR_VERBOSITY = 268,           /* VAR_VERBOSITY  */
-    VAR_NUM_THREADS = 269,         /* VAR_NUM_THREADS  */
-    VAR_PORT = 270,                /* VAR_PORT  */
-    VAR_OUTGOING_RANGE = 271,      /* VAR_OUTGOING_RANGE  */
-    VAR_INTERFACE = 272,           /* VAR_INTERFACE  */
-    VAR_PREFER_IP4 = 273,          /* VAR_PREFER_IP4  */
-    VAR_DO_IP4 = 274,              /* VAR_DO_IP4  */
-    VAR_DO_IP6 = 275,              /* VAR_DO_IP6  */
-    VAR_PREFER_IP6 = 276,          /* VAR_PREFER_IP6  */
-    VAR_DO_UDP = 277,              /* VAR_DO_UDP  */
-    VAR_DO_TCP = 278,              /* VAR_DO_TCP  */
-    VAR_TCP_MSS = 279,             /* VAR_TCP_MSS  */
-    VAR_OUTGOING_TCP_MSS = 280,    /* VAR_OUTGOING_TCP_MSS  */
-    VAR_TCP_IDLE_TIMEOUT = 281,    /* VAR_TCP_IDLE_TIMEOUT  */
-    VAR_EDNS_TCP_KEEPALIVE = 282,  /* VAR_EDNS_TCP_KEEPALIVE  */
-    VAR_EDNS_TCP_KEEPALIVE_TIMEOUT = 283, /* VAR_EDNS_TCP_KEEPALIVE_TIMEOUT  */
-    VAR_CHROOT = 284,              /* VAR_CHROOT  */
-    VAR_USERNAME = 285,            /* VAR_USERNAME  */
-    VAR_DIRECTORY = 286,           /* VAR_DIRECTORY  */
-    VAR_LOGFILE = 287,             /* VAR_LOGFILE  */
-    VAR_PIDFILE = 288,             /* VAR_PIDFILE  */
-    VAR_MSG_CACHE_SIZE = 289,      /* VAR_MSG_CACHE_SIZE  */
-    VAR_MSG_CACHE_SLABS = 290,     /* VAR_MSG_CACHE_SLABS  */
-    VAR_NUM_QUERIES_PER_THREAD = 291, /* VAR_NUM_QUERIES_PER_THREAD  */
-    VAR_RRSET_CACHE_SIZE = 292,    /* VAR_RRSET_CACHE_SIZE  */
-    VAR_RRSET_CACHE_SLABS = 293,   /* VAR_RRSET_CACHE_SLABS  */
-    VAR_OUTGOING_NUM_TCP = 294,    /* VAR_OUTGOING_NUM_TCP  */
-    VAR_INFRA_HOST_TTL = 295,      /* VAR_INFRA_HOST_TTL  */
-    VAR_INFRA_LAME_TTL = 296,      /* VAR_INFRA_LAME_TTL  */
-    VAR_INFRA_CACHE_SLABS = 297,   /* VAR_INFRA_CACHE_SLABS  */
-    VAR_INFRA_CACHE_NUMHOSTS = 298, /* VAR_INFRA_CACHE_NUMHOSTS  */
-    VAR_INFRA_CACHE_LAME_SIZE = 299, /* VAR_INFRA_CACHE_LAME_SIZE  */
-    VAR_NAME = 300,                /* VAR_NAME  */
-    VAR_STUB_ZONE = 301,           /* VAR_STUB_ZONE  */
-    VAR_STUB_HOST = 302,           /* VAR_STUB_HOST  */
-    VAR_STUB_ADDR = 303,           /* VAR_STUB_ADDR  */
-    VAR_TARGET_FETCH_POLICY = 304, /* VAR_TARGET_FETCH_POLICY  */
-    VAR_HARDEN_SHORT_BUFSIZE = 305, /* VAR_HARDEN_SHORT_BUFSIZE  */
-    VAR_HARDEN_LARGE_QUERIES = 306, /* VAR_HARDEN_LARGE_QUERIES  */
-    VAR_FORWARD_ZONE = 307,        /* VAR_FORWARD_ZONE  */
-    VAR_FORWARD_HOST = 308,        /* VAR_FORWARD_HOST  */
-    VAR_FORWARD_ADDR = 309,        /* VAR_FORWARD_ADDR  */
-    VAR_DO_NOT_QUERY_ADDRESS = 310, /* VAR_DO_NOT_QUERY_ADDRESS  */
-    VAR_HIDE_IDENTITY = 311,       /* VAR_HIDE_IDENTITY  */
-    VAR_HIDE_VERSION = 312,        /* VAR_HIDE_VERSION  */
-    VAR_IDENTITY = 313,            /* VAR_IDENTITY  */
-    VAR_VERSION = 314,             /* VAR_VERSION  */
-    VAR_HARDEN_GLUE = 315,         /* VAR_HARDEN_GLUE  */
-    VAR_MODULE_CONF = 316,         /* VAR_MODULE_CONF  */
-    VAR_TRUST_ANCHOR_FILE = 317,   /* VAR_TRUST_ANCHOR_FILE  */
-    VAR_TRUST_ANCHOR = 318,        /* VAR_TRUST_ANCHOR  */
-    VAR_VAL_OVERRIDE_DATE = 319,   /* VAR_VAL_OVERRIDE_DATE  */
-    VAR_BOGUS_TTL = 320,           /* VAR_BOGUS_TTL  */
-    VAR_VAL_CLEAN_ADDITIONAL = 321, /* VAR_VAL_CLEAN_ADDITIONAL  */
-    VAR_VAL_PERMISSIVE_MODE = 322, /* VAR_VAL_PERMISSIVE_MODE  */
-    VAR_INCOMING_NUM_TCP = 323,    /* VAR_INCOMING_NUM_TCP  */
-    VAR_MSG_BUFFER_SIZE = 324,     /* VAR_MSG_BUFFER_SIZE  */
-    VAR_KEY_CACHE_SIZE = 325,      /* VAR_KEY_CACHE_SIZE  */
-    VAR_KEY_CACHE_SLABS = 326,     /* VAR_KEY_CACHE_SLABS  */
-    VAR_TRUSTED_KEYS_FILE = 327,   /* VAR_TRUSTED_KEYS_FILE  */
-    VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 328, /* VAR_VAL_NSEC3_KEYSIZE_ITERATIONS  */
-    VAR_USE_SYSLOG = 329,          /* VAR_USE_SYSLOG  */
-    VAR_OUTGOING_INTERFACE = 330,  /* VAR_OUTGOING_INTERFACE  */
-    VAR_ROOT_HINTS = 331,          /* VAR_ROOT_HINTS  */
-    VAR_DO_NOT_QUERY_LOCALHOST = 332, /* VAR_DO_NOT_QUERY_LOCALHOST  */
-    VAR_CACHE_MAX_TTL = 333,       /* VAR_CACHE_MAX_TTL  */
-    VAR_HARDEN_DNSSEC_STRIPPED = 334, /* VAR_HARDEN_DNSSEC_STRIPPED  */
-    VAR_ACCESS_CONTROL = 335,      /* VAR_ACCESS_CONTROL  */
-    VAR_LOCAL_ZONE = 336,          /* VAR_LOCAL_ZONE  */
-    VAR_LOCAL_DATA = 337,          /* VAR_LOCAL_DATA  */
-    VAR_INTERFACE_AUTOMATIC = 338, /* VAR_INTERFACE_AUTOMATIC  */
-    VAR_STATISTICS_INTERVAL = 339, /* VAR_STATISTICS_INTERVAL  */
-    VAR_DO_DAEMONIZE = 340,        /* VAR_DO_DAEMONIZE  */
-    VAR_USE_CAPS_FOR_ID = 341,     /* VAR_USE_CAPS_FOR_ID  */
-    VAR_STATISTICS_CUMULATIVE = 342, /* VAR_STATISTICS_CUMULATIVE  */
-    VAR_OUTGOING_PORT_PERMIT = 343, /* VAR_OUTGOING_PORT_PERMIT  */
-    VAR_OUTGOING_PORT_AVOID = 344, /* VAR_OUTGOING_PORT_AVOID  */
-    VAR_DLV_ANCHOR_FILE = 345,     /* VAR_DLV_ANCHOR_FILE  */
-    VAR_DLV_ANCHOR = 346,          /* VAR_DLV_ANCHOR  */
-    VAR_NEG_CACHE_SIZE = 347,      /* VAR_NEG_CACHE_SIZE  */
-    VAR_HARDEN_REFERRAL_PATH = 348, /* VAR_HARDEN_REFERRAL_PATH  */
-    VAR_PRIVATE_ADDRESS = 349,     /* VAR_PRIVATE_ADDRESS  */
-    VAR_PRIVATE_DOMAIN = 350,      /* VAR_PRIVATE_DOMAIN  */
-    VAR_REMOTE_CONTROL = 351,      /* VAR_REMOTE_CONTROL  */
-    VAR_CONTROL_ENABLE = 352,      /* VAR_CONTROL_ENABLE  */
-    VAR_CONTROL_INTERFACE = 353,   /* VAR_CONTROL_INTERFACE  */
-    VAR_CONTROL_PORT = 354,        /* VAR_CONTROL_PORT  */
-    VAR_SERVER_KEY_FILE = 355,     /* VAR_SERVER_KEY_FILE  */
-    VAR_SERVER_CERT_FILE = 356,    /* VAR_SERVER_CERT_FILE  */
-    VAR_CONTROL_KEY_FILE = 357,    /* VAR_CONTROL_KEY_FILE  */
-    VAR_CONTROL_CERT_FILE = 358,   /* VAR_CONTROL_CERT_FILE  */
-    VAR_CONTROL_USE_CERT = 359,    /* VAR_CONTROL_USE_CERT  */
-    VAR_TCP_REUSE_TIMEOUT = 360,   /* VAR_TCP_REUSE_TIMEOUT  */
-    VAR_MAX_REUSE_TCP_QUERIES = 361, /* VAR_MAX_REUSE_TCP_QUERIES  */
-    VAR_EXTENDED_STATISTICS = 362, /* VAR_EXTENDED_STATISTICS  */
-    VAR_LOCAL_DATA_PTR = 363,      /* VAR_LOCAL_DATA_PTR  */
-    VAR_JOSTLE_TIMEOUT = 364,      /* VAR_JOSTLE_TIMEOUT  */
-    VAR_STUB_PRIME = 365,          /* VAR_STUB_PRIME  */
-    VAR_UNWANTED_REPLY_THRESHOLD = 366, /* VAR_UNWANTED_REPLY_THRESHOLD  */
-    VAR_LOG_TIME_ASCII = 367,      /* VAR_LOG_TIME_ASCII  */
-    VAR_DOMAIN_INSECURE = 368,     /* VAR_DOMAIN_INSECURE  */
-    VAR_PYTHON = 369,              /* VAR_PYTHON  */
-    VAR_PYTHON_SCRIPT = 370,       /* VAR_PYTHON_SCRIPT  */
-    VAR_VAL_SIG_SKEW_MIN = 371,    /* VAR_VAL_SIG_SKEW_MIN  */
-    VAR_VAL_SIG_SKEW_MAX = 372,    /* VAR_VAL_SIG_SKEW_MAX  */
-    VAR_VAL_MAX_RESTART = 373,     /* VAR_VAL_MAX_RESTART  */
-    VAR_CACHE_MIN_TTL = 374,       /* VAR_CACHE_MIN_TTL  */
-    VAR_VAL_LOG_LEVEL = 375,       /* VAR_VAL_LOG_LEVEL  */
-    VAR_AUTO_TRUST_ANCHOR_FILE = 376, /* VAR_AUTO_TRUST_ANCHOR_FILE  */
-    VAR_KEEP_MISSING = 377,        /* VAR_KEEP_MISSING  */
-    VAR_ADD_HOLDDOWN = 378,        /* VAR_ADD_HOLDDOWN  */
-    VAR_DEL_HOLDDOWN = 379,        /* VAR_DEL_HOLDDOWN  */
-    VAR_SO_RCVBUF = 380,           /* VAR_SO_RCVBUF  */
-    VAR_EDNS_BUFFER_SIZE = 381,    /* VAR_EDNS_BUFFER_SIZE  */
-    VAR_PREFETCH = 382,            /* VAR_PREFETCH  */
-    VAR_PREFETCH_KEY = 383,        /* VAR_PREFETCH_KEY  */
-    VAR_SO_SNDBUF = 384,           /* VAR_SO_SNDBUF  */
-    VAR_SO_REUSEPORT = 385,        /* VAR_SO_REUSEPORT  */
-    VAR_HARDEN_BELOW_NXDOMAIN = 386, /* VAR_HARDEN_BELOW_NXDOMAIN  */
-    VAR_IGNORE_CD_FLAG = 387,      /* VAR_IGNORE_CD_FLAG  */
-    VAR_LOG_QUERIES = 388,         /* VAR_LOG_QUERIES  */
-    VAR_LOG_REPLIES = 389,         /* VAR_LOG_REPLIES  */
-    VAR_LOG_LOCAL_ACTIONS = 390,   /* VAR_LOG_LOCAL_ACTIONS  */
-    VAR_TCP_UPSTREAM = 391,        /* VAR_TCP_UPSTREAM  */
-    VAR_SSL_UPSTREAM = 392,        /* VAR_SSL_UPSTREAM  */
-    VAR_TCP_AUTH_QUERY_TIMEOUT = 393, /* VAR_TCP_AUTH_QUERY_TIMEOUT  */
-    VAR_SSL_SERVICE_KEY = 394,     /* VAR_SSL_SERVICE_KEY  */
-    VAR_SSL_SERVICE_PEM = 395,     /* VAR_SSL_SERVICE_PEM  */
-    VAR_SSL_PORT = 396,            /* VAR_SSL_PORT  */
-    VAR_FORWARD_FIRST = 397,       /* VAR_FORWARD_FIRST  */
-    VAR_STUB_SSL_UPSTREAM = 398,   /* VAR_STUB_SSL_UPSTREAM  */
-    VAR_FORWARD_SSL_UPSTREAM = 399, /* VAR_FORWARD_SSL_UPSTREAM  */
-    VAR_TLS_CERT_BUNDLE = 400,     /* VAR_TLS_CERT_BUNDLE  */
-    VAR_STUB_TCP_UPSTREAM = 401,   /* VAR_STUB_TCP_UPSTREAM  */
-    VAR_FORWARD_TCP_UPSTREAM = 402, /* VAR_FORWARD_TCP_UPSTREAM  */
-    VAR_HTTPS_PORT = 403,          /* VAR_HTTPS_PORT  */
-    VAR_HTTP_ENDPOINT = 404,       /* VAR_HTTP_ENDPOINT  */
-    VAR_HTTP_MAX_STREAMS = 405,    /* VAR_HTTP_MAX_STREAMS  */
-    VAR_HTTP_QUERY_BUFFER_SIZE = 406, /* VAR_HTTP_QUERY_BUFFER_SIZE  */
-    VAR_HTTP_RESPONSE_BUFFER_SIZE = 407, /* VAR_HTTP_RESPONSE_BUFFER_SIZE  */
-    VAR_HTTP_NODELAY = 408,        /* VAR_HTTP_NODELAY  */
-    VAR_HTTP_NOTLS_DOWNSTREAM = 409, /* VAR_HTTP_NOTLS_DOWNSTREAM  */
-    VAR_STUB_FIRST = 410,          /* VAR_STUB_FIRST  */
-    VAR_MINIMAL_RESPONSES = 411,   /* VAR_MINIMAL_RESPONSES  */
-    VAR_RRSET_ROUNDROBIN = 412,    /* VAR_RRSET_ROUNDROBIN  */
-    VAR_MAX_UDP_SIZE = 413,        /* VAR_MAX_UDP_SIZE  */
-    VAR_DELAY_CLOSE = 414,         /* VAR_DELAY_CLOSE  */
-    VAR_UDP_CONNECT = 415,         /* VAR_UDP_CONNECT  */
-    VAR_UNBLOCK_LAN_ZONES = 416,   /* VAR_UNBLOCK_LAN_ZONES  */
-    VAR_INSECURE_LAN_ZONES = 417,  /* VAR_INSECURE_LAN_ZONES  */
-    VAR_INFRA_CACHE_MIN_RTT = 418, /* VAR_INFRA_CACHE_MIN_RTT  */
-    VAR_INFRA_CACHE_MAX_RTT = 419, /* VAR_INFRA_CACHE_MAX_RTT  */
-    VAR_INFRA_KEEP_PROBING = 420,  /* VAR_INFRA_KEEP_PROBING  */
-    VAR_DNS64_PREFIX = 421,        /* VAR_DNS64_PREFIX  */
-    VAR_DNS64_SYNTHALL = 422,      /* VAR_DNS64_SYNTHALL  */
-    VAR_DNS64_IGNORE_AAAA = 423,   /* VAR_DNS64_IGNORE_AAAA  */
-    VAR_DNSTAP = 424,              /* VAR_DNSTAP  */
-    VAR_DNSTAP_ENABLE = 425,       /* VAR_DNSTAP_ENABLE  */
-    VAR_DNSTAP_SOCKET_PATH = 426,  /* VAR_DNSTAP_SOCKET_PATH  */
-    VAR_DNSTAP_IP = 427,           /* VAR_DNSTAP_IP  */
-    VAR_DNSTAP_TLS = 428,          /* VAR_DNSTAP_TLS  */
-    VAR_DNSTAP_TLS_SERVER_NAME = 429, /* VAR_DNSTAP_TLS_SERVER_NAME  */
-    VAR_DNSTAP_TLS_CERT_BUNDLE = 430, /* VAR_DNSTAP_TLS_CERT_BUNDLE  */
-    VAR_DNSTAP_TLS_CLIENT_KEY_FILE = 431, /* VAR_DNSTAP_TLS_CLIENT_KEY_FILE  */
-    VAR_DNSTAP_TLS_CLIENT_CERT_FILE = 432, /* VAR_DNSTAP_TLS_CLIENT_CERT_FILE  */
-    VAR_DNSTAP_SEND_IDENTITY = 433, /* VAR_DNSTAP_SEND_IDENTITY  */
-    VAR_DNSTAP_SEND_VERSION = 434, /* VAR_DNSTAP_SEND_VERSION  */
-    VAR_DNSTAP_BIDIRECTIONAL = 435, /* VAR_DNSTAP_BIDIRECTIONAL  */
-    VAR_DNSTAP_IDENTITY = 436,     /* VAR_DNSTAP_IDENTITY  */
-    VAR_DNSTAP_VERSION = 437,      /* VAR_DNSTAP_VERSION  */
-    VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 438, /* VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES  */
-    VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 439, /* VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES  */
-    VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 440, /* VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES  */
-    VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 441, /* VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES  */
-    VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 442, /* VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES  */
-    VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 443, /* VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES  */
-    VAR_RESPONSE_IP_TAG = 444,     /* VAR_RESPONSE_IP_TAG  */
-    VAR_RESPONSE_IP = 445,         /* VAR_RESPONSE_IP  */
-    VAR_RESPONSE_IP_DATA = 446,    /* VAR_RESPONSE_IP_DATA  */
-    VAR_HARDEN_ALGO_DOWNGRADE = 447, /* VAR_HARDEN_ALGO_DOWNGRADE  */
-    VAR_IP_TRANSPARENT = 448,      /* VAR_IP_TRANSPARENT  */
-    VAR_IP_DSCP = 449,             /* VAR_IP_DSCP  */
-    VAR_DISABLE_DNSSEC_LAME_CHECK = 450, /* VAR_DISABLE_DNSSEC_LAME_CHECK  */
-    VAR_IP_RATELIMIT = 451,        /* VAR_IP_RATELIMIT  */
-    VAR_IP_RATELIMIT_SLABS = 452,  /* VAR_IP_RATELIMIT_SLABS  */
-    VAR_IP_RATELIMIT_SIZE = 453,   /* VAR_IP_RATELIMIT_SIZE  */
-    VAR_RATELIMIT = 454,           /* VAR_RATELIMIT  */
-    VAR_RATELIMIT_SLABS = 455,     /* VAR_RATELIMIT_SLABS  */
-    VAR_RATELIMIT_SIZE = 456,      /* VAR_RATELIMIT_SIZE  */
-    VAR_OUTBOUND_MSG_RETRY = 457,  /* VAR_OUTBOUND_MSG_RETRY  */
-    VAR_RATELIMIT_FOR_DOMAIN = 458, /* VAR_RATELIMIT_FOR_DOMAIN  */
-    VAR_RATELIMIT_BELOW_DOMAIN = 459, /* VAR_RATELIMIT_BELOW_DOMAIN  */
-    VAR_IP_RATELIMIT_FACTOR = 460, /* VAR_IP_RATELIMIT_FACTOR  */
-    VAR_RATELIMIT_FACTOR = 461,    /* VAR_RATELIMIT_FACTOR  */
-    VAR_IP_RATELIMIT_BACKOFF = 462, /* VAR_IP_RATELIMIT_BACKOFF  */
-    VAR_RATELIMIT_BACKOFF = 463,   /* VAR_RATELIMIT_BACKOFF  */
-    VAR_SEND_CLIENT_SUBNET = 464,  /* VAR_SEND_CLIENT_SUBNET  */
-    VAR_CLIENT_SUBNET_ZONE = 465,  /* VAR_CLIENT_SUBNET_ZONE  */
-    VAR_CLIENT_SUBNET_ALWAYS_FORWARD = 466, /* VAR_CLIENT_SUBNET_ALWAYS_FORWARD  */
-    VAR_CLIENT_SUBNET_OPCODE = 467, /* VAR_CLIENT_SUBNET_OPCODE  */
-    VAR_MAX_CLIENT_SUBNET_IPV4 = 468, /* VAR_MAX_CLIENT_SUBNET_IPV4  */
-    VAR_MAX_CLIENT_SUBNET_IPV6 = 469, /* VAR_MAX_CLIENT_SUBNET_IPV6  */
-    VAR_MIN_CLIENT_SUBNET_IPV4 = 470, /* VAR_MIN_CLIENT_SUBNET_IPV4  */
-    VAR_MIN_CLIENT_SUBNET_IPV6 = 471, /* VAR_MIN_CLIENT_SUBNET_IPV6  */
-    VAR_MAX_ECS_TREE_SIZE_IPV4 = 472, /* VAR_MAX_ECS_TREE_SIZE_IPV4  */
-    VAR_MAX_ECS_TREE_SIZE_IPV6 = 473, /* VAR_MAX_ECS_TREE_SIZE_IPV6  */
-    VAR_CAPS_WHITELIST = 474,      /* VAR_CAPS_WHITELIST  */
-    VAR_CACHE_MAX_NEGATIVE_TTL = 475, /* VAR_CACHE_MAX_NEGATIVE_TTL  */
-    VAR_PERMIT_SMALL_HOLDDOWN = 476, /* VAR_PERMIT_SMALL_HOLDDOWN  */
-    VAR_QNAME_MINIMISATION = 477,  /* VAR_QNAME_MINIMISATION  */
-    VAR_QNAME_MINIMISATION_STRICT = 478, /* VAR_QNAME_MINIMISATION_STRICT  */
-    VAR_IP_FREEBIND = 479,         /* VAR_IP_FREEBIND  */
-    VAR_DEFINE_TAG = 480,          /* VAR_DEFINE_TAG  */
-    VAR_LOCAL_ZONE_TAG = 481,      /* VAR_LOCAL_ZONE_TAG  */
-    VAR_ACCESS_CONTROL_TAG = 482,  /* VAR_ACCESS_CONTROL_TAG  */
-    VAR_LOCAL_ZONE_OVERRIDE = 483, /* VAR_LOCAL_ZONE_OVERRIDE  */
-    VAR_ACCESS_CONTROL_TAG_ACTION = 484, /* VAR_ACCESS_CONTROL_TAG_ACTION  */
-    VAR_ACCESS_CONTROL_TAG_DATA = 485, /* VAR_ACCESS_CONTROL_TAG_DATA  */
-    VAR_VIEW = 486,                /* VAR_VIEW  */
-    VAR_ACCESS_CONTROL_VIEW = 487, /* VAR_ACCESS_CONTROL_VIEW  */
-    VAR_VIEW_FIRST = 488,          /* VAR_VIEW_FIRST  */
-    VAR_SERVE_EXPIRED = 489,       /* VAR_SERVE_EXPIRED  */
-    VAR_SERVE_EXPIRED_TTL = 490,   /* VAR_SERVE_EXPIRED_TTL  */
-    VAR_SERVE_EXPIRED_TTL_RESET = 491, /* VAR_SERVE_EXPIRED_TTL_RESET  */
-    VAR_SERVE_EXPIRED_REPLY_TTL = 492, /* VAR_SERVE_EXPIRED_REPLY_TTL  */
-    VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 493, /* VAR_SERVE_EXPIRED_CLIENT_TIMEOUT  */
-    VAR_EDE_SERVE_EXPIRED = 494,   /* VAR_EDE_SERVE_EXPIRED  */
-    VAR_SERVE_ORIGINAL_TTL = 495,  /* VAR_SERVE_ORIGINAL_TTL  */
-    VAR_FAKE_DSA = 496,            /* VAR_FAKE_DSA  */
-    VAR_FAKE_SHA1 = 497,           /* VAR_FAKE_SHA1  */
-    VAR_LOG_IDENTITY = 498,        /* VAR_LOG_IDENTITY  */
-    VAR_HIDE_TRUSTANCHOR = 499,    /* VAR_HIDE_TRUSTANCHOR  */
-    VAR_HIDE_HTTP_USER_AGENT = 500, /* VAR_HIDE_HTTP_USER_AGENT  */
-    VAR_HTTP_USER_AGENT = 501,     /* VAR_HTTP_USER_AGENT  */
-    VAR_TRUST_ANCHOR_SIGNALING = 502, /* VAR_TRUST_ANCHOR_SIGNALING  */
-    VAR_AGGRESSIVE_NSEC = 503,     /* VAR_AGGRESSIVE_NSEC  */
-    VAR_USE_SYSTEMD = 504,         /* VAR_USE_SYSTEMD  */
-    VAR_SHM_ENABLE = 505,          /* VAR_SHM_ENABLE  */
-    VAR_SHM_KEY = 506,             /* VAR_SHM_KEY  */
-    VAR_ROOT_KEY_SENTINEL = 507,   /* VAR_ROOT_KEY_SENTINEL  */
-    VAR_DNSCRYPT = 508,            /* VAR_DNSCRYPT  */
-    VAR_DNSCRYPT_ENABLE = 509,     /* VAR_DNSCRYPT_ENABLE  */
-    VAR_DNSCRYPT_PORT = 510,       /* VAR_DNSCRYPT_PORT  */
-    VAR_DNSCRYPT_PROVIDER = 511,   /* VAR_DNSCRYPT_PROVIDER  */
-    VAR_DNSCRYPT_SECRET_KEY = 512, /* VAR_DNSCRYPT_SECRET_KEY  */
-    VAR_DNSCRYPT_PROVIDER_CERT = 513, /* VAR_DNSCRYPT_PROVIDER_CERT  */
-    VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 514, /* VAR_DNSCRYPT_PROVIDER_CERT_ROTATED  */
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 515, /* VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE  */
-    VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 516, /* VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS  */
-    VAR_DNSCRYPT_NONCE_CACHE_SIZE = 517, /* VAR_DNSCRYPT_NONCE_CACHE_SIZE  */
-    VAR_DNSCRYPT_NONCE_CACHE_SLABS = 518, /* VAR_DNSCRYPT_NONCE_CACHE_SLABS  */
-    VAR_PAD_RESPONSES = 519,       /* VAR_PAD_RESPONSES  */
-    VAR_PAD_RESPONSES_BLOCK_SIZE = 520, /* VAR_PAD_RESPONSES_BLOCK_SIZE  */
-    VAR_PAD_QUERIES = 521,         /* VAR_PAD_QUERIES  */
-    VAR_PAD_QUERIES_BLOCK_SIZE = 522, /* VAR_PAD_QUERIES_BLOCK_SIZE  */
-    VAR_IPSECMOD_ENABLED = 523,    /* VAR_IPSECMOD_ENABLED  */
-    VAR_IPSECMOD_HOOK = 524,       /* VAR_IPSECMOD_HOOK  */
-    VAR_IPSECMOD_IGNORE_BOGUS = 525, /* VAR_IPSECMOD_IGNORE_BOGUS  */
-    VAR_IPSECMOD_MAX_TTL = 526,    /* VAR_IPSECMOD_MAX_TTL  */
-    VAR_IPSECMOD_WHITELIST = 527,  /* VAR_IPSECMOD_WHITELIST  */
-    VAR_IPSECMOD_STRICT = 528,     /* VAR_IPSECMOD_STRICT  */
-    VAR_CACHEDB = 529,             /* VAR_CACHEDB  */
-    VAR_CACHEDB_BACKEND = 530,     /* VAR_CACHEDB_BACKEND  */
-    VAR_CACHEDB_SECRETSEED = 531,  /* VAR_CACHEDB_SECRETSEED  */
-    VAR_CACHEDB_REDISHOST = 532,   /* VAR_CACHEDB_REDISHOST  */
-    VAR_CACHEDB_REDISPORT = 533,   /* VAR_CACHEDB_REDISPORT  */
-    VAR_CACHEDB_REDISTIMEOUT = 534, /* VAR_CACHEDB_REDISTIMEOUT  */
-    VAR_CACHEDB_REDISEXPIRERECORDS = 535, /* VAR_CACHEDB_REDISEXPIRERECORDS  */
-    VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 536, /* VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM  */
-    VAR_FOR_UPSTREAM = 537,        /* VAR_FOR_UPSTREAM  */
-    VAR_AUTH_ZONE = 538,           /* VAR_AUTH_ZONE  */
-    VAR_ZONEFILE = 539,            /* VAR_ZONEFILE  */
-    VAR_MASTER = 540,              /* VAR_MASTER  */
-    VAR_URL = 541,                 /* VAR_URL  */
-    VAR_FOR_DOWNSTREAM = 542,      /* VAR_FOR_DOWNSTREAM  */
-    VAR_FALLBACK_ENABLED = 543,    /* VAR_FALLBACK_ENABLED  */
-    VAR_TLS_ADDITIONAL_PORT = 544, /* VAR_TLS_ADDITIONAL_PORT  */
-    VAR_LOW_RTT = 545,             /* VAR_LOW_RTT  */
-    VAR_LOW_RTT_PERMIL = 546,      /* VAR_LOW_RTT_PERMIL  */
-    VAR_FAST_SERVER_PERMIL = 547,  /* VAR_FAST_SERVER_PERMIL  */
-    VAR_FAST_SERVER_NUM = 548,     /* VAR_FAST_SERVER_NUM  */
-    VAR_ALLOW_NOTIFY = 549,        /* VAR_ALLOW_NOTIFY  */
-    VAR_TLS_WIN_CERT = 550,        /* VAR_TLS_WIN_CERT  */
-    VAR_TCP_CONNECTION_LIMIT = 551, /* VAR_TCP_CONNECTION_LIMIT  */
-    VAR_ANSWER_COOKIE = 552,       /* VAR_ANSWER_COOKIE  */
-    VAR_COOKIE_SECRET = 553,       /* VAR_COOKIE_SECRET  */
-    VAR_FORWARD_NO_CACHE = 554,    /* VAR_FORWARD_NO_CACHE  */
-    VAR_STUB_NO_CACHE = 555,       /* VAR_STUB_NO_CACHE  */
-    VAR_LOG_SERVFAIL = 556,        /* VAR_LOG_SERVFAIL  */
-    VAR_DENY_ANY = 557,            /* VAR_DENY_ANY  */
-    VAR_UNKNOWN_SERVER_TIME_LIMIT = 558, /* VAR_UNKNOWN_SERVER_TIME_LIMIT  */
-    VAR_LOG_TAG_QUERYREPLY = 559,  /* VAR_LOG_TAG_QUERYREPLY  */
-    VAR_STREAM_WAIT_SIZE = 560,    /* VAR_STREAM_WAIT_SIZE  */
-    VAR_TLS_CIPHERS = 561,         /* VAR_TLS_CIPHERS  */
-    VAR_TLS_CIPHERSUITES = 562,    /* VAR_TLS_CIPHERSUITES  */
-    VAR_TLS_USE_SNI = 563,         /* VAR_TLS_USE_SNI  */
-    VAR_IPSET = 564,               /* VAR_IPSET  */
-    VAR_IPSET_NAME_V4 = 565,       /* VAR_IPSET_NAME_V4  */
-    VAR_IPSET_NAME_V6 = 566,       /* VAR_IPSET_NAME_V6  */
-    VAR_TLS_SESSION_TICKET_KEYS = 567, /* VAR_TLS_SESSION_TICKET_KEYS  */
-    VAR_RPZ = 568,                 /* VAR_RPZ  */
-    VAR_TAGS = 569,                /* VAR_TAGS  */
-    VAR_RPZ_ACTION_OVERRIDE = 570, /* VAR_RPZ_ACTION_OVERRIDE  */
-    VAR_RPZ_CNAME_OVERRIDE = 571,  /* VAR_RPZ_CNAME_OVERRIDE  */
-    VAR_RPZ_LOG = 572,             /* VAR_RPZ_LOG  */
-    VAR_RPZ_LOG_NAME = 573,        /* VAR_RPZ_LOG_NAME  */
-    VAR_DYNLIB = 574,              /* VAR_DYNLIB  */
-    VAR_DYNLIB_FILE = 575,         /* VAR_DYNLIB_FILE  */
-    VAR_EDNS_CLIENT_STRING = 576,  /* VAR_EDNS_CLIENT_STRING  */
-    VAR_EDNS_CLIENT_STRING_OPCODE = 577, /* VAR_EDNS_CLIENT_STRING_OPCODE  */
-    VAR_NSID = 578,                /* VAR_NSID  */
-    VAR_ZONEMD_PERMISSIVE_MODE = 579, /* VAR_ZONEMD_PERMISSIVE_MODE  */
-    VAR_ZONEMD_CHECK = 580,        /* VAR_ZONEMD_CHECK  */
-    VAR_ZONEMD_REJECT_ABSENCE = 581, /* VAR_ZONEMD_REJECT_ABSENCE  */
-    VAR_RPZ_SIGNAL_NXDOMAIN_RA = 582, /* VAR_RPZ_SIGNAL_NXDOMAIN_RA  */
-    VAR_INTERFACE_AUTOMATIC_PORTS = 583, /* VAR_INTERFACE_AUTOMATIC_PORTS  */
-    VAR_EDE = 584,                 /* VAR_EDE  */
-    VAR_INTERFACE_ACTION = 585,    /* VAR_INTERFACE_ACTION  */
-    VAR_INTERFACE_VIEW = 586,      /* VAR_INTERFACE_VIEW  */
-    VAR_INTERFACE_TAG = 587,       /* VAR_INTERFACE_TAG  */
-    VAR_INTERFACE_TAG_ACTION = 588, /* VAR_INTERFACE_TAG_ACTION  */
-    VAR_INTERFACE_TAG_DATA = 589,  /* VAR_INTERFACE_TAG_DATA  */
-    VAR_PROXY_PROTOCOL_PORT = 590  /* VAR_PROXY_PROTOCOL_PORT  */
-  };
-  typedef enum yytokentype yytoken_kind_t;
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     SPACE = 258,
+     LETTER = 259,
+     NEWLINE = 260,
+     COMMENT = 261,
+     COLON = 262,
+     ANY = 263,
+     ZONESTR = 264,
+     STRING_ARG = 265,
+     VAR_FORCE_TOPLEVEL = 266,
+     VAR_SERVER = 267,
+     VAR_VERBOSITY = 268,
+     VAR_NUM_THREADS = 269,
+     VAR_PORT = 270,
+     VAR_OUTGOING_RANGE = 271,
+     VAR_INTERFACE = 272,
+     VAR_PREFER_IP4 = 273,
+     VAR_DO_IP4 = 274,
+     VAR_DO_IP6 = 275,
+     VAR_PREFER_IP6 = 276,
+     VAR_DO_UDP = 277,
+     VAR_DO_TCP = 278,
+     VAR_TCP_MSS = 279,
+     VAR_OUTGOING_TCP_MSS = 280,
+     VAR_TCP_IDLE_TIMEOUT = 281,
+     VAR_EDNS_TCP_KEEPALIVE = 282,
+     VAR_EDNS_TCP_KEEPALIVE_TIMEOUT = 283,
+     VAR_CHROOT = 284,
+     VAR_USERNAME = 285,
+     VAR_DIRECTORY = 286,
+     VAR_LOGFILE = 287,
+     VAR_PIDFILE = 288,
+     VAR_MSG_CACHE_SIZE = 289,
+     VAR_MSG_CACHE_SLABS = 290,
+     VAR_NUM_QUERIES_PER_THREAD = 291,
+     VAR_RRSET_CACHE_SIZE = 292,
+     VAR_RRSET_CACHE_SLABS = 293,
+     VAR_OUTGOING_NUM_TCP = 294,
+     VAR_INFRA_HOST_TTL = 295,
+     VAR_INFRA_LAME_TTL = 296,
+     VAR_INFRA_CACHE_SLABS = 297,
+     VAR_INFRA_CACHE_NUMHOSTS = 298,
+     VAR_INFRA_CACHE_LAME_SIZE = 299,
+     VAR_NAME = 300,
+     VAR_STUB_ZONE = 301,
+     VAR_STUB_HOST = 302,
+     VAR_STUB_ADDR = 303,
+     VAR_TARGET_FETCH_POLICY = 304,
+     VAR_HARDEN_SHORT_BUFSIZE = 305,
+     VAR_HARDEN_LARGE_QUERIES = 306,
+     VAR_FORWARD_ZONE = 307,
+     VAR_FORWARD_HOST = 308,
+     VAR_FORWARD_ADDR = 309,
+     VAR_DO_NOT_QUERY_ADDRESS = 310,
+     VAR_HIDE_IDENTITY = 311,
+     VAR_HIDE_VERSION = 312,
+     VAR_IDENTITY = 313,
+     VAR_VERSION = 314,
+     VAR_HARDEN_GLUE = 315,
+     VAR_MODULE_CONF = 316,
+     VAR_TRUST_ANCHOR_FILE = 317,
+     VAR_TRUST_ANCHOR = 318,
+     VAR_VAL_OVERRIDE_DATE = 319,
+     VAR_BOGUS_TTL = 320,
+     VAR_VAL_CLEAN_ADDITIONAL = 321,
+     VAR_VAL_PERMISSIVE_MODE = 322,
+     VAR_INCOMING_NUM_TCP = 323,
+     VAR_MSG_BUFFER_SIZE = 324,
+     VAR_KEY_CACHE_SIZE = 325,
+     VAR_KEY_CACHE_SLABS = 326,
+     VAR_TRUSTED_KEYS_FILE = 327,
+     VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 328,
+     VAR_USE_SYSLOG = 329,
+     VAR_OUTGOING_INTERFACE = 330,
+     VAR_ROOT_HINTS = 331,
+     VAR_DO_NOT_QUERY_LOCALHOST = 332,
+     VAR_CACHE_MAX_TTL = 333,
+     VAR_HARDEN_DNSSEC_STRIPPED = 334,
+     VAR_ACCESS_CONTROL = 335,
+     VAR_LOCAL_ZONE = 336,
+     VAR_LOCAL_DATA = 337,
+     VAR_INTERFACE_AUTOMATIC = 338,
+     VAR_STATISTICS_INTERVAL = 339,
+     VAR_DO_DAEMONIZE = 340,
+     VAR_USE_CAPS_FOR_ID = 341,
+     VAR_STATISTICS_CUMULATIVE = 342,
+     VAR_OUTGOING_PORT_PERMIT = 343,
+     VAR_OUTGOING_PORT_AVOID = 344,
+     VAR_DLV_ANCHOR_FILE = 345,
+     VAR_DLV_ANCHOR = 346,
+     VAR_NEG_CACHE_SIZE = 347,
+     VAR_HARDEN_REFERRAL_PATH = 348,
+     VAR_PRIVATE_ADDRESS = 349,
+     VAR_PRIVATE_DOMAIN = 350,
+     VAR_REMOTE_CONTROL = 351,
+     VAR_CONTROL_ENABLE = 352,
+     VAR_CONTROL_INTERFACE = 353,
+     VAR_CONTROL_PORT = 354,
+     VAR_SERVER_KEY_FILE = 355,
+     VAR_SERVER_CERT_FILE = 356,
+     VAR_CONTROL_KEY_FILE = 357,
+     VAR_CONTROL_CERT_FILE = 358,
+     VAR_CONTROL_USE_CERT = 359,
+     VAR_TCP_REUSE_TIMEOUT = 360,
+     VAR_MAX_REUSE_TCP_QUERIES = 361,
+     VAR_EXTENDED_STATISTICS = 362,
+     VAR_LOCAL_DATA_PTR = 363,
+     VAR_JOSTLE_TIMEOUT = 364,
+     VAR_STUB_PRIME = 365,
+     VAR_UNWANTED_REPLY_THRESHOLD = 366,
+     VAR_LOG_TIME_ASCII = 367,
+     VAR_DOMAIN_INSECURE = 368,
+     VAR_PYTHON = 369,
+     VAR_PYTHON_SCRIPT = 370,
+     VAR_VAL_SIG_SKEW_MIN = 371,
+     VAR_VAL_SIG_SKEW_MAX = 372,
+     VAR_VAL_MAX_RESTART = 373,
+     VAR_CACHE_MIN_TTL = 374,
+     VAR_VAL_LOG_LEVEL = 375,
+     VAR_AUTO_TRUST_ANCHOR_FILE = 376,
+     VAR_KEEP_MISSING = 377,
+     VAR_ADD_HOLDDOWN = 378,
+     VAR_DEL_HOLDDOWN = 379,
+     VAR_SO_RCVBUF = 380,
+     VAR_EDNS_BUFFER_SIZE = 381,
+     VAR_PREFETCH = 382,
+     VAR_PREFETCH_KEY = 383,
+     VAR_SO_SNDBUF = 384,
+     VAR_SO_REUSEPORT = 385,
+     VAR_HARDEN_BELOW_NXDOMAIN = 386,
+     VAR_IGNORE_CD_FLAG = 387,
+     VAR_LOG_QUERIES = 388,
+     VAR_LOG_REPLIES = 389,
+     VAR_LOG_LOCAL_ACTIONS = 390,
+     VAR_TCP_UPSTREAM = 391,
+     VAR_SSL_UPSTREAM = 392,
+     VAR_TCP_AUTH_QUERY_TIMEOUT = 393,
+     VAR_SSL_SERVICE_KEY = 394,
+     VAR_SSL_SERVICE_PEM = 395,
+     VAR_SSL_PORT = 396,
+     VAR_FORWARD_FIRST = 397,
+     VAR_STUB_SSL_UPSTREAM = 398,
+     VAR_FORWARD_SSL_UPSTREAM = 399,
+     VAR_TLS_CERT_BUNDLE = 400,
+     VAR_STUB_TCP_UPSTREAM = 401,
+     VAR_FORWARD_TCP_UPSTREAM = 402,
+     VAR_HTTPS_PORT = 403,
+     VAR_HTTP_ENDPOINT = 404,
+     VAR_HTTP_MAX_STREAMS = 405,
+     VAR_HTTP_QUERY_BUFFER_SIZE = 406,
+     VAR_HTTP_RESPONSE_BUFFER_SIZE = 407,
+     VAR_HTTP_NODELAY = 408,
+     VAR_HTTP_NOTLS_DOWNSTREAM = 409,
+     VAR_STUB_FIRST = 410,
+     VAR_MINIMAL_RESPONSES = 411,
+     VAR_RRSET_ROUNDROBIN = 412,
+     VAR_MAX_UDP_SIZE = 413,
+     VAR_DELAY_CLOSE = 414,
+     VAR_UDP_CONNECT = 415,
+     VAR_UNBLOCK_LAN_ZONES = 416,
+     VAR_INSECURE_LAN_ZONES = 417,
+     VAR_INFRA_CACHE_MIN_RTT = 418,
+     VAR_INFRA_CACHE_MAX_RTT = 419,
+     VAR_INFRA_KEEP_PROBING = 420,
+     VAR_DNS64_PREFIX = 421,
+     VAR_DNS64_SYNTHALL = 422,
+     VAR_DNS64_IGNORE_AAAA = 423,
+     VAR_DNSTAP = 424,
+     VAR_DNSTAP_ENABLE = 425,
+     VAR_DNSTAP_SOCKET_PATH = 426,
+     VAR_DNSTAP_IP = 427,
+     VAR_DNSTAP_TLS = 428,
+     VAR_DNSTAP_TLS_SERVER_NAME = 429,
+     VAR_DNSTAP_TLS_CERT_BUNDLE = 430,
+     VAR_DNSTAP_TLS_CLIENT_KEY_FILE = 431,
+     VAR_DNSTAP_TLS_CLIENT_CERT_FILE = 432,
+     VAR_DNSTAP_SEND_IDENTITY = 433,
+     VAR_DNSTAP_SEND_VERSION = 434,
+     VAR_DNSTAP_BIDIRECTIONAL = 435,
+     VAR_DNSTAP_IDENTITY = 436,
+     VAR_DNSTAP_VERSION = 437,
+     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 438,
+     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 439,
+     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 440,
+     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 441,
+     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 442,
+     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 443,
+     VAR_RESPONSE_IP_TAG = 444,
+     VAR_RESPONSE_IP = 445,
+     VAR_RESPONSE_IP_DATA = 446,
+     VAR_HARDEN_ALGO_DOWNGRADE = 447,
+     VAR_IP_TRANSPARENT = 448,
+     VAR_IP_DSCP = 449,
+     VAR_DISABLE_DNSSEC_LAME_CHECK = 450,
+     VAR_IP_RATELIMIT = 451,
+     VAR_IP_RATELIMIT_SLABS = 452,
+     VAR_IP_RATELIMIT_SIZE = 453,
+     VAR_RATELIMIT = 454,
+     VAR_RATELIMIT_SLABS = 455,
+     VAR_RATELIMIT_SIZE = 456,
+     VAR_OUTBOUND_MSG_RETRY = 457,
+     VAR_RATELIMIT_FOR_DOMAIN = 458,
+     VAR_RATELIMIT_BELOW_DOMAIN = 459,
+     VAR_IP_RATELIMIT_FACTOR = 460,
+     VAR_RATELIMIT_FACTOR = 461,
+     VAR_IP_RATELIMIT_BACKOFF = 462,
+     VAR_RATELIMIT_BACKOFF = 463,
+     VAR_SEND_CLIENT_SUBNET = 464,
+     VAR_CLIENT_SUBNET_ZONE = 465,
+     VAR_CLIENT_SUBNET_ALWAYS_FORWARD = 466,
+     VAR_CLIENT_SUBNET_OPCODE = 467,
+     VAR_MAX_CLIENT_SUBNET_IPV4 = 468,
+     VAR_MAX_CLIENT_SUBNET_IPV6 = 469,
+     VAR_MIN_CLIENT_SUBNET_IPV4 = 470,
+     VAR_MIN_CLIENT_SUBNET_IPV6 = 471,
+     VAR_MAX_ECS_TREE_SIZE_IPV4 = 472,
+     VAR_MAX_ECS_TREE_SIZE_IPV6 = 473,
+     VAR_CAPS_WHITELIST = 474,
+     VAR_CACHE_MAX_NEGATIVE_TTL = 475,
+     VAR_PERMIT_SMALL_HOLDDOWN = 476,
+     VAR_QNAME_MINIMISATION = 477,
+     VAR_QNAME_MINIMISATION_STRICT = 478,
+     VAR_IP_FREEBIND = 479,
+     VAR_DEFINE_TAG = 480,
+     VAR_LOCAL_ZONE_TAG = 481,
+     VAR_ACCESS_CONTROL_TAG = 482,
+     VAR_LOCAL_ZONE_OVERRIDE = 483,
+     VAR_ACCESS_CONTROL_TAG_ACTION = 484,
+     VAR_ACCESS_CONTROL_TAG_DATA = 485,
+     VAR_VIEW = 486,
+     VAR_ACCESS_CONTROL_VIEW = 487,
+     VAR_VIEW_FIRST = 488,
+     VAR_SERVE_EXPIRED = 489,
+     VAR_SERVE_EXPIRED_TTL = 490,
+     VAR_SERVE_EXPIRED_TTL_RESET = 491,
+     VAR_SERVE_EXPIRED_REPLY_TTL = 492,
+     VAR_SERVE_EXPIRED_CLIENT_TIMEOUT = 493,
+     VAR_EDE_SERVE_EXPIRED = 494,
+     VAR_SERVE_ORIGINAL_TTL = 495,
+     VAR_FAKE_DSA = 496,
+     VAR_FAKE_SHA1 = 497,
+     VAR_LOG_IDENTITY = 498,
+     VAR_HIDE_TRUSTANCHOR = 499,
+     VAR_HIDE_HTTP_USER_AGENT = 500,
+     VAR_HTTP_USER_AGENT = 501,
+     VAR_TRUST_ANCHOR_SIGNALING = 502,
+     VAR_AGGRESSIVE_NSEC = 503,
+     VAR_USE_SYSTEMD = 504,
+     VAR_SHM_ENABLE = 505,
+     VAR_SHM_KEY = 506,
+     VAR_ROOT_KEY_SENTINEL = 507,
+     VAR_DNSCRYPT = 508,
+     VAR_DNSCRYPT_ENABLE = 509,
+     VAR_DNSCRYPT_PORT = 510,
+     VAR_DNSCRYPT_PROVIDER = 511,
+     VAR_DNSCRYPT_SECRET_KEY = 512,
+     VAR_DNSCRYPT_PROVIDER_CERT = 513,
+     VAR_DNSCRYPT_PROVIDER_CERT_ROTATED = 514,
+     VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE = 515,
+     VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS = 516,
+     VAR_DNSCRYPT_NONCE_CACHE_SIZE = 517,
+     VAR_DNSCRYPT_NONCE_CACHE_SLABS = 518,
+     VAR_PAD_RESPONSES = 519,
+     VAR_PAD_RESPONSES_BLOCK_SIZE = 520,
+     VAR_PAD_QUERIES = 521,
+     VAR_PAD_QUERIES_BLOCK_SIZE = 522,
+     VAR_IPSECMOD_ENABLED = 523,
+     VAR_IPSECMOD_HOOK = 524,
+     VAR_IPSECMOD_IGNORE_BOGUS = 525,
+     VAR_IPSECMOD_MAX_TTL = 526,
+     VAR_IPSECMOD_WHITELIST = 527,
+     VAR_IPSECMOD_STRICT = 528,
+     VAR_CACHEDB = 529,
+     VAR_CACHEDB_BACKEND = 530,
+     VAR_CACHEDB_SECRETSEED = 531,
+     VAR_CACHEDB_REDISHOST = 532,
+     VAR_CACHEDB_REDISPORT = 533,
+     VAR_CACHEDB_REDISTIMEOUT = 534,
+     VAR_CACHEDB_REDISEXPIRERECORDS = 535,
+     VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM = 536,
+     VAR_FOR_UPSTREAM = 537,
+     VAR_AUTH_ZONE = 538,
+     VAR_ZONEFILE = 539,
+     VAR_MASTER = 540,
+     VAR_URL = 541,
+     VAR_FOR_DOWNSTREAM = 542,
+     VAR_FALLBACK_ENABLED = 543,
+     VAR_TLS_ADDITIONAL_PORT = 544,
+     VAR_LOW_RTT = 545,
+     VAR_LOW_RTT_PERMIL = 546,
+     VAR_FAST_SERVER_PERMIL = 547,
+     VAR_FAST_SERVER_NUM = 548,
+     VAR_ALLOW_NOTIFY = 549,
+     VAR_TLS_WIN_CERT = 550,
+     VAR_TCP_CONNECTION_LIMIT = 551,
+     VAR_ANSWER_COOKIE = 552,
+     VAR_COOKIE_SECRET = 553,
+     VAR_FORWARD_NO_CACHE = 554,
+     VAR_STUB_NO_CACHE = 555,
+     VAR_LOG_SERVFAIL = 556,
+     VAR_DENY_ANY = 557,
+     VAR_UNKNOWN_SERVER_TIME_LIMIT = 558,
+     VAR_LOG_TAG_QUERYREPLY = 559,
+     VAR_STREAM_WAIT_SIZE = 560,
+     VAR_TLS_CIPHERS = 561,
+     VAR_TLS_CIPHERSUITES = 562,
+     VAR_TLS_USE_SNI = 563,
+     VAR_IPSET = 564,
+     VAR_IPSET_NAME_V4 = 565,
+     VAR_IPSET_NAME_V6 = 566,
+     VAR_TLS_SESSION_TICKET_KEYS = 567,
+     VAR_RPZ = 568,
+     VAR_TAGS = 569,
+     VAR_RPZ_ACTION_OVERRIDE = 570,
+     VAR_RPZ_CNAME_OVERRIDE = 571,
+     VAR_RPZ_LOG = 572,
+     VAR_RPZ_LOG_NAME = 573,
+     VAR_DYNLIB = 574,
+     VAR_DYNLIB_FILE = 575,
+     VAR_EDNS_CLIENT_STRING = 576,
+     VAR_EDNS_CLIENT_STRING_OPCODE = 577,
+     VAR_NSID = 578,
+     VAR_ZONEMD_PERMISSIVE_MODE = 579,
+     VAR_ZONEMD_CHECK = 580,
+     VAR_ZONEMD_REJECT_ABSENCE = 581,
+     VAR_RPZ_SIGNAL_NXDOMAIN_RA = 582,
+     VAR_INTERFACE_AUTOMATIC_PORTS = 583,
+     VAR_EDE = 584,
+     VAR_UPSTREAM_COOKIES = 585,
+     VAR_INTERFACE_ACTION = 586,
+     VAR_INTERFACE_VIEW = 587,
+     VAR_INTERFACE_TAG = 588,
+     VAR_INTERFACE_TAG_ACTION = 589,
+     VAR_INTERFACE_TAG_DATA = 590,
+     VAR_PROXY_PROTOCOL_PORT = 591
+   };
 #endif
-/* Token kinds.  */
-#define YYEMPTY -2
-#define YYEOF 0
-#define YYerror 256
-#define YYUNDEF 257
+/* Tokens.  */
 #define SPACE 258
 #define LETTER 259
 #define NEWLINE 260
@@ -722,34 +703,30 @@ extern int yydebug;
 #define VAR_RPZ_SIGNAL_NXDOMAIN_RA 582
 #define VAR_INTERFACE_AUTOMATIC_PORTS 583
 #define VAR_EDE 584
-#define VAR_INTERFACE_ACTION 585
-#define VAR_INTERFACE_VIEW 586
-#define VAR_INTERFACE_TAG 587
-#define VAR_INTERFACE_TAG_ACTION 588
-#define VAR_INTERFACE_TAG_DATA 589
-#define VAR_PROXY_PROTOCOL_PORT 590
+#define VAR_UPSTREAM_COOKIES 585
+#define VAR_INTERFACE_ACTION 586
+#define VAR_INTERFACE_VIEW 587
+#define VAR_INTERFACE_TAG 588
+#define VAR_INTERFACE_TAG_ACTION 589
+#define VAR_INTERFACE_TAG_DATA 590
+#define VAR_PROXY_PROTOCOL_PORT 591
+
+
+
 
-/* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-union YYSTYPE
-{
+typedef union YYSTYPE
 #line 69 "./util/configparser.y"
-
+{
 	char*	str;
-
-#line 741 "util/configparser.h"
-
-};
-typedef union YYSTYPE YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 1529 of yacc.c.  */
+#line 725 "util/configparser.h"
+	YYSTYPE;
+# define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
-
 extern YYSTYPE yylval;
 
-
-int yyparse (void);
-
-
-#endif /* !YY_YY_UTIL_CONFIGPARSER_H_INCLUDED  */

util/configparser.y

@@ -194,6 +194,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_EDNS_CLIENT_STRING_OPCODE VAR_NSID
 %token VAR_ZONEMD_PERMISSIVE_MODE VAR_ZONEMD_CHECK VAR_ZONEMD_REJECT_ABSENCE
 %token VAR_RPZ_SIGNAL_NXDOMAIN_RA VAR_INTERFACE_AUTOMATIC_PORTS VAR_EDE
+%token VAR_UPSTREAM_COOKIES
 %token VAR_INTERFACE_ACTION VAR_INTERFACE_VIEW VAR_INTERFACE_TAG
 %token VAR_INTERFACE_TAG_ACTION VAR_INTERFACE_TAG_DATA
 %token VAR_PROXY_PROTOCOL_PORT
@@ -325,7 +326,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_edns_client_string_opcode | server_nsid |
 	server_zonemd_permissive_mode | server_max_reuse_tcp_queries |
 	server_tcp_reuse_timeout | server_tcp_auth_query_timeout |
-	server_interface_automatic_ports | server_ede |
+	server_interface_automatic_ports | server_ede | server_upstream_cookies |
 	server_proxy_protocol_port
 	;
 stubstart: VAR_STUB_ZONE
@@ -2829,6 +2830,14 @@ server_ede: VAR_EDE STRING_ARG
 		free($2);
 	}
 	;
+server_upstream_cookies: VAR_UPSTREAM_COOKIES STRING_ARG
+	{
+		OUTYY(("P(server_upstream_cookies:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->upstream_cookies = (strcmp($2, "yes")==0);
+		free($2);
+	}
 server_proxy_protocol_port: VAR_PROXY_PROTOCOL_PORT STRING_ARG
 	{
 		OUTYY(("P(server_proxy_protocol_port:%s)\n", $2));

util/data/msgparse.c

@@ -597,6 +597,19 @@ parse_query_section(sldns_buffer* pkt, struct msg_parse* msg)
 	return 0;
 }
 
+struct edns_option*
+edns_list_get_option(struct edns_option* option, uint16_t code)
+{
+	while (option) {
+		if (option->opt_code == code) {
+			return option;
+		}
+
+		option = option->next;
+	}
+	return NULL;
+}
+
 size_t
 get_rdf_size(sldns_rdf_type rdf)
 {

util/data/msgparse.h

@@ -259,6 +259,15 @@ struct edns_option {
 	uint8_t* opt_data;
 };
 
+
+/**
+ * Search through an EDNS list to find if the specified option.
+ * @param option: The EDNS list which we search in
+ * @param code: the option code that we search for
+ * @return: returns the option if it is there, and NULL when it is not
+ */
+struct edns_option* edns_list_get_option(struct edns_option* option, uint16_t code);
+
 /**
  * Obtain size in the packet of an rr type, that is before dname type.
  * Do TYPE_DNAME, and type STR, yourself. Gives size for most regular types.

util/module.c

@@ -70,6 +70,8 @@ strmodulevent(enum module_ev e)
 	case module_event_noreply: return "module_event_noreply";
 	case module_event_capsfail: return "module_event_capsfail";
 	case module_event_moddone: return "module_event_moddone";
+	case module_event_interface_not_available: return 
+		"module_event_interface_not_available";
 	case module_event_error: return "module_event_error";
 	}
 	return "bad_event_value";

util/module.h

@@ -579,6 +579,8 @@ enum module_ev {
 	module_event_capsfail,
 	/** next module is done, and its reply is awaiting you */
 	module_event_moddone,
+    /** retry of the query is needed with a rewritten (client) cookie */
+    module_event_interface_not_available,
 	/** error */
 	module_event_error
 };

util/netevent.h

@@ -99,6 +99,10 @@ typedef int comm_point_callback_type(struct comm_point*, void*, int,
 /** to pass write of the write packet is done to callback function
  * used when tcp_write_and_read is enabled */
 #define NETEVENT_PKT_WRITTEN -5
+/** to pass a retry event when the bound interface of a cookie has failed
+ * and a retry is needed with a rewritten (client) cookie */
+#define NETEVENT_BOUND_INTERFACE_NOT_AVAILABLE -6
+
 
 /** timeout to slow accept calls when not possible, in msec. */
 #define NETEVENT_SLOW_ACCEPT_TIME 2000