update unbound from upstream

6 files changed, 68 insertions, 45 deletions

diff --git a/external/unbound/services/cache/dns.c b/external/unbound/services/cache/dns.c
index c663b8e8b..4692744a1 100644
--- a/external/unbound/services/cache/dns.c
+++ b/external/unbound/services/cache/dns.c
@@ -184,7 +184,7 @@ addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 /** lookup message in message cache */
 static struct msgreply_entry* 
 msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen, 
-	uint16_t qtype, uint16_t qclass, time_t now, int wr)
+	uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
 {
 	struct lruhash_entry* e;
 	struct query_info k;
@@ -194,7 +194,7 @@ msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
 	k.qname_len = qnamelen;
 	k.qtype = qtype;
 	k.qclass = qclass;
-	h = query_info_hash(&k);
+	h = query_info_hash(&k, flags);
 	e = slabhash_lookup(env->msg_cache, h, &k, wr);
 
 	if(!e) return NULL;
@@ -226,8 +226,10 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 				addr_to_additional(akey, region, *msg, now);
 			lock_rw_unlock(&akey->entry.lock);
 		} else {
+			/* BIT_CD on false because delegpt lookup does
+			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
-				LDNS_RR_TYPE_A, qclass, now, 0);
+				LDNS_RR_TYPE_A, qclass, 0, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -244,8 +246,10 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 				addr_to_additional(akey, region, *msg, now);
 			lock_rw_unlock(&akey->entry.lock);
 		} else {
+			/* BIT_CD on false because delegpt lookup does
+			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
-				LDNS_RR_TYPE_AAAA, qclass, now, 0);
+				LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -276,8 +280,10 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 				ns->name, LDNS_RR_TYPE_A, qclass);
 			lock_rw_unlock(&akey->entry.lock);
 		} else {
+			/* BIT_CD on false because delegpt lookup does
+			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
-				LDNS_RR_TYPE_A, qclass, now, 0);
+				LDNS_RR_TYPE_A, qclass, 0, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -294,8 +300,10 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 				ns->name, LDNS_RR_TYPE_AAAA, qclass);
 			lock_rw_unlock(&akey->entry.lock);
 		} else {
+			/* BIT_CD on false because delegpt lookup does
+			 * not use dns64 translation */
 			neg = msg_cache_lookup(env, ns->name, ns->namelen,
-				LDNS_RR_TYPE_AAAA, qclass, now, 0);
+				LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 			if(neg) {
 				delegpt_add_neg_msg(dp, neg);
 				lock_rw_unlock(&neg->entry.lock);
@@ -626,7 +634,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 struct dns_msg* 
 dns_cache_lookup(struct module_env* env,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	struct regional* region, struct regional* scratch)
+	uint16_t flags, struct regional* region, struct regional* scratch)
 {
 	struct lruhash_entry* e;
 	struct query_info k;
@@ -639,7 +647,7 @@ dns_cache_lookup(struct module_env* env,
 	k.qname_len = qnamelen;
 	k.qtype = qtype;
 	k.qclass = qclass;
-	h = query_info_hash(&k);
+	h = query_info_hash(&k, flags);
 	e = slabhash_lookup(env->msg_cache, h, &k, 0);
 	if(e) {
 		struct msgreply_entry* key = (struct msgreply_entry*)e->key;
@@ -716,7 +724,7 @@ dns_cache_lookup(struct module_env* env,
 	if(env->cfg->harden_below_nxdomain)
 	    while(!dname_is_root(k.qname)) {
 		dname_remove_label(&k.qname, &k.qname_len);
-		h = query_info_hash(&k);
+		h = query_info_hash(&k, flags);
 		e = slabhash_lookup(env->msg_cache, h, &k, 0);
 		if(e) {
 			struct reply_info* data = (struct reply_info*)e->data;
@@ -741,7 +749,7 @@ dns_cache_lookup(struct module_env* env,
 int 
 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
         struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
-	struct regional* region)
+	struct regional* region, uint16_t flags)
 {
 	struct reply_info* rep = NULL;
 	/* alloc, malloc properly (not in region, like msg is) */
@@ -786,7 +794,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 		 * Not AA from cache. Not CD in cache (depends on client bit). */
 		rep->flags |= (BIT_RA | BIT_QR);
 		rep->flags &= ~(BIT_AA | BIT_CD);
-		h = query_info_hash(&qinf);
+		h = query_info_hash(&qinf, flags);
 		dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
 			region);
 		/* qname is used inside query_info_entrysetup, and set to 
@@ -798,11 +806,11 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 
 int 
 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
-        time_t adjust)
+        time_t adjust, uint16_t flags)
 {
 	struct msgreply_entry* msg;
 	msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
-		qinfo->qtype, qinfo->qclass, *env->now, 1);
+		qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
 	if(msg) {
 		struct reply_info* rep = (struct reply_info*)msg->entry.data;
 		if(rep) {
diff --git a/external/unbound/services/cache/dns.h b/external/unbound/services/cache/dns.h
index 05a3e6296..69796c2eb 100644
--- a/external/unbound/services/cache/dns.h
+++ b/external/unbound/services/cache/dns.h
@@ -79,11 +79,12 @@ struct dns_msg {
  * 	can be updated to full TTL even in prefetch situations.
  * @param region: region to allocate better entries from cache into.
  *   (used when is_referral is false).
+ * @param flags: flags with BIT_CD for AAAA queries in dns64 translation.
  * @return 0 on alloc error (out of memory).
  */
 int dns_cache_store(struct module_env* env, struct query_info* qinf,
         struct reply_info* rep, int is_referral, time_t leeway, int pside,
-	struct regional* region); 
+	struct regional* region, uint16_t flags); 
 
 /**
  * Store message in the cache. Stores in message cache and rrset cache.
@@ -132,6 +133,7 @@ struct delegpt* dns_cache_find_delegation(struct module_env* env,
  * @param qnamelen: length of qname.
  * @param qtype: query type.
  * @param qclass: query class.
+ * @param flags: flags with BIT_CD for AAAA queries in dns64 translation.
  * @param region: where to allocate result.
  * @param scratch: where to allocate temporary data.
  * @return new response message (alloced in region, rrsets do not have IDs).
@@ -140,7 +142,7 @@ struct delegpt* dns_cache_find_delegation(struct module_env* env,
  */
 struct dns_msg* dns_cache_lookup(struct module_env* env,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	struct regional* region, struct regional* scratch);
+	uint16_t flags, struct regional* region, struct regional* scratch);
 
 /** 
  * find and add A and AAAA records for missing nameservers in delegpt 
@@ -186,9 +188,10 @@ int dns_msg_authadd(struct dns_msg* msg, struct regional* region,
  * @param env: module environment with caches and time.
  * @param qinfo: query info for the query that needs adjustment.
  * @param adjust: time in seconds to add to the prefetch_leeway.
+ * @param flags: flags with BIT_CD for AAAA queries in dns64 translation.
  * @return false if not in cache. true if added.
  */
 int dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
-        time_t adjust);
+        time_t adjust, uint16_t flags);
 
 #endif /* SERVICES_CACHE_DNS_H */
diff --git a/external/unbound/services/mesh.c b/external/unbound/services/mesh.c
index bc711d9b3..a69aced22 100644
--- a/external/unbound/services/mesh.c
+++ b/external/unbound/services/mesh.c
@@ -132,6 +132,11 @@ mesh_state_compare(const void* ap, const void* bp)
 	if(!a->s.is_priming && b->s.is_priming)
 		return 1;
 
+	if(a->s.is_valrec && !b->s.is_valrec)
+		return -1;
+	if(!a->s.is_valrec && b->s.is_valrec)
+		return 1;
+
 	if((a->s.query_flags&BIT_RD) && !(b->s.query_flags&BIT_RD))
 		return -1;
 	if(!(a->s.query_flags&BIT_RD) && (b->s.query_flags&BIT_RD))
@@ -277,11 +282,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
         uint16_t qflags, struct edns_data* edns, struct comm_reply* rep,
         uint16_t qid)
 {
-	/* do not use CD flag from user for mesh state, we want the CD-query
-	 * to receive validation anyway, to protect out cache contents and
-	 * avoid bad-data in this cache that a downstream validator cannot
-	 * remove from this cache */
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -311,7 +312,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 #ifdef UNBOUND_DEBUG
 		struct rbnode_t* n;
 #endif
-		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
@@ -375,7 +376,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, sldns_buffer* buf, 
 	uint16_t qid, mesh_cb_func_t cb, void* cb_arg)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
@@ -386,7 +387,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 #ifdef UNBOUND_DEBUG
 		struct rbnode_t* n;
 #endif
-		s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 		if(!s) {
 			return 0;
 		}
@@ -428,7 +429,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
         uint16_t qflags, time_t leeway)
 {
-	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&BIT_RD, 0);
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 #ifdef UNBOUND_DEBUG
 	struct rbnode_t* n;
 #endif
@@ -447,7 +448,7 @@ void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
 		mesh->stats_dropped ++;
 		return;
 	}
-	s = mesh_state_create(mesh->env, qinfo, qflags&BIT_RD, 0);
+	s = mesh_state_create(mesh->env, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
 	if(!s) {
 		log_err("prefetch mesh_state_create: out of memory");
 		return;
@@ -496,7 +497,7 @@ void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
 
 struct mesh_state* 
 mesh_state_create(struct module_env* env, struct query_info* qinfo, 
-	uint16_t qflags, int prime)
+	uint16_t qflags, int prime, int valrec)
 {
 	struct regional* region = alloc_reg_obtain(env->alloc);
 	struct mesh_state* mstate;
@@ -533,6 +534,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	/* remove all weird bits from qflags */
 	mstate->s.query_flags = (qflags & (BIT_RD|BIT_CD));
 	mstate->s.is_priming = prime;
+	mstate->s.is_valrec = valrec;
 	mstate->s.reply = NULL;
 	mstate->s.region = region;
 	mstate->s.curmod = 0;
@@ -679,11 +681,12 @@ void mesh_detach_subs(struct module_qstate* qstate)
 }
 
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, struct module_qstate** newq)
+        uint16_t qflags, int prime, int valrec, struct module_qstate** newq)
 {
 	/* find it, if not, create it */
 	struct mesh_area* mesh = qstate->env->mesh;
-	struct mesh_state* sub = mesh_area_find(mesh, qinfo, qflags, prime);
+	struct mesh_state* sub = mesh_area_find(mesh, qinfo, qflags, prime,
+		valrec);
 	int was_detached;
 	if(mesh_detect_cycle_found(qstate, sub)) {
 		verbose(VERB_ALGO, "attach failed, cycle detected");
@@ -694,7 +697,8 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 		struct rbnode_t* n;
 #endif
 		/* create a new one */
-		sub = mesh_state_create(qstate->env, qinfo, qflags, prime);
+		sub = mesh_state_create(qstate->env, qinfo, qflags, prime,
+			valrec);
 		if(!sub) {
 			log_err("mesh_attach_sub: out of memory");
 			return 0;
@@ -941,13 +945,14 @@ void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
 }
 
 struct mesh_state* mesh_area_find(struct mesh_area* mesh,
-	struct query_info* qinfo, uint16_t qflags, int prime)
+	struct query_info* qinfo, uint16_t qflags, int prime, int valrec)
 {
 	struct mesh_state key;
 	struct mesh_state* result;
 
 	key.node.key = &key;
 	key.s.is_priming = prime;
+	key.s.is_valrec = valrec;
 	key.s.qinfo = *qinfo;
 	key.s.query_flags = qflags;
 	
@@ -1107,8 +1112,9 @@ mesh_log_list(struct mesh_area* mesh)
 	struct mesh_state* m;
 	int num = 0;
 	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
-		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s mod%d %s%s", 
+		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s", 
 			num++, (m->s.is_priming)?"p":"",  /* prime */
+			(m->s.is_valrec)?"v":"",  /* prime */
 			(m->s.query_flags&BIT_RD)?"RD":"",
 			(m->s.query_flags&BIT_CD)?"CD":"",
 			(m->super_set.count==0)?"d":"", /* detached */
@@ -1178,10 +1184,11 @@ mesh_get_mem(struct mesh_area* mesh)
 
 int 
 mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t flags, int prime)
+	uint16_t flags, int prime, int valrec)
 {
 	struct mesh_area* mesh = qstate->env->mesh;
-	struct mesh_state* dep_m = mesh_area_find(mesh, qinfo, flags, prime);
+	struct mesh_state* dep_m = mesh_area_find(mesh, qinfo, flags, prime,
+		valrec);
 	return mesh_detect_cycle_found(qstate, dep_m);
 }
 
diff --git a/external/unbound/services/mesh.h b/external/unbound/services/mesh.h
index fbfbbcb4a..086e39094 100644
--- a/external/unbound/services/mesh.h
+++ b/external/unbound/services/mesh.h
@@ -353,12 +353,13 @@ void mesh_detach_subs(struct module_qstate* qstate);
  * @param qinfo: what to query for (copied).
  * @param qflags: what flags to use (RD / CD flag or not).
  * @param prime: if it is a (stub) priming query.
+ * @param valrec: if it is a validation recursion query (lookup of key, DS).
  * @param newq: If the new subquery needs initialisation, it is returned,
  * 	otherwise NULL is returned.
  * @return: false on error, true if success (and init may be needed).
  */
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t qflags, int prime, struct module_qstate** newq);
+	uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
 
 /**
  * Query state is done, send messages to reply entries.
@@ -406,10 +407,12 @@ void mesh_state_delete(struct module_qstate* qstate);
  * @param qinfo: query info that the mesh is for.
  * @param qflags: flags for query (RD / CD flag).
  * @param prime: if true, it is a priming query, set is_priming on mesh state.
+ * @param valrec: if true, it is a validation recursion query, and sets
+ * 	is_valrec on the mesh state.
  * @return: new mesh state or NULL on allocation error.
  */
 struct mesh_state* mesh_state_create(struct module_env* env, 
-	struct query_info* qinfo, uint16_t qflags, int prime);
+	struct query_info* qinfo, uint16_t qflags, int prime, int valrec);
 
 /**
  * Cleanup a mesh state and its query state. Does not do rbtree or 
@@ -432,10 +435,11 @@ void mesh_delete_all(struct mesh_area* mesh);
  * @param qinfo: what query
  * @param qflags: if RD / CD bit is set or not.
  * @param prime: if it is a priming query.
+ * @param valrec: if it is a validation-recursion query.
  * @return: mesh state or NULL if not found.
  */
 struct mesh_state* mesh_area_find(struct mesh_area* mesh, 
-	struct query_info* qinfo, uint16_t qflags, int prime);
+	struct query_info* qinfo, uint16_t qflags, int prime, int valrec);
 
 /**
  * Setup attachment super/sub relation between super and sub mesh state.
@@ -523,13 +527,14 @@ size_t mesh_get_mem(struct mesh_area* mesh);
  * @param qinfo: query info for dependency.
  * @param flags: query flags of dependency.
  * @param prime: if dependency is a priming query or not.
+ * @param valrec: if it is a validation recursion query (lookup of key, DS).
  * @return true if the name,type,class exists and the given qstate mesh exists
  * 	as a dependency of that name. Thus if qstate becomes dependent on
  * 	name,type,class then a cycle is created, this is return value 1.
  * 	Too large to search is value 2 (also true).
  */
 int mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t flags, int prime);
+	uint16_t flags, int prime, int valrec);
 
 /** compare two mesh_states */
 int mesh_state_compare(const void* ap, const void* bp);
diff --git a/external/unbound/services/modstack.c b/external/unbound/services/modstack.c
index a99030bc3..49bb2fd15 100644
--- a/external/unbound/services/modstack.c
+++ b/external/unbound/services/modstack.c
@@ -60,12 +60,12 @@ count_modules(const char* s)
                 return 0;
         while(*s) {
                 /* skip whitespace */
-                while(*s && isspace((int)*s))
+                while(*s && isspace((unsigned char)*s))
                         s++;
-                if(*s && !isspace((int)*s)) {
+                if(*s && !isspace((unsigned char)*s)) {
                         /* skip identifier */
                         num++;
-                        while(*s && !isspace((int)*s))
+                        while(*s && !isspace((unsigned char)*s))
                                 s++;
                 }
         }
@@ -152,7 +152,7 @@ module_func_block* module_factory(const char** str)
         const char* s = *str;
 	const char** names = module_list_avail();
 	fbgetfunctype* fb = module_funcs_avail();
-        while(*s && isspace((int)*s))
+        while(*s && isspace((unsigned char)*s))
                 s++;
 	while(names[i]) {
                 if(strncmp(names[i], s, strlen(names[i])) == 0) {
diff --git a/external/unbound/services/outside_network.c b/external/unbound/services/outside_network.c
index 986c53dd8..5bb52ff9f 100644
--- a/external/unbound/services/outside_network.c
+++ b/external/unbound/services/outside_network.c
@@ -1334,16 +1334,16 @@ serviced_perturb_qname(struct ub_randstate* rnd, uint8_t* qbuf, size_t len)
 	while(lablen) {
 		while(lablen--) {
 			/* only perturb A-Z, a-z */
-			if(isalpha((int)*d)) {
+			if(isalpha((unsigned char)*d)) {
 				/* get a random bit */	
 				if(bits == 0) {
 					random = ub_random(rnd);
 					bits = 30;
 				}
 				if(random & 0x1) {
-					*d = (uint8_t)toupper((int)*d);
+					*d = (uint8_t)toupper((unsigned char)*d);
 				} else {
-					*d = (uint8_t)tolower((int)*d);
+					*d = (uint8_t)tolower((unsigned char)*d);
 				}
 				random >>= 1;
 				bits--;