Upgrade unbound library

These files were pulled from the 1.6.3 release tarball.

This new version builds against OpenSSL version 1.1 which will be
the default in the new Debian Stable which is due to be released
RealSoonNow (tm).

9 files changed, 253 insertions, 41 deletions

diff --git a/external/unbound/sldns/keyraw.c b/external/unbound/sldns/keyraw.c
index 59e8000f5..e8f2da089 100644
--- a/external/unbound/sldns/keyraw.c
+++ b/external/unbound/sldns/keyraw.c
@@ -23,6 +23,15 @@
 #ifdef HAVE_OPENSSL_ENGINE_H
 #  include <openssl/engine.h>
 #endif
+#ifdef HAVE_OPENSSL_BN_H
+#include <openssl/bn.h>
+#endif
+#ifdef HAVE_OPENSSL_RSA_H
+#include <openssl/rsa.h>
+#endif
+#ifdef HAVE_OPENSSL_DSA_H
+#include <openssl/dsa.h>
+#endif
 #endif /* HAVE_SSL */
 
 size_t
@@ -206,7 +215,6 @@ sldns_key_buf2dsa_raw(unsigned char* key, size_t len)
 	offset += length;
 
 	Y = BN_bin2bn(key+offset, (int)length, NULL);
-	offset += length;
 
 	/* create the key and set its properties */
 	if(!Q || !P || !G || !Y || !(dsa = DSA_new())) {
@@ -216,6 +224,7 @@ sldns_key_buf2dsa_raw(unsigned char* key, size_t len)
 		BN_free(Y);
 		return NULL;
 	}
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
 #ifndef S_SPLINT_S
 	dsa->p = P;
 	dsa->q = Q;
@@ -223,6 +232,25 @@ sldns_key_buf2dsa_raw(unsigned char* key, size_t len)
 	dsa->pub_key = Y;
 #endif /* splint */
 
+#else /* OPENSSL_VERSION_NUMBER */
+	if (!DSA_set0_pqg(dsa, P, Q, G)) {
+		/* QPG not yet attached, need to free */
+		BN_free(Q);
+		BN_free(P);
+		BN_free(G);
+
+		DSA_free(dsa);
+		BN_free(Y);
+		return NULL;
+	}
+	if (!DSA_set0_key(dsa, Y, NULL)) {
+		/* QPG attached, cleaned up by DSA_fre() */
+		DSA_free(dsa);
+		BN_free(Y);
+		return NULL;
+	}
+#endif
+
 	return dsa;
 }
 
@@ -274,11 +302,21 @@ sldns_key_buf2rsa_raw(unsigned char* key, size_t len)
 		BN_free(modulus);
 		return NULL;
 	}
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
 #ifndef S_SPLINT_S
 	rsa->n = modulus;
 	rsa->e = exponent;
 #endif /* splint */
 
+#else /* OPENSSL_VERSION_NUMBER */
+	if (!RSA_set0_key(rsa, modulus, exponent, NULL)) {
+		BN_free(exponent);
+		BN_free(modulus);
+		RSA_free(rsa);
+		return NULL;
+	}
+#endif
+
 	return rsa;
 }
 
diff --git a/external/unbound/sldns/parseutil.c b/external/unbound/sldns/parseutil.c
index 2a2ebbb08..32717616a 100644
--- a/external/unbound/sldns/parseutil.c
+++ b/external/unbound/sldns/parseutil.c
@@ -637,7 +637,7 @@ int sldns_b64_ntop(uint8_t const *src, size_t srclength,
 		target[o+1] = b64[ ((src[i]&0x03)<<4) | (src[i+1]>>4) ];
 		target[o+2] = b64[ ((src[i+1]&0x0f)<<2) ];
 		target[o+3] = pad64;
-		i += 2;
+		/* i += 2; */
 		o += 4;
 		break;
 	case 1:
@@ -646,7 +646,7 @@ int sldns_b64_ntop(uint8_t const *src, size_t srclength,
 		target[o+1] = b64[ ((src[i]&0x03)<<4) ];
 		target[o+2] = pad64;
 		target[o+3] = pad64;
-		i += 1;
+		/* i += 1; */
 		o += 4;
 		break;
 	case 0:
diff --git a/external/unbound/sldns/rrdef.c b/external/unbound/sldns/rrdef.c
index a8c6229b9..80b47da16 100644
--- a/external/unbound/sldns/rrdef.c
+++ b/external/unbound/sldns/rrdef.c
@@ -144,6 +144,12 @@ static const sldns_rdf_type type_dhcid_wireformat[] = {
 static const sldns_rdf_type type_talink_wireformat[] = {
 	LDNS_RDF_TYPE_DNAME, LDNS_RDF_TYPE_DNAME
 };
+static const sldns_rdf_type type_openpgpkey_wireformat[] = {
+	LDNS_RDF_TYPE_B64
+};
+static const sldns_rdf_type type_csync_wireformat[] = {
+	LDNS_RDF_TYPE_INT32, LDNS_RDF_TYPE_INT16, LDNS_RDF_TYPE_NSEC
+};
 /* nsec3 is some vars, followed by same type of data of nsec */
 static const sldns_rdf_type type_nsec3_wireformat[] = {
 /*	LDNS_RDF_TYPE_NSEC3_VARS, LDNS_RDF_TYPE_NSEC3_NEXT_OWNER, LDNS_RDF_TYPE_NSEC*/
@@ -361,8 +367,10 @@ static sldns_rr_descriptor rdata_field_descriptors[] = {
 	{LDNS_RR_TYPE_CDS, "CDS", 4, 4, type_ds_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 	/* 60 */
 	{LDNS_RR_TYPE_CDNSKEY, "CDNSKEY", 4, 4, type_dnskey_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-{LDNS_RR_TYPE_NULL, "TYPE61", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-{LDNS_RR_TYPE_NULL, "TYPE62", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+	/* 61 */
+{LDNS_RR_TYPE_OPENPGPKEY, "OPENPGPKEY", 1, 1, type_openpgpkey_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
+	/* 62 */
+	{LDNS_RR_TYPE_CSYNC, "CSYNC", 3, 3, type_csync_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE63", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE64", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE65", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
diff --git a/external/unbound/sldns/rrdef.h b/external/unbound/sldns/rrdef.h
index ab65943a5..af7bca1d2 100644
--- a/external/unbound/sldns/rrdef.h
+++ b/external/unbound/sldns/rrdef.h
@@ -182,6 +182,8 @@ enum sldns_enum_rr_type
 	LDNS_RR_TYPE_NSEC3PARAM = 51, /* RFC 5155 */
 	LDNS_RR_TYPE_NSEC3PARAMS = 51,
 	LDNS_RR_TYPE_TLSA = 52, /* RFC 6698 */
+	LDNS_RR_TYPE_SMIMEA = 53, /* draft-ietf-dane-smime, TLSA-like but may
+				     be extended */
 
 	LDNS_RR_TYPE_HIP = 55, /* RFC 5205 */
 
@@ -193,6 +195,8 @@ enum sldns_enum_rr_type
         LDNS_RR_TYPE_TALINK = 58,
 	LDNS_RR_TYPE_CDS = 59, /** RFC 7344 */
 	LDNS_RR_TYPE_CDNSKEY = 60, /** RFC 7344 */
+	LDNS_RR_TYPE_OPENPGPKEY = 61, /* RFC 7929 */
+	LDNS_RR_TYPE_CSYNC = 62, /* RFC 7477 */
 
 	LDNS_RR_TYPE_SPF = 99, /* RFC 4408 */
 
@@ -368,6 +372,8 @@ enum sldns_enum_algorithm
         LDNS_ECC_GOST           = 12,  /* RFC 5933 */
         LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
         LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
+	LDNS_ED25519		= 15,  /* RFC 8080 */
+	LDNS_ED448		= 16,  /* RFC 8080 */
         LDNS_INDIRECT           = 252,
         LDNS_PRIVATEDNS         = 253,
         LDNS_PRIVATEOID         = 254
@@ -416,7 +422,9 @@ enum sldns_enum_edns_option
 	LDNS_EDNS_DAU = 5, /* RFC6975 */
 	LDNS_EDNS_DHU = 6, /* RFC6975 */
 	LDNS_EDNS_N3U = 7, /* RFC6975 */
-	LDNS_EDNS_CLIENT_SUBNET = 8 /* draft-vandergaast-edns-client-subnet */
+	LDNS_EDNS_CLIENT_SUBNET = 8, /* RFC7871 */
+	LDNS_EDNS_KEEPALIVE = 11, /* draft-ietf-dnsop-edns-tcp-keepalive*/
+	LDNS_EDNS_PADDING = 12 /* RFC7830 */
 };
 typedef enum sldns_enum_edns_option sldns_edns_option;
 
diff --git a/external/unbound/sldns/sbuffer.c b/external/unbound/sldns/sbuffer.c
index a7fe53aa0..a04b9b655 100644
--- a/external/unbound/sldns/sbuffer.c
+++ b/external/unbound/sldns/sbuffer.c
@@ -33,6 +33,7 @@ sldns_buffer_new(size_t capacity)
 	buffer->_position = 0;
 	buffer->_limit = buffer->_capacity = capacity;
 	buffer->_fixed = 0;
+	buffer->_vfixed = 0;
 	buffer->_status_err = 0;
 	
 	sldns_buffer_invariant(buffer);
@@ -48,6 +49,7 @@ sldns_buffer_new_frm_data(sldns_buffer *buffer, void *data, size_t size)
 	buffer->_position = 0; 
 	buffer->_limit = buffer->_capacity = size;
 	buffer->_fixed = 0;
+	buffer->_vfixed = 0;
 	buffer->_data = malloc(size);
 	if(!buffer->_data) {
 		buffer->_status_err = 1;
@@ -66,6 +68,17 @@ sldns_buffer_init_frm_data(sldns_buffer *buffer, void *data, size_t size)
 	buffer->_data = data;
 	buffer->_capacity = buffer->_limit = size;
 	buffer->_fixed = 1;
+	buffer->_vfixed = 0;
+}
+
+void
+sldns_buffer_init_vfixed_frm_data(sldns_buffer *buffer, void *data, size_t size)
+{
+	memset(buffer, 0, sizeof(*buffer));
+	buffer->_data = data;
+	buffer->_capacity = buffer->_limit = size;
+	buffer->_fixed = 1;
+	buffer->_vfixed = 1;
 }
 
 int
@@ -74,7 +87,7 @@ sldns_buffer_set_capacity(sldns_buffer *buffer, size_t capacity)
 	void *data;
 	
 	sldns_buffer_invariant(buffer);
-	assert(buffer->_position <= capacity);
+	assert(buffer->_position <= capacity && !buffer->_fixed);
 
 	data = (uint8_t *) realloc(buffer->_data, capacity);
 	if (!data) {
@@ -126,7 +139,7 @@ sldns_buffer_printf(sldns_buffer *buffer, const char *format, ...)
 		if (written == -1) {
 			buffer->_status_err = 1;
 			return -1;
-		} else if ((size_t) written >= remaining) {
+		} else if (!buffer->_vfixed && (size_t) written >= remaining) {
 			if (!sldns_buffer_reserve(buffer, (size_t) written + 1)) {
 				buffer->_status_err = 1;
 				return -1;
diff --git a/external/unbound/sldns/sbuffer.h b/external/unbound/sldns/sbuffer.h
index 3ce874fc7..d1aadf8a1 100644
--- a/external/unbound/sldns/sbuffer.h
+++ b/external/unbound/sldns/sbuffer.h
@@ -87,6 +87,19 @@ sldns_write_uint32(void *dst, uint32_t data)
 }
 
 
+INLINE void
+sldns_write_uint48(void *dst, uint64_t data)
+{
+        uint8_t *p = (uint8_t *) dst;
+        p[0] = (uint8_t) ((data >> 40) & 0xff);
+        p[1] = (uint8_t) ((data >> 32) & 0xff);
+        p[2] = (uint8_t) ((data >> 24) & 0xff);
+        p[3] = (uint8_t) ((data >> 16) & 0xff);
+        p[4] = (uint8_t) ((data >> 8) & 0xff);
+        p[5] = (uint8_t) (data & 0xff);
+}
+
+
 /**
  * \file sbuffer.h
  *
@@ -117,6 +130,17 @@ struct sldns_buffer
 	/** If the buffer is fixed it cannot be resized */
 	unsigned _fixed : 1;
 
+	/** If the buffer is vfixed, no more than capacity bytes willl be
+	 * written to _data, however the _position counter will be updated
+	 * with the amount that would have been written in consecutive
+	 * writes.  This allows for a modus operandi in which a sequence is
+	 * written on a fixed capacity buffer (perhaps with _data on stack).
+	 * When everything could be written, then the _data is immediately
+	 * usable, if not, then a buffer could be allocated sized precisely
+	 * to fit the data for a second attempt.
+	 */
+	unsigned _vfixed : 1;
+
 	/** The current state of the buffer. If writing to the buffer fails
 	 * for any reason, this value is changed. This way, you can perform
 	 * multiple writes in sequence and check for success afterwards. */
@@ -134,9 +158,9 @@ INLINE void
 sldns_buffer_invariant(sldns_buffer *buffer)
 {
 	assert(buffer != NULL);
-	assert(buffer->_position <= buffer->_limit);
+	assert(buffer->_position <= buffer->_limit || buffer->_vfixed);
 	assert(buffer->_limit <= buffer->_capacity);
-	assert(buffer->_data != NULL);
+	assert(buffer->_data != NULL || (buffer->_vfixed && buffer->_capacity == 0));
 }
 #endif
 
@@ -169,6 +193,19 @@ void sldns_buffer_new_frm_data(sldns_buffer *buffer, void *data, size_t size);
 void sldns_buffer_init_frm_data(sldns_buffer *buffer, void *data, size_t size);
 
 /**
+ * Setup a buffer with the data pointed to. No data copied, no memory allocs.
+ * The buffer is "virtually" fixed.  Writes beyond size (the capacity) will
+ * only update position, but no data will be written beyond capacity.  This
+ * allows to determine how big the buffer should have been to contain all the
+ * written data, by looking at the position with sldns_buffer_position(),
+ * similarly to the return value of POSIX's snprintf.
+ * \param[in] buffer pointer to the buffer to put the data in
+ * \param[in] data the data to encapsulate in the buffer
+ * \param[in] size the size of the data
+ */
+void sldns_buffer_init_vfixed_frm_data(sldns_buffer *buffer, void *data, size_t size);
+
+/**
  * clears the buffer and make it ready for writing.  The buffer's limit
  * is set to the capacity and the position is set to 0.
  * \param[in] buffer the buffer to clear
@@ -231,7 +268,7 @@ sldns_buffer_position(sldns_buffer *buffer)
 INLINE void
 sldns_buffer_set_position(sldns_buffer *buffer, size_t mark)
 {
-	assert(mark <= buffer->_limit);
+	assert(mark <= buffer->_limit || buffer->_vfixed);
 	buffer->_position = mark;
 }
 
@@ -245,7 +282,7 @@ sldns_buffer_set_position(sldns_buffer *buffer, size_t mark)
 INLINE void
 sldns_buffer_skip(sldns_buffer *buffer, ssize_t count)
 {
-	assert(buffer->_position + count <= buffer->_limit);
+	assert(buffer->_position + count <= buffer->_limit || buffer->_vfixed);
 	buffer->_position += count;
 }
 
@@ -317,7 +354,7 @@ int sldns_buffer_reserve(sldns_buffer *buffer, size_t amount);
 INLINE uint8_t *
 sldns_buffer_at(const sldns_buffer *buffer, size_t at)
 {
-	assert(at <= buffer->_limit);
+	assert(at <= buffer->_limit || buffer->_vfixed);
 	return buffer->_data + at;
 }
 
@@ -367,8 +404,8 @@ INLINE size_t
 sldns_buffer_remaining_at(sldns_buffer *buffer, size_t at)
 {
 	sldns_buffer_invariant(buffer);
-	assert(at <= buffer->_limit);
-	return buffer->_limit - at;
+	assert(at <= buffer->_limit || buffer->_vfixed);
+	return at < buffer->_limit ? buffer->_limit - at : 0;
 }
 
 /**
@@ -420,11 +457,43 @@ sldns_buffer_available(sldns_buffer *buffer, size_t count)
 INLINE void
 sldns_buffer_write_at(sldns_buffer *buffer, size_t at, const void *data, size_t count)
 {
-	assert(sldns_buffer_available_at(buffer, at, count));
+	if (!buffer->_vfixed)
+		assert(sldns_buffer_available_at(buffer, at, count));
+	else if (sldns_buffer_remaining_at(buffer, at) == 0)
+		return;
+	else if (count > sldns_buffer_remaining_at(buffer, at)) {
+		memcpy(buffer->_data + at, data,
+		    sldns_buffer_remaining_at(buffer, at));
+		return;
+	}
 	memcpy(buffer->_data + at, data, count);
 }
 
 /**
+ * set the given byte to the buffer at the specified position
+ * \param[in] buffer the buffer
+ * \param[in] at the position (in number of bytes) to write the data at
+ * \param[in] c the byte to set to the buffer
+ * \param[in] count the number of bytes of bytes to write
+ */
+
+INLINE void
+sldns_buffer_set_at(sldns_buffer *buffer, size_t at, int c, size_t count)
+{
+    if (!buffer->_vfixed)
+        assert(sldns_buffer_available_at(buffer, at, count));
+    else if (sldns_buffer_remaining_at(buffer, at) == 0)
+        return;
+    else if (count > sldns_buffer_remaining_at(buffer, at)) {
+        memset(buffer->_data + at, c,
+            sldns_buffer_remaining_at(buffer, at));
+        return;
+    }
+	memset(buffer->_data + at, c, count);
+}
+
+
+/**
  * writes count bytes of data to the current position of the buffer
  * \param[in] buffer the buffer
  * \param[in] data the data to write
@@ -469,6 +538,7 @@ sldns_buffer_write_string(sldns_buffer *buffer, const char *str)
 INLINE void
 sldns_buffer_write_u8_at(sldns_buffer *buffer, size_t at, uint8_t data)
 {
+	if (buffer->_vfixed && at + sizeof(data) > buffer->_limit) return;
 	assert(sldns_buffer_available_at(buffer, at, sizeof(data)));
 	buffer->_data[at] = data;
 }
@@ -494,6 +564,7 @@ sldns_buffer_write_u8(sldns_buffer *buffer, uint8_t data)
 INLINE void
 sldns_buffer_write_u16_at(sldns_buffer *buffer, size_t at, uint16_t data)
 {
+	if (buffer->_vfixed && at + sizeof(data) > buffer->_limit) return;
 	assert(sldns_buffer_available_at(buffer, at, sizeof(data)));
 	sldns_write_uint16(buffer->_data + at, data);
 }
@@ -519,11 +590,26 @@ sldns_buffer_write_u16(sldns_buffer *buffer, uint16_t data)
 INLINE void
 sldns_buffer_write_u32_at(sldns_buffer *buffer, size_t at, uint32_t data)
 {
+	if (buffer->_vfixed && at + sizeof(data) > buffer->_limit) return;
 	assert(sldns_buffer_available_at(buffer, at, sizeof(data)));
 	sldns_write_uint32(buffer->_data + at, data);
 }
 
 /**
+ * writes the given 6 byte integer at the given position in the buffer
+ * \param[in] buffer the buffer
+ * \param[in] at the position in the buffer
+ * \param[in] data the (lower) 48 bits to write
+ */
+INLINE void
+sldns_buffer_write_u48_at(sldns_buffer *buffer, size_t at, uint64_t data)
+{
+	if (buffer->_vfixed && at + 6 > buffer->_limit) return;
+	assert(sldns_buffer_available_at(buffer, at, 6));
+	sldns_write_uint48(buffer->_data + at, data);
+}
+
+/**
  * writes the given 4 byte integer at the current position in the buffer
  * \param[in] buffer the buffer
  * \param[in] data the 32 bits to write
@@ -536,6 +622,18 @@ sldns_buffer_write_u32(sldns_buffer *buffer, uint32_t data)
 }
 
 /**
+ * writes the given 6 byte integer at the current position in the buffer
+ * \param[in] buffer the buffer
+ * \param[in] data the 48 bits to write
+ */
+INLINE void
+sldns_buffer_write_u48(sldns_buffer *buffer, uint64_t data)
+{
+	sldns_buffer_write_u48_at(buffer, buffer->_position, data);
+	buffer->_position += 6;
+}
+
+/**
  * copies count bytes of data at the given position to the given data-array
  * \param[in] buffer the buffer
  * \param[in] at the position in the buffer to start
diff --git a/external/unbound/sldns/str2wire.c b/external/unbound/sldns/str2wire.c
index 8cda8c750..75c5d71b1 100644
--- a/external/unbound/sldns/str2wire.c
+++ b/external/unbound/sldns/str2wire.c
@@ -204,7 +204,7 @@ rrinternal_get_owner(sldns_buffer* strbuf, uint8_t* rr, size_t* len,
 			return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL,
 				sldns_buffer_position(strbuf));
 		memmove(rr, tocopy, *dname_len);
-	} else if(strlen(token) == 0) {
+	} else if(*token == '\0') {
 		/* no ownername was given, try prev, if that fails
 		 * origin, else default to root */
 		uint8_t* tocopy;
@@ -328,7 +328,7 @@ rrinternal_write_typeclassttl(sldns_buffer* strbuf, uint8_t* rr, size_t len,
 
 /** find delimiters for type */
 static const char*
-rrinternal_get_delims(sldns_rdf_type rdftype, uint16_t r_cnt, uint16_t r_max)
+rrinternal_get_delims(sldns_rdf_type rdftype, size_t r_cnt, size_t r_max)
 {
 	switch(rdftype) {
 	case LDNS_RDF_TYPE_B64        :
@@ -463,7 +463,7 @@ rrinternal_parse_unknown(sldns_buffer* strbuf, char* token, size_t token_len,
 static int
 rrinternal_parse_rdf(sldns_buffer* strbuf, char* token, size_t token_len,
 	uint8_t* rr, size_t rr_len, size_t* rr_cur_len, sldns_rdf_type rdftype,
-	uint16_t rr_type, uint16_t r_cnt, uint16_t r_max, size_t dname_len,
+	uint16_t rr_type, size_t r_cnt, size_t r_max, size_t dname_len,
 	uint8_t* origin, size_t origin_len)
 {
 	size_t len;
@@ -613,7 +613,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,
 	uint8_t* origin, size_t origin_len)
 {
 	const sldns_rr_descriptor *desc = sldns_rr_descript((uint16_t)rr_type);
-	uint16_t r_cnt, r_min, r_max;
+	size_t r_cnt, r_min, r_max;
 	size_t rr_cur_len = dname_len + 10, pre_data_pos, token_strlen;
 	int was_unknown_rr_format = 0, parens = 0, status, quoted;
 	const char* delimiters;
@@ -693,7 +693,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,
 				sldns_buffer_position(strbuf));
 	}
 	/* write rdata length */
-	sldns_write_uint16(rr+dname_len+8, rr_cur_len-dname_len-10);
+	sldns_write_uint16(rr+dname_len+8, (uint16_t)(rr_cur_len-dname_len-10));
 	*rr_len = rr_cur_len;
 	return LDNS_WIREPARSE_ERR_OK;
 }
@@ -892,10 +892,10 @@ int sldns_fp2wire_rr_buf(FILE* in, uint8_t* rr, size_t* len, size_t* dname_len,
 			parse_state?parse_state->default_ttl:0,
 			(parse_state&&parse_state->origin_len)?
 				parse_state->origin:NULL,
-			parse_state->origin_len,
+			parse_state?parse_state->origin_len:0,
 			(parse_state&&parse_state->prev_rr_len)?
 				parse_state->prev_rr:NULL,
-			parse_state->prev_rr_len);
+			parse_state?parse_state->prev_rr_len:0);
 	}
 	return LDNS_WIREPARSE_ERR_OK;
 }
@@ -1091,7 +1091,7 @@ int sldns_str2wire_apl_buf(const char* str, uint8_t* rd, size_t* len)
 	uint8_t prefix;
 	size_t i;
 
-	if(strlen(my_str) == 0) {
+	if(*my_str == '\0') {
 		/* empty APL element, no data, no string */
 		*len = 0;
 		return LDNS_WIREPARSE_ERR_OK;
@@ -1369,7 +1369,7 @@ int sldns_str2wire_time_buf(const char* str, uint8_t* rd, size_t* len)
 		if (tm.tm_sec < 0 || tm.tm_sec > 59)
 			return LDNS_WIREPARSE_ERR_SYNTAX_TIME;
 
-		sldns_write_uint32(rd, sldns_mktime_from_utc(&tm));
+		sldns_write_uint32(rd, (uint32_t)sldns_mktime_from_utc(&tm));
 	} else {
 		/* handle it as 32 bits timestamp */
 		char *end;
@@ -1932,7 +1932,7 @@ int sldns_str2wire_tag_buf(const char* str, uint8_t* rd, size_t* len)
 		if(!isalnum((unsigned char)*ptr))
 			return RET_ERR(LDNS_WIREPARSE_ERR_SYNTAX_TAG, ptr-str);
 	}
-	rd[0] = slen;
+	rd[0] = (uint8_t)slen;
 	memmove(rd+1, str, slen);
 	*len = slen+1;
 	return LDNS_WIREPARSE_ERR_OK;
@@ -2000,7 +2000,7 @@ int sldns_str2wire_hip_buf(const char* str, uint8_t* rd, size_t* len)
 		return RET_ERR_SHIFT(e, s-(char*)str);
 	if(pklen > 65535)
 		return RET_ERR(LDNS_WIREPARSE_ERR_LABEL_OVERFLOW, s-(char*)str+65535);
-	sldns_write_uint16(rd+2, pklen);
+	sldns_write_uint16(rd+2, (uint16_t)pklen);
 
 	*len = 4 + hitlen + pklen;
 	return LDNS_WIREPARSE_ERR_OK;
diff --git a/external/unbound/sldns/wire2str.c b/external/unbound/sldns/wire2str.c
index 5cbd78eed..b2ca6192c 100644
--- a/external/unbound/sldns/wire2str.c
+++ b/external/unbound/sldns/wire2str.c
@@ -47,6 +47,8 @@ static sldns_lookup_table sldns_algorithms_data[] = {
 	{ LDNS_ECC_GOST, "ECC-GOST"},
 	{ LDNS_ECDSAP256SHA256, "ECDSAP256SHA256"},
 	{ LDNS_ECDSAP384SHA384, "ECDSAP384SHA384"},
+	{ LDNS_ED25519, "ED25519"},
+	{ LDNS_ED448, "ED448"},
 	{ LDNS_INDIRECT, "INDIRECT" },
 	{ LDNS_PRIVATEDNS, "PRIVATEDNS" },
 	{ LDNS_PRIVATEOID, "PRIVATEOID" },
@@ -165,6 +167,8 @@ static sldns_lookup_table sldns_edns_options_data[] = {
 	{ 6, "DHU" },
 	{ 7, "N3U" },
 	{ 8, "edns-client-subnet" },
+	{ 11, "edns-tcp-keepalive"},
+	{ 12, "Padding" },
 	{ 0, NULL}
 };
 sldns_lookup_table* sldns_edns_options = sldns_edns_options_data;
@@ -269,6 +273,12 @@ int sldns_wire2str_rcode_buf(int rcode, char* s, size_t slen)
 	return sldns_wire2str_rcode_print(&s, &slen, rcode);
 }
 
+int sldns_wire2str_opcode_buf(int opcode, char* s, size_t slen)
+{
+	/* use arguments as temporary variables */
+	return sldns_wire2str_opcode_print(&s, &slen, opcode);
+}
+
 int sldns_wire2str_dname_buf(uint8_t* d, size_t dlen, char* s, size_t slen)
 {
 	/* use arguments as temporary variables */
@@ -666,7 +676,7 @@ int sldns_wire2str_rdata_scan(uint8_t** d, size_t* dlen, char** s,
 	uint8_t* origd = *d;
 	char* origs = *s;
 	size_t origdlen = *dlen, origslen = *slen;
-	uint16_t r_cnt, r_max;
+	size_t r_cnt, r_max;
 	sldns_rdf_type rdftype;
 	int w = 0, n;
 
@@ -787,8 +797,9 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
 		}
 
 		/* spool label characters, end with '.' */
-		if(in_buf && *dlen < labellen) labellen = *dlen;
-		else if(!in_buf && pos+labellen > pkt+pktlen)
+		if(in_buf && *dlen < (size_t)labellen)
+			labellen = (uint8_t)*dlen;
+		else if(!in_buf && pos+(size_t)labellen > pkt+pktlen)
 			labellen = (uint8_t)(pkt + pktlen - pos);
 		for(i=0; i<(unsigned)labellen; i++) {
 			w += dname_char_print(s, slen, *pos++);
@@ -1836,6 +1847,25 @@ int sldns_wire2str_edns_subnet_print(char** s, size_t* sl, uint8_t* data,
 	return w;
 }
 
+int sldns_wire2str_edns_keepalive_print(char** s, size_t* sl, uint8_t* data,
+	size_t len)
+{
+	int w = 0;
+	uint16_t timeout;
+	if(!(len == 0 || len == 2)) {
+		w += sldns_str_print(s, sl, "malformed keepalive ");
+		w += print_hex_buf(s, sl, data, len);
+		return w;
+	}
+	if(len == 0 ) {
+		w += sldns_str_print(s, sl, "no timeout value (only valid for client option) ");
+	} else {
+		timeout = sldns_read_uint16(data);
+		w += sldns_str_print(s, sl, "timeout value in units of 100ms %u", (int)timeout);
+	}
+	return w;
+}
+
 int sldns_wire2str_edns_option_print(char** s, size_t* sl,
 	uint16_t option_code, uint8_t* optdata, size_t optlen)
 {
@@ -1864,6 +1894,12 @@ int sldns_wire2str_edns_option_print(char** s, size_t* sl,
 	case LDNS_EDNS_CLIENT_SUBNET:
 		w += sldns_wire2str_edns_subnet_print(s, sl, optdata, optlen);
 		break;
+	 case LDNS_EDNS_KEEPALIVE:
+		w += sldns_wire2str_edns_keepalive_print(s, sl, optdata, optlen);
+		break;
+	case LDNS_EDNS_PADDING:
+		w += print_hex_buf(s, sl, optdata, optlen);
+		break;
 	default:
 		/* unknown option code */
 		w += print_hex_buf(s, sl, optdata, optlen);
@@ -1956,10 +1992,10 @@ int sldns_wire2str_edns_scan(uint8_t** data, size_t* data_len, char** str,
 	w += sldns_str_print(str, str_len, " ; udp: %u", (unsigned)udpsize);
 
 	if(rdatalen) {
-		if(*data_len < rdatalen) {
+		if((size_t)*data_len < rdatalen) {
 			w += sldns_str_print(str, str_len,
 				" ; Error EDNS rdata too short; ");
-			rdatalen = *data_len;
+			rdatalen = (uint16_t)*data_len;
 		}
 		w += print_edns_opts(str, str_len, *data, rdatalen);
 		(*data) += rdatalen;
diff --git a/external/unbound/sldns/wire2str.h b/external/unbound/sldns/wire2str.h
index 67f543566..e0fda9233 100644
--- a/external/unbound/sldns/wire2str.h
+++ b/external/unbound/sldns/wire2str.h
@@ -118,7 +118,7 @@ int sldns_str_print(char** str, size_t* slen, const char* format, ...)
  * @param str_len: the size of the string buffer.  If more is needed, it'll
  * 	silently truncate the output to fit in the buffer.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_pkt_buf(uint8_t* data, size_t data_len, char* str,
 	size_t str_len);
@@ -351,7 +351,7 @@ int sldns_wire2str_edns_option_code_print(char** str, size_t* str_len,
  * @param str_len: the size of the string buffer.  If more is needed, it'll
  * 	silently truncate the output to fit in the buffer.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rr_buf(uint8_t* rr, size_t rr_len, char* str,
 	size_t str_len);
@@ -369,7 +369,7 @@ int sldns_wire2str_rr_buf(uint8_t* rr, size_t rr_len, char* str,
  * @param str_len: the size of the string buffer.  If more is needed, it'll
  * 	silently truncate the output to fit in the buffer.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rr_unknown_buf(uint8_t* rr, size_t rr_len, char* str,
 	size_t str_len);
@@ -389,7 +389,7 @@ int sldns_wire2str_rr_unknown_buf(uint8_t* rr, size_t rr_len, char* str,
  * @param str_len: the size of the string buffer.  If more is needed, it'll
  * 	silently truncate the output to fit in the buffer.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rr_comment_buf(uint8_t* rr, size_t rr_len, size_t dname_len,
 	char* str, size_t str_len);
@@ -406,7 +406,7 @@ int sldns_wire2str_rr_comment_buf(uint8_t* rr, size_t rr_len, size_t dname_len,
  * 	silently truncate the output to fit in the buffer.
  * @param rrtype: rr type of the data
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rdata_buf(uint8_t* rdata, size_t rdata_len, char* str,
 	size_t str_len, uint16_t rrtype);
@@ -417,7 +417,7 @@ int sldns_wire2str_rdata_buf(uint8_t* rdata, size_t rdata_len, char* str,
  * @param str: the string to write to.
  * @param len: length of str.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_type_buf(uint16_t rrtype, char* str, size_t len);
 
@@ -427,7 +427,7 @@ int sldns_wire2str_type_buf(uint16_t rrtype, char* str, size_t len);
  * @param str: the string to write to.
  * @param len: length of str.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_class_buf(uint16_t rrclass, char* str, size_t len);
 
@@ -437,18 +437,29 @@ int sldns_wire2str_class_buf(uint16_t rrclass, char* str, size_t len);
  * @param str: the string to write to.
  * @param len: length of str.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_rcode_buf(int rcode, char* str, size_t len);
 
 /**
+ * Convert host format opcode to a string. 'QUERY', 'NOTIFY', 'UPDATE'.
+ * With user buffer.
+ * @param opcode: opcode as integer in host order
+ * @param str: the string to write to.
+ * @param len: length of str.
+ * @return the number of characters for this element, excluding zerobyte.
+ * 	Is larger or equal than str_len if output was truncated.
+ */
+int sldns_wire2str_opcode_buf(int opcode, char* str, size_t len);
+
+/**
  * Convert wire dname to a string, "example.com.".  With user buffer.
  * @param dname: the dname in uncompressed wireformat.
  * @param dname_len: length of the dname.
  * @param str: the string to write to.
  * @param len: length of string.
  * @return the number of characters for this element, excluding zerobyte.
- * 	Is larger than str_len if output was truncated.
+ * 	Is larger or equal than str_len if output was truncated.
  */
 int sldns_wire2str_dname_buf(uint8_t* dname, size_t dname_len, char* str,
 	size_t len);