import unbound 1.25.0

README.md

@@ -4,7 +4,7 @@
 [![Packaging status](https://repology.org/badge/tiny-repos/unbound.svg)](https://repology.org/project/unbound/versions)
 [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/unbound.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:unbound)
 [![Documentation Status](https://readthedocs.org/projects/unbound/badge/?version=latest)](https://unbound.readthedocs.io/en/latest/?badge=latest)
-[![Mastodon Follow](https://img.shields.io/mastodon/follow/109262826617293067?domain=https%3A%2F%2Ffosstodon.org&style=social)](https://fosstodon.org/@nlnetlabs)
+[![Mastodon Follow](https://img.shields.io/mastodon/follow/114692612288811644?domain=social.nlnetlabs.nl&style=social)](https://social.nlnetlabs.nl/@nlnetlabs)
 
 Unbound is a validating, recursive, caching DNS resolver. It is designed to be
 fast and lean and incorporates modern features based on open standards. If you
@@ -25,18 +25,21 @@ Unbound can be compiled and installed using:
 ./configure && make && make install
 ```
 
-You can use libevent if you want. libevent is useful when using many (10000)
-outgoing ports. By default max 256 ports are opened at the same time and the
-builtin alternative is equally capable and a little faster.
-
+You can use libevent if you want. libevent is useful when using many (e.g.,
+10000) outgoing ports.
 Use the `--with-libevent` configure option to compile Unbound with libevent
 support.
 
+If not, the default builtin alternative opens max 256 ports at the same time
+and is equally capable and a little faster.
+
+
 ## Unbound configuration
 
-All of Unbound's configuration options are described in the man pages, which
-will be installed and are available on the Unbound
-[documentation page](https://unbound.docs.nlnetlabs.nl/).
+All of Unbound's configuration options are described in the `unbound.conf(5)`
+man page, which will be installed and is also available on the Unbound
+[documentation page](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html)
+for the latest version.
 
-An example configuration file is located in
+An example configuration file, with minimal documentation, is located in
 [doc/example.conf](https://github.com/NLnetLabs/unbound/blob/master/doc/example.conf.in).

acx_nlnetlabs.m4

@@ -2,7 +2,12 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 48
+# Version 51
+# 2025-11-06 Fix ACX_CHECK_NONSTRING_ATTRIBUTE to reject clang, that prints
+#	     a warning for 'unknown attribute' when nonstring is used.
+# 2025-09-29 add ac_cv_func_malloc_0_nonnull as a cache value for the malloc(0)
+#            check by ACX_FUNC_MALLOC.
+# 2025-09-29 add ACX_CHECK_NONSTRING_ATTRIBUTE, AHX_CONFIG_NONSTRING_ATTRIBUTE.
 # 2024-01-16 fix to add -l:libssp.a to -lcrypto link check.
 #	     and check for getaddrinfo with only header.
 # 2024-01-15 fix to add crypt32 to -lcrypto link check when checking for gdi32.
@@ -71,6 +76,7 @@
 # ACX_DEPFLAG			- find cc dependency flags.
 # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX.
 # ACX_CHECK_FORMAT_ATTRIBUTE	- find cc printf format syntax.
+# ACX_CHECK_NONSTRING_ATTRIBUTE - find cc nonstring attribute syntax.
 # ACX_CHECK_UNUSED_ATTRIBUTE	- find cc variable unused syntax.
 # ACX_CHECK_FLTO		- see if cc supports -flto and use it if so.
 # ACX_LIBTOOL_C_ONLY		- create libtool for C only, improved.
@@ -92,6 +98,7 @@
 # ACX_FUNC_IOCTLSOCKET		- find ioctlsocket, portably.
 # ACX_FUNC_MALLOC		- check malloc, define replacement .
 # AHX_CONFIG_FORMAT_ATTRIBUTE	- config.h text for format.
+# AHX_CONFIG_NONSTRING_ATTRIBUTE - config.h text for nonstring.
 # AHX_CONFIG_UNUSED_ATTRIBUTE	- config.h text for unused.
 # AHX_CONFIG_FSEEKO		- define fseeko, ftello fallback.
 # AHX_CONFIG_RAND_MAX		- define RAND_MAX if needed.
@@ -490,7 +497,7 @@ AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE],
 ])
 
 dnl Check how to mark function arguments as unused.
-dnl result in HAVE_ATTR_UNUSED.  
+dnl result in HAVE_ATTR_UNUSED.
 dnl Make sure you include AHX_CONFIG_UNUSED_ATTRIBUTE also.
 AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -525,6 +532,49 @@ if test $ac_cv_c_unused_attribute = yes; then
 fi
 ])dnl
 
+dnl Check how to mark function arguments as nonstring.
+dnl result in HAVE_ATTR_NONSTRING.
+dnl Make sure you include AHX_CONFIG_NONSTRING_ATTRIBUTE also.
+AC_DEFUN([ACX_CHECK_NONSTRING_ATTRIBUTE],
+[AC_REQUIRE([AC_PROG_CC])
+AC_REQUIRE([ACX_CHECK_ERROR_FLAGS])
+BAKCFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS $ERRFLAG"
+AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "nonstring" attribute)
+AC_CACHE_VAL(ac_cv_c_nonstring_attribute,
+[ac_cv_c_nonstring_attribute=no
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
+struct test {
+    char __attribute__((nonstring)) s[1];
+};
+]], [[
+   struct test t = { "1" };
+   (void) t;
+]])],[ac_cv_c_nonstring_attribute="yes"],[ac_cv_c_nonstring_attribute="no"])
+CFLAGS="$BAKCFLAGS"
+])
+
+dnl Setup ATTR_NONSTRING config.h parts.
+dnl make sure you call ACX_CHECK_NONSTRING_ATTRIBUTE also.
+AC_DEFUN([AHX_CONFIG_NONSTRING_ATTRIBUTE],
+[
+#if defined(DOXYGEN)
+#  define ATTR_NONSTRING(x)  x
+#elif defined(__cplusplus)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#elif defined(HAVE_ATTR_NONSTRING)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#else /* !HAVE_ATTR_NONSTRING */
+#  define ATTR_NONSTRING(x)  x
+#endif /* !HAVE_ATTR_NONSTRING */
+])
+
+AC_MSG_RESULT($ac_cv_c_nonstring_attribute)
+if test $ac_cv_c_nonstring_attribute = yes; then
+  AC_DEFINE(HAVE_ATTR_NONSTRING, 1, [Whether the C compiler accepts the "nonstring" attribute])
+fi
+])dnl
+
 dnl Pre-fun for ACX_LIBTOOL_C_ONLY
 AC_DEFUN([ACX_LIBTOOL_C_PRE], [
 # skip these tests, we do not need them.
@@ -1190,8 +1240,9 @@ dnl detect malloc and provide malloc compat prototype.
 dnl $1: unique name for compat code
 AC_DEFUN([ACX_FUNC_MALLOC],
 [
-	AC_MSG_CHECKING([for GNU libc compatible malloc])
-	AC_RUN_IFELSE([AC_LANG_PROGRAM(
+	AC_CACHE_CHECK([for GNU libc compatible malloc],[ac_cv_func_malloc_0_nonnull],
+	[
+		AC_RUN_IFELSE([AC_LANG_PROGRAM(
 [[#if defined STDC_HEADERS || defined HAVE_STDLIB_H
 #include <stdlib.h>
 #else
@@ -1199,14 +1250,16 @@ char *malloc ();
 #endif
 ]], [ if(malloc(0) != 0) return 1;])
 ],
-	[AC_MSG_RESULT([no])
-	AC_LIBOBJ(malloc)
-	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] ,
-	[AC_MSG_RESULT([yes])
-	AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
-	[AC_MSG_RESULT([no (crosscompile)])
-	AC_LIBOBJ(malloc)
-	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] )
+		[ac_cv_func_malloc_0_nonnull=no],
+		[ac_cv_func_malloc_0_nonnull=yes],
+		[ac_cv_func_malloc_0_nonnull="no (crosscompile)"])
+	])
+	AS_IF([test "$ac_cv_func_malloc_0_nonnull" = yes],
+		[AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
+	[
+		AC_LIBOBJ(malloc)
+		AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])
+	])
 ])
 
 dnl Define fallback for fseeko and ftello if needed.

cachedb/cachedb.c

@@ -401,12 +401,9 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
 	   FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
 		LDNS_RCODE_YXDOMAIN)
 		return 0;
-	/* We don't store the reply if its TTL is 0 unless serve-expired is
-	 * enabled.  Such a reply won't be reusable and simply be a waste for
-	 * the backend.  It's also compatible with the default behavior of
-	 * dns_cache_store_msg(). */
-	if(qstate->return_msg->rep->ttl == 0 &&
-		!qstate->env->cfg->serve_expired)
+	/* We don't store the reply if its TTL is 0. This is probably coming
+	 * from upstream and it is not meant to be stored. */
+	if(qstate->return_msg->rep->ttl == 0)
 		return 0;
 
 	/* The EDE is added to the out-list so it is encoded in the cached message */
@@ -460,7 +457,7 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 	 * - serve_expired needs to be set
 	 * - if SERVE_EXPIRED_TTL is set make sure that the record is not older
 	 *   than that. */
-	if((time_t)expiry < *qstate->env->now &&
+	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now) &&
 		(!qstate->env->cfg->serve_expired ||
 			(SERVE_EXPIRED_TTL &&
 			*qstate->env->now - (time_t)expiry > SERVE_EXPIRED_TTL)))
@@ -472,7 +469,8 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 /* Adjust the TTL of the given RRset by 'subtract'.  If 'subtract' is
  * negative, set the TTL to 0. */
 static void
-packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
+packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract,
+	time_t timestamp)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -484,13 +482,13 @@ packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
 			data->rr_ttl[i] -= subtract;
 		else	data->rr_ttl[i] = 0;
 	}
-	data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;
+	data->ttl_add = timestamp;
 }
 
 /* Adjust the TTL of a DNS message and its RRs by 'adjust'.  If 'adjust' is
  * negative, set the TTLs to 0. */
 static void
-adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
+adjust_msg_ttl(struct dns_msg* msg, time_t adjust, time_t timestamp)
 {
 	size_t i;
 	if(adjust >= 0 && msg->rep->ttl > adjust)
@@ -502,13 +500,13 @@ adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
 
 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_subtract((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, adjust);
+			rep->rrsets[i]->entry.data, adjust, timestamp);
 	}
 }
 
 /* Set the TTL of the given RRset to fixed value. */
 static void
-packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
+packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl, time_t timestamp)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -516,12 +514,12 @@ packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
 	for(i=0; i<total; i++) {
 		data->rr_ttl[i] = ttl;
 	}
-	data->ttl_add = 0;
+	data->ttl_add = timestamp;
 }
 
 /* Set the TTL of a DNS message and its RRs by to a fixed value. */
 static void
-set_msg_ttl(struct dns_msg* msg, time_t ttl)
+set_msg_ttl(struct dns_msg* msg, time_t ttl, time_t timestamp)
 {
 	size_t i;
 	msg->rep->ttl = ttl;
@@ -530,14 +528,14 @@ set_msg_ttl(struct dns_msg* msg, time_t ttl)
 
 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_set((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, ttl);
+			rep->rrsets[i]->entry.data, ttl, timestamp);
 	}
 }
 
 /** convert dns message in buffer to return_msg */
 static int
 parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
-	int* msg_expired)
+	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
 {
 	struct msg_parse* prs;
 	struct edns_data edns;
@@ -554,6 +552,9 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		&timestamp, sizeof(timestamp));
 	expiry = be64toh(expiry);
 	timestamp = be64toh(timestamp);
+	log_assert(timestamp <= expiry);
+	*msg_expiry = (time_t)expiry;
+	*msg_timestamp = (time_t)timestamp;
 
 	/* parse DNS packet */
 	regional_free_all(qstate->env->scratch);
@@ -605,11 +606,9 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		return 1; /* message from the future (clock skew?) */
 	}
 	adjust = *qstate->env->now - (time_t)timestamp;
-	if(qstate->return_msg->rep->ttl < adjust) {
+	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now)) {
 		verbose(VERB_ALGO, "cachedb msg expired");
 		*msg_expired = 1;
-		/* If serve-expired is enabled, we still use an expired message
-		 * setting the TTL to 0. */
 		if(!qstate->env->cfg->serve_expired ||
 			(FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_NOERROR &&
@@ -618,23 +617,21 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_YXDOMAIN))
 			return 0; /* message expired */
-		else
-			adjust = -1;
+		/* If serve-expired is enabled, we still use an expired message.
+		 * Set the TTL to 0 now and it will be handled specially later
+		 * when we need to store it internally. */
+		adjust = -1;
 	}
+	adjust_msg_ttl(qstate->return_msg, adjust, timestamp);
 	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
-	adjust_msg_ttl(qstate->return_msg, adjust);
 	if(qstate->env->cfg->aggressive_nsec) {
 		limit_nsec_ttl(qstate->return_msg);
 	}
 
 	/* Similar to the unbound worker, if serve-expired is enabled and
 	 * the msg would be considered to be expired, mark the state so a
-	 * refetch will be scheduled.  The comparison between 'expiry' and
-	 * 'now' should be redundant given how these values were calculated,
-	 * but we check it just in case as does good_expiry_and_qinfo(). */
-	if(qstate->env->cfg->serve_expired &&
-		!qstate->env->cfg->serve_expired_client_timeout &&
-		(adjust == -1 || (time_t)expiry < *qstate->env->now)) {
+	 * refetch will be scheduled. */
+	if(*msg_expired && !qstate->env->cfg->serve_expired_client_timeout) {
 		qstate->need_refetch = 1;
 	}
 
@@ -647,7 +644,7 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
  */
 static int
 cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
-	int* msg_expired)
+	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
 	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
@@ -664,7 +661,8 @@ cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
 	}
 
 	/* parse dns message into return_msg */
-	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired) ) {
+	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired,
+		msg_timestamp, msg_expiry) ) {
 		return 0;
 	}
 	return 1;
@@ -736,24 +734,30 @@ cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde)
  * Store query into the internal cache of unbound.
  */
 static void
-cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
+cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
+	time_t msg_timestamp, time_t msg_expiry)
 {
 	uint32_t store_flags = qstate->query_flags;
 	int serve_expired = qstate->env->cfg->serve_expired;
-
-	if(qstate->env->cfg->serve_expired)
-		store_flags |= DNSCACHE_STORE_ZEROTTL;
 	if(!qstate->return_msg)
 		return;
 	if(serve_expired && msg_expired) {
-		/* Set TTLs to a value such that value + *env->now is
-		 * going to be now-3 seconds. Making it expired
-		 * in the cache. */
-		set_msg_ttl(qstate->return_msg, (time_t)-3);
+		time_t original_ttl = msg_expiry - msg_timestamp;
+		store_flags |= DNSCACHE_STORE_EXPIRED_MSG_CACHEDB;
+		/* Pass the original TTL of the expired message and signal with
+		 * the DNSCACHE_STORE_EXPIRED_MSG_CACHEDB flag that
+		 * dns_cache_store_msg() needs to set absolute expired TTLs
+		 * based on the original message TTL.
+		 * Results as expired message in the cache */
+		set_msg_ttl(qstate->return_msg, original_ttl, 0);
+		verbose(VERB_ALGO, "cachedb expired msg set to be expired now "
+			"(original ttl: %d)", (int)original_ttl);
 		/* The expired entry does not get checked by the validator
 		 * and we need a validation value for it. */
+		/* By setting this to unchecked, bogus data is not returned
+		 * as non-bogus. */
 		if(qstate->env->cfg->cachedb_check_when_serve_expired)
-			qstate->return_msg->rep->security = sec_status_insecure;
+			qstate->return_msg->rep->security = sec_status_unchecked;
 	}
 	(void)dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
@@ -767,12 +771,14 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
 			 * of cache. */
 			return;
 		}
-		/* set TTLs to zero again */
-		adjust_msg_ttl(qstate->return_msg, -1);
 		/* Send serve expired responses based on the cachedb
 		 * returned message, that was just stored in the cache.
 		 * It can then continue to work on this query. */
 		mesh_respond_serve_expired(qstate->mesh_info);
+		/* set TTLs as expired for this return_msg in case it is used
+		 * later on */
+		set_msg_ttl(qstate->return_msg,
+			EXPIRED_REPLY_TTL_CALC(msg_expiry, msg_timestamp), 0);
 	}
 }
 
@@ -790,6 +796,7 @@ cachedb_handle_query(struct module_qstate* qstate,
 	struct cachedb_env* ie, int id)
 {
 	int msg_expired = 0;
+	time_t msg_timestamp, msg_expiry;
 	qstate->is_cachedb_answer = 0;
 	/* check if we are enabled, and skip if so */
 	if(!ie->enabled) {
@@ -798,8 +805,11 @@ cachedb_handle_query(struct module_qstate* qstate,
 		return;
 	}
 
-	if(qstate->blacklist || qstate->no_cache_lookup) {
-		/* cache is blacklisted or we are instructed from edns to not look */
+	if(qstate->blacklist || qstate->no_cache_lookup
+		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
+		NULL, 0)) {
+		/* cache is blacklisted or we are instructed from edns to not
+		 * look or a forwarder/stub forbids it */
 		/* pass request to next module */
 		qstate->ext_state[id] = module_wait_module;
 		return;
@@ -824,13 +834,15 @@ cachedb_handle_query(struct module_qstate* qstate,
 	}
 
 	/* ask backend cache to see if we have data */
-	if(cachedb_extcache_lookup(qstate, ie, &msg_expired)) {
+	if(cachedb_extcache_lookup(qstate, ie, &msg_expired, &msg_timestamp,
+		&msg_expiry)) {
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg(ie->backend->name,
 				&qstate->return_msg->qinfo,
 				qstate->return_msg->rep);
 		/* store this result in internal cache */
-		cachedb_intcache_store(qstate, msg_expired);
+		cachedb_intcache_store(qstate,
+			msg_expired, msg_timestamp, msg_expiry);
 		/* In case we have expired data but there is a client timer for expired
 		 * answers, pass execution to next module in order to try updating the
 		 * data first.
@@ -850,6 +862,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 				qstate->ext_state[id] = module_wait_module;
 				return;
 		}
+		/* No 0TTL answers escaping from external cache. */
+		log_assert(qstate->return_msg->rep->ttl > 0);
 		qstate->is_cachedb_answer = 1;
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
@@ -883,7 +897,9 @@ cachedb_handle_response(struct module_qstate* qstate,
 {
 	qstate->is_cachedb_answer = 0;
 	/* check if we are not enabled or instructed to not cache, and skip */
-	if(!ie->enabled || qstate->no_cache_store) {
+	if(!ie->enabled || qstate->no_cache_store
+		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
+		NULL, 0)) {
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
 		return;

cachedb/redis.c

@@ -143,6 +143,12 @@ redis_connect(const char* host, int port, const char* path,
 {
 	struct timeval now_val;
 	redisContext* ctx;
+#ifdef THREADS_DISABLED
+	/* Fix attribute unused warning.
+	 * wait_lock is only used with lock_basic_* functions that are nop'ed
+	 * when compiled without thread support. */
+	(void)wait_lock;
+#endif /* THREADS_DISABLED */
 
 	/* See if the redis server is down, and reconnect has to wait. */
 	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {

compat/arc4random.c

@@ -38,6 +38,9 @@
 #ifndef UB_ON_WINDOWS
 #include <sys/mman.h>
 #endif
+#ifdef __QNX__
+#include "util/log.h"
+#endif /* __QNX__ */
 
 #define KEYSTREAM_ONLY
 #include "chacha_private.h"
@@ -187,7 +190,11 @@ _rs_stir(void)
 		if(errno != ENOSYS ||
 			fallback_getentropy_urandom(rnd, sizeof rnd) == -1) {
 #ifdef SIGKILL
+#ifndef __QNX__
 			raise(SIGKILL);
+#else /* !__QNX__ */
+			fatal_exit("failed to getentropy");
+#endif /* __QNX__ */
 #else
 			exit(9); /* windows */
 #endif

compat/chacha_private.h

@@ -48,8 +48,8 @@ typedef struct
   a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
   c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
 
-static const char sigma[16] = "expand 32-byte k";
-static const char tau[16] = "expand 16-byte k";
+static const char ATTR_NONSTRING(sigma[16]) = "expand 32-byte k";
+static const char ATTR_NONSTRING(tau[16]) = "expand 16-byte k";
 
 static void
 chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits,u32 ATTR_UNUSED(ivbits))

compat/getentropy_linux.c

@@ -29,7 +29,9 @@
 #include <sys/param.h>
 #include <sys/ioctl.h>
 #include <sys/resource.h>
+#ifndef __QNX__
 #include <sys/syscall.h>
+#endif /* !__QNX__ */
 #ifdef SYS__sysctl
 #include <linux/sysctl.h>
 #endif
@@ -42,7 +44,9 @@
 #include <stdlib.h>
 #include <stdint.h>
 #include <stdio.h>
+#ifndef __QNX__
 #include <link.h>
+#endif /* __QNX__ */
 #include <termios.h>
 #include <fcntl.h>
 #include <signal.h>
@@ -60,12 +64,14 @@
 #define SHA512_Final(r, c)	sha512_digest(c, SHA512_DIGEST_SIZE, r)
 #endif
 
+#ifndef __QNX__
 #include <linux/types.h>
 #include <linux/random.h>
 #ifdef HAVE_GETAUXVAL
 #include <sys/auxv.h>
 #endif
 #include <sys/vfs.h>
+#endif /* !__QNX__ */
 #ifndef MAP_ANON
 #define MAP_ANON MAP_ANONYMOUS
 #endif
@@ -94,8 +100,10 @@ static int getentropy_urandom(void *buf, size_t len);
 #ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
 #endif
+#ifndef __QNX__
 static int getentropy_fallback(void *buf, size_t len);
 static int getentropy_phdr(struct dl_phdr_info *info, size_t size, void *data);
+#endif /* !__QNX__ */
 
 int
 getentropy(void *buf, size_t len)
@@ -178,6 +186,7 @@ getentropy(void *buf, size_t len)
 	 * sysctl ABI, or consider providing a new failsafe API which
 	 * works in a chroot or when file descriptors are exhausted.
 	 */
+#ifndef __QNX__
 #undef FAIL_INSTEAD_OF_TRYING_FALLBACK
 #ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
 	raise(SIGKILL);
@@ -185,6 +194,9 @@ getentropy(void *buf, size_t len)
 	ret = getentropy_fallback(buf, len);
 	if (ret != -1)
 		return (ret);
+#else /* !__QNX__ */
+	fatal_exit("failed to read from /dev/urandom");
+#endif /* __QNX__ */
 
 	errno = EIO;
 	return (ret);
@@ -214,7 +226,11 @@ getentropy_urandom(void *buf, size_t len)
 {
 	struct stat st;
 	size_t i;
+#ifndef __QNX__
 	int fd, cnt, flags;
+#else /* !__QNX__ */
+	int fd, flags;
+#endif /* __QNX__ */
 	int save_errno = errno;
 
 start:
@@ -241,10 +257,12 @@ start:
 		close(fd);
 		goto nodevrandom;
 	}
+#ifndef __QNX__
 	if (ioctl(fd, RNDGETENTCNT, &cnt) == -1) {
 		close(fd);
 		goto nodevrandom;
 	}
+#endif /* !__QNX__ */
 	for (i = 0; i < len; ) {
 		size_t wanted = len - i;
 		ssize_t ret = read(fd, (char *)buf + i, wanted);
@@ -265,6 +283,7 @@ nodevrandom:
 	return (-1);
 }
 
+#ifndef __QNX__
 #ifdef SYS__sysctl
 static int
 getentropy_sysctl(void *buf, size_t len)
@@ -537,3 +556,4 @@ getentropy_fallback(void *buf, size_t len)
 	errno = save_errno;
 	return (0);		/* satisfied */
 }
+#endif /* !__QNX__ */

compat/gmtime_r.c

@@ -42,10 +42,7 @@ static const int	year_lengths[2] = {
 };
 
 static void
-timesub(timep, offset, tmp)
-const time_t * const			timep;
-const long				offset;
-struct tm * const		tmp;
+timesub(const time_t * const timep, const long offset, struct tm * const tmp)
 {
 	long			days;
 	long			rem;

config.h.in

@@ -48,13 +48,13 @@
    internal symbols */
 #undef EXPORT_ALL_SYMBOLS
 
-/* Define to 1 if you have the 'accept4' function. */
+/* Define to 1 if you have the `accept4' function. */
 #undef HAVE_ACCEPT4
 
-/* Define to 1 if you have the 'arc4random' function. */
+/* Define to 1 if you have the `arc4random' function. */
 #undef HAVE_ARC4RANDOM
 
-/* Define to 1 if you have the 'arc4random_uniform' function. */
+/* Define to 1 if you have the `arc4random_uniform' function. */
 #undef HAVE_ARC4RANDOM_UNIFORM
 
 /* Define to 1 if you have the <arpa/inet.h> header file. */
@@ -66,6 +66,9 @@
 /* Whether the C compiler accepts the "format" attribute */
 #undef HAVE_ATTR_FORMAT
 
+/* Whether the C compiler accepts the "nonstring" attribute */
+#undef HAVE_ATTR_NONSTRING
+
 /* Whether the C compiler accepts the "noreturn" attribute */
 #undef HAVE_ATTR_NORETURN
 
@@ -78,7 +81,7 @@
 /* If we have be64toh */
 #undef HAVE_BE64TOH
 
-/* Define to 1 if you have the 'BIO_set_callback_ex' function. */
+/* Define to 1 if you have the `BIO_set_callback_ex' function. */
 #undef HAVE_BIO_SET_CALLBACK_EX
 
 /* Define to 1 if you have the <bsd/stdlib.h> header file. */
@@ -87,245 +90,245 @@
 /* Define to 1 if you have the <bsd/string.h> header file. */
 #undef HAVE_BSD_STRING_H
 
-/* Define to 1 if you have the 'chown' function. */
+/* Define to 1 if you have the `chown' function. */
 #undef HAVE_CHOWN
 
-/* Define to 1 if you have the 'chroot' function. */
+/* Define to 1 if you have the `chroot' function. */
 #undef HAVE_CHROOT
 
-/* Define to 1 if you have the 'CRYPTO_cleanup_all_ex_data' function. */
+/* Define to 1 if you have the `CRYPTO_cleanup_all_ex_data' function. */
 #undef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
 
-/* Define to 1 if you have the 'CRYPTO_THREADID_set_callback' function. */
+/* Define to 1 if you have the `CRYPTO_THREADID_set_callback' function. */
 #undef HAVE_CRYPTO_THREADID_SET_CALLBACK
 
-/* Define to 1 if you have the 'ctime_r' function. */
+/* Define to 1 if you have the `ctime_r' function. */
 #undef HAVE_CTIME_R
 
-/* Define to 1 if you have the 'daemon' function. */
+/* Define to 1 if you have the `daemon' function. */
 #undef HAVE_DAEMON
 
-/* Define to 1 if you have the declaration of 'arc4random', and to 0 if you
+/* Define to 1 if you have the declaration of `arc4random', and to 0 if you
    don't. */
 #undef HAVE_DECL_ARC4RANDOM
 
-/* Define to 1 if you have the declaration of 'arc4random_uniform', and to 0
+/* Define to 1 if you have the declaration of `arc4random_uniform', and to 0
    if you don't. */
 #undef HAVE_DECL_ARC4RANDOM_UNIFORM
 
-/* Define to 1 if you have the declaration of 'evsignal_assign', and to 0 if
+/* Define to 1 if you have the declaration of `evsignal_assign', and to 0 if
    you don't. */
 #undef HAVE_DECL_EVSIGNAL_ASSIGN
 
-/* Define to 1 if you have the declaration of 'inet_ntop', and to 0 if you
+/* Define to 1 if you have the declaration of `inet_ntop', and to 0 if you
    don't. */
 #undef HAVE_DECL_INET_NTOP
 
-/* Define to 1 if you have the declaration of 'inet_pton', and to 0 if you
+/* Define to 1 if you have the declaration of `inet_pton', and to 0 if you
    don't. */
 #undef HAVE_DECL_INET_PTON
 
-/* Define to 1 if you have the declaration of 'nghttp2_session_server_new',
+/* Define to 1 if you have the declaration of `nghttp2_session_server_new',
    and to 0 if you don't. */
 #undef HAVE_DECL_NGHTTP2_SESSION_SERVER_NEW
 
-/* Define to 1 if you have the declaration of 'ngtcp2_conn_server_new', and to
+/* Define to 1 if you have the declaration of `ngtcp2_conn_server_new', and to
    0 if you don't. */
 #undef HAVE_DECL_NGTCP2_CONN_SERVER_NEW
 
-/* Define to 1 if you have the declaration of 'ngtcp2_crypto_encrypt_cb', and
+/* Define to 1 if you have the declaration of `ngtcp2_crypto_encrypt_cb', and
    to 0 if you don't. */
 #undef HAVE_DECL_NGTCP2_CRYPTO_ENCRYPT_CB
 
-/* Define to 1 if you have the declaration of 'NID_ED25519', and to 0 if you
+/* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
    don't. */
 #undef HAVE_DECL_NID_ED25519
 
-/* Define to 1 if you have the declaration of 'NID_ED448', and to 0 if you
+/* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
    don't. */
 #undef HAVE_DECL_NID_ED448
 
-/* Define to 1 if you have the declaration of 'NID_secp384r1', and to 0 if you
+/* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
    don't. */
 #undef HAVE_DECL_NID_SECP384R1
 
-/* Define to 1 if you have the declaration of 'NID_X9_62_prime256v1', and to 0
+/* Define to 1 if you have the declaration of `NID_X9_62_prime256v1', and to 0
    if you don't. */
 #undef HAVE_DECL_NID_X9_62_PRIME256V1
 
-/* Define to 1 if you have the declaration of 'reallocarray', and to 0 if you
+/* Define to 1 if you have the declaration of `reallocarray', and to 0 if you
    don't. */
 #undef HAVE_DECL_REALLOCARRAY
 
-/* Define to 1 if you have the declaration of 'redisConnect', and to 0 if you
+/* Define to 1 if you have the declaration of `redisConnect', and to 0 if you
    don't. */
 #undef HAVE_DECL_REDISCONNECT
 
-/* Define to 1 if you have the declaration of 'sk_SSL_COMP_pop_free', and to 0
+/* Define to 1 if you have the declaration of `sk_SSL_COMP_pop_free', and to 0
    if you don't. */
 #undef HAVE_DECL_SK_SSL_COMP_POP_FREE
 
 /* Define to 1 if you have the declaration of
-   'SSL_COMP_get_compression_methods', and to 0 if you don't. */
+   `SSL_COMP_get_compression_methods', and to 0 if you don't. */
 #undef HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 
-/* Define to 1 if you have the declaration of 'SSL_CTX_set_ecdh_auto', and to
+/* Define to 1 if you have the declaration of `SSL_CTX_set_ecdh_auto', and to
    0 if you don't. */
 #undef HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
 
-/* Define to 1 if you have the declaration of 'SSL_CTX_set_tmp_ecdh', and to 0
+/* Define to 1 if you have the declaration of `SSL_CTX_set_tmp_ecdh', and to 0
    if you don't. */
 #undef HAVE_DECL_SSL_CTX_SET_TMP_ECDH
 
-/* Define to 1 if you have the declaration of 'strlcat', and to 0 if you
+/* Define to 1 if you have the declaration of `strlcat', and to 0 if you
    don't. */
 #undef HAVE_DECL_STRLCAT
 
-/* Define to 1 if you have the declaration of 'strlcpy', and to 0 if you
+/* Define to 1 if you have the declaration of `strlcpy', and to 0 if you
    don't. */
 #undef HAVE_DECL_STRLCPY
 
-/* Define to 1 if you have the declaration of 'XML_StopParser', and to 0 if
+/* Define to 1 if you have the declaration of `XML_StopParser', and to 0 if
    you don't. */
 #undef HAVE_DECL_XML_STOPPARSER
 
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
-/* Define to 1 if you have the 'DSA_SIG_set0' function. */
+/* Define to 1 if you have the `DSA_SIG_set0' function. */
 #undef HAVE_DSA_SIG_SET0
 
 /* Define to 1 if you have the <endian.h> header file. */
 #undef HAVE_ENDIAN_H
 
-/* Define to 1 if you have the 'endprotoent' function. */
+/* Define to 1 if you have the `endprotoent' function. */
 #undef HAVE_ENDPROTOENT
 
-/* Define to 1 if you have the 'endpwent' function. */
+/* Define to 1 if you have the `endpwent' function. */
 #undef HAVE_ENDPWENT
 
-/* Define to 1 if you have the 'endservent' function. */
+/* Define to 1 if you have the `endservent' function. */
 #undef HAVE_ENDSERVENT
 
-/* Define to 1 if you have the 'ENGINE_cleanup' function. */
+/* Define to 1 if you have the `ENGINE_cleanup' function. */
 #undef HAVE_ENGINE_CLEANUP
 
-/* Define to 1 if you have the 'ERR_free_strings' function. */
+/* Define to 1 if you have the `ERR_free_strings' function. */
 #undef HAVE_ERR_FREE_STRINGS
 
-/* Define to 1 if you have the 'ERR_load_crypto_strings' function. */
+/* Define to 1 if you have the `ERR_load_crypto_strings' function. */
 #undef HAVE_ERR_LOAD_CRYPTO_STRINGS
 
-/* Define to 1 if you have the 'event_assign' function. */
+/* Define to 1 if you have the `event_assign' function. */
 #undef HAVE_EVENT_ASSIGN
 
-/* Define to 1 if you have the 'event_base_free' function. */
+/* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE
 
-/* Define to 1 if you have the 'event_base_get_method' function. */
+/* Define to 1 if you have the `event_base_get_method' function. */
 #undef HAVE_EVENT_BASE_GET_METHOD
 
-/* Define to 1 if you have the 'event_base_new' function. */
+/* Define to 1 if you have the `event_base_new' function. */
 #undef HAVE_EVENT_BASE_NEW
 
-/* Define to 1 if you have the 'event_base_once' function. */
+/* Define to 1 if you have the `event_base_once' function. */
 #undef HAVE_EVENT_BASE_ONCE
 
 /* Define to 1 if you have the <event.h> header file. */
 #undef HAVE_EVENT_H
 
-/* Define to 1 if you have the 'EVP_aes_256_cbc' function. */
+/* Define to 1 if you have the `EVP_aes_256_cbc' function. */
 #undef HAVE_EVP_AES_256_CBC
 
-/* Define to 1 if you have the 'EVP_cleanup' function. */
+/* Define to 1 if you have the `EVP_cleanup' function. */
 #undef HAVE_EVP_CLEANUP
 
-/* Define to 1 if you have the 'EVP_default_properties_is_fips_enabled'
+/* Define to 1 if you have the `EVP_default_properties_is_fips_enabled'
    function. */
 #undef HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED
 
-/* Define to 1 if you have the 'EVP_DigestVerify' function. */
+/* Define to 1 if you have the `EVP_DigestVerify' function. */
 #undef HAVE_EVP_DIGESTVERIFY
 
-/* Define to 1 if you have the 'EVP_dss1' function. */
+/* Define to 1 if you have the `EVP_dss1' function. */
 #undef HAVE_EVP_DSS1
 
-/* Define to 1 if you have the 'EVP_EncryptInit_ex' function. */
+/* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
 #undef HAVE_EVP_ENCRYPTINIT_EX
 
-/* Define to 1 if you have the 'EVP_MAC_CTX_set_params' function. */
+/* Define to 1 if you have the `EVP_MAC_CTX_set_params' function. */
 #undef HAVE_EVP_MAC_CTX_SET_PARAMS
 
-/* Define to 1 if you have the 'EVP_MD_CTX_new' function. */
+/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #undef HAVE_EVP_MD_CTX_NEW
 
-/* Define to 1 if you have the 'EVP_sha1' function. */
+/* Define to 1 if you have the `EVP_sha1' function. */
 #undef HAVE_EVP_SHA1
 
-/* Define to 1 if you have the 'EVP_sha256' function. */
+/* Define to 1 if you have the `EVP_sha256' function. */
 #undef HAVE_EVP_SHA256
 
-/* Define to 1 if you have the 'EVP_sha512' function. */
+/* Define to 1 if you have the `EVP_sha512' function. */
 #undef HAVE_EVP_SHA512
 
-/* Define to 1 if you have the 'ev_default_loop' function. */
+/* Define to 1 if you have the `ev_default_loop' function. */
 #undef HAVE_EV_DEFAULT_LOOP
 
-/* Define to 1 if you have the 'ev_loop' function. */
+/* Define to 1 if you have the `ev_loop' function. */
 #undef HAVE_EV_LOOP
 
 /* Define to 1 if you have the <expat.h> header file. */
 #undef HAVE_EXPAT_H
 
-/* Define to 1 if you have the 'explicit_bzero' function. */
+/* Define to 1 if you have the `explicit_bzero' function. */
 #undef HAVE_EXPLICIT_BZERO
 
-/* Define to 1 if you have the 'fcntl' function. */
+/* Define to 1 if you have the `fcntl' function. */
 #undef HAVE_FCNTL
 
-/* Define to 1 if you have the 'FIPS_mode' function. */
+/* Define to 1 if you have the `FIPS_mode' function. */
 #undef HAVE_FIPS_MODE
 
-/* Define to 1 if you have the 'fork' function. */
+/* Define to 1 if you have the `fork' function. */
 #undef HAVE_FORK
 
-/* Define to 1 if fseeko (and ftello) are declared in stdio.h. */
+/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
 #undef HAVE_FSEEKO
 
-/* Define to 1 if you have the 'fsync' function. */
+/* Define to 1 if you have the `fsync' function. */
 #undef HAVE_FSYNC
 
 /* Whether getaddrinfo is available */
 #undef HAVE_GETADDRINFO
 
-/* Define to 1 if you have the 'getauxval' function. */
+/* Define to 1 if you have the `getauxval' function. */
 #undef HAVE_GETAUXVAL
 
-/* Define to 1 if you have the 'getentropy' function. */
+/* Define to 1 if you have the `getentropy' function. */
 #undef HAVE_GETENTROPY
 
-/* Define to 1 if you have the 'getifaddrs' function. */
+/* Define to 1 if you have the `getifaddrs' function. */
 #undef HAVE_GETIFADDRS
 
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
 
-/* Define to 1 if you have the 'getpwnam' function. */
+/* Define to 1 if you have the `getpwnam' function. */
 #undef HAVE_GETPWNAM
 
-/* Define to 1 if you have the 'getrlimit' function. */
+/* Define to 1 if you have the `getrlimit' function. */
 #undef HAVE_GETRLIMIT
 
-/* Define to 1 if you have the 'gettid' function. */
+/* Define to 1 if you have the `gettid' function. */
 #undef HAVE_GETTID
 
-/* Define to 1 if you have the 'glob' function. */
+/* Define to 1 if you have the `glob' function. */
 #undef HAVE_GLOB
 
 /* Define to 1 if you have the <glob.h> header file. */
 #undef HAVE_GLOB_H
 
-/* Define to 1 if you have the 'gmtime_r' function. */
+/* Define to 1 if you have the `gmtime_r' function. */
 #undef HAVE_GMTIME_R
 
 /* Define to 1 if you have the <grp.h> header file. */
@@ -334,7 +337,7 @@
 /* Define to 1 if you have the <hiredis/hiredis.h> header file. */
 #undef HAVE_HIREDIS_HIREDIS_H
 
-/* Define to 1 if you have the 'HMAC_Init_ex' function. */
+/* Define to 1 if you have the `HMAC_Init_ex' function. */
 #undef HAVE_HMAC_INIT_EX
 
 /* If we have htobe64 */
@@ -343,19 +346,19 @@
 /* Define to 1 if you have the <ifaddrs.h> header file. */
 #undef HAVE_IFADDRS_H
 
-/* Define to 1 if you have the 'if_nametoindex' function. */
+/* Define to 1 if you have the `if_nametoindex' function. */
 #undef HAVE_IF_NAMETOINDEX
 
-/* Define to 1 if you have the 'inet_aton' function. */
+/* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
 
-/* Define to 1 if you have the 'inet_ntop' function. */
+/* Define to 1 if you have the `inet_ntop' function. */
 #undef HAVE_INET_NTOP
 
-/* Define to 1 if you have the 'inet_pton' function. */
+/* Define to 1 if you have the `inet_pton' function. */
 #undef HAVE_INET_PTON
 
-/* Define to 1 if you have the 'initgroups' function. */
+/* Define to 1 if you have the `initgroups' function. */
 #undef HAVE_INITGROUPS
 
 /* Define to 1 if you have the <inttypes.h> header file. */
@@ -367,10 +370,10 @@
 /* Define to 1 if you have the <iphlpapi.h> header file. */
 #undef HAVE_IPHLPAPI_H
 
-/* Define to 1 if you have the 'isblank' function. */
+/* Define to 1 if you have the `isblank' function. */
 #undef HAVE_ISBLANK
 
-/* Define to 1 if you have the 'kill' function. */
+/* Define to 1 if you have the `kill' function. */
 #undef HAVE_KILL
 
 /* Use portable libbsd functions */
@@ -388,7 +391,7 @@
 /* Define to 1 if you have the <linux/net_tstamp.h> header file. */
 #undef HAVE_LINUX_NET_TSTAMP_H
 
-/* Define to 1 if you have the 'localtime_r' function. */
+/* Define to 1 if you have the `localtime_r' function. */
 #undef HAVE_LOCALTIME_R
 
 /* Define to 1 if you have the <login_cap.h> header file. */
@@ -397,7 +400,7 @@
 /* If have GNU libc compatible malloc */
 #undef HAVE_MALLOC
 
-/* Define to 1 if you have the 'memmove' function. */
+/* Define to 1 if you have the `memmove' function. */
 #undef HAVE_MEMMOVE
 
 /* Define to 1 if you have the <minix/config.h> header file. */
@@ -439,52 +442,52 @@
 /* Define this to use ngtcp2. */
 #undef HAVE_NGTCP2
 
-/* Define to 1 if you have the 'ngtcp2_ccerr_default' function. */
+/* Define to 1 if you have the `ngtcp2_ccerr_default' function. */
 #undef HAVE_NGTCP2_CCERR_DEFAULT
 
-/* Define to 1 if you have the 'ngtcp2_conn_encode_0rtt_transport_params'
+/* Define to 1 if you have the `ngtcp2_conn_encode_0rtt_transport_params'
    function. */
 #undef HAVE_NGTCP2_CONN_ENCODE_0RTT_TRANSPORT_PARAMS
 
-/* Define to 1 if you have the 'ngtcp2_conn_get_max_local_streams_uni'
+/* Define to 1 if you have the `ngtcp2_conn_get_max_local_streams_uni'
    function. */
 #undef HAVE_NGTCP2_CONN_GET_MAX_LOCAL_STREAMS_UNI
 
-/* Define to 1 if you have the 'ngtcp2_conn_get_num_scid' function. */
+/* Define to 1 if you have the `ngtcp2_conn_get_num_scid' function. */
 #undef HAVE_NGTCP2_CONN_GET_NUM_SCID
 
-/* Define to 1 if you have the 'ngtcp2_conn_in_closing_period' function. */
+/* Define to 1 if you have the `ngtcp2_conn_in_closing_period' function. */
 #undef HAVE_NGTCP2_CONN_IN_CLOSING_PERIOD
 
-/* Define to 1 if you have the 'ngtcp2_conn_in_draining_period' function. */
+/* Define to 1 if you have the `ngtcp2_conn_in_draining_period' function. */
 #undef HAVE_NGTCP2_CONN_IN_DRAINING_PERIOD
 
 /* Define if ngtcp2_conn_shutdown_stream has 4 arguments. */
 #undef HAVE_NGTCP2_CONN_SHUTDOWN_STREAM4
 
-/* Define to 1 if you have the 'ngtcp2_conn_tls_early_data_rejected' function.
+/* Define to 1 if you have the `ngtcp2_conn_tls_early_data_rejected' function.
    */
 #undef HAVE_NGTCP2_CONN_TLS_EARLY_DATA_REJECTED
 
-/* Define to 1 if you have the 'ngtcp2_crypto_encrypt_cb' function. */
+/* Define to 1 if you have the `ngtcp2_crypto_encrypt_cb' function. */
 #undef HAVE_NGTCP2_CRYPTO_ENCRYPT_CB
 
 /* Define to 1 if you have the
-   'ngtcp2_crypto_quictls_configure_client_context' function. */
+   `ngtcp2_crypto_quictls_configure_client_context' function. */
 #undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_CLIENT_CONTEXT
 
 /* Define to 1 if you have the
-   'ngtcp2_crypto_quictls_configure_server_context' function. */
+   `ngtcp2_crypto_quictls_configure_server_context' function. */
 #undef HAVE_NGTCP2_CRYPTO_QUICTLS_CONFIGURE_SERVER_CONTEXT
 
 /* Define to 1 if you have the
-   'ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
+   `ngtcp2_crypto_quictls_from_ossl_encryption_level' function. */
 #undef HAVE_NGTCP2_CRYPTO_QUICTLS_FROM_OSSL_ENCRYPTION_LEVEL
 
-/* Define to 1 if you have the 'ngtcp2_crypto_quictls_init' function. */
+/* Define to 1 if you have the `ngtcp2_crypto_quictls_init' function. */
 #undef HAVE_NGTCP2_CRYPTO_QUICTLS_INIT
 
-/* Define to 1 if the system has the type 'ngtcp2_encryption_level'. */
+/* Define to 1 if the system has the type `ngtcp2_encryption_level'. */
 #undef HAVE_NGTCP2_ENCRYPTION_LEVEL
 
 /* Define to 1 if you have the <ngtcp2/ngtcp2_crypto_openssl.h> header file.
@@ -504,13 +507,13 @@
 /* Use libnss for crypto */
 #undef HAVE_NSS
 
-/* Define to 1 if you have the 'OpenSSL_add_all_digests' function. */
+/* Define to 1 if you have the `OpenSSL_add_all_digests' function. */
 #undef HAVE_OPENSSL_ADD_ALL_DIGESTS
 
 /* Define to 1 if you have the <openssl/bn.h> header file. */
 #undef HAVE_OPENSSL_BN_H
 
-/* Define to 1 if you have the 'OPENSSL_config' function. */
+/* Define to 1 if you have the `OPENSSL_config' function. */
 #undef HAVE_OPENSSL_CONFIG
 
 /* Define to 1 if you have the <openssl/conf.h> header file. */
@@ -531,10 +534,10 @@
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #undef HAVE_OPENSSL_ERR_H
 
-/* Define to 1 if you have the 'OPENSSL_init_crypto' function. */
+/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
 #undef HAVE_OPENSSL_INIT_CRYPTO
 
-/* Define to 1 if you have the 'OPENSSL_init_ssl' function. */
+/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
 #undef HAVE_OPENSSL_INIT_SSL
 
 /* Define to 1 if you have the <openssl/param_build.h> header file. */
@@ -549,10 +552,10 @@
 /* Define to 1 if you have the <openssl/ssl.h> header file. */
 #undef HAVE_OPENSSL_SSL_H
 
-/* Define to 1 if you have the 'OSSL_PARAM_BLD_new' function. */
+/* Define to 1 if you have the `OSSL_PARAM_BLD_new' function. */
 #undef HAVE_OSSL_PARAM_BLD_NEW
 
-/* Define to 1 if you have the 'poll' function. */
+/* Define to 1 if you have the `poll' function. */
 #undef HAVE_POLL
 
 /* Define to 1 if you have the <poll.h> header file. */
@@ -561,13 +564,28 @@
 /* Define if you have POSIX threads libraries and header files. */
 #undef HAVE_PTHREAD
 
+/* Define to 1 if you have the <pthread_np.h> header file. */
+#undef HAVE_PTHREAD_NP_H
+
 /* Have PTHREAD_PRIO_INHERIT. */
 #undef HAVE_PTHREAD_PRIO_INHERIT
 
-/* Define to 1 if the system has the type 'pthread_rwlock_t'. */
+/* Define to 1 if the system has the type `pthread_rwlock_t'. */
 #undef HAVE_PTHREAD_RWLOCK_T
 
-/* Define to 1 if the system has the type 'pthread_spinlock_t'. */
+/* Define if pthread_setname_np has the common 2 arguments. */
+#undef HAVE_PTHREAD_SETNAME_NP
+
+/* Define if pthread_setname_np has only 1 argument. */
+#undef HAVE_PTHREAD_SETNAME_NP1
+
+/* Define if pthread_setname_np has 3 arguments. */
+#undef HAVE_PTHREAD_SETNAME_NP3
+
+/* Define if pthread_setname_np exists as pthread_set_name_np instead. */
+#undef HAVE_PTHREAD_SET_NAME_NP
+
+/* Define to 1 if the system has the type `pthread_spinlock_t'. */
 #undef HAVE_PTHREAD_SPINLOCK_T
 
 /* Define to 1 if you have the <pwd.h> header file. */
@@ -576,98 +594,98 @@
 /* Define if you have Python libraries and header files. */
 #undef HAVE_PYTHON
 
-/* Define to 1 if you have the 'random' function. */
+/* Define to 1 if you have the `random' function. */
 #undef HAVE_RANDOM
 
-/* Define to 1 if you have the 'RAND_cleanup' function. */
+/* Define to 1 if you have the `RAND_cleanup' function. */
 #undef HAVE_RAND_CLEANUP
 
 /* If we have reallocarray(3) */
 #undef HAVE_REALLOCARRAY
 
-/* Define to 1 if you have the 'recvmsg' function. */
+/* Define to 1 if you have the `recvmsg' function. */
 #undef HAVE_RECVMSG
 
-/* Define to 1 if you have the 'sendmsg' function. */
+/* Define to 1 if you have the `sendmsg' function. */
 #undef HAVE_SENDMSG
 
-/* Define to 1 if you have the 'setregid' function. */
+/* Define to 1 if you have the `setregid' function. */
 #undef HAVE_SETREGID
 
-/* Define to 1 if you have the 'setresgid' function. */
+/* Define to 1 if you have the `setresgid' function. */
 #undef HAVE_SETRESGID
 
-/* Define to 1 if you have the 'setresuid' function. */
+/* Define to 1 if you have the `setresuid' function. */
 #undef HAVE_SETRESUID
 
-/* Define to 1 if you have the 'setreuid' function. */
+/* Define to 1 if you have the `setreuid' function. */
 #undef HAVE_SETREUID
 
-/* Define to 1 if you have the 'setrlimit' function. */
+/* Define to 1 if you have the `setrlimit' function. */
 #undef HAVE_SETRLIMIT
 
-/* Define to 1 if you have the 'setsid' function. */
+/* Define to 1 if you have the `setsid' function. */
 #undef HAVE_SETSID
 
-/* Define to 1 if you have the 'setusercontext' function. */
+/* Define to 1 if you have the `setusercontext' function. */
 #undef HAVE_SETUSERCONTEXT
 
-/* Define to 1 if you have the 'SHA512_Update' function. */
+/* Define to 1 if you have the `SHA512_Update' function. */
 #undef HAVE_SHA512_UPDATE
 
-/* Define to 1 if you have the 'shmget' function. */
+/* Define to 1 if you have the `shmget' function. */
 #undef HAVE_SHMGET
 
-/* Define to 1 if you have the 'sigprocmask' function. */
+/* Define to 1 if you have the `sigprocmask' function. */
 #undef HAVE_SIGPROCMASK
 
-/* Define to 1 if you have the 'sleep' function. */
+/* Define to 1 if you have the `sleep' function. */
 #undef HAVE_SLEEP
 
-/* Define to 1 if you have the 'snprintf' function. */
+/* Define to 1 if you have the `snprintf' function. */
 #undef HAVE_SNPRINTF
 
-/* Define to 1 if you have the 'socketpair' function. */
+/* Define to 1 if you have the `socketpair' function. */
 #undef HAVE_SOCKETPAIR
 
 /* Using Solaris threads */
 #undef HAVE_SOLARIS_THREADS
 
-/* Define to 1 if you have the 'srandom' function. */
+/* Define to 1 if you have the `srandom' function. */
 #undef HAVE_SRANDOM
 
 /* Define if you have the SSL libraries installed. */
 #undef HAVE_SSL
 
-/* Define to 1 if you have the 'SSL_CTX_set_alpn_protos' function. */
+/* Define to 1 if you have the `SSL_CTX_set_alpn_protos' function. */
 #undef HAVE_SSL_CTX_SET_ALPN_PROTOS
 
-/* Define to 1 if you have the 'SSL_CTX_set_alpn_select_cb' function. */
+/* Define to 1 if you have the `SSL_CTX_set_alpn_select_cb' function. */
 #undef HAVE_SSL_CTX_SET_ALPN_SELECT_CB
 
-/* Define to 1 if you have the 'SSL_CTX_set_ciphersuites' function. */
+/* Define to 1 if you have the `SSL_CTX_set_ciphersuites' function. */
 #undef HAVE_SSL_CTX_SET_CIPHERSUITES
 
-/* Define to 1 if you have the 'SSL_CTX_set_security_level' function. */
+/* Define to 1 if you have the `SSL_CTX_set_security_level' function. */
 #undef HAVE_SSL_CTX_SET_SECURITY_LEVEL
 
-/* Define to 1 if you have the 'SSL_CTX_set_tlsext_ticket_key_evp_cb'
+/* Define to 1 if you have the `SSL_CTX_set_tlsext_ticket_key_evp_cb'
    function. */
 #undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
 
-/* Define to 1 if you have the 'SSL_get0_alpn_selected' function. */
+/* Define to 1 if you have the `SSL_get0_alpn_selected' function. */
 #undef HAVE_SSL_GET0_ALPN_SELECTED
 
-/* Define to 1 if you have the 'SSL_get0_peername' function. */
+/* Define to 1 if you have the `SSL_get0_peername' function. */
 #undef HAVE_SSL_GET0_PEERNAME
 
-/* Define to 1 if you have the 'SSL_get1_peer_certificate' function. */
+/* Define to 1 if you have the `SSL_get1_peer_certificate' function. */
 #undef HAVE_SSL_GET1_PEER_CERTIFICATE
 
-/* Define to 1 if you have the 'SSL_is_quic' function. */
+/* Define to 1 if you have the `SSL_is_quic' function. */
 #undef HAVE_SSL_IS_QUIC
 
-/* Define to 1 if you have the 'SSL_set1_host' function. */
+/* Define to 1 if you have the `SSL_set1_host' function. */
 #undef HAVE_SSL_SET1_HOST
 
 /* Define to 1 if you have the <stdarg.h> header file. */
@@ -688,7 +706,7 @@
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
-/* Define to 1 if you have the 'strftime' function. */
+/* Define to 1 if you have the `strftime' function. */
 #undef HAVE_STRFTIME
 
 /* Define to 1 if you have the <strings.h> header file. */
@@ -697,41 +715,47 @@
 /* Define to 1 if you have the <string.h> header file. */
 #undef HAVE_STRING_H
 
-/* Define to 1 if you have the 'strlcat' function. */
+/* Define to 1 if you have the `strlcat' function. */
 #undef HAVE_STRLCAT
 
-/* Define to 1 if you have the 'strlcpy' function. */
+/* Define to 1 if you have the `strlcpy' function. */
 #undef HAVE_STRLCPY
 
-/* Define to 1 if you have the 'strptime' function. */
+/* Define to 1 if you have the `strptime' function. */
 #undef HAVE_STRPTIME
 
-/* Define to 1 if you have the 'strsep' function. */
+/* Define to 1 if you have the `strsep' function. */
 #undef HAVE_STRSEP
 
-/* Define to 1 if 'ipi_spec_dst' is a member of 'struct in_pktinfo'. */
+/* Define to 1 if `ipi_spec_dst' is a member of `struct in_pktinfo'. */
 #undef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
 
-/* Define to 1 if 'tokenlen' is a member of 'struct ngtcp2_pkt_hd'. */
+/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_pkt_hd'. */
 #undef HAVE_STRUCT_NGTCP2_PKT_HD_TOKENLEN
 
-/* Define to 1 if 'max_tx_udp_payload_size' is a member of 'struct
+/* Define to 1 if `max_tx_udp_payload_size' is a member of `struct
    ngtcp2_settings'. */
 #undef HAVE_STRUCT_NGTCP2_SETTINGS_MAX_TX_UDP_PAYLOAD_SIZE
 
-/* Define to 1 if 'tokenlen' is a member of 'struct ngtcp2_settings'. */
+/* Define to 1 if `tokenlen' is a member of `struct ngtcp2_settings'. */
 #undef HAVE_STRUCT_NGTCP2_SETTINGS_TOKENLEN
 
-/* Define to 1 if 'original_dcid_present' is a member of 'struct
+/* Define to 1 if `original_dcid_present' is a member of `struct
    ngtcp2_transport_params'. */
 #undef HAVE_STRUCT_NGTCP2_TRANSPORT_PARAMS_ORIGINAL_DCID_PRESENT
 
-/* Define to 1 if the system has the type 'struct ngtcp2_version_cid'. */
+/* Define to 1 if the system has the type `struct ngtcp2_version_cid'. */
 #undef HAVE_STRUCT_NGTCP2_VERSION_CID
 
-/* Define to 1 if 'sun_len' is a member of 'struct sockaddr_un'. */
+/* Define to 1 if `sun_len' is a member of `struct sockaddr_un'. */
 #undef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
 
+/* Define to 1 if `st_mtimensec' is a member of `struct stat'. */
+#undef HAVE_STRUCT_STAT_ST_MTIMENSEC
+
+/* Define to 1 if `st_mtim.tv_nsec' is a member of `struct stat'. */
+#undef HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC
+
 /* Define if you have Swig libraries and header files. */
 #undef HAVE_SWIG
 
@@ -789,16 +813,16 @@
 /* Define to 1 if you have the <time.h> header file. */
 #undef HAVE_TIME_H
 
-/* Define to 1 if you have the 'tzset' function. */
+/* Define to 1 if you have the `tzset' function. */
 #undef HAVE_TZSET
 
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
-/* Define to 1 if you have the 'usleep' function. */
+/* Define to 1 if you have the `usleep' function. */
 #undef HAVE_USLEEP
 
-/* Define to 1 if you have the 'vfork' function. */
+/* Define to 1 if you have the `vfork' function. */
 #undef HAVE_VFORK
 
 /* Define to 1 if you have the <vfork.h> header file. */
@@ -816,22 +840,22 @@
 /* Define to 1 if you have the <winsock2.h> header file. */
 #undef HAVE_WINSOCK2_H
 
-/* Define to 1 if 'fork' works. */
+/* Define to 1 if `fork' works. */
 #undef HAVE_WORKING_FORK
 
-/* Define to 1 if 'vfork' works. */
+/* Define to 1 if `vfork' works. */
 #undef HAVE_WORKING_VFORK
 
-/* Define to 1 if you have the 'writev' function. */
+/* Define to 1 if you have the `writev' function. */
 #undef HAVE_WRITEV
 
 /* Define to 1 if you have the <ws2tcpip.h> header file. */
 #undef HAVE_WS2TCPIP_H
 
-/* Define to 1 if you have the 'X509_VERIFY_PARAM_set1_host' function. */
+/* Define to 1 if you have the `X509_VERIFY_PARAM_set1_host' function. */
 #undef HAVE_X509_VERIFY_PARAM_SET1_HOST
 
-/* Define to 1 if you have the '_beginthreadex' function. */
+/* Define to 1 if you have the `_beginthreadex' function. */
 #undef HAVE__BEGINTHREADEX
 
 /* If HMAC_Init_ex() returns void */
@@ -930,16 +954,16 @@
 /* Shared data */
 #undef SHARE_DIR
 
-/* The size of 'pthread_t', as computed by sizeof. */
+/* The size of `pthread_t', as computed by sizeof. */
 #undef SIZEOF_PTHREAD_T
 
-/* The size of 'size_t', as computed by sizeof. */
+/* The size of `size_t', as computed by sizeof. */
 #undef SIZEOF_SIZE_T
 
-/* The size of 'time_t', as computed by sizeof. */
+/* The size of `time_t', as computed by sizeof. */
 #undef SIZEOF_TIME_T
 
-/* The size of 'unsigned long', as computed by sizeof. */
+/* The size of `unsigned long', as computed by sizeof. */
 #undef SIZEOF_UNSIGNED_LONG
 
 /* define if (v)snprintf does not return length needed, (but length used) */
@@ -948,7 +972,7 @@
 /* Define to 1 if libsodium supports sodium_set_misuse_handler */
 #undef SODIUM_MISUSE_HANDLER
 
-/* Define to 1 if all of the C89 standard headers exist (not just the ones
+/* Define to 1 if all of the C90 standard headers exist (not just the ones
    required in a freestanding environment). This macro is provided for
    backward compatibility; new code need not use it. */
 #undef STDC_HEADERS
@@ -1045,7 +1069,7 @@
 /* Define this to enable SHA256 and SHA512 support. */
 #undef USE_SHA2
 
-/* Enable extensions on AIX, Interix, z/OS.  */
+/* Enable extensions on AIX 3, Interix.  */
 #ifndef _ALL_SOURCE
 # undef _ALL_SOURCE
 #endif
@@ -1106,15 +1130,11 @@
 #ifndef __STDC_WANT_IEC_60559_DFP_EXT__
 # undef __STDC_WANT_IEC_60559_DFP_EXT__
 #endif
-/* Enable extensions specified by C23 Annex F.  */
-#ifndef __STDC_WANT_IEC_60559_EXT__
-# undef __STDC_WANT_IEC_60559_EXT__
-#endif
 /* Enable extensions specified by ISO/IEC TS 18661-4:2015.  */
 #ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
 # undef __STDC_WANT_IEC_60559_FUNCS_EXT__
 #endif
-/* Enable extensions specified by C23 Annex H and ISO/IEC TS 18661-3:2015.  */
+/* Enable extensions specified by ISO/IEC TS 18661-3:2015.  */
 #ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
 # undef __STDC_WANT_IEC_60559_TYPES_EXT__
 #endif
@@ -1155,36 +1175,30 @@
 /* Define if you want PyUnbound. */
 #undef WITH_PYUNBOUND
 
-/* Define to 1 if 'lex' declares 'yytext' as a 'char *' by default, not a
-   'char[]'. */
+/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
+   `char[]'. */
 #undef YYTEXT_POINTER
 
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS
 
-/* Define to 1 if necessary to make fseeko visible. */
+/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
 #undef _LARGEFILE_SOURCE
 
-/* Define to 1 on platforms where this makes off_t a 64-bit type. */
+/* Define for large files, on AIX-style hosts. */
 #undef _LARGE_FILES
 
 /* Enable for compile on Minix */
 #undef _NETBSD_SOURCE
 
-/* Number of bits in time_t, on hosts where this is settable. */
-#undef _TIME_BITS
-
-/* Define to 1 on platforms where this makes time_t a 64-bit type. */
-#undef __MINGW_USE_VC2005_COMPAT
-
 /* defined to use gcc ansi snprintf and sscanf that understands %lld when
    compiled for windows. */
 #undef __USE_MINGW_ANSI_STDIO
 
-/* Define to empty if 'const' does not conform to ANSI C. */
+/* Define to empty if `const' does not conform to ANSI C. */
 #undef const
 
-/* Define as 'int' if <sys/types.h> doesn't define. */
+/* Define to `int' if <sys/types.h> doesn't define. */
 #undef gid_t
 
 /* in_addr_t */
@@ -1193,28 +1207,28 @@
 /* in_port_t */
 #undef in_port_t
 
-/* Define to '__inline__' or '__inline' if that's what the C compiler
+/* Define to `__inline__' or `__inline' if that's what the C compiler
    calls it, or to nothing if 'inline' is not supported under any name.  */
 #ifndef __cplusplus
 #undef inline
 #endif
 
-/* Define to 'short' if <sys/types.h> does not define. */
+/* Define to `short' if <sys/types.h> does not define. */
 #undef int16_t
 
-/* Define to 'int' if <sys/types.h> does not define. */
+/* Define to `int' if <sys/types.h> does not define. */
 #undef int32_t
 
-/* Define to 'long long' if <sys/types.h> does not define. */
+/* Define to `long long' if <sys/types.h> does not define. */
 #undef int64_t
 
-/* Define to 'signed char' if <sys/types.h> does not define. */
+/* Define to `signed char' if <sys/types.h> does not define. */
 #undef int8_t
 
 /* Define if replacement function should be used. */
 #undef malloc
 
-/* Define to 'long int' if <sys/types.h> does not define. */
+/* Define to `long int' if <sys/types.h> does not define. */
 #undef off_t
 
 /* Define as a signed integer type capable of holding a process identifier. */
@@ -1223,34 +1237,34 @@
 /* Define to 'int' if not defined */
 #undef rlim_t
 
-/* Define as 'unsigned int' if <stddef.h> doesn't define. */
+/* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef size_t
 
 /* Define to 'int' if not defined */
 #undef socklen_t
 
-/* Define to 'int' if <sys/types.h> does not define. */
+/* Define to `int' if <sys/types.h> does not define. */
 #undef ssize_t
 
 /* Define to 'unsigned char if not defined */
 #undef u_char
 
-/* Define as 'int' if <sys/types.h> doesn't define. */
+/* Define to `int' if <sys/types.h> doesn't define. */
 #undef uid_t
 
-/* Define to 'unsigned short' if <sys/types.h> does not define. */
+/* Define to `unsigned short' if <sys/types.h> does not define. */
 #undef uint16_t
 
-/* Define to 'unsigned int' if <sys/types.h> does not define. */
+/* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef uint32_t
 
-/* Define to 'unsigned long long' if <sys/types.h> does not define. */
+/* Define to `unsigned long long' if <sys/types.h> does not define. */
 #undef uint64_t
 
-/* Define to 'unsigned char' if <sys/types.h> does not define. */
+/* Define to `unsigned char' if <sys/types.h> does not define. */
 #undef uint8_t
 
-/* Define as 'fork' if 'vfork' does not work. */
+/* Define as `fork' if `vfork' does not work. */
 #undef vfork
 
 #if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE)
@@ -1391,6 +1405,17 @@
 #endif /* !HAVE_ATTR_UNUSED */
 
 
+#if defined(DOXYGEN)
+#  define ATTR_NONSTRING(x)  x
+#elif defined(__cplusplus)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#elif defined(HAVE_ATTR_NONSTRING)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#else /* !HAVE_ATTR_NONSTRING */
+#  define ATTR_NONSTRING(x)  x
+#endif /* !HAVE_ATTR_NONSTRING */
+
+
 #ifndef HAVE_FSEEKO
 #define fseeko fseek
 #define ftello ftell

configure.ac

@@ -11,15 +11,15 @@ sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[24])
-m4_define([VERSION_MICRO],[2])
+m4_define([VERSION_MINOR],[25])
+m4_define([VERSION_MICRO],[0])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=34
+LIBUNBOUND_REVISION=36
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -122,6 +122,7 @@ LIBUNBOUND_AGE=1
 # 1.24.0 had 9:33:1
 # 1.24.1 had 9:34:1
 # 1.24.2 had 9:35:1
+# 1.25.0 had 9:36:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -330,6 +331,7 @@ fi
 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
 ACX_CHECK_UNUSED_ATTRIBUTE
+ACX_CHECK_NONSTRING_ATTRIBUTE
 
 AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -360,7 +362,14 @@ AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "noreturn" attribu
 AC_CACHE_VAL(ac_cv_c_noreturn_attribute,
 [ac_cv_c_noreturn_attribute=no
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-__attribute__((noreturn)) void f(int x) { printf("%d", x); }
+#ifdef STDC_HEADERS
+# include <stdlib.h>
+#else
+# ifdef HAVE_STDLIB_H
+#  include <stdlib.h>
+# endif
+#endif
+__attribute__((noreturn)) void f(int x) { printf("%d", x); exit(1); }
 ]], [[
    f(1);
 ]])],[ac_cv_c_noreturn_attribute="yes"],[ac_cv_c_noreturn_attribute="no"])
@@ -635,19 +644,19 @@ AC_ARG_ENABLE(alloc-nonregional, AS_HELP_STRING([--enable-alloc-nonregional],[ e
 if test x_$enable_alloc_nonregional = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
 fi
-if test x_$enable_alloc_checks = x_yes; then
+AS_IF([test x_$enable_alloc_checks = x_yes],[
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 	SLDNS_ALLOCCHECK_EXTRA_OBJ="alloc.lo log.lo"
 	AC_SUBST(SLDNS_ALLOCCHECK_EXTRA_OBJ)
 	ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ="alloc.lo"
 	AC_SUBST(ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ)
-else
-	if test x_$enable_alloc_lite = x_yes; then
+],[
+	AS_IF([test x_$enable_alloc_lite = x_yes],[
 		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
-	else
+	],[
 		ACX_FUNC_MALLOC([unbound])
-	fi
-fi
+	])
+])
 
 # check windows threads (we use them, not pthreads, on windows).
 if test "$on_mingw" = "yes"; then
@@ -722,6 +731,76 @@ int main(void) {return 0;}
 		])
 fi
 
+if test x_$ub_have_pthreads != x_no; then
+	# Long checks to support pthread_setname_np().
+	# Some OSes have the extra non-portable functions in a specific
+	# header file.
+	AC_CHECK_HEADERS([pthread_np.h],,, [AC_INCLUDES_DEFAULT])
+	BAKCFLAGS="$CFLAGS"
+	CFLAGS="$CFLAGS -Werror"
+	# MacOS only has 1 argument, the name.
+	AC_MSG_CHECKING([whether pthread_setname_np has only 1 argument])
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
+#include <pthread.h>
+#ifdef HAVE_PTHREAD_NP_H
+#include <pthread_np.h>
+#endif
+	],[
+	    (void)pthread_setname_np("");
+	])],[
+	    AC_MSG_RESULT(yes)
+	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP1, 1, [Define if pthread_setname_np has only 1 argument.])
+	],[
+	    AC_MSG_RESULT(no)
+	])
+	# NetBSD has 3 arguments to allow for formatting of the name.
+	AC_MSG_CHECKING([whether pthread_setname_np has 3 arguments])
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
+#include <pthread.h>
+#ifdef HAVE_PTHREAD_NP_H
+#include <pthread_np.h>
+#endif
+	],[
+	    (void)pthread_setname_np(0, "", NULL);
+	])],[
+	    AC_MSG_RESULT(yes)
+	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP3, 1, [Define if pthread_setname_np has 3 arguments.])
+	],[
+	    AC_MSG_RESULT(no)
+	])
+	# Most OSes have the common 2 arguments, thread and name.
+	AC_MSG_CHECKING([whether pthread_setname_np has the common 2 arguments])
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
+#include <pthread.h>
+#ifdef HAVE_PTHREAD_NP_H
+#include <pthread_np.h>
+#endif
+	],[
+	    (void)pthread_setname_np(0, "");
+	])],[
+	    AC_MSG_RESULT(yes)
+	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP, 1, [Define if pthread_setname_np has the common 2 arguments.])
+	],[
+	    AC_MSG_RESULT(no)
+	])
+	# FreeBSD/OpenBSD use a slightly different function name.
+	AC_MSG_CHECKING([whether pthread_setname_np exists as pthread_set_name_np instead])
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
+#include <pthread.h>
+#ifdef HAVE_PTHREAD_NP_H
+#include <pthread_np.h>
+#endif
+	],[
+	    (void)pthread_set_name_np(0, "");
+	])],[
+	    AC_MSG_RESULT(yes)
+	    AC_DEFINE(HAVE_PTHREAD_SET_NAME_NP, 1, [Define if pthread_setname_np exists as pthread_set_name_np instead.])
+	],[
+	    AC_MSG_RESULT(no)
+	])
+	CFLAGS="$BAKCFLAGS"
+fi
+
 # check solaris thread library
 AC_ARG_WITH(solaris-threads, AS_HELP_STRING([--with-solaris-threads],[use solaris native thread library.]), [ ],[ withval="no" ])
 ub_have_sol_threads=no
@@ -1253,7 +1332,7 @@ case "$enable_ecdsa" in
 	      # see if OPENSSL 1.0.0 or later (has EVP MD and Verify independency)
 	      AC_MSG_CHECKING([if openssl supports SHA2 and ECDSA with EVP])
 	      if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL" >/dev/null; then
-		if grep OPENSSL_VERSION_NUMBER $ssldir_include/openssl/opensslv.h | grep 0x0 >/dev/null; then
+		if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL 0\." >/dev/null; then
 		  AC_MSG_RESULT([no])
 		  AC_DEFINE_UNQUOTED([USE_ECDSA_EVP_WORKAROUND], [1], [Define this to enable an EVP workaround for older openssl])
 		else
@@ -1673,10 +1752,12 @@ if test x_$enable_static_exe = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
+		if echo "$host" | $GREP -i -e linux >/dev/null; then
+			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+				:
+			else
+				LIBS="$LIBS -l:libssp.a"
+			fi
 		fi
 	fi
 fi
@@ -1694,10 +1775,12 @@ if test x_$enable_fully_static = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
+		if echo "$host" | $GREP -i -e linux >/dev/null; then
+			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+				:
+			else
+				LIBS="$LIBS -l:libssp.a"
+			fi
 		fi
 	fi
 fi
@@ -1756,6 +1839,7 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi
 
+AC_CHECK_MEMBERS([struct stat.st_mtimensec, struct stat.st_mtim.tv_nsec])
 AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_UN_H
@@ -2293,6 +2377,7 @@ dnl includes
 
 AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
+AHX_CONFIG_NONSTRING_ATTRIBUTE
 AHX_CONFIG_FSEEKO
 AHX_CONFIG_MAXHOSTNAMELEN
 #if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)

contrib/README

@@ -58,3 +58,5 @@ distribution but may be helpful.
 * unbound.init_yocto: An init script to start and stop the server. Put it
   in /etc/init.d/unbound to use it. It is for the Yocto Project, in
   embedded systems, contributed by beni-sandu.
+* gost12.patch: adds ECC-GOST12 support for the informational RFC9558.
+  Contributed by Igor V. Ruzanov.

contrib/gost12.patch

@@ -0,0 +1,325 @@
+diff --git a/sldns/keyraw.c b/sldns/keyraw.c
+index 42a9262a3..cc6406a56 100644
+--- a/sldns/keyraw.c
++++ b/sldns/keyraw.c
+@@ -85,7 +85,7 @@ sldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
+ 		}
+ 		break;
+ #ifdef USE_GOST
+-	case LDNS_ECC_GOST:
++	case LDNS_ECC_GOST12:
+ 		return 512;
+ #endif
+ #ifdef USE_ECDSA
+@@ -146,7 +146,7 @@ sldns_key_EVP_load_gost_id(void)
+ 	if(gost_id) return gost_id;
+ 
+ 	/* see if configuration loaded gost implementation from other engine*/
+-	meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
++	meth = EVP_PKEY_asn1_find_str(NULL, "gost2012_256", -1);
+ 	if(meth) {
+ 		EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
+ 		return gost_id;
+@@ -170,7 +170,7 @@ sldns_key_EVP_load_gost_id(void)
+ 		return 0;
+ 	}
+ 
+-	meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
++	meth = EVP_PKEY_asn1_find_str(&e, "gost2012_256", -1);
+ 	if(!meth) {
+ 		/* algo not found */
+ 		ENGINE_finish(e);
+@@ -536,12 +536,17 @@ EVP_PKEY* sldns_key_rsa2pkey_raw(unsigned char* key, size_t len)
+ EVP_PKEY*
+ sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
+ {
+-	/* prefix header for X509 encoding */
+-	uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85, 
+-		0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85, 
+-		0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03, 
+-		0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
+-	unsigned char encoded[37+64];
++	/* prefix header for X509 encoding
++	 *
++	 * note: based on draft-makarenko-gost2012-dnssec-01 (pre-RFC9558 and it DOES work!)
++	 * ASN1 header described in RFC9558 is not suitable due to d2i_PUBKEY() works with
++	 * non-compressed public keys (two additional bytes 0x04, 0x40 at the end of header)
++	 */
++	uint8_t asn[32] = { 0x30, 0x5e, 0x30, 0x17, 0x06, 0x08, 0x2a, 0x85,
++			    0x03, 0x07, 0x01, 0x01, 0x01, 0x01, 0x30, 0x0b,
++			    0x06, 0x09, 0x2a, 0x85, 0x03, 0x07, 0x01, 0x02,
++			    0x01, 0x01, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40 };
++	unsigned char encoded[32+64];
+ 	const unsigned char* pp;
+ 	if(keylen != 64) {
+ 		/* key wrong size */
+@@ -549,8 +554,8 @@ sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
+ 	}
+ 
+ 	/* create evp_key */
+-	memmove(encoded, asn, 37);
+-	memmove(encoded+37, key, 64);
++	memmove(encoded, asn, 32);
++	memmove(encoded+32, key, 64);
+ 	pp = (unsigned char*)&encoded[0];
+ 
+ 	return d2i_PUBKEY(NULL, &pp, (int)sizeof(encoded));
+diff --git a/sldns/rrdef.h b/sldns/rrdef.h
+index bbc3d5b86..7d5f3c057 100644
+--- a/sldns/rrdef.h
++++ b/sldns/rrdef.h
+@@ -384,11 +384,12 @@ enum sldns_enum_algorithm
+         LDNS_RSASHA1_NSEC3      = 7,
+         LDNS_RSASHA256          = 8,   /* RFC 5702 */
+         LDNS_RSASHA512          = 10,  /* RFC 5702 */
+-        LDNS_ECC_GOST           = 12,  /* RFC 5933 */
++        LDNS_ECC_GOST           = 12,  /* RFC 5933, deprecated */
+         LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
+         LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
+ 	LDNS_ED25519		= 15,  /* RFC 8080 */
+ 	LDNS_ED448		= 16,  /* RFC 8080 */
++	LDNS_ECC_GOST12		= 23,  /* RFC 9558 */
+         LDNS_INDIRECT           = 252,
+         LDNS_PRIVATEDNS         = 253,
+         LDNS_PRIVATEOID         = 254
+@@ -402,8 +403,9 @@ enum sldns_enum_hash
+ {
+         LDNS_SHA1               = 1,  /* RFC 4034 */
+         LDNS_SHA256             = 2,  /* RFC 4509 */
+-        LDNS_HASH_GOST          = 3,  /* RFC 5933 */
+-        LDNS_SHA384             = 4   /* RFC 6605 */
++        LDNS_HASH_GOST          = 3,  /* RFC 5933, deprecated */
++        LDNS_SHA384             = 4,  /* RFC 6605 */
++        LDNS_HASH_GOST12        = 5   /* RFC 9558 */
+ };
+ typedef enum sldns_enum_hash sldns_hash;
+ 
+diff --git a/sldns/wire2str.c b/sldns/wire2str.c
+index 75b8f37b0..b4c4755e6 100644
+--- a/sldns/wire2str.c
++++ b/sldns/wire2str.c
+@@ -45,11 +45,12 @@ static sldns_lookup_table sldns_algorithms_data[] = {
+ 	{ LDNS_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
+ 	{ LDNS_RSASHA256, "RSASHA256"},
+ 	{ LDNS_RSASHA512, "RSASHA512"},
+-	{ LDNS_ECC_GOST, "ECC-GOST"},
++	{ LDNS_ECC_GOST, "ECC-GOST"}, /* deprecated */
+ 	{ LDNS_ECDSAP256SHA256, "ECDSAP256SHA256"},
+ 	{ LDNS_ECDSAP384SHA384, "ECDSAP384SHA384"},
+ 	{ LDNS_ED25519, "ED25519"},
+ 	{ LDNS_ED448, "ED448"},
++	{ LDNS_ECC_GOST12, "ECC-GOST12"},
+ 	{ LDNS_INDIRECT, "INDIRECT" },
+ 	{ LDNS_PRIVATEDNS, "PRIVATEDNS" },
+ 	{ LDNS_PRIVATEOID, "PRIVATEOID" },
+@@ -61,8 +62,9 @@ sldns_lookup_table* sldns_algorithms = sldns_algorithms_data;
+ static sldns_lookup_table sldns_hashes_data[] = {
+ 	{ LDNS_SHA1, "SHA1" },
+ 	{ LDNS_SHA256, "SHA256" },
+-	{ LDNS_HASH_GOST, "HASH-GOST" },
++	{ LDNS_HASH_GOST, "HASH-GOST" }, /* deprecated */
+ 	{ LDNS_SHA384, "SHA384" },
++	{ LDNS_HASH_GOST12, "HASH-GOST12" },
+ 	{ 0, NULL }
+ };
+ sldns_lookup_table* sldns_hashes = sldns_hashes_data;
+diff --git a/testcode/unitverify.c b/testcode/unitverify.c
+index fcf2e2ffe..4a33e9f6a 100644
+--- a/testcode/unitverify.c
++++ b/testcode/unitverify.c
+@@ -696,7 +696,7 @@ verify_test(void)
+ #endif
+ #ifdef USE_GOST
+ 	if(sldns_key_EVP_load_gost_id())
+-	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost", "20090807060504");
++	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost12", "20251226060504");
+ 	else printf("Warning: skipped GOST, openssl does not provide gost.\n");
+ #endif
+ #ifdef USE_ECDSA
+diff --git a/testdata/test_sigs.gost12 b/testdata/test_sigs.gost12
+new file mode 100644
+index 000000000..72a250cff
+--- /dev/null
++++ b/testdata/test_sigs.gost12
+@@ -0,0 +1,39 @@
++; Signature test file
++
++; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification.
++; later entries are verified with it.
++
++; Test GOST signatures using algo number 23.
++
++ENTRY_BEGIN
++SECTION QUESTION
++nlnetlabs.nl.	IN DNSKEY
++SECTION ANSWER
++nlnetlabs.nl.   3600    IN      DNSKEY  256 3 23 cdOtkEcb6NhcdOpIbPYtWyWxdlUiKgtKQbYg3lIjtG7i3fYjUID9zyOgoQEiV9wuGCfrw5cNsnvNw+8HiVFK4g== ;{id = 12301 (zsk), size = 512b}
++ENTRY_END
++
++; entry to test
++ENTRY_BEGIN
++SECTION QUESTION
++open.nlnetlabs.nl. IN A
++SECTION ANSWER
++open.nlnetlabs.nl.      600     IN      A       213.154.224.1
++open.nlnetlabs.nl.      600     IN      RRSIG   A 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. I12wYNs96DxMy26CWx296/sWMJAFg4nNXBo0sw7PnuMbJW5NFAmZYtFWhUdOWn4umaiodYOAmKG8Zg/OKvEtAQ==
++ENTRY_END
++
++ENTRY_BEGIN
++SECTION QUESTION
++open.nlnetlabs.nl. IN AAAA
++SECTION ANSWER
++open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::1
++open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::53
++open.nlnetlabs.nl.      600     IN      RRSIG   AAAA 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. J0jHa+CP8HM6UDa2+uYgaze2mfpJTh2hkZ2KwMTYb5sfL6iBmxxql0c/403Itk4fMfYBMGn7zfzDQ+CxnCgSWw==
++ENTRY_END
++
++ENTRY_BEGIN
++SECTION QUESTION
++open.nlnetlabs.nl. IN NSEC
++SECTION ANSWER
++open.nlnetlabs.nl.      86400   IN      NSEC    nlnetlabs.nl. A AAAA RRSIG NSEC
++open.nlnetlabs.nl.      86400   IN      RRSIG   NSEC 23 3 86400 20260122084903 20251225084903 12301 nlnetlabs.nl. INCLYe9vAaNYaYx5Ay3Q6QdX+wPW9sMRvVlGt/jUEGgCi+88QlV80CT1oHrhRI66I14Wk6NRAGZRNx1tUPSHSg==
++ENTRY_END
+diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
+index be8347b1b..4f621a309 100644
+--- a/validator/val_secalgo.c
++++ b/validator/val_secalgo.c
+@@ -246,10 +246,10 @@ ds_digest_size_supported(int algo)
+ 			return SHA256_DIGEST_LENGTH;
+ #endif
+ #ifdef USE_GOST
+-		case LDNS_HASH_GOST:
++		case LDNS_HASH_GOST12:
+ 			/* we support GOST if it can be loaded */
+ 			(void)sldns_key_EVP_load_gost_id();
+-			if(EVP_get_digestbyname("md_gost94"))
++			if(EVP_get_digestbyname("md_gost12_256"))
+ 				return 32;
+ 			else	return 0;
+ #endif
+@@ -265,9 +265,9 @@ ds_digest_size_supported(int algo)
+ #ifdef USE_GOST
+ /** Perform GOST hash */
+ static int
+-do_gost94(unsigned char* data, size_t len, unsigned char* dest)
++do_gost12(unsigned char* data, size_t len, unsigned char* dest)
+ {
+-	const EVP_MD* md = EVP_get_digestbyname("md_gost94");
++	const EVP_MD* md = EVP_get_digestbyname("md_gost12_256");
+ 	if(!md) 
+ 		return 0;
+ 	return sldns_digest_evp(data, (unsigned int)len, dest, md);
+@@ -302,8 +302,8 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
+ 			return 1;
+ #endif
+ #ifdef USE_GOST
+-		case LDNS_HASH_GOST:
+-			if(do_gost94(buf, len, res))
++		case LDNS_HASH_GOST12:
++			if(do_gost12(buf, len, res))
+ 				return 1;
+ 			break;
+ #endif
+@@ -384,7 +384,7 @@ dnskey_algo_id_is_supported(int id)
+ #endif
+ 
+ #ifdef USE_GOST
+-	case LDNS_ECC_GOST:
++	case LDNS_ECC_GOST12:
+ 		/* we support GOST if it can be loaded */
+ 		return sldns_key_EVP_load_gost_id();
+ #endif
+@@ -612,17 +612,17 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
+ 
+ 			break;
+ #ifdef USE_GOST
+-		case LDNS_ECC_GOST:
++		case LDNS_ECC_GOST12:
+ 			*evp_key = sldns_gost2pkey_raw(key, keylen);
+ 			if(!*evp_key) {
+ 				verbose(VERB_QUERY, "verify: "
+ 					"sldns_gost2pkey_raw failed");
+ 				return 0;
+ 			}
+-			*digest_type = EVP_get_digestbyname("md_gost94");
++			*digest_type = EVP_get_digestbyname("md_gost12_256");
+ 			if(!*digest_type) {
+ 				verbose(VERB_QUERY, "verify: "
+-					"EVP_getdigest md_gost94 failed");
++					"EVP_getdigest md_gost12_256 failed");
+ 				return 0;
+ 			}
+ 			break;
+@@ -964,7 +964,7 @@ ds_digest_size_supported(int algo)
+ 			return SHA384_LENGTH;
+ #endif
+ 		/* GOST not supported in NSS */
+-		case LDNS_HASH_GOST:
++		case LDNS_HASH_GOST12:
+ 		default: break;
+ 	}
+ 	return 0;
+@@ -991,7 +991,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
+ 			return HASH_HashBuf(HASH_AlgSHA384, res, buf, len)
+ 				== SECSuccess;
+ #endif
+-		case LDNS_HASH_GOST:
++		case LDNS_HASH_GOST12:
+ 		default: 
+ 			verbose(VERB_QUERY, "unknown DS digest algorithm %d", 
+ 				algo);
+@@ -1031,7 +1031,7 @@ dnskey_algo_id_is_supported(int id)
+ 	case LDNS_ECDSAP384SHA384:
+ 		return PK11_TokenExists(CKM_ECDSA);
+ #endif
+-	case LDNS_ECC_GOST:
++	case LDNS_ECC_GOST12:
+ 	default:
+ 		return 0;
+ 	}
+@@ -1352,7 +1352,7 @@ nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
+ 			/* no prefix for DSA verification */
+ 			break;
+ #endif /* USE_ECDSA */
+-		case LDNS_ECC_GOST:
++		case LDNS_ECC_GOST12:
+ 		default:
+ 			verbose(VERB_QUERY, "verify: unknown algorithm %d", 
+ 				algo);
+@@ -1675,7 +1675,7 @@ ds_digest_size_supported(int algo)
+ 			return SHA384_DIGEST_SIZE;
+ #endif
+ 		/* GOST not supported */
+-		case LDNS_HASH_GOST:
++		case LDNS_ECC_GOST12:
+ 		default:
+ 			break;
+ 	}
+@@ -1700,7 +1700,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
+ 			return _digest_nettle(SHA384_DIGEST_SIZE, buf, len, res);
+ 
+ #endif
+-		case LDNS_HASH_GOST:
++		case LDNS_ECC_GOST12:
+ 		default:
+ 			verbose(VERB_QUERY, "unknown DS digest algorithm %d",
+ 				algo);
+@@ -1744,7 +1744,7 @@ dnskey_algo_id_is_supported(int id)
+ 		return 1;
+ #endif
+ 	case LDNS_RSAMD5: /* RFC 6725 deprecates RSAMD5 */
+-	case LDNS_ECC_GOST:
++	case LDNS_ECC_GOST12:
+ 	default:
+ 		return 0;
+ 	}
+@@ -2103,7 +2103,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
+ 			return sec_status_secure;
+ #endif
+ 	case LDNS_RSAMD5:
+-	case LDNS_ECC_GOST:
++	case LDNS_ECC_GOST12:
+ 	default:
+ 		*reason = "unable to verify signature, unknown algorithm";
+ 		return sec_status_bogus;

contrib/ios/install_openssl.sh

@@ -1,21 +1,22 @@
 #!/usr/bin/env bash
+OPENSSL_VERSION=1.1.1d
 
 echo "Downloading OpenSSL"
-if ! curl -L -k -s -o openssl-1.1.1d.tar.gz https://www.openssl.org/source/openssl-1.1.1d.tar.gz;
+if ! curl -L -k -s -o openssl-$OPENSSL_VERSION.tar.gz https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz;
 then
     echo "Failed to download OpenSSL"
     exit 1
 fi
 
 echo "Unpacking OpenSSL"
-rm -rf ./openssl-1.1.1d
-if ! tar -xf openssl-1.1.1d.tar.gz;
+rm -rf ./openssl-$OPENSSL_VERSION
+if ! tar -xf openssl-$OPENSSL_VERSION.tar.gz;
 then
     echo "Failed to unpack OpenSSL"
     exit 1
 fi
 
-cd openssl-1.1.1d || exit 1
+cd openssl-$OPENSSL_VERSION || exit 1
 
 if ! cp ../contrib/ios/15-ios.conf Configurations/; then
     echo "Failed to copy OpenSSL ios config"
@@ -27,7 +28,8 @@ fi
 # Also see https://github.com/openssl/openssl/issues/7607.
 if ! patch -u -p0 < ../contrib/ios/openssl.patch; then
     echo "Failed to patch OpenSSL"
-    exit 1
+    # the partial patch may be useful.
+    #exit 1
 fi
 
 echo "Configuring OpenSSL"

contrib/ios/setenv_ios.sh

@@ -175,6 +175,7 @@ fi
 # For example, remove 4.3, 6.2, and 6.1 if they are not installed. We go back to
 # the 1.0 SDKs because Apple WatchOS uses low numbers, like 2.0 and 2.1.
 XCODE_SDK=
+if test -z "$SDK_VERSION"; then
 for i in $(seq -f "%.1f" 30.0 -0.1 1.0)
 do
     if [ -d "$XCODE_DEVELOPER_SDK/Developer/SDKs/$IOS_SDK$i.sdk" ]; then
@@ -182,6 +183,10 @@ do
         break
     fi
 done
+else
+    i="$SDK_VERSION"
+    XCODE_SDK="$IOS_SDK$i.sdk"
+fi
 
 # Error checking
 if [ -z "$XCODE_SDK" ]; then

contrib/unbound.service.in

@@ -59,7 +59,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true

contrib/unbound_portable.service.in

@@ -26,7 +26,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true

daemon/daemon.c

@@ -199,6 +199,255 @@ signal_handling_playback(struct worker* wrk)
 	sig_record_reload = 0;
 }
 
+#ifdef HAVE_SSL
+/* setup a listening ssl context, fatal_exit() on any failure */
+static void
+setup_listen_sslctx(void** ctx, int is_dot, int is_doh,
+	struct config_file* cfg, char* chroot)
+{
+	char* key = cfg->ssl_service_key;
+	char* pem = cfg->ssl_service_pem;
+	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
+		key += strlen(chroot);
+	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
+		pem += strlen(chroot);
+	if(!(*ctx = listen_sslctx_create(key, pem, NULL,
+		cfg->tls_ciphers, cfg->tls_ciphersuites,
+		(cfg->tls_session_ticket_keys.first &&
+		cfg->tls_session_ticket_keys.first->str[0] != 0),
+		is_dot, is_doh, cfg->tls_protocols))) {
+		fatal_exit("could not set up listen SSL_CTX");
+	}
+}
+#endif /* HAVE_SSL */
+
+#ifdef HAVE_SSL
+void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
+	struct config_file* cfg)
+{
+	void* ctx;
+	(void)setup_listen_sslctx(&ctx, 1, 0, cfg, daemon->chroot);
+	return ctx;
+}
+#endif /* HAVE_SSL */
+
+#ifdef HAVE_SSL
+#ifdef HAVE_NGHTTP2_NGHTTP2_H
+void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
+	struct config_file* cfg)
+{
+	void* ctx;
+	(void)setup_listen_sslctx(&ctx, 0, 1, cfg, daemon->chroot);
+	return ctx;
+}
+#endif /* HAVE_NGHTTP2_NGHTTP2_H */
+#endif /* HAVE_SSL */
+
+#ifdef HAVE_SSL
+#ifdef HAVE_NGTCP2
+void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
+	struct config_file* cfg)
+{
+	void* ctx;
+	char* chroot = daemon->chroot;
+	char* key = cfg->ssl_service_key;
+	char* pem = cfg->ssl_service_pem;
+	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
+		key += strlen(chroot);
+	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
+		pem += strlen(chroot);
+
+	if(!(ctx = quic_sslctx_create(key, pem, NULL))) {
+		fatal_exit("could not set up quic SSL_CTX");
+	}
+	return ctx;
+}
+#endif /* HAVE_NGTCP2 */
+#endif /* HAVE_SSL */
+
+#ifdef HAVE_SSL
+void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
+	struct config_file* cfg)
+{
+	void* ctx;
+	char* bundle, *chroot = daemon->chroot;
+	bundle = cfg->tls_cert_bundle;
+	if(chroot && bundle && strncmp(bundle, chroot, strlen(chroot)) == 0)
+		bundle += strlen(chroot);
+
+	if(!(ctx = connect_sslctx_create(NULL, NULL, bundle,
+		cfg->tls_win_cert)))
+		fatal_exit("could not set up connect SSL_CTX");
+	return ctx;
+}
+#endif /* HAVE_SSL */
+
+/* setups the needed ssl contexts, fatal_exit() on any failure */
+void
+daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
+{
+#ifdef HAVE_SSL
+	char* chroot = daemon->chroot;
+	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
+		char* key = cfg->ssl_service_key;
+		char* pem = cfg->ssl_service_pem;
+		if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
+			key += strlen(chroot);
+		if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
+			pem += strlen(chroot);
+
+		/* setup the session keys; the callback to use them will be
+		 * attached to each sslctx separately */
+		if(cfg->tls_session_ticket_keys.first &&
+			cfg->tls_session_ticket_keys.first->str[0] != 0) {
+			if(!listen_sslctx_setup_ticket_keys(
+				cfg->tls_session_ticket_keys.first, chroot)) {
+				fatal_exit("could not set session ticket SSL_CTX");
+			}
+		}
+		daemon->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(
+			daemon, cfg);
+#ifdef HAVE_NGHTTP2_NGHTTP2_H
+		if(cfg_has_https(cfg)) {
+			daemon->listen_doh_sslctx =
+				daemon_setup_listen_doh_sslctx(daemon, cfg);
+		}
+#endif
+#ifdef HAVE_NGTCP2
+		if(cfg_has_quic(cfg)) {
+			daemon->listen_quic_sslctx =
+				daemon_setup_listen_quic_sslctx(daemon, cfg);
+		}
+#endif /* HAVE_NGTCP2 */
+
+		/* Store the file name and mtime to detect changes later. */
+		daemon->ssl_service_key = strdup(cfg->ssl_service_key);
+		if(!daemon->ssl_service_key)
+			fatal_exit("could not setup ssl ctx: out of memory");
+		if(cfg->ssl_service_pem) {
+			daemon->ssl_service_pem = strdup(cfg->ssl_service_pem);
+			if(!daemon->ssl_service_pem)
+				fatal_exit("could not setup ssl ctx: out of memory");
+		} else {
+			daemon->ssl_service_pem = NULL;
+		}
+		if(!file_get_mtime(key,
+			&daemon->mtime_ssl_service_key,
+			&daemon->mtime_ns_ssl_service_key, NULL))
+			log_err("Could not stat(%s): %s",
+				key, strerror(errno));
+		if(pem) {
+			if(!file_get_mtime(pem,
+				&daemon->mtime_ssl_service_pem,
+				&daemon->mtime_ns_ssl_service_pem, NULL))
+				log_err("Could not stat(%s): %s",
+					pem, strerror(errno));
+		} else {
+			daemon->mtime_ssl_service_pem = 0;
+			daemon->mtime_ns_ssl_service_pem = 0;
+		}
+	}
+	daemon->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
+		daemon, cfg);
+#else /* HAVE_SSL */
+	(void)daemon;(void)cfg;
+#endif /* HAVE_SSL */
+}
+
+/** Delete the ssl ctxs */
+static void
+daemon_delete_sslctxs(struct daemon* daemon)
+{
+#ifdef HAVE_SSL
+	listen_sslctx_delete_ticket_keys();
+	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
+	daemon->listen_dot_sslctx = NULL;
+	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
+	daemon->listen_doh_sslctx = NULL;
+	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
+	daemon->connect_dot_sslctx = NULL;
+	free(daemon->ssl_service_key);
+	daemon->ssl_service_key = NULL;
+	free(daemon->ssl_service_pem);
+	daemon->ssl_service_pem = NULL;
+#else
+	(void)daemon;
+#endif
+#ifdef HAVE_NGTCP2
+	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
+	daemon->listen_quic_sslctx = NULL;
+#endif
+}
+
+int
+ssl_cert_changed(struct daemon* daemon, struct config_file* cfg)
+{
+	time_t mtime = 0;
+	long ns = 0;
+	char* chroot = daemon->chroot;
+	char* key = cfg->ssl_service_key;
+	char* pem = cfg->ssl_service_pem;
+	log_assert(daemon->ssl_service_key && cfg->ssl_service_key);
+	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
+		key += strlen(chroot);
+	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
+		pem += strlen(chroot);
+
+	if(strcmp(daemon->ssl_service_key, cfg->ssl_service_key) != 0)
+		return 1;
+	if(daemon->ssl_service_pem && cfg->ssl_service_pem &&
+	   strcmp(daemon->ssl_service_pem, cfg->ssl_service_pem) != 0)
+		return 1;
+	if(!file_get_mtime(key, &mtime, &ns, NULL)) {
+		log_err("Could not stat(%s): %s",
+			key, strerror(errno));
+		/* It has probably changed, but file read is likely going to
+		 * fail. */
+		return 0;
+	}
+	if(mtime != daemon->mtime_ssl_service_key ||
+		ns != daemon->mtime_ns_ssl_service_key)
+		return 1;
+	if(pem) {
+		if(!file_get_mtime(pem, &mtime, &ns, NULL)) {
+			log_err("Could not stat(%s): %s",
+				pem, strerror(errno));
+			/* It has probably changed, but file read is likely going to
+			 * fail. */
+			return 0;
+		}
+		if(mtime != daemon->mtime_ssl_service_pem ||
+			ns != daemon->mtime_ns_ssl_service_pem)
+			return 1;
+	}
+	return 0;
+}
+
+/** Reload the sslctxs if they have changed */
+static void
+daemon_reload_sslctxs(struct daemon* daemon)
+{
+#ifdef HAVE_SSL
+	if(daemon->cfg->ssl_service_key && daemon->cfg->ssl_service_key[0]) {
+		/* See if changed */
+		if(!daemon->ssl_service_key ||
+			ssl_cert_changed(daemon,daemon->cfg)) {
+			verbose(VERB_ALGO, "Reloading certificates");
+			daemon_delete_sslctxs(daemon);
+			daemon_setup_sslctxs(daemon, daemon->cfg);
+		}
+	} else {
+		/* See if sslctxs are removed from config. */
+		if(daemon->ssl_service_key) {
+			verbose(VERB_ALGO, "Removing certificates");
+			daemon_delete_sslctxs(daemon);
+		}
+	}
+#else
+	(void)daemon;
+#endif
+}
+
 struct daemon* 
 daemon_init(void)
 {
@@ -235,7 +484,11 @@ daemon_init(void)
 #  else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#    endif
+		, NULL);
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 	/* grab the COMP method ptr because openssl leaks it */
@@ -244,7 +497,11 @@ daemon_init(void)
 #  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #  else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#    endif
+		, NULL);
 #  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
@@ -558,9 +815,11 @@ daemon_create_workers(struct daemon* daemon)
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
 
 #ifdef HAVE_NGTCP2
-	daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
-	if(!daemon->doq_table)
-		fatal_exit("could not create doq_table: out of memory");
+	if (cfg_has_quic(daemon->cfg)) {
+		daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
+		if(!daemon->doq_table)
+			fatal_exit("could not create doq_table: out of memory");
+	}
 #endif
 	
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
@@ -631,6 +890,25 @@ static void close_other_pipes(struct daemon* daemon, int thr)
 }
 #endif /* THREADS_DISABLED */
 
+/**
+ * Function to set the thread local log ID.
+ * Either the internal thread number, or the LWP ID on Linux based on
+ * configuration.
+ */
+static void
+set_log_thread_id(struct worker* worker, struct config_file* cfg)
+{
+	(void)cfg;
+	log_assert(worker);
+#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
+	worker->thread_tid = gettid();
+	if(cfg->log_thread_id)
+		log_thread_set(&worker->thread_tid);
+	else
+#endif
+		log_thread_set(&worker->thread_num);
+}
+
 /**
  * Function to start one thread. 
  * @param arg: user argument.
@@ -641,7 +919,14 @@ thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
 	int port_num = 0;
-	log_thread_set(&worker->thread_num);
+	log_assert(worker->thr_id);
+	set_log_thread_id(worker, worker->daemon->cfg);
+	{
+		char name[16]; /* seems to be the safest size between
+				  different OSes */
+		snprintf(name, sizeof(name), "unbound/%u", worker->thread_num);
+		ub_thread_setname(worker->thr_id, name);
+	}
 	ub_thread_blocksigs();
 #ifdef THREADS_DISABLED
 	/* close pipe ends used by main */
@@ -716,6 +1001,7 @@ daemon_fork(struct daemon* daemon)
 #endif
 
 	log_assert(daemon);
+	daemon_reload_sslctxs(daemon);
 	if(!(daemon->env->views = views_create()))
 		fatal_exit("Could not create views: out of memory");
 	/* create individual views and their localzone/data trees */
@@ -801,9 +1087,19 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("RPZ requires the respip module");
 
 	/* first create all the worker structures, so we can pass
-	 * them to the newly created threads. 
+	 * them to the newly created threads.
 	 */
 	daemon_create_workers(daemon);
+	/* Set it for the first (main) worker since it does not take part in
+	 * the thread_start() procedure.
+	 */
+	set_log_thread_id(daemon->workers[0], daemon->cfg);
+	/* If shm stats need an offset, calculate it */
+	if(daemon->cfg->shm_enable && daemon->cfg->stat_interval > 0) {
+		daemon->stat_time_specific = 1;
+		daemon->stat_time_offset =
+			((int)time(NULL))%daemon->cfg->stat_interval;
+	}
 
 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
@@ -917,8 +1213,10 @@ daemon_cleanup(struct daemon* daemon)
 	daemon->dnscenv = NULL;
 #endif
 #ifdef HAVE_NGTCP2
-	doq_table_delete(daemon->doq_table);
-	daemon->doq_table = NULL;
+	if (daemon->doq_table) {
+		doq_table_delete(daemon->doq_table);
+		daemon->doq_table = NULL;
+	}
 #endif
 	daemon->cfg = NULL;
 }
@@ -956,15 +1254,7 @@ daemon_delete(struct daemon* daemon)
 	free(daemon->pidfile);
 	free(daemon->cfgfile);
 	free(daemon->env);
-#ifdef HAVE_SSL
-	listen_sslctx_delete_ticket_keys();
-	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
-	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
-	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
-#endif
-#ifdef HAVE_NGTCP2
-	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
-#endif
+	daemon_delete_sslctxs(daemon);
 	free(daemon);
 	/* lex cleanup */
 	ub_c_lex_destroy();

daemon/daemon.h

@@ -107,6 +107,18 @@ struct daemon {
 	void* listen_doh_sslctx;
 	/** ssl context for listening to quic */
 	void* listen_quic_sslctx;
+	/** the file name that the ssl context is made with, private key. */
+	char* ssl_service_key;
+	/** the file name that the ssl context is made with, certificate. */
+	char* ssl_service_pem;
+	/** modification time for ssl_service_key, in sec and ns. Like
+	 * in a struct timespec, but without that for portability. */
+	time_t mtime_ssl_service_key;
+	long mtime_ns_ssl_service_key;
+	/** modification time for ssl_service_pem, in sec and ns. Like
+	 * in a struct timespec, but without that for portability. */
+	time_t mtime_ssl_service_pem;
+	long mtime_ns_ssl_service_pem;
 	/** num threads allocated */
 	int num;
 	/** num threads allocated in the previous config or 0 at first */
@@ -143,7 +155,14 @@ struct daemon {
 	/** the dnstap environment master value, copied and changed by threads*/
 	struct dt_env* dtenv;
 #endif
+	/** The SHM info for shared memory stats. */
 	struct shm_main_info* shm_info;
+	/** if the timeout for statistics is attempted at specific offset.
+	 * If it is true, the stat timeout is the interval+offset, and that
+	 * picks (roughly) the same time offset every time period. */
+	int stat_time_specific;
+	/** if the timeout is specific, what offset in the period. */
+	int stat_time_offset;
 	/** some response-ip tags or actions are configured if true */
 	int use_response_ip;
 	/** some RPZ policies are configured */
@@ -229,4 +248,26 @@ void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg);
  */
 int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list);
 
+/* setups the needed ssl contexts, fatal_exit() on any failure */
+void daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg);
+
+/** See if the SSL cert files have changed */
+int ssl_cert_changed(struct daemon* daemon, struct config_file* cfg);
+
+/** Setup the listening DoT SSL_CTX, returns the ssl ctx. */
+void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
+	struct config_file* cfg);
+
+/** Setup the listening DoH SSL_CTX, returns the ssl ctx. */
+void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
+	struct config_file* cfg);
+
+/** Setup the listening Quic SSL_CTX, returns the ssl ctx */
+void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
+	struct config_file* cfg);
+
+/** Setup the connect DoT SSL_CTX, returns the ssl ctx */
+void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
+	struct config_file* cfg);
+
 #endif /* DAEMON_H */

daemon/remote.c

@@ -153,7 +153,7 @@ remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
 		log_crypto_err("could not SSL_CTX_new");
 		return 0;
 	}
-	if(!listen_sslctx_setup(rc->ctx)) {
+	if(!listen_sslctx_setup(rc->ctx, cfg->tls_protocols)) {
 		return 0;
 	}
 
@@ -307,6 +307,26 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 #endif
 		}
 	} else {
+		char* s = strchr(ip, '@');
+		char newif[128];
+		if(s) {
+			/* override port with ifspec@port */
+			int portnr;
+			if((size_t)(s-ip) >= sizeof(newif)) {
+				log_err("ifname too long: %s", ip);
+				return -1;
+			}
+			portnr = atoi(s+1);
+			if(portnr < 0 || 0 == portnr || portnr > 65535) {
+				log_err("invalid portnumber in control-interface: %s", ip);
+				return -1;
+			}
+			(void)strlcpy(newif, ip, sizeof(newif));
+			newif[s-ip] = 0;
+			ip = newif;
+			snprintf(port, sizeof(port), "%d", portnr);
+			port[sizeof(port)-1]=0;
+		}
 		hints.ai_socktype = SOCK_STREAM;
 		hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
 		if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
@@ -801,6 +821,8 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 		(unsigned long)s->svr.num_queries_cookie_invalid)) return 0;
 	if(!ssl_printf(ssl, "%s.num.queries_discard_timeout"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_discard_timeout)) return 0;
+	if(!ssl_printf(ssl, "%s.num.queries_replyaddr_limit"SQ"%lu\n", nm,
+		(unsigned long)s->svr.num_queries_replyaddr_limit)) return 0;
 	if(!ssl_printf(ssl, "%s.num.queries_wait_limit"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_wait_limit)) return 0;
 	if(!ssl_printf(ssl, "%s.num.cachehits"SQ"%lu\n", nm,
@@ -845,6 +867,8 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 		(unsigned long)s->mesh_num_states)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.current.user"SQ"%lu\n", nm,
 		(unsigned long)s->mesh_num_reply_states)) return 0;
+	if(!ssl_printf(ssl, "%s.requestlist.current.replies"SQ"%lu\n", nm,
+		(unsigned long)s->mesh_num_reply_addrs)) return 0;
 #ifndef S_SPLINT_S
 	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
 	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
@@ -4629,6 +4653,26 @@ fr_init_time(struct timeval* time_start, struct timeval* time_read,
  * are kept in here. They can then be deleted.
  */
 struct fast_reload_construct {
+	/** ssl context for listening to dnstcp over ssl */
+	void* listen_dot_sslctx;
+	/** ssl context for connecting to dnstcp over ssl */
+	void* connect_dot_sslctx;
+	/** ssl context for listening to DoH */
+	void* listen_doh_sslctx;
+	/** ssl context for listening to quic */
+	void* listen_quic_sslctx;
+	/** the file name that the ssl context is made with, private key. */
+	char* ssl_service_key;
+	/** the file name that the ssl context is made with, certificate. */
+	char* ssl_service_pem;
+	/** modification time for ssl_service_key, in sec and ns. Like
+	 * in a struct timespec, but without that for portability. */
+	time_t mtime_ssl_service_key;
+	long mtime_ns_ssl_service_key;
+	/** modification time for ssl_service_pem, in sec and ns. Like
+	 * in a struct timespec, but without that for portability. */
+	time_t mtime_ssl_service_pem;
+	long mtime_ns_ssl_service_pem;
 	/** construct for views */
 	struct views* views;
 	/** construct for auth zones */
@@ -4932,9 +4976,7 @@ fr_check_compat_cfg(struct fast_reload_thread* fr, struct config_file* newcfg)
 	FR_CHECK_CHANGED_CFG("http_notls_downstream", http_notls_downstream, changed_str);
 	FR_CHECK_CHANGED_CFG("https-port", https_port, changed_str);
 	FR_CHECK_CHANGED_CFG("tls-port", ssl_port, changed_str);
-	FR_CHECK_CHANGED_CFG_STR("tls-service-key", ssl_service_key, changed_str);
-	FR_CHECK_CHANGED_CFG_STR("tls-service-pem", ssl_service_pem, changed_str);
-	FR_CHECK_CHANGED_CFG_STR("tls-cert-bundle", tls_cert_bundle, changed_str);
+	FR_CHECK_CHANGED_CFG_STR("tls-protocols", tls_protocols, changed_str);
 	FR_CHECK_CHANGED_CFG_STRLIST("proxy-protocol-port", proxy_protocol_port, changed_str);
 	FR_CHECK_CHANGED_CFG_STRLIST("tls-additional-port", tls_additional_port, changed_str);
 	FR_CHECK_CHANGED_CFG_STR("interface-automatic-ports", if_automatic_ports, changed_str);
@@ -5043,6 +5085,19 @@ fr_construct_clear(struct fast_reload_construct* ct)
 	wait_limits_free(&ct->wait_limits_netblock);
 	wait_limits_free(&ct->wait_limits_cookie_netblock);
 	domain_limits_free(&ct->domain_limits);
+#ifdef HAVE_SSL
+	/* The SSL contexts can be SSL_CTX_free here. It is reference
+	 * counted. So ongoing transfers with can continue.
+	 * Once they are done, the context is freed. */
+	SSL_CTX_free((SSL_CTX*)ct->listen_dot_sslctx);
+	SSL_CTX_free((SSL_CTX*)ct->connect_dot_sslctx);
+	SSL_CTX_free((SSL_CTX*)ct->listen_doh_sslctx);
+#endif /* HAVE_SSL */
+#ifdef HAVE_NGTCP2
+	SSL_CTX_free((SSL_CTX*)ct->listen_quic_sslctx);
+#endif
+	free(ct->ssl_service_key);
+	free(ct->ssl_service_pem);
 	/* Delete the log identity here so that the global value is not
 	 * reset by config_delete. */
 	if(ct->oldcfg && ct->oldcfg->log_identity) {
@@ -5175,6 +5230,7 @@ config_file_getmem(struct config_file* cfg)
 	m += getmem_config_strlist(cfg->tls_session_ticket_keys.first);
 	m += getmem_str(cfg->tls_ciphers);
 	m += getmem_str(cfg->tls_ciphersuites);
+	m += getmem_str(cfg->tls_protocols);
 	m += getmem_str(cfg->http_endpoint);
 	m += (cfg->outgoing_avail_ports?65536*sizeof(int):0);
 	m += getmem_str(cfg->target_fetch_policy);
@@ -5291,6 +5347,8 @@ fr_printmem(struct fast_reload_thread* fr,
 	size_t mem = 0;
 	if(fr_poll_for_quit(fr))
 		return 1;
+	mem += getmem_str(ct->ssl_service_key);
+	mem += getmem_str(ct->ssl_service_pem);
 	mem += views_get_mem(ct->views);
 	mem += respip_set_get_mem(ct->respip_set);
 	mem += auth_zones_get_mem(ct->auth_zones);
@@ -5524,6 +5582,96 @@ auth_zones_check_changes(struct fast_reload_thread* fr,
 	return 1;
 }
 
+/** Check if the sslctxs have changed. */
+static int
+fr_check_sslctx_change(struct fast_reload_thread* fr,
+	struct config_file* newcfg)
+{
+#ifdef HAVE_SSL
+	struct daemon* daemon = fr->worker->daemon;
+	if(newcfg->ssl_service_key && newcfg->ssl_service_key[0]) {
+		if(!daemon->ssl_service_key ||
+			ssl_cert_changed(daemon, newcfg))
+			return 1;
+	} else {
+		if(daemon->ssl_service_key)
+			return 1; /* it is removed */
+	}
+	if((daemon->cfg->tls_cert_bundle && !newcfg->tls_cert_bundle) ||
+	   (!daemon->cfg->tls_cert_bundle && newcfg->tls_cert_bundle) ||
+	   (daemon->cfg->tls_cert_bundle && newcfg->tls_cert_bundle &&
+	    strcmp(daemon->cfg->tls_cert_bundle, newcfg->tls_cert_bundle)!=0))
+		return 1; /* The tls-cert-bundle has changed and return
+			true here makes it reload the connect_dot_sslctx. */
+#else
+	(void)fr; (void)newcfg;
+#endif /* HAVE_SSL */
+	return 0;
+}
+
+/** Create the SSL CTXs when they have changed. */
+static int
+ct_create_sslctxs(struct fast_reload_construct* ct,
+	struct config_file* newcfg, struct daemon* daemon)
+{
+#ifdef HAVE_SSL
+	char* chroot = daemon->chroot;
+	char* key = newcfg->ssl_service_key;
+	char* pem = newcfg->ssl_service_pem;
+
+	if(!(newcfg->ssl_service_key && newcfg->ssl_service_key[0])) {
+		/* Leave listen ctxs and file str at NULL */
+		ct->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
+			daemon, newcfg);
+		return 1;
+	}
+
+	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
+		key += strlen(chroot);
+	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
+		pem += strlen(chroot);
+
+	ct->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(daemon, newcfg);
+#ifdef HAVE_NGHTTP2_NGHTTP2_H
+	if(cfg_has_https(newcfg)) {
+		ct->listen_doh_sslctx = daemon_setup_listen_doh_sslctx(
+			daemon, newcfg);
+	}
+#endif
+#ifdef HAVE_NGTCP2
+	if(cfg_has_quic(newcfg)) {
+		ct->listen_quic_sslctx = daemon_setup_listen_quic_sslctx(
+			daemon, newcfg);
+	}
+#endif /* HAVE_NGTCP2 */
+	ct->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(daemon,
+		newcfg);
+
+	/* Store mtime and names */
+	ct->ssl_service_key = strdup(newcfg->ssl_service_key);
+	if(!ct->ssl_service_key) {
+		log_err("ct_create_sslctxs: out of memory");
+		return 0;
+	}
+	ct->ssl_service_pem = strdup(newcfg->ssl_service_pem);
+	if(!ct->ssl_service_pem) {
+		log_err("ct_create_sslctxs: out of memory");
+		return 0;
+	}
+	if(!file_get_mtime(key, &ct->mtime_ssl_service_key,
+		&ct->mtime_ns_ssl_service_key, NULL))
+		log_err("Could not stat(%s): %s",
+			key, strerror(errno));
+	if(!file_get_mtime(pem, &ct->mtime_ssl_service_pem,
+		&ct->mtime_ns_ssl_service_pem, NULL))
+		log_err("Could not stat(%s): %s",
+			pem, strerror(errno));
+#else
+	(void)ct; (void)newcfg; (void)daemon;
+#endif /* HAVE_SSL */
+	return 1;
+}
+
 /** fast reload thread, construct from config the new items */
 static int
 fr_construct_from_config(struct fast_reload_thread* fr,
@@ -5531,6 +5679,13 @@ fr_construct_from_config(struct fast_reload_thread* fr,
 {
 	int have_view_respip_cfg = 0;
 
+	fr->sslctxs_changed = fr_check_sslctx_change(fr, newcfg);
+	if(fr->sslctxs_changed) {
+		if(!ct_create_sslctxs(ct, newcfg, fr->worker->daemon)) {
+			fr_construct_clear(ct);
+			return 0;
+		}
+	}
 	if(!(ct->views = views_create())) {
 		fr_construct_clear(ct);
 		return 0;
@@ -5808,6 +5963,44 @@ auth_zones_swap(struct auth_zones* az, struct auth_zones* data)
 	 * the xfer elements can continue to be their callbacks. */
 }
 
+/** Swap two void* */
+static void
+void_ptr_swap(void** a, void **b)
+{
+	void* tmp = *a;
+	*a = *b;
+	*b = tmp;
+}
+
+/** Swap two char* */
+static void
+char_ptr_swap(char** a, char **b)
+{
+	char* tmp = *a;
+	*a = *b;
+	*b = tmp;
+}
+
+/** Swap and set ssl ctx information */
+static void
+sslctxs_swap(struct daemon* daemon, struct fast_reload_construct* ct)
+{
+	void_ptr_swap(&daemon->listen_dot_sslctx, &ct->listen_dot_sslctx);
+	void_ptr_swap(&daemon->connect_dot_sslctx, &ct->connect_dot_sslctx);
+#ifdef HAVE_NGHTTP2_NGHTTP2_H
+	void_ptr_swap(&daemon->listen_doh_sslctx, &ct->listen_doh_sslctx);
+#endif
+#ifdef HAVE_NGTCP2
+	void_ptr_swap(&daemon->listen_quic_sslctx, &ct->listen_quic_sslctx);
+#endif /* HAVE_NGTCP2 */
+	char_ptr_swap(&daemon->ssl_service_key, &ct->ssl_service_key);
+	char_ptr_swap(&daemon->ssl_service_pem, &ct->ssl_service_pem);
+	daemon->mtime_ssl_service_key = ct->mtime_ssl_service_key;
+	daemon->mtime_ns_ssl_service_key = ct->mtime_ns_ssl_service_key;
+	daemon->mtime_ssl_service_pem = ct->mtime_ssl_service_pem;
+	daemon->mtime_ns_ssl_service_pem = ct->mtime_ns_ssl_service_pem;
+}
+
 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE)
 /** Fast reload thread, if atomics are available, copy the config items
  * one by one with atomic store operations. */
@@ -5869,6 +6062,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(tls_session_ticket_keys.last);
 	COPY_VAR_ptr(tls_ciphers);
 	COPY_VAR_ptr(tls_ciphersuites);
+	COPY_VAR_ptr(tls_protocols);
 	COPY_VAR_int(tls_use_sni);
 	COPY_VAR_int(https_port);
 	COPY_VAR_ptr(http_endpoint);
@@ -5967,6 +6161,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_int(log_servfail);
 	COPY_VAR_ptr(log_identity);
 	COPY_VAR_int(log_destaddr);
+	COPY_VAR_int(log_thread_id);
 	COPY_VAR_int(hide_identity);
 	COPY_VAR_int(hide_version);
 	COPY_VAR_int(hide_trustanchor);
@@ -6176,7 +6371,20 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(ipset_name_v6);
 #endif
 	COPY_VAR_int(ede);
+	COPY_VAR_int(iter_scrub_ns);
+	COPY_VAR_int(iter_scrub_cname);
+	COPY_VAR_int(iter_scrub_rrsig);
+	COPY_VAR_int(max_global_quota);
 	COPY_VAR_int(iter_scrub_promiscuous);
+
+#undef COPY_VAR_int
+#undef COPY_VAR_ptr
+#undef COPY_VAR_unsigned_int
+#undef COPY_VAR_size_t
+#undef COPY_VAR_uint8_t
+#undef COPY_VAR_uint16_t
+#undef COPY_VAR_uint32_t
+#undef COPY_VAR_int32_t
 }
 #endif /* ATOMIC_POINTER_LOCK_FREE && HAVE_LINK_ATOMIC_STORE */
 
@@ -6402,6 +6610,9 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 	daemon->env->cachedb_enabled = cachedb_is_enabled(&daemon->mods,
 		daemon->env);
 #endif
+	if(fr->sslctxs_changed) {
+		sslctxs_swap(daemon, ct);
+	}
 #ifdef USE_DNSTAP
 	if(env->cfg->dnstap) {
 		if(!fr->fr_nopause)
@@ -6626,7 +6837,19 @@ static void* fast_reload_thread_main(void* arg)
 	struct fast_reload_thread* fast_reload_thread = (struct fast_reload_thread*)arg;
 	struct timeval time_start, time_read, time_construct, time_reload,
 		time_end;
-	log_thread_set(&fast_reload_thread->threadnum);
+	const char name[16] = "unbound/freload"; /* seems to be the safest size
+						    between different OSes */
+
+#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
+	fast_reload_thread->thread_tid = gettid();
+	if(fast_reload_thread->thread_tid_log)
+		log_thread_set(&fast_reload_thread->thread_tid);
+	else
+#endif
+		log_thread_set(&fast_reload_thread->threadnum);
+
+	ub_thread_setname(fast_reload_thread->tid, name);
+	(void)name; /* When setname is not defined, ignore the name variable. */
 
 	verbose(VERB_ALGO, "start fast reload thread");
 	if(fast_reload_thread->fr_verb >= 1) {
@@ -7014,6 +7237,9 @@ fast_reload_thread_setup(struct worker* worker, int fr_verb, int fr_nopause,
 	lock_basic_init(&fr->fr_output_lock);
 	lock_protect(&fr->fr_output_lock, fr->fr_output,
 		sizeof(*fr->fr_output));
+#ifdef HAVE_GETTID
+	fr->thread_tid_log = worker->env.cfg->log_thread_id;
+#endif
 	return 1;
 }
 
@@ -7588,6 +7814,44 @@ fr_worker_pickup_auth_changes(struct worker* worker,
 	}
 }
 
+/** Fast reload, the worker picks up changes in listen_dnsport. */
+static void
+fr_worker_pickup_listen_dnsport(struct worker* worker)
+{
+	struct listen_dnsport* front = worker->front;
+	struct daemon* daemon = worker->daemon;
+	if(worker->daemon->fast_reload_thread->sslctxs_changed) {
+		struct listen_list* ll;
+		void* dot_sslctx = daemon->listen_dot_sslctx;
+		void* doh_sslctx = daemon->listen_doh_sslctx;
+#ifdef HAVE_NGTCP2
+		void* quic_sslctx = daemon->listen_quic_sslctx;
+#endif  /* HAVE_NGTCP2 */
+		for(ll = front->cps; ll; ll = ll->next) {
+			struct comm_point* cp = ll->com;
+			if(cp->type == comm_tcp_accept &&
+				cp->tcp_handlers &&
+				cp->max_tcp_count > 0 &&
+				cp->tcp_handlers[0]->type == comm_http) {
+				if(cp->ssl)
+					cp->ssl = doh_sslctx;
+			} else if(cp->type == comm_tcp_accept) {
+				if(cp->ssl)
+					cp->ssl = dot_sslctx;
+#ifdef HAVE_NGTCP2
+			} else if(cp->type == comm_doq) {
+				if(cp->ssl) {
+					cp->ssl = quic_sslctx;
+					if(cp->doq_socket)
+						cp->doq_socket->ctx =
+							(SSL_CTX*)quic_sslctx;
+				}
+#endif  /* HAVE_NGTCP2 */
+			}
+		}
+	}
+}
+
 /** Fast reload, the worker picks up changes in outside_network. */
 static void
 fr_worker_pickup_outside_network(struct worker* worker)
@@ -7603,6 +7867,8 @@ fr_worker_pickup_outside_network(struct worker* worker)
 	outnet->tcp_reuse_timeout = cfg->tcp_reuse_timeout;
 	outnet->tcp_auth_query_timeout = cfg->tcp_auth_query_timeout;
 	outnet->delayclose = cfg->delay_close;
+	if(worker->daemon->fast_reload_thread->sslctxs_changed)
+		outnet->sslctx = worker->daemon->connect_dot_sslctx;
 	if(outnet->delayclose) {
 #ifndef S_SPLINT_S
 		outnet->delay_tv.tv_sec = cfg->delay_close/1000;
@@ -7611,6 +7877,41 @@ fr_worker_pickup_outside_network(struct worker* worker)
 	}
 }
 
+#ifdef USE_DNSTAP
+/** Fast reload, the worker picks up changes to DNSTAP configuration. */
+static void
+fr_worker_pickup_dnstap_changes(struct worker* worker)
+{
+	struct dt_env* w_dtenv = &worker->dtenv;
+	struct dt_env* d_dtenv = worker->daemon->dtenv;
+	log_assert(d_dtenv != NULL || !worker->daemon->cfg->dnstap);
+	if(d_dtenv == NULL) {
+		/* There is no environment when DNSTAP was not enabled
+		 * in the configuration. */
+		return;
+	}
+	w_dtenv->identity = d_dtenv->identity;
+	w_dtenv->len_identity = d_dtenv->len_identity;
+	w_dtenv->version = d_dtenv->version;
+	w_dtenv->len_version = d_dtenv->len_version;
+	w_dtenv->log_resolver_query_messages =
+		d_dtenv->log_resolver_query_messages;
+	w_dtenv->log_resolver_response_messages =
+		d_dtenv->log_resolver_response_messages;
+	w_dtenv->log_client_query_messages =
+		d_dtenv->log_client_query_messages;
+	w_dtenv->log_client_response_messages =
+		d_dtenv->log_client_response_messages;
+	w_dtenv->log_forwarder_query_messages =
+		d_dtenv->log_forwarder_query_messages;
+	w_dtenv->log_forwarder_response_messages =
+		d_dtenv->log_forwarder_response_messages;
+	lock_basic_lock(&d_dtenv->sample_lock);
+	w_dtenv->sample_rate = d_dtenv->sample_rate;
+	lock_basic_unlock(&d_dtenv->sample_lock);
+}
+#endif /* USE_DNSTAP */
+
 void
 fast_reload_worker_pickup_changes(struct worker* worker)
 {
@@ -7638,7 +7939,11 @@ fast_reload_worker_pickup_changes(struct worker* worker)
 #ifdef USE_CACHEDB
 	worker->env.cachedb_enabled = worker->daemon->env->cachedb_enabled;
 #endif
+	fr_worker_pickup_listen_dnsport(worker);
 	fr_worker_pickup_outside_network(worker);
+#ifdef USE_DNSTAP
+	fr_worker_pickup_dnstap_changes(worker);
+#endif
 }
 
 /** fast reload thread, handle reload_stop notification, send reload stop

daemon/remote.h

@@ -206,6 +206,12 @@ struct fast_reload_thread {
 	int commpair[2];
 	/** thread id, of the io thread */
 	ub_thread_type tid;
+#ifdef HAVE_GETTID
+	/** thread tid, the LWP id */
+	pid_t thread_tid;
+	/** if logging should include the LWP id */
+	int thread_tid_log;
+#endif
 	/** if the io processing has started */
 	int started;
 	/** if the thread has to quit */
@@ -249,6 +255,8 @@ struct fast_reload_thread {
 	struct fast_reload_auth_change* auth_zone_change_list;
 	/** the old tree of auth zones, to lookup. */
 	struct auth_zones* old_auth_zones;
+	/** If the ssl ctxs have changed. */
+	int sslctxs_changed;
 };
 
 /**

daemon/stats.c

@@ -262,6 +262,7 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr = worker->stats;
 	s->mesh_num_states = (long long)worker->env.mesh->all.count;
 	s->mesh_num_reply_states = (long long)worker->env.mesh->num_reply_states;
+	s->mesh_num_reply_addrs = (long long)worker->env.mesh->num_reply_addrs;
 	s->mesh_jostled = (long long)worker->env.mesh->stats_jostled;
 	s->mesh_dropped = (long long)worker->env.mesh->stats_dropped;
 	s->mesh_replies_sent = (long long)worker->env.mesh->replies_sent;
@@ -284,6 +285,8 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		NUM_BUCKETS_HIST);
 	s->svr.num_queries_discard_timeout +=
 		(long long)worker->env.mesh->num_queries_discard_timeout;
+	s->svr.num_queries_replyaddr_limit +=
+		(long long)worker->env.mesh->num_queries_replyaddr_limit;
 	s->svr.num_queries_wait_limit +=
 		(long long)worker->env.mesh->num_queries_wait_limit;
 	s->svr.num_dns_error_reports +=
@@ -448,6 +451,8 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 	total->svr.num_queries_cookie_invalid += a->svr.num_queries_cookie_invalid;
 	total->svr.num_queries_discard_timeout +=
 		a->svr.num_queries_discard_timeout;
+	total->svr.num_queries_replyaddr_limit +=
+		a->svr.num_queries_replyaddr_limit;
 	total->svr.num_queries_wait_limit += a->svr.num_queries_wait_limit;
 	total->svr.num_dns_error_reports += a->svr.num_dns_error_reports;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
@@ -519,6 +524,7 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 
 	total->mesh_num_states += a->mesh_num_states;
 	total->mesh_num_reply_states += a->mesh_num_reply_states;
+	total->mesh_num_reply_addrs += a->mesh_num_reply_addrs;
 	total->mesh_jostled += a->mesh_jostled;
 	total->mesh_dropped += a->mesh_dropped;
 	total->mesh_replies_sent += a->mesh_replies_sent;

daemon/unbound.c

@@ -463,57 +463,13 @@ detach(void)
 #endif /* HAVE_DAEMON */
 }
 
-#ifdef HAVE_SSL
-/* setup a listening ssl context, fatal_exit() on any failure */
+/** setup the remote and ticket keys */
 static void
-setup_listen_sslctx(void** ctx, int is_dot, int is_doh, struct config_file* cfg)
-{
-	if(!(*ctx = listen_sslctx_create(
-		cfg->ssl_service_key, cfg->ssl_service_pem, NULL,
-		cfg->tls_ciphers, cfg->tls_ciphersuites,
-		(cfg->tls_session_ticket_keys.first &&
-		cfg->tls_session_ticket_keys.first->str[0] != 0),
-		is_dot, is_doh))) {
-		fatal_exit("could not set up listen SSL_CTX");
-	}
-}
-#endif /* HAVE_SSL */
-
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-static void
-setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
+setup_sslctx_remote(struct daemon* daemon, struct config_file* cfg)
 {
 #ifdef HAVE_SSL
 	if(!(daemon->rc = daemon_remote_create(cfg)))
 		fatal_exit("could not set up remote-control");
-	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
-		/* setup the session keys; the callback to use them will be
-		 * attached to each sslctx separately */
-		if(cfg->tls_session_ticket_keys.first &&
-			cfg->tls_session_ticket_keys.first->str[0] != 0) {
-			if(!listen_sslctx_setup_ticket_keys(
-				cfg->tls_session_ticket_keys.first)) {
-				fatal_exit("could not set session ticket SSL_CTX");
-			}
-		}
-		(void)setup_listen_sslctx(&daemon->listen_dot_sslctx, 1, 0, cfg);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-		if(cfg_has_https(cfg)) {
-			(void)setup_listen_sslctx(&daemon->listen_doh_sslctx, 0, 1, cfg);
-		}
-#endif
-#ifdef HAVE_NGTCP2
-		if(cfg_has_quic(cfg)) {
-			if(!(daemon->listen_quic_sslctx = quic_sslctx_create(
-				cfg->ssl_service_key, cfg->ssl_service_pem, NULL))) {
-				fatal_exit("could not set up quic SSL_CTX");
-			}
-		}
-#endif /* HAVE_NGTCP2 */
-	}
-	if(!(daemon->connect_dot_sslctx = connect_sslctx_create(NULL, NULL,
-		cfg->tls_cert_bundle, cfg->tls_win_cert)))
-		fatal_exit("could not set up connect SSL_CTX");
 #else /* HAVE_SSL */
 	(void)daemon;(void)cfg;
 #endif /* HAVE_SSL */
@@ -545,7 +501,8 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 
 	/* read ssl keys while superuser and outside chroot */
-	(void)setup_sslctxs(daemon, cfg);
+	setup_sslctx_remote(daemon, cfg);
+	daemon_setup_sslctxs(daemon, cfg);
 
 	/* init syslog (as root) if needed, before daemonize, otherwise
 	 * a fork error could not be printed since daemonize closed stderr.*/

daemon/worker.c

@@ -255,7 +255,8 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 		return 0;
 	}
 	/* sanity check. */
-	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
+	if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE
+		|| !LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
 		|| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
 			LDNS_PACKET_QUERY
 		|| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
@@ -292,6 +293,44 @@ worker_err_ratelimit(struct worker* worker, int err)
 	return err;
 }
 
+/**
+ * Reply with an error.
+ * This reply includes the qname if it has been parsed.
+ * For error ratelimiting, the err ratelimit routine should be checked
+ * beforehand. The reply is without EDNS, and copies RD and sets QR flag.
+ * @param pkt: the packet buffer from the comm point.
+ * @param err: the error code that would be wanted.
+ * @param qname_len: 0 if not parsed, and the qname length in packet.
+ */
+static void
+query_error(sldns_buffer* pkt, int err, size_t qname_len)
+{
+	/* Preserve the RD flag.
+	 * The CD flag must be cleared in authoritative answers,
+	 * also the AD flag need not be copied into answers.
+	 * The other flags need not be copied into the answer. */
+	sldns_buffer_write_u16_at(pkt, 2,
+		sldns_buffer_read_u16_at(pkt, 2)&0x0100U);
+	LDNS_QR_SET(sldns_buffer_begin(pkt)); /* Set QR flag. */
+	LDNS_RCODE_SET(sldns_buffer_begin(pkt), err); /* Set rcode */
+
+	if(qname_len && LDNS_QDCOUNT(sldns_buffer_begin(pkt))>=1 &&
+		qname_len <= LDNS_MAX_DOMAINLEN) {
+		/* Copy query into the answer. */
+		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 1);
+		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE +
+			qname_len + 2 /* type */ + 2 /* class */ );
+	} else {
+		/* No query section in answer. */
+		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 0);
+		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE);
+	}
+	LDNS_ANCOUNT_SET(sldns_buffer_begin(pkt), 0);
+	LDNS_NSCOUNT_SET(sldns_buffer_begin(pkt), 0);
+	LDNS_ARCOUNT_SET(sldns_buffer_begin(pkt), 0);
+	sldns_buffer_flip(pkt);
+}
+
 /**
  * Structure holding the result of the worker_check_request function.
  * Based on configuration it could be called up to four times; ideally should
@@ -329,7 +368,6 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 		return;
 	}
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
-		LDNS_TC_CLR(sldns_buffer_begin(pkt));
 		verbose(VERB_QUERY, "request bad, has TC bit on");
 		out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 		return;
@@ -746,7 +784,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	*partial_repp = NULL;  /* avoid accidental further pass */
 
 	/* Check TTL */
-	if(rep->ttl < timenow) {
+	if(TTL_IS_EXPIRED(rep->ttl, timenow)) {
 		/* Check if we need to serve expired now */
 		if(worker->env.cfg->serve_expired &&
 			/* if serve-expired-client-timeout is set, serve
@@ -971,6 +1009,7 @@ chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
 	size_t udpsize = edns->udp_size;
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
+	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
 		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad,
@@ -1229,9 +1268,7 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		worker_check_request(c->buffer, worker, check_result);
 		if(check_result->value != 0) {
 			if(check_result->value != -1) {
-				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-					check_result->value);
+				query_error(c->buffer, check_result->value, 0);
 				return 1;
 			}
 			comm_point_drop_reply(repinfo);
@@ -1248,41 +1285,17 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		/* check additional section is present and that we respond with EDEs */
 		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
 			|| !ede) {
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				LDNS_RCODE_REFUSED);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-			sldns_buffer_flip(c->buffer);
+			query_error(c->buffer, LDNS_RCODE_REFUSED, 0);
 			return 1;
 		}
 
 		if (!query_dname_len(c->buffer)) {
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				LDNS_RCODE_FORMERR);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-			sldns_buffer_flip(c->buffer);
+			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
 			return 1;
 		}
 		/* space available for query type and class? */
 		if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
-                        LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-                        LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				 LDNS_RCODE_FORMERR);
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-                        sldns_buffer_flip(c->buffer);
+			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
 			return 1;
 		}
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
@@ -1304,35 +1317,27 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			if(!skip_pkt_rrs(c->buffer,
 				((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
 				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
-				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-					LDNS_RCODE_FORMERR);
-				LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				sldns_buffer_set_position(c->buffer, opt_rr_mark);
-				sldns_buffer_flip(c->buffer);
+				query_error(c->buffer, LDNS_RCODE_FORMERR,
+					opt_rr_mark - LDNS_HEADER_SIZE
+					- 2 /* qtype */ - 2 /* qclass */);
 				return 1;
 			}
 		}
 		/* Do we have a valid OPT RR here? If not return REFUSED (could be a valid TSIG or something so no FORMERR) */
 		/* domain name must be the root of length 1. */
 		if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, opt_rr_mark);
-			sldns_buffer_flip(c->buffer);
+			query_error(c->buffer, LDNS_RCODE_REFUSED,
+				opt_rr_mark - LDNS_HEADER_SIZE
+				- 2 /* qtype */ - 2 /* qclass */);
 			return 1;
 		} else {
 			sldns_buffer_skip(c->buffer, 1); /* skip root label */
 		}
 		if(sldns_buffer_remaining(c->buffer) < 2 ||
 			sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, opt_rr_mark);
-			sldns_buffer_flip(c->buffer);
+			query_error(c->buffer, LDNS_RCODE_REFUSED,
+				opt_rr_mark - LDNS_HEADER_SIZE
+				- 2 /* qtype */ - 2 /* qclass */);
 			return 1;
 		}
 		/* Write OPT RR directly after the query,
@@ -1444,6 +1449,24 @@ check_ip_ratelimit(struct worker* worker, struct sockaddr_storage* addr,
 	return 1;
 }
 
+/*
+ * This is the callback function when a request arrives. It is passed
+ * the packet and user argument. Return true to send a reply.
+ * This is of type comm_point_callback_type. The struct comm_point contains
+ * more comments on the comm_point.callback member about the function.
+ * @param c: the comm_point where the request arrives on.
+ * @param arg: the user argument for the callback, the worker.
+ * @param error: This can be NETEVENT_NOERROR, NETEVENT_TIMEOUT,
+ *	NETEVENT_CLOSED or other comm point callback error values.
+ * @param repinfo: The reply info, use it to send a reply. If the reply
+ *	is immediate, return 1. If the reply is later on return 0 and save
+ *	the repinfo, to call comm_point_send_reply on.
+ * @return 1 to sent a reply straight away, for like cache response so that
+ *	no allocation needs to be done. And only internal preallocated buffers
+ *	are used. Return 0 and save the repinfo to reply later, for responses
+ *	that need to be looked up. Return 0 and call comm_point_drop_reply on
+ *	the repinfo to drop the response.
+ */
 int
 worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct comm_reply* repinfo)
@@ -1510,6 +1533,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker check request: bad query.");
 			log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
 				repinfo->client_addrlen);
+			if(check_result.value != -1) {
+				query_error(c->buffer, check_result.value, 0);
+				return 1;
+			}
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
@@ -1518,8 +1545,12 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker parse request: formerror.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			comm_point_drop_reply(repinfo);
-			return 0;
+			if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
+				comm_point_drop_reply(repinfo);
+				return 0;
+			}
+			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+			return 1;
 		}
 		dname_str(qinfo.qname, buf);
 		if(!(qinfo.qtype == LDNS_RR_TYPE_TXT &&
@@ -1530,9 +1561,14 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				worker->daemon->dnscenv->provider_name,
 				sldns_rr_descript(qinfo.qtype)->_name,
 				buf);
-			comm_point_drop_reply(repinfo);
+			if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
+				comm_point_drop_reply(repinfo);
+				return 0;
+			}
+			query_error(c->buffer, LDNS_RCODE_SERVFAIL,
+				qinfo.qname_len);
 			worker->stats.num_query_dnscrypt_cleartext++;
-			return 0;
+			return 1;
 		}
 		worker->stats.num_query_dnscrypt_cert++;
 		sldns_buffer_rewind(c->buffer);
@@ -1572,9 +1608,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker check request: bad query.");
 		log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
 		if(check_result.value != -1) {
-			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				check_result.value);
+			query_error(c->buffer, check_result.value, 0);
 			return 1;
 		}
 		comm_point_drop_reply(repinfo);
@@ -1608,10 +1642,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		sldns_buffer_rewind(c->buffer);
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-			LDNS_RCODE_FORMERR);
+		query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
 		goto send_reply;
 	}
 	if(worker->env.cfg->log_queries) {
@@ -1624,10 +1655,11 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		sldns_buffer_rewind(c->buffer);
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-			LDNS_RCODE_REFUSED);
+		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
+		query_error(c->buffer, LDNS_RCODE_REFUSED, qinfo.qname_len);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1646,10 +1678,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		sldns_buffer_rewind(c->buffer);
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-			LDNS_RCODE_FORMERR);
+		query_error(c->buffer, LDNS_RCODE_FORMERR, qinfo.qname_len);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1657,13 +1686,17 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 	if((ret=parse_edns_from_query_pkt(
 			c->buffer, &edns, worker->env.cfg, c, repinfo,
-			(worker->env.now ? *worker->env.now : time(NULL)),
-			worker->scratchpad,
+			*worker->env.now, worker->scratchpad,
 			worker->daemon->cookie_secrets)) != 0) {
 		struct edns_data reply_edns;
 		verbose(VERB_ALGO, "worker parse edns: formerror.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
+		if(worker_err_ratelimit(worker, ret) == -1) {
+			comm_point_drop_reply(repinfo);
+			regional_free_all(worker->scratchpad);
+			return 0;
+		}
 		memset(&reply_edns, 0, sizeof(reply_edns));
 		reply_edns.edns_present = 1;
 		error_encode(c->buffer, ret, &qinfo,
@@ -1680,6 +1713,11 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			verbose(VERB_ALGO, "query with bad edns version.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
+			if(worker_err_ratelimit(worker, EDNS_RCODE_BADVERS) == -1) {
+				comm_point_drop_reply(repinfo);
+				regional_free_all(worker->scratchpad);
+				return 0;
+			}
 			extended_error_encode(c->buffer, EDNS_RCODE_BADVERS, &qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 				sldns_buffer_read_u16_at(c->buffer, 2), 0, &edns);
@@ -1725,6 +1763,11 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 
 	else if(edns.cookie_present) {
 		/* Cookie present, but not valid: Cookie was bad! */
+		if(worker_err_ratelimit(worker, LDNS_EXT_RCODE_BADCOOKIE) == -1) {
+			comm_point_drop_reply(repinfo);
+			regional_free_all(worker->scratchpad);
+			return 0;
+		}
 		extended_error_encode(c->buffer,
 			LDNS_EXT_RCODE_BADCOOKIE, &qinfo,
 			*(uint16_t*)(void *)
@@ -1739,6 +1782,11 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			"need cookie or stateful transport");
 		log_addr(VERB_ALGO, "from",&repinfo->remote_addr
 		                          , repinfo->remote_addrlen);
+		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
+			comm_point_drop_reply(repinfo);
+			regional_free_all(worker->scratchpad);
+			return 0;
+		}
 		EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 			worker->scratchpad, LDNS_EDE_OTHER,
 			"DNS Cookie needed for UDP replies");
@@ -1765,14 +1813,14 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: edns is too small.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
+			comm_point_drop_reply(repinfo);
+			regional_free_all(worker->scratchpad);
+			return 0;
+		}
+		/* A small error without qname, and TC flag on. */
+		query_error(c->buffer, LDNS_RCODE_SERVFAIL, 0);
 		LDNS_TC_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-			LDNS_RCODE_SERVFAIL);
-		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-		sldns_buffer_write_at(c->buffer, 4,
-			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
-		sldns_buffer_flip(c->buffer);
 		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
@@ -1857,6 +1905,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	 * ACLs allow the snooping. */
 	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
 		acl != acl_allow_snoop ) {
+		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
+			&repinfo->client_addr, repinfo->client_addrlen);
+		/* This ratelimited error query is accounted in the stats,
+		 * as an incoming query. */
+		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
+			comm_point_drop_reply(repinfo);
+			regional_free_all(worker->scratchpad);
+			return 0;
+		}
 		if(worker->env.cfg->ede) {
 			EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 				worker->scratchpad, LDNS_EDE_NOT_AUTHORITATIVE, "");
@@ -1865,9 +1922,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &edns);
 		regional_free_all(worker->scratchpad);
-		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
-			&repinfo->client_addr, repinfo->client_addrlen);
-
 		goto send_reply;
 	}
 
@@ -1929,11 +1983,11 @@ lookup_cache:
 				if((worker->env.cfg->prefetch &&
 					rep->prefetch_ttl <= *worker->env.now) ||
 					(worker->env.cfg->serve_expired &&
-					rep->ttl < *worker->env.now  &&
+					TTL_IS_EXPIRED(rep->ttl, *worker->env.now) &&
 					!(*worker->env.now < rep->serve_expired_norec_ttl))) {
-					time_t leeway = rep->ttl - *worker->env.now;
-					if(rep->ttl < *worker->env.now)
-						leeway = 0;
+					time_t leeway =
+						TTL_IS_EXPIRED(rep->ttl, *worker->env.now)
+						? 0 : rep->ttl - *worker->env.now;
 					lock_rw_unlock(&e->lock);
 
 					reply_and_prefetch(worker, lookup_qinfo,
@@ -2106,10 +2160,37 @@ worker_restart_timer(struct worker* worker)
 {
 	if(worker->env.cfg->stat_interval > 0) {
 		struct timeval tv;
+		if(worker->daemon->stat_time_specific) {
+			struct timeval dest, now;
+			int interval = worker->env.cfg->stat_interval;
+			int offset = worker->daemon->stat_time_offset;
+			int nows, spec;
+			if(gettimeofday(&now, NULL) < 0)
+				log_err("gettimeofday: %s", strerror(errno));
 #ifndef S_SPLINT_S
-		tv.tv_sec = worker->env.cfg->stat_interval;
-		tv.tv_usec = 0;
+			nows = (int)now.tv_sec;
+			/* The next time is on the timer interval, at the
+			 * specific offset, time value % interval = offset. */
+			/* It relies on the integer division below to drop the
+			 * remainder in order to calculate the expected
+			 * result. */
+			spec = ((nows-offset)/interval+1)*interval+offset;
+			/* This is instead of an assertion, and should not
+			 * be needed. So assert(spec > nows), tv is going to
+			 * be positive. */
+			if(spec<=nows) spec += interval;
+			dest.tv_sec = spec;
+			dest.tv_usec = 0;
 #endif
+			/* Subtract in timeval, so the fractions of a second
+			 * are rounded to the whole specific time. */
+			timeval_subtract(&tv, &dest, &now);
+		} else {
+#ifndef S_SPLINT_S
+			tv.tv_sec = worker->env.cfg->stat_interval;
+			tv.tv_usec = 0;
+#endif
+		}
 		comm_timer_set(worker->stat_timer, &tv);
 	}
 }
@@ -2184,9 +2265,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	struct dt_env* dtenv = &worker->dtenv;
 #else
 	void* dtenv = NULL;
-#endif
-#ifdef HAVE_GETTID
-	worker->thread_tid = gettid();
 #endif
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create(do_sigs);

dns64/dns64.c

@@ -366,22 +366,23 @@ static int
 dns64_apply_cfg(struct dns64_env* dns64_env, struct config_file* cfg)
 {
     struct config_strlist* s;
-    verbose(VERB_ALGO, "dns64-prefix: %s", cfg->dns64_prefix);
-    if (!netblockstrtoaddr(cfg->dns64_prefix ? cfg->dns64_prefix :
-                DEFAULT_DNS64_PREFIX, 0, &dns64_env->prefix_addr,
+    const char* dns64_prefix = cfg->dns64_prefix ?
+	cfg->dns64_prefix : DEFAULT_DNS64_PREFIX;
+    verbose(VERB_ALGO, "dns64-prefix: %s", dns64_prefix);
+    if (!netblockstrtoaddr(dns64_prefix, 0, &dns64_env->prefix_addr,
                 &dns64_env->prefix_addrlen, &dns64_env->prefix_net)) {
-        log_err("cannot parse dns64-prefix netblock: %s", cfg->dns64_prefix);
+        log_err("cannot parse dns64-prefix netblock: %s", dns64_prefix);
         return 0;
     }
     if (!addr_is_ip6(&dns64_env->prefix_addr, dns64_env->prefix_addrlen)) {
-        log_err("dns64_prefix is not IPv6: %s", cfg->dns64_prefix);
+        log_err("dns64_prefix is not IPv6: %s", dns64_prefix);
         return 0;
     }
     if (dns64_env->prefix_net != 32 && dns64_env->prefix_net != 40 &&
             dns64_env->prefix_net != 48 && dns64_env->prefix_net != 56 &&
             dns64_env->prefix_net != 64 && dns64_env->prefix_net != 96 ) {
-        log_err("dns64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
-                cfg->dns64_prefix);
+        log_err("dns64-prefix length is not 32, 40, 48, 56, 64 or 96: %s",
+                dns64_prefix);
         return 0;
     }
     for(s = cfg->dns64_ignore_aaaa; s; s = s->next) {
@@ -496,8 +497,8 @@ handle_ipv6_ptr(struct module_qstate* qstate, int id)
 
     /* Create the new sub-query. */
     fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0, 0,
-                &subq))
+    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
+	    qstate->query_flags, 0, 0, &subq))
         return module_error;
     if (subq) {
         subq->curmod = id;
@@ -522,8 +523,8 @@ generate_type_A_query(struct module_qstate* qstate, int id)
 
 	/* Start the sub-query. */
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
-				       0, &subq))
+	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
+		qstate->query_flags, 0, 0, &subq))
 	{
 		verbose(VERB_ALGO, "dns64: sub-query creation failed");
 		return module_error;

dnstap/dtstream.c

@@ -448,6 +448,9 @@ int dt_io_thread_apply_cfg(struct dt_io_thread* dtio, struct config_file *cfg)
 		dtio->tls_use_sni = cfg->tls_use_sni;
 #endif /* HAVE_SSL */
 	}
+#ifdef HAVE_GETTID
+	dtio->thread_tid_log = cfg->log_thread_id;
+#endif
 	return 1;
 }
 
@@ -2130,7 +2133,18 @@ static void* dnstap_io(void* arg)
 	struct dt_io_thread* dtio = (struct dt_io_thread*)arg;
 	time_t secs = 0;
 	struct timeval now;
-	log_thread_set(&dtio->threadnum);
+	const char name[16] = "unbound/dnstap"; /* seems to be the safest size
+						   between different OSes */
+
+#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
+	dtio->thread_tid = gettid();
+	if(dtio->thread_tid_log)
+		log_thread_set(&dtio->thread_tid);
+	else
+#endif
+		log_thread_set(&dtio->threadnum);
+
+	ub_thread_setname(dtio->tid, name);
 
 	/* setup */
 	verbose(VERB_ALGO, "start dnstap io thread");

dnstap/dtstream.h

@@ -131,6 +131,12 @@ struct dt_io_thread {
 	struct dt_io_list_item* io_list_iter;
 	/** thread id, of the io thread */
 	ub_thread_type tid;
+#ifdef HAVE_GETTID
+	/** thread tid, the LWP id */
+	pid_t thread_tid;
+	/** if logging should include the LWP id */
+	int thread_tid_log;
+#endif
 	/** if the io processing has started */
 	int started;
 	/** ssl context for the io thread, for tls connections. type SSL_CTX* */

dnstap/unbound-dnstap-socket.c

@@ -330,7 +330,7 @@ static struct tap_socket* tap_socket_new_tcpaccept(char* ip,
 /** create new socket (unconnected, not base-added), or NULL malloc fail */
 static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	void (*ev_cb)(int, short, void*), void* data, char* server_key,
-	char* server_cert, char* verifypem)
+	char* server_cert, char* verifypem, char* tls_protocols)
 {
 	struct tap_socket* s = calloc(1, sizeof(*s));
 	if(!s) {
@@ -347,7 +347,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	s->ev_cb = ev_cb;
 	s->data = data;
 	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem,
-		NULL, NULL, 0, 0, 0);
+		NULL, NULL, 0, 0, 0, tls_protocols);
 	if(!s->sslctx) {
 		log_err("could not create ssl context");
 		free(s->ip);
@@ -1261,13 +1261,13 @@ static void setup_tcp_list(struct main_tap_data* maindata,
 /** setup tls accept sockets */
 static void setup_tls_list(struct main_tap_data* maindata,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem)
+	char* server_cert, char* verifypem, char* tls_protocols)
 {
 	struct config_strlist* item;
 	for(item = tls_list->first; item; item = item->next) {
 		struct tap_socket* s;
 		s = tap_socket_new_tlsaccept(item->str, &dtio_mainfdcallback,
-			maindata, server_key, server_cert, verifypem);
+			maindata, server_key, server_cert, verifypem, tls_protocols);
 		if(!s) fatal_exit("out of memory");
 		if(!tap_socket_list_insert(&maindata->acceptlist, s))
 			fatal_exit("out of memory");
@@ -1300,7 +1300,7 @@ static void
 setup_and_run(struct config_strlist_head* local_list,
 	struct config_strlist_head* tcp_list,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem)
+	char* server_cert, char* verifypem, char* tls_protocols)
 {
 	time_t secs = 0;
 	struct timeval now;
@@ -1326,7 +1326,7 @@ setup_and_run(struct config_strlist_head* local_list,
 	setup_local_list(maindata, local_list);
 	setup_tcp_list(maindata, tcp_list);
 	setup_tls_list(maindata, tls_list, server_key, server_cert,
-		verifypem);
+		verifypem, tls_protocols);
 	if(!tap_socket_list_addevs(maindata->acceptlist, base))
 		fatal_exit("could not setup accept events");
 	if(verbosity) log_info("start of service");
@@ -1462,6 +1462,8 @@ int main(int argc, char** argv)
 	struct config_strlist_head tcp_list;
 	struct config_strlist_head tls_list;
 	char* server_key = NULL, *server_cert = NULL, *verifypem = NULL;
+
+	char* tls_protocols = "TLSv1.2 TLSv1.3";
 #ifdef USE_WINSOCK
 	WSADATA wsa_data;
 	if(WSAStartup(MAKEWORD(2,2), &wsa_data) != 0) {
@@ -1561,17 +1563,25 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 #endif /* HAVE_SSL */
 	}
 	setup_and_run(&local_list, &tcp_list, &tls_list, server_key,
-		server_cert, verifypem);
+		server_cert, verifypem, tls_protocols);
 	config_delstrlist(local_list.first);
 	config_delstrlist(tcp_list.first);
 	config_delstrlist(tls_list.first);

doc/Changelog

@@ -1,3 +1,487 @@
+23 April 2026: Wouter
+	- Merge #1441: Fix buffer overrun in
+	  doq_repinfo_retrieve_localaddr().
+	- For #1441: Fix type of ipv6 addr struct.
+
+21 April 2026: Wouter
+	- Add test case for malformed SVCB records. Thanks to
+	  Qifan Zhang, Palo Alto Networks for the additional test.
+	- Fix for the Jiggle Attack. The server is fixed to answer
+	  with errors for error cases, and does not stay silent.
+	  In addition, the error replies do not contain parts of the
+	  incoming query. This is more conformant, stops reflection
+	  and stops it as a covert channel. Thanks to Yuqi Qiu and
+	  Xiang Li, Nankai University (AOSP Lab) for the report.
+	  In addition, thanks to Qifan Zhang, Palo Alto Networks, for
+	  noting the fingerprinting possibility, that is also fixed
+	  with this.
+	- Fix EDNS extended RCODE reflection. This fixes that
+	  the server does not echo extended rcode values after class
+	  chaos queries. Thanks to Qifan Zhang, Palo Alto Networks
+	  for the report.
+	- Fix for iterator RCODE handling of YXDOMAIN. This fixes
+	  that the server only accepts YXDOMAIN answers that contain
+	  a DNAME record. This stops bad answers, and checks that
+	  the authoritative server gives correct replies.
+	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
+	- Fix for missing bounds check for decompressing dnames
+	  for downloaded authority zones. This fixes that the server
+	  could end up with malformed zone content after receiving
+	  truncated packet contents from an AXFR. In addition, the
+	  domain names in the SOA rdata are checked before the
+	  authority code picks up the zone serial.
+	  Thanks to Halil Oktay for the report.
+	- Fix that upstream TLS connections are not reused as TLS
+	  connections for a different name, at the same IP. This
+	  checks that the tls name is correct when reusing the
+	  upstream connections. Thanks to TaoFei Guo from Peking
+	  University and JianJun Chen from Tsinghua University for
+	  the report.
+	- Fix that signatures are not allowed with revoked dnskeys.
+	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
+	- Fix that a DNAME with an unsigned CNAME is checked for
+	  the correct match. This stops that for certain zone
+	  configurations an unchecked unsigned CNAME could get
+	  secure status. Thanks to Qifan Zhang, Palo Alto Networks
+	  for the report.
+	- Fix handling of wildcard CNAMEs in the chain of trust.
+	  An improper wildcard in the chain of trust would send
+	  the retries to the wrong upstream. Also it could label
+	  the step in the chain of trust as secure, when it was not.
+	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
+	- Set version number to 1.25.0 of code repository.
+	- Fix doxygen comment syntax.
+
+20 April 2026: Wouter
+	- Fix compile warnings for thread setname routine, and test compile.
+	- Fix unused variable warning when compiled without ssl.
+	- Fix test with https zone for libressl.
+
+17 April 2026: Wouter
+	- Fix setup of ssl context copy of the tls service pem option,
+	  from a clang analyzer warning.
+	- Fix setup of ssl context copy, to check for the tls service
+	  pem option for stat calls.
+	- Fix to compile the shm code when there is no shmget.
+	- Update github ci to use actions/checkout@v6.
+	- Update github ci cross platform to use
+	  cross-platform-actions/action@v1.0.0.
+	- Fix github ci to speed up with parralel build, for windows ci.
+	- Fix compat/chacha_private sigma and tau definitions to use
+	  nonstring attribute.
+	- Fix compat/gmtime_r old style definition syntax.
+	- Fix to increase size of the buffer for the win_svc reportev log
+	  function.
+	- Fix ttl comparisons in rdata_copy for 32bit signed or unsigned.
+	- Fix subnet store of servfail to not leak memory.
+	- Update generated man pages.
+	- Update generated configure, with autoconf.
+	- Fix pthread_setname detection to fail on warnings.
+
+17 April 2026: Yorgos
+	- Merge #1400: Support pthread_setname_np. Adds support for
+	  pthread_setname_np and variants to set the name on spawned threads
+	  for easier debugging/monitoring.
+
+16 April 2026: Yorgos
+	- Merge #1406: Introduce new 'tls-protocols' configuration option.
+	- Introduce new 'tls-protocols' configuration option that specifies
+	  which of the supported TLS protocols will be used.
+	  This change invalidates some previous changes:
+	- TLSv1.2 is again enabled by default, but can be selectively turned
+	  off if desired (related to #1303).
+	- The biefly introduced (not yet released) 'tls-use-system-versions'
+	  configuration option, that addressed #1346, is reverted in favor of
+	  'tls-protocols'.
+	- The briefly introduced (not yet released) '--enable-system-tls'
+	  configure option, related to #1401, is no longer needed with the new
+	  option and the current default.
+	- Fix cleaning up DoH session. The same query can be on multiple
+	  streams in a session.
+
+16 April 2026: Wouter
+	- Fix configure, autoconf for #1406.
+
+15 April 2026: Wouter
+	- Fix RFC7766 compliance when client sends EOF over TCP. It stops
+	  pending replies and closes. Thanks to Yuxiao Wu, Tsinghua
+	  University for the report.
+	- Fix to shorten RRSIG count in scrubber, this protects against
+	  an overly large number of RRSIGs. It can be configured with
+	  `iter-scrub-rrsig: 8`, it has default 8. Thanks to Yuxiao Wu,
+	  Tsinghua University for the report.
+
+14 April 2026: Wouter
+	- Fix #1017: memory corruption related core dumps.
+	  When alloc_reg_obtain has an empty list, return a new allocation.
+	- Fix clang analyzer warning for subnetmod, when return_msg is
+	  NULL for update cache, like when it stores servfail status.
+	- iana portlist updated.
+
+13 April 2026: Yorgos
+	- Update the documentation of 'max-query-restarts' in the man page.
+
+10 April 2026: Wouter
+	- Fix for EDNS client subnet so that it does not store SERVFAIL in
+	  the global cache after a failed lookup, such as timeouts. A failure
+	  entry is stored in the subnet cache, for the query name, for a
+	  couple of seconds. Queries can continue to use the subnet cache
+	  during that time.
+
+7 April 2026: Yorgos
+	- Fix unused variable warning.
+
+30 March 2026: Wouter
+	- Merge #1408: Fix shared memory stats with threads.
+
+27 March 2026: Wouter
+	- Fix to allow the control-interface config to use ip@port notation.
+	- Fix test code to allow empty hex answer packets from testbound.
+	- Fix defense in depth for service callback with empty packet.
+
+24 March 2026: Wouter
+	- Fix to check for invalid http content length and chunk size,
+	  and to check the RR rdata field lengths when decompressing and
+	  inserting RRs from an authority zone transfer. This stops
+	  large memory use and heap buffer-overflow read errors. Thanks
+	  to Haruto Kimura (Stella) for the report.
+
+20 March 2026: Wouter
+	- Fix for testcode pktview to check buffer size and log errors.
+
+13 March 2026: Yorgos
+	- Fix to ignore out-of-zone DNAME records for CNAME synthesis. Thanks
+	  to Yuxiao Wu, Yiyi Wang, Zhang Chao, Baojun Liu, and Haixin Duan from
+	  Tsinghua University.
+
+13 March 2026: Wouter
+	- Fix #278: DoT: complete unbound restart required on certificate
+	  renew. Fix so that a reload checks if the files have changed, and
+	  if so, reload the contexts. Also for DoH, DoQ and outgoing DoT.
+	- iana portlist updated.
+	- For #278: fast_reload can reload tls-service-key, tls-service-pem
+	  and tls-cert-bundle changes. It checks the modification time of
+	  the tls-service-key and tls-service-pem files for update.
+	- Fix detection of http listening port in fast_reload.
+	- Fix to add tls-service-key to memory printout for fast_reload.
+
+9 March 2026: Wouter
+	- Fix compile failure in unbound-checkconf for older gcc compiler.
+	- Merge #1418: Apply cache TTL policy to DNAME and synthesized
+	  CNAME on wire path.
+
+6 March 2026: Wouter
+	- Merge #1415: Add lock unlock for view in memory error handling.
+
+6 March 2026: Yorgos
+	- Document the suggestion for a higher value for 'outgoing-range';
+	  helps when the request list is full.
+	- Warn for unused 'nodefault' local-zone configuration in
+	  unbound-checkconf (related to #1416).
+
+5 March 2026: Wouter
+	- Fix for DNS Rebinding Bypass via SVCB/HTTPS Records in Unbound.
+	  Thanks to Kunta Chu, School of Software, Tsinghua University,
+	  Taofei Guo, Peking University, and Jianjun Chen, Institute for
+	  Network Sciences and Cyberspace, Tsinghua University for the
+	  report. The private-address option is fixed to also elide
+	  SVCB and HTTPS records that match the filter.
+	- Update generated man pages.
+
+4 March 2026: Yorgos
+	- For #1411: Introduce a failing case in the rpl test so that it only
+	  passes with the fix in place.
+
+3 March 2026: Wouter
+	- Merge #1411: Allow synthesized DNAME TTL=0 to be served from cache
+	  within grace period. The responses are served from cache within
+	  a 1-second grace period. Reduces recursion when authoritative
+	  servers return DNAME with TTL=0 (RFC 2308). Response
+	  still returns TTL=0 to clients. Adds a test for it.
+	- For #1411: Fix that the lookup for DNAME uses flag. Fix assertion
+	  in expired calc debug routine.
+
+27 February 2026: Wouter
+	- Merge #1409: Documentation CNAME in redirect-type local-zone.
+	- Update generated man pages.
+
+25 February 2026: Wouter
+	- Fix validator to set unchecked when validation recursion
+	  requests are passed. The edns subnet module checks if validation
+	  is needed for a cache response, and set the validator to protect
+	  the cache with validation for non-subnet lookups.
+
+23 February 2026: Wouter
+	- Fix to have cachedb not return expired bogus data as non-bogus.
+	- Fix to make the cachedb_val_expired.crpl succeed.
+
+23 February 2026: Yorgos
+	- Fix to disallow cache lookup/store in external cachedb when a
+	  forwarder/stub forbids it with the no-cache option.
+	- Fixed some typos reported in #1395 by rezky_nightky.
+
+17 February 2026: Wouter
+	- Fix to remove unused conditional from cookie timestamp at
+	  worker env.
+	- For #1405: local-zone always_refuse also blocks queries of type DS.
+
+16 February 2026: Yorgos
+	- Fix #1404: Priming the root key fails after loading ipfire.org RPZ
+	  zones. Fixed by including the ZONEMD RRtype in the list of types to
+	  ignore for RPZ zones. Analysis and patch provided by ummeegge.
+
+16 February 2026: Wouter
+	- Fix that cachedb aggressive negative responses have the RA flag set.
+
+11 February 2026: Wouter
+	- Fix #1403: Inconsistency between do-nat64 and do-not-query-address
+	  during retries.
+
+9 February 2026: Wouter
+	- Merge #1401: Add a new build-time option for system TLS.
+	  The --enable-system-tls flag enables the
+	  tls-use-system-policy-versions setting by default.
+	- Update generated man pages.
+
+6 February 2026: Yorgos
+	- Fix #1389: [FR] replacement with ECC-GOST12 according to RFC9558.
+	  Patch contributed by Igor V. Ruzanov, available in
+	  contrib/gost12.patch.
+
+4 February 2026: Wouter
+	- Fix local privilege escalation on Windows. Thanks to Hao Huang and
+	  CrisprXiang with Fudan University for the report. The OpenSSL
+	  init calls are set to not load the openssl.cnf file when compiled
+	  for Windows.
+
+3 February 2026: Yorgos
+	- Eagerly remove .skip mark files in between mini_tdir.sh runs in case
+	  there has been a change on the environment.
+
+27 January 2026: Wouter
+	- Add test for allow-notify with a host name.
+
+26 January 2026: Wouter
+	- Fix that allow-notify entries with hostnames are copied after IPv4
+	  and IPv6 lookup.
+	- Fix to not skip allow-notify hostname lookups when there are only
+	  urls.
+
+23 January 2026: Yorgos
+	- Merge #1396: Log Linux thread ID.
+	- On Linux systems log the system-wide unique thread ID instead of
+	  Unbound's internal thread counter.
+	- Introduce the 'log-thread-id' configuration option to manage logging
+	  the system-wide Linux thread ID for easier debugging with system
+	  tools.
+	- Update generated man pages.
+
+22 January 2026: Wouter
+	- Fix that fast reload copies the iter_scrub_ns, iter_scrub_cname
+	  and max_global_quota options.
+	- Fix http test tool petal to not print errors when there is no
+	  error.
+
+21 January 2026: Wouter
+	- Merge #1388: QNX Porting support for unbound.
+
+19 January 2026: Wouter
+	- Merge #1392: Include "V" (version) option in synopsis.
+
+15 January 2026: Wouter
+	- Fix documentation for requestlist.overwritten and
+	  requestlist.exceeded, it explains which query was dropped.
+
+8 January 2026: Wouter
+	- Merge #1381: Do not initialize quic_table unless it is enabled.
+
+6 January 2026: Wouter
+	- Fix edns subnet, that scope zero queries, when there is a
+	  subquery without subnet, and the forward-no-cache or
+	  stub-no-cache option is set, it is not stored in cache due to
+	  the forward or stub option.
+
+6 January 2026: Yorgos
+	- Merge #1391 from Götz Görisch: Fix documentation to adhere to
+	  RFC5952.
+
+31 December 2025: Yorgos
+	- Update the unbound-anchor man page to note write permissions of the
+	  generated file if it is to be used with Unbound's
+	  auto-trust-anchor-file option.
+	- Use the same EDE removal logic when encoding errors as when encoding
+	  replies.
+
+30 December 2025: Yorgos
+	- Mark "THROWAWAY" and "(DNSSEC) LAME" responses clearly as Unbound's
+	  categorization in the log output.
+
+24 December 2025: Yorgos
+	- More specific wording in the unbound.conf man page for stub-first
+	  and forward-first options.
+
+3 December 2025: Wouter
+	- Fix http2 drop handling to clear the postpone_drop state so that
+	  other streams on the http2 session are not affected by a drop,
+	  and can clean up properly if also dropped. Fix http2 send reply
+	  so that when there is a send failure is does not recurse into
+	  the mesh functions and also does not drop the connection due to
+	  the condition of one stream.
+
+2 December 2025: Wouter
+	- Fix to remove http2 stream mesh state when mesh new request is
+	  dropping the new request.
+
+1 December 2025: Wouter
+	- Fix to add EDNS CO flag to testbound and debug message log.
+	- Fix header comment about EDE reference in validator/val_sigcrypt.h.
+
+28 November 2025: Yorgos
+	- For #1375, there is no DNSTAP environment if it wasn't configured.
+
+26 November 2025: Yorgos
+	- Tag for 1.24.2 release.
+	  The repository continues with version 1.24.3.
+
+13 November 2025: Wouter
+	- Merge #1374: Mesh reply counters.
+	  This adds the statistics num.queries.replyaddr_limit and
+	  requestlist.current.replies.
+	- Merge #1375: Copy DNSTAP changes from daemon to workers after
+	  fast_reload.
+
+12 November 2025: Wouter
+	- Fix that when discard timeout drops packet, they are accounted as
+	  less reply addresses in use in the mesh area.
+	- iana portlist updated.
+
+6 November 2025: Wouter
+	- Fix add comment to worker_handle_request function that explain it.
+	- Fix configure test for noreturn attribute so it compiles without
+	  warning.
+	- Fix configure test for nonstring attribute so that it does not
+	  accept when the compiler prints a warning about an unknown
+	  attribute.
+
+4 November 2025: Wouter
+	- Fix dns64 log output to log the default instead of a null string.
+
+1 November 2025: Yorgos
+	- Fix #1366: Infra cache does not work correctly for NAT64, by
+	  moving the NAT64 synthesis from the iterator when selecting a target
+	  address, to the delegation point itself when adding target
+	  addresses.
+
+27 October 2025: Yorgos
+	- Merge #1331 from Jitka Plesníková: Replace deprecated $function by
+	  new $action, for SWIG.
+	- Fix #1165, document the possible circular dependency when using
+	  host names instead of IP addresses for name servers in stub/forward
+	  zones and log a warning when spotted in the configuration.
+
+24 October 2025: Yorgos
+	- unbound.conf man page updates to include a preview of the section
+	  clauses and some reformatting around the use of "clause", "option"
+	  and "attributes". Based on Havard Eidnes' suggestions on the
+	  mailing list.
+	- Fix unused attribute warning in redis.c when threads are not
+	  supported.
+	- For #1364, use OPENSSL_VERSION_TEXT instead of OPENSSL_VERSION_NUMBER
+	  for part of the configure script. OPENSSL_VERSION_TEXT is more
+	  consistent across versions.
+
+22 October 2025: Yorgos
+	- Tag for 1.24.1 release.
+	  The repository continues with version 1.24.2.
+
+15 October 2025: Wouter
+	- Fix to drop UDP for discard-timeout, but not stream connections.
+	- Fix to reply with SERVFAIL when the wait-limit is exceeded.
+	- Add extended dns error code for invalid query type to definition
+	  list.
+	- Fix unbound.conf man page entry for root-hints to say it can
+	  be used without strongly recommending it.
+	- Remove iPhone armv7s, and iPhoneSimulator i386 from ios ci.
+	  The lib system does not provide symbols for it on the new macos
+	  runner.
+	- Fix to exclude libssp for windows compiles.
+
+10 October 2025: Wouter
+	- Fix #1358 Enabling FIPS in OpenSSL causes unit test to fail.
+
+3 October 2025: Yorgos
+	- Note 'respip' and 'dns64' module order in the unbound.conf
+	  man page.
+	- Note clearly that 'wait-limit: 0' disables all wait limits.
+	- 'wait-limit-cookie: 0' can now disable cookie validated wait
+	  limits.
+
+2 October 2025: Wouter
+	- Fix that https is set up as enabled when the port is listed in
+	  interface-automatic-ports. Also for the set up of quic it is
+	  enabled when listed there.
+
+30 September 2025: Wouter
+	- Fix for #1344: Fix that respip and dns64 can be enabled at the
+	  same time, the client info is copied for attach_sub and add_sub
+	  calls. That makes respip work on dns64 synthesized answers, and
+	  also makes RPZ work with DNS64. The order for the modules is
+	  module-config: "respip dns64 validator iterator".
+
+29 September 2025: Wouter
+	- Rebuild configure script from its sources.
+	- Fix modstack_call_init to use the original string when it has
+	  changed, to call modstack_config with. And skip the changed name
+	  in the string correctly. Thanks to Jan Komissar.
+	- Neaten up the change in acx_nlnetlabs.m4 to version 49.
+	- Fix fr_atomic_copy_cfg.
+	- Rebuild configure script from its sources.
+	- Fix #1353: auth-zone can not use empty label for $ORIGIN when
+	  http download.
+	- Fix #1344: module conf 'respip dns64 validator cachedb iterator'
+	  is not known to work.
+
+29 September 2025: Yorgos
+	- Merge #1349: Fix #1346: [FR] Please allow back TLS 1.2.
+	- Merge #1351: ac_cv_func_malloc_0_nonnull for malloc(0) check.
+
+26 September 2025: Yorgos
+	- Test for nonstring attribute in configure and add
+	  nonstring attribute annotations.
+
+24 September 2025: Yorgos
+	- Avoid calling mesh_detect_cycle_found() when there is no mesh state
+	  to begin with.
+
+23 September 2025: Yorgos
+	- Merge #1352 from Petr Vaganov: pythonmod: fix HANDLE_LEAK on
+	  pythonmod_init.
+	- For #1352, align with the current Python<3 code.
+	- Merge #1350 from Maryse47: unbound.service.in: allow CAP_NET_ADMIN.
+	- For #1350, same CAP_NET_ADMIN change for unbound_portable.service.in
+	  as well.
+
+19 September 2025: Wouter
+	- Fix to remove configure~ from release tarballs.
+
+19 September 2025: Yorgos
+	- Update README.man with clearer text.
+	- Merge #1337: 0 TTL cached replies and some TTL behavior changes.
+	- TTL change: Cached records that reach TTL 0 are expired.
+	- TTL change: TTL 0 upstream answers are no longer cached by
+	   cachedb, as they should.
+	- TTL change: 'serve-expired-reply-ttl' is now capped by the original
+	  TTL value of the record to try and make some sense when replying
+	  with expired records.
+	- TTL change: TTL decoding was updated to adhere to RFC8767 section 4
+	  where a 'set high-order bit' means the value is positive instead of
+	  0.
+	- unbound.conf manpage: explicitly mention RFC6891.
+
+18 September 2025: Wouter
+	- Tag for 1.24.0 release. Includes the fixes below after rc1.
+	  The repository continues with version 1.24.1.
+
 17 September 2025: Yorgos
 	- Too many quotes for the EDE message debug printout.
 

doc/README

@@ -1,4 +1,4 @@
-README for Unbound 1.24.2
+README for Unbound 1.25.0
 Copyright 2007 NLnet Labs
 http://unbound.net
 

doc/README.DNS64

@@ -13,7 +13,7 @@ If you're not using DNSSEC then you may remove "validator".
 
 2. The "dns64-prefix" directive indicates your DNS64 prefix. For example:
 
-    dns64-prefix: 64:FF9B::/96
+    dns64-prefix: 64:ff9b::/96
 
 The prefix must be a /96 or shorter.
 
@@ -42,9 +42,9 @@ To enable NAT64 in Unbound, add to unbound.conf's "server" section:
     do-nat64: yes
 
 The NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the
-standard 64:FF9B::/96 prefix.  You can reconfigure it with:
+standard 64:ff9b::/96 prefix.  You can reconfigure it with:
 
-    nat64-prefix: 64:FF9B::/96
+    nat64-prefix: 64:ff9b::/96
 
 To test NAT64 operation, pick a domain that only has IPv4 reachability for its
 nameservers and try resolving any names in that domain.

doc/README.man

@@ -6,11 +6,16 @@ and makes it easier to maintain and contribute to the documentation.
 The templated man pages (*.in) are still part of the code repository as to not
 alter current procedures that could be in place by users/packagers.
 
+These man pages (*.in) are still the ones being used when
+configuring/installing Unbound.
+Packagers/users do not have to generate any man pages themselves, this is done
+by the core developers during development and upon releasing new versions.
+
 The templated man pages (*.in) are generated by Sphinx (used for the online
 documentation).
 The online documentation has its own repository at
 https://github.com/NLnetLabs/unbound-manual.
 
-In the README.md there (branch test-auto for now), there are further simple
-instructions on how to generate the templated man pages there and update them
-in this repository.
+In that README.md (https://github.com/NLnetLabs/unbound-manual/README.md)
+there are further simple instructions on how to generate the templated man
+pages there and update them in this repository.

doc/example.conf.in

@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.24.2.
+# See unbound.conf(5) man page, version 1.25.0.
 #
 # this is a comment.
 
@@ -54,7 +54,7 @@ server:
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
 	# interface: 192.0.2.154@5003
-	# interface: 2001:DB8::5
+	# interface: 2001:db8::5
 	# interface: eth0@5003
 
 	# enable this feature to copy the source address of queries to reply.
@@ -72,12 +72,12 @@ server:
 	# server from by ip-address. If none, the default (all) interface
 	# is used. Specify every interface on a 'outgoing-interface:' line.
 	# outgoing-interface: 192.0.2.153
-	# outgoing-interface: 2001:DB8::5
-	# outgoing-interface: 2001:DB8::6
+	# outgoing-interface: 2001:db8::5
+	# outgoing-interface: 2001:db8::6
 
 	# Specify a netblock to use remainder 64 bits as random bits for
 	# upstream queries.  Uses freebind option (Linux).
-	# outgoing-interface: 2001:DB8::/64
+	# outgoing-interface: 2001:db8::/64
 	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
 	# And: ip -6 route add local 2001:db8::/64 dev lo
 	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
@@ -193,6 +193,9 @@ server:
 	# Limit on number of CNAME, DNAME records for incoming packets.
 	# iter-scrub-cname: 11
 
+	# Limit on number of RRSIGs for an RRset for incoming packets.
+	# iter-scrub-rrsig: 8
+
 	# Limit on upstream queries for an incoming query and its recursion.
 	# max-global-quota: 200
 
@@ -379,7 +382,7 @@ server:
 	# interface-action: 192.0.2.153 allow
 	# interface-action: 192.0.2.154 allow
 	# interface-action: 192.0.2.154@5003 allow
-	# interface-action: 2001:DB8::5 allow
+	# interface-action: 2001:db8::5 allow
 	# interface-action: eth0@5003 allow
 
 	# Similar to 'access-control-tag:' but for interfaces.
@@ -496,6 +499,10 @@ server:
 	# print log lines that say why queries return SERVFAIL to clients.
 	# log-servfail: no
 
+	# log system-wide Linux thread ID, insted of Unbound's internal thread
+	# counter. Only on Linux and only when threads are available.
+	# log-thread-id: no
+
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"
 
@@ -658,7 +665,7 @@ server:
 	# or, just before the iterator).
 	# module-config: "validator iterator"
 
-	# File with trusted keys, kept uptodate using RFC5011 probes,
+	# File with trusted keys, kept up-to-date using RFC5011 probes,
 	# initial file like trust-anchor-file, then it stores metadata.
 	# Use several entries, one per domain name, to track multiple zones.
 	#
@@ -718,7 +725,7 @@ server:
 	# val-max-restart: 5
 
 	# Should additional section of secure message also be kept clean of
-	# unsecure data. Useful to shield the users of this validator from
+	# non-secure data. Useful to shield the users of this validator from
 	# potential bogus data in the additional section. All unsigned data
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
@@ -756,6 +763,7 @@ server:
 	# serve-expired-ttl-reset: no
 	#
 	# TTL value to use when replying with expired data.
+	# Capped by the original TTL of the record.
 	# serve-expired-reply-ttl: 30
 	#
 	# Time in milliseconds before replying to the client with expired data.
@@ -925,6 +933,22 @@ server:
 	# add a netblock specific override to a localzone, with zone type
 	# local-zone-override: "example.com" 192.0.2.0/24 refuse
 
+	# Action to apply when the IP address in an AAAA or A RR in the answer
+	# section of a response matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip: 192.0.2.0/24 redirect
+
+	# Redirect as specified by the "resource record string" when the IP
+	# address in an AAAA or A RR in the answer section of a response
+	# matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
+
+	# Apply tag(s) when the IP address in an AAAA or A RR in the answer
+	# section of a response matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip-tag: 192.0.2.0/24 "tag1 tag2"
+
 	# service clients over TLS (on the TCP sockets) with plain DNS inside
 	# the TLS stream, and over HTTPS using HTTP/2 as specified in RFC8484.
 	# Give the certificate to use and private key.
@@ -935,21 +959,22 @@ server:
 	# https-port: 443
 	# quic-port: 853
 
+	# Also serve tls on these port numbers (eg. 443, ...), by listing
+	# tls-additional-port: portno for each of the port numbers.
+
 	# cipher setting for TLSv1.2
 	# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
 	# cipher setting for TLSv1.3
 	# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
 
-	# Pad responses to padded queries received over TLS
-	# pad-responses: yes
-
-	# Padded responses will be padded to the closest multiple of this size.
-	# pad-responses-block-size: 468
-
 	# Use the SNI extension for TLS connections.  Default is yes.
-	# Changing the value requires a reload.
+	# Changing the value requires a restart.
 	# tls-use-sni: yes
 
+	# TLS protocols.
+	# Changing the value requires a restart.
+	# tls-protocols: "TLSv1.2 TLSv1.3"
+
 	# Add the secret file for TLS Session Ticket.
 	# Secret file must be 80 bytes of random data.
 	# First key use to encrypt and decrypt TLS session tickets.
@@ -970,15 +995,18 @@ server:
 	# and on other systems, the default openssl certificates
 	# tls-system-cert: no
 
+	# Pad responses to padded queries received over TLS
+	# pad-responses: yes
+
+	# Padded responses will be padded to the closest multiple of this size.
+	# pad-responses-block-size: 468
+
 	# Pad queries over TLS upstreams
 	# pad-queries: yes
 
 	# Padded queries will be padded to the closest multiple of this size.
 	# pad-queries-block-size: 128
 
-	# Also serve tls on these port numbers (eg. 443, ...), by listing
-	# tls-additional-port: portno for each of the port numbers.
-
 	# HTTP endpoint to provide DNS-over-HTTPS service on.
 	# http-endpoint: "/dns-query"
 
@@ -1261,10 +1289,11 @@ remote-control:
 #	zonefile: "example.org.zone"
 
 # Views
-# Create named views. Name must be unique. Map views to requests using
-# the access-control-view option. Views can contain zero or more local-zone
-# and local-data options. Options from matching views will override global
-# options. Global options will be used if no matching view is found.
+# Create named views. Name must be unique.
+# Map views to requests using the access-control-view/interface-view options.
+# Views can contain zero or more local-zone and local-data options.
+# Options from matching views will override global options.
+# Global options will be used if no matching view is found.
 # With view-first yes, it will try to answer using the global local-zone and
 # local-data elements if there is no view specific match.
 # view:
@@ -1272,6 +1301,8 @@ remote-control:
 #	local-zone: "example.com" redirect
 #	local-data: "example.com A 192.0.2.3"
 #	local-data-ptr: "192.0.2.3 www.example.com"
+#	response-ip: 192.0.2.0/24 redirect
+#	response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
 #	view-first: no
 # view:
 #	name: "anotherview"

doc/libunbound.3.in

@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "LIBUNBOUND" "3" "Nov 26, 2025" "1.24.2" "Unbound"
+.TH "LIBUNBOUND" "3" "Apr 29, 2026" "1.25.0" "Unbound"
 .SH NAME
-libunbound \- Unbound DNS validating resolver 1.24.2 functions.
+libunbound \- Unbound DNS validating resolver 1.25.0 functions.
 .SH SYNOPSIS
 .sp
 \fB#include <unbound.h>\fP
@@ -416,6 +416,6 @@ on a function return with file read failure.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2025, NLnet Labs
+1999-2026, NLnet Labs
 .\" Generated by docutils manpage writer.
 .

doc/unbound-anchor.8.in

@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "UNBOUND-ANCHOR" "8" "Nov 26, 2025" "1.24.2" "Unbound"
+.TH "UNBOUND-ANCHOR" "8" "Apr 29, 2026" "1.25.0" "Unbound"
 .SH NAME
-unbound-anchor \- Unbound 1.24.2 anchor utility.
+unbound-anchor \- Unbound 1.25.0 anchor utility.
 .SH SYNOPSIS
 .sp
 \fBunbound\-anchor\fP [\fBopts\fP]
@@ -39,9 +39,17 @@ unbound-anchor \- Unbound 1.24.2 anchor utility.
 validation.
 The program fetches the trust anchor with the method from \fI\%RFC 7958\fP when
 regular \fI\%RFC 5011\fP update fails to bring it up to date.
-It can be run (as root) from the commandline, or run as part of startup
-scripts.
-Before you start the \fI\%unbound(8)\fP DNS server.
+It can be run from the commandline, or run as part of startup scripts before
+you start the \fI\%unbound(8)\fP DNS server.
+.sp
+Note that if you want to use \fI\%RFC 5011\fP with Unbound (i.e., the
+\fI\%auto\-trust\-anchor\-file\fP option) so
+that trust anchor information is automatically tracked by Unbound during
+operation, the user that Unbound runs under (by default \(aqunbound\(aq) must have
+write permissions to the file and the directory the file lives in (for creating
+temporary files).
+In this case you would probably want to run this program as the designated
+Unbound user.
 .sp
 Suggested usage:
 .INDENT 0.0
@@ -52,6 +60,7 @@ Suggested usage:
 # in the init scripts.
 # provide or update the root anchor (if necessary)
 unbound\-anchor \-a \(dq@UNBOUND_ROOTKEY_FILE@\(dq
+
 # Please note usage of this root anchor is at your own risk
 # and under the terms of our LICENSE (see source).
 #
@@ -295,6 +304,6 @@ Signature on the root key information.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2025, NLnet Labs
+1999-2026, NLnet Labs
 .\" Generated by docutils manpage writer.
 .

doc/unbound-anchor.rst

@@ -51,9 +51,17 @@ Description
 validation.
 The program fetches the trust anchor with the method from :rfc:`7958` when
 regular :rfc:`5011` update fails to bring it up to date.
-It can be run (as root) from the commandline, or run as part of startup
-scripts.
-Before you start the :doc:`unbound(8)</manpages/unbound>` DNS server.
+It can be run from the commandline, or run as part of startup scripts before
+you start the :doc:`unbound(8)</manpages/unbound>` DNS server.
+
+Note that if you want to use :rfc:`5011` with Unbound (i.e., the
+:ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>` option) so
+that trust anchor information is automatically tracked by Unbound during
+operation, the user that Unbound runs under (by default 'unbound') must have
+write permissions to the file and the directory the file lives in (for creating
+temporary files).
+In this case you would probably want to run this program as the designated
+Unbound user.
 
 Suggested usage:
 
@@ -62,6 +70,7 @@ Suggested usage:
    # in the init scripts.
    # provide or update the root anchor (if necessary)
    unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
+
    # Please note usage of this root anchor is at your own risk
    # and under the terms of our LICENSE (see source).
    #

doc/unbound-checkconf.8.in

@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "UNBOUND-CHECKCONF" "8" "Nov 26, 2025" "1.24.2" "Unbound"
+.TH "UNBOUND-CHECKCONF" "8" "Apr 29, 2026" "1.25.0" "Unbound"
 .SH NAME
-unbound-checkconf \- Check Unbound 1.24.2 configuration file for errors.
+unbound-checkconf \- Check Unbound 1.25.0 configuration file for errors.
 .SH SYNOPSIS
 .sp
 \fBunbound\-checkconf\fP [\fB\-hf\fP] [\fB\-o option\fP] [cfgfile]
@@ -88,6 +88,6 @@ Unbound configuration file.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2025, NLnet Labs
+1999-2026, NLnet Labs
 .\" Generated by docutils manpage writer.
 .

doc/unbound-control.8.in

@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "UNBOUND-CONTROL" "8" "Nov 26, 2025" "1.24.2" "Unbound"
+.TH "UNBOUND-CONTROL" "8" "Apr 29, 2026" "1.25.0" "Unbound"
 .SH NAME
-unbound-control \- Unbound 1.24.2 remote server control utility.
+unbound-control \- Unbound 1.25.0 remote server control utility.
 .SH SYNOPSIS
 .sp
 \fBunbound\-control\fP [\fB\-hq\fP] [\fB\-c cfgfile\fP] [\fB\-s server\fP] command
@@ -168,6 +168,8 @@ ipset,
 \fI\%tcp\-auth\-query\-timeout\fP,
 \fI\%delay\-close\fP\&.
 \fI\%iter\-scrub\-promiscuous\fP\&.
+\fI\%tls\-service\-key\fP\&.
+\fI\%tls\-service\-pem\fP\&.
 .sp
 It does not work with
 \fI\%interface\fP and
@@ -880,6 +882,11 @@ number of queries removed due to discard\-timeout by thread
 .UNINDENT
 .INDENT 0.0
 .TP
+.B threadX.num.queries_replyaddr_limit 
+number of queries removed due to replyaddr limits by thread
+.UNINDENT
+.INDENT 0.0
+.TP
 .B threadX.num.queries_wait_limit 
 number of queries removed due to wait\-limit by thread
 .UNINDENT
@@ -973,6 +980,10 @@ Number of requests in the request list that were overwritten by newer
 entries.
 This happens if there is a flood of queries that recursive processing and
 the server has a hard time.
+The counter is increased when during the flood the
+\fI\%jostle\-timeout\fP
+allows a query to be removed in favor of a new incoming query.
+The older query is then dropped to make space.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -980,6 +991,12 @@ the server has a hard time.
 Queries that were dropped because the request list was full.
 This happens if a flood of queries need recursive processing, and the
 server can not keep up.
+The counter is increased when during the flood there is no space
+to be made with the jostle out of an older query, and the new query
+is dropped.
+Since no older queries are removed, see
+\fI\%jostle\-timeout\fP setting, there
+is no space for the new query.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -994,6 +1011,13 @@ Current size of the request list, only the requests from client queries.
 .UNINDENT
 .INDENT 0.0
 .TP
+.B threadX.requestlist.current.replies 
+Current count of the number of reply entries waiting on request list
+entries. Because a request list entry can send results to multiple reply
+addresses, this number may be larger than the size of the request list.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B threadX.recursion.time.avg 
 Average time it took to answer queries that needed recursive processing.
 Note that queries that were answered from the cache are not in this average.
@@ -1048,6 +1072,11 @@ summed over threads.
 .UNINDENT
 .INDENT 0.0
 .TP
+.B total.num.queries_replyaddr_limit 
+summed over threads.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B total.num.queries_wait_limit 
 summed over threads.
 .UNINDENT
@@ -1138,6 +1167,16 @@ summed over threads.
 .UNINDENT
 .INDENT 0.0
 .TP
+.B total.requestlist.current.user 
+summed over threads.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B total.requestlist.current.replies 
+summed over threads.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B total.recursion.time.median 
 averaged over threads.
 .UNINDENT
@@ -1543,6 +1582,6 @@ directory with private keys (\fBunbound_server.key\fP and
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2025, NLnet Labs
+1999-2026, NLnet Labs
 .\" Generated by docutils manpage writer.
 .

doc/unbound-control.rst

@@ -170,6 +170,8 @@ There are several commands that the server understands.
     :ref:`tcp-auth-query-timeout<unbound.conf.tcp-auth-query-timeout>`,
     :ref:`delay-close<unbound.conf.delay-close>`.
     :ref:`iter-scrub-promiscuous<unbound.conf.iter-scrub-promiscuous>`.
+    :ref:`tls-service-key<unbound.conf.tls-service-key>`.
+    :ref:`tls-service-pem<unbound.conf.tls-service-pem>`.
 
     It does not work with
     :ref:`interface<unbound.conf.interface>` and
@@ -815,6 +817,10 @@ number of statistic counters:
     number of queries removed due to discard-timeout by thread
 
 
+@@UAHL@unbound-control.stats@threadX.num.queries_replyaddr_limit@@
+    number of queries removed due to replyaddr limits by thread
+
+
 @@UAHL@unbound-control.stats@threadX.num.queries_wait_limit@@
     number of queries removed due to wait-limit by thread
 
@@ -893,12 +899,22 @@ number of statistic counters:
     entries.
     This happens if there is a flood of queries that recursive processing and
     the server has a hard time.
+    The counter is increased when during the flood the
+    :ref:`jostle-timeout<unbound.conf.jostle-timeout>`
+    allows a query to be removed in favor of a new incoming query.
+    The older query is then dropped to make space.
 
 
 @@UAHL@unbound-control.stats@threadX.requestlist.exceeded@@
     Queries that were dropped because the request list was full.
     This happens if a flood of queries need recursive processing, and the
     server can not keep up.
+    The counter is increased when during the flood there is no space
+    to be made with the jostle out of an older query, and the new query
+    is dropped.
+    Since no older queries are removed, see
+    :ref:`jostle-timeout<unbound.conf.jostle-timeout>` setting, there
+    is no space for the new query.
 
 
 @@UAHL@unbound-control.stats@threadX.requestlist.current.all@@
@@ -910,6 +926,12 @@ number of statistic counters:
     Current size of the request list, only the requests from client queries.
 
 
+@@UAHL@unbound-control.stats@threadX.requestlist.current.replies@@
+    Current count of the number of reply entries waiting on request list
+    entries. Because a request list entry can send results to multiple reply
+    addresses, this number may be larger than the size of the request list.
+
+
 @@UAHL@unbound-control.stats@threadX.recursion.time.avg@@
     Average time it took to answer queries that needed recursive processing.
     Note that queries that were answered from the cache are not in this average.
@@ -955,6 +977,10 @@ number of statistic counters:
     summed over threads.
 
 
+@@UAHL@unbound-control.stats@total.num.queries_replyaddr_limit@@
+    summed over threads.
+
+
 @@UAHL@unbound-control.stats@total.num.queries_wait_limit@@
     summed over threads.
 
@@ -1027,6 +1053,14 @@ number of statistic counters:
     summed over threads.
 
 
+@@UAHL@unbound-control.stats@total.requestlist.current.user@@
+    summed over threads.
+
+
+@@UAHL@unbound-control.stats@total.requestlist.current.replies@@
+    summed over threads.
+
+
 @@UAHL@unbound-control.stats@total.recursion.time.median@@
     averaged over threads.
 

doc/unbound-host.1.in

@@ -27,9 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "UNBOUND-HOST" "1" "Nov 26, 2025" "1.24.2" "Unbound"
+.TH "UNBOUND-HOST" "1" "Apr 29, 2026" "1.25.0" "Unbound"
 .SH NAME
-unbound-host \- Unbound 1.24.2 DNS lookup utility.
+unbound-host \- Unbound 1.25.0 DNS lookup utility.
 .SH SYNOPSIS
 .sp
 \fBunbound\-host\fP [\fB\-C configfile\fP] [\fB\-vdhr46D\fP] [\fB\-c class\fP]
@@ -185,6 +185,6 @@ encountered a fatal error.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2025, NLnet Labs
+1999-2026, NLnet Labs
 .\" Generated by docutils manpage writer.
 .

doc/unbound.8.in

@@ -27,12 +27,12 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "UNBOUND" "8" "Nov 26, 2025" "1.24.2" "Unbound"
+.TH "UNBOUND" "8" "Apr 29, 2026" "1.25.0" "Unbound"
 .SH NAME
-unbound \- Unbound DNS validating resolver 1.24.2.
+unbound \- Unbound DNS validating resolver 1.25.0.
 .SH SYNOPSIS
 .sp
-\fBunbound\fP [\fB\-hdpv\fP] [\fB\-c <cfgfile>\fP]
+\fBunbound\fP [\fB\-hdpVv\fP] [\fB\-c <cfgfile>\fP]
 .SH DESCRIPTION
 .sp
 \fBunbound\fP is a caching DNS resolver.
@@ -118,6 +118,6 @@ Show the version number and build options, and exit.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2025, NLnet Labs
+1999-2026, NLnet Labs
 .\" Generated by docutils manpage writer.
 .

doc/unbound.conf.rst

@@ -46,34 +46,41 @@ Description
 -----------
 
 **unbound.conf** is used to configure :doc:`unbound(8)</manpages/unbound>`.
-The file format has attributes and values.
-Some attributes have attributes inside them.
-The notation is: ``attribute: value``.
-
-Comments start with ``#`` and last to the end of line.
-Empty lines are ignored as is whitespace at the beginning of a line.
 
 The utility :doc:`unbound-checkconf(8)</manpages/unbound-checkconf>` can be
 used to check ``unbound.conf`` prior to usage.
 
+File Format
+-----------
+
+Whitespace is used to separate keywords.
+Whitespace indentation is insignificant, but is still recommended for visual
+clarity.
+Comments start with ``#`` and last to the end of line.
+Empty lines are ignored, as is whitespace at the beginning of a line.
+
+Attribute keywords end with a colon (``:``) and they are either options or
+section clauses (group options together).
+
+The configuration file is logically divided into **sections** where each section
+is introduced by a :ref:`section clause<unbound.conf.clauses>`.
+
 Example
 -------
 
-An example config file is shown below.
-Copy this to :file:`/etc/unbound/unbound.conf` and start the server with:
+An example minimal config file is shown below; most settings are the defaults.
+Copy this to ``@ub_conf_file@`` and start the server with:
 
 .. code-block:: text
 
-    $ unbound -c /etc/unbound/unbound.conf
+    $ unbound -c @ub_conf_file@
 
-Most settings are the defaults.
 Stop the server with:
 
 .. code-block:: text
 
-    $ kill `cat /etc/unbound/unbound.pid`
+    $ kill `cat @UNBOUND_PIDFILE@`
 
-Below is a minimal config file.
 The source distribution contains an extensive :file:`example.conf` file with
 all the options.
 
@@ -81,35 +88,87 @@ all the options.
 
     # unbound.conf(5) config file for unbound(8).
     server:
-        directory: "/etc/unbound"
+        directory: "@UNBOUND_RUN_DIR@"
         username: unbound
         # make sure unbound can access entropy from inside the chroot.
         # e.g. on linux the use these commands (on BSD, devfs(8) is used):
-        #      mount --bind -n /dev/urandom /etc/unbound/dev/urandom
-        # and  mount --bind -n /dev/log /etc/unbound/dev/log
-        chroot: "/etc/unbound"
-        # logfile: "/etc/unbound/unbound.log"  #uncomment to use logfile.
-        pidfile: "/etc/unbound/unbound.pid"
+        #      mount --bind -n /dev/urandom @UNBOUND_RUN_DIR@/dev/urandom
+        # and  mount --bind -n /dev/log @UNBOUND_RUN_DIR@/dev/log
+        chroot: "@UNBOUND_CHROOT_DIR@"
+        # logfile: "@UNBOUND_RUN_DIR@/unbound.log"  #uncomment to use logfile.
+        pidfile: "@UNBOUND_PIDFILE@"
         # verbosity: 1      # uncomment and increase to get more logging.
         # listen on all interfaces, answer queries from the local subnet.
         interface: 0.0.0.0
         interface: ::0
         access-control: 10.0.0.0/8 allow
-        access-control: 2001:DB8::/64 allow
+        access-control: 2001:db8::/64 allow
 
-File Format
------------
+.. _unbound.conf.clauses:
 
-There must be whitespace between keywords.
-Attribute keywords end with a colon ``':'``.
-An attribute is followed by a value, or its containing attributes in which case
-it is referred to as a clause.
-Clauses can be repeated throughout the file (or included files) to group
-attributes under the same clause.
+Section Clauses
+---------------
+
+The recognized section clauses are:
+
+    :ref:`server:<unbound.conf.server>`
+        Most of the configuration is found in this section.
+
+    :ref:`remote-control:<unbound.conf.remote>`
+        Configuration for the facility used by
+        :doc:`unbound-control(8)</manpages/unbound-control>`.
+
+    :ref:`stub-zone:<unbound.conf.stub>`
+        Configuration for a zone that redirects to specific authoritative name
+        servers, e.g. for zones not generally available on the greater
+        Internet.
+
+    :ref:`forward-zone:<unbound.conf.forward>`
+        Configuration for a zone that forwards to specific DNS resolvers.
+
+    :ref:`auth-zone:<unbound.conf.auth>`
+        Configuration for local authoritative zones.
+
+    :ref:`view:<unbound.conf.view>`
+        Overriding a small subset of configuration for incoming requests.
+        Requests are mapped to views with
+        :ref:`access-control-view<unbound.conf.access-control-view>` and
+        :ref:`interface-view<unbound.conf.interface-view>`.
+
+    :ref:`python:<unbound.conf.python>`
+        Configuration for the optional ``python`` script module.
+
+    :ref:`dynlib:<unbound.conf.dynlib>`
+        Configuration for the optional ``dynlib`` module that loads dynamic
+        libraries into Unbound.
+
+    :ref:`dnscrypt:<unbound.conf.dnscrypt>`
+        Configuration for the optional DNSCrypt feature.
+
+    :ref:`cachedb:<unbound.conf.cachedb>`
+        Configuration for the optional ``cachedb`` module that can interface
+        with second level caches, currently Redis or Redis-complatible
+        databases.
+
+    :ref:`dnstap:<unbound.conf.dnstap>`
+        Configuration of the optional dnstap logging feature; a flexible,
+        structured binary log format for DNS software.
+
+    :ref:`rpz:<unbound.conf.rpz>`
+        Configuration for Response Policy Zones that allows for DNS filtering.
+        Requires the ``respip`` module.
+
+Section clauses can be repeated throughout the file (or included files) to
+logically group options in one visually cohesive group.
+This may be particularly useful for the ``server:`` clause with its myriad of
+options.
 
 .. _unbound.conf.include:
 
-Files can be included using the **include:** directive.
+Including Files
+---------------
+
+Files can be included using the ``include:`` directive.
 It can appear anywhere, it accepts a single file name as argument.
 Processing continues as if the text from the included file was copied into the
 config file at that point.
@@ -122,17 +181,17 @@ Wildcards can be used to include multiple files, see *glob(7)*.
 
 .. _unbound.conf.include-toplevel:
 
-For a more structural include option, the **include-toplevel:** directive can
+For a more structural include option, the ``include-toplevel:`` directive can
 be used.
-This closes whatever clause is currently active (if any) and forces the use of
-clauses in the included files and right after this directive.
+This closes whatever section clause is currently active (if any) and forces the
+use of section clauses in the included files and right after this directive.
 
 .. _unbound.conf.server:
 
 Server Options
-^^^^^^^^^^^^^^
+--------------
 
-These options are part of the **server:** clause.
+These options are part of the ``server:`` section.
 
 
 @@UAHL@unbound.conf@verbosity@@: *<number>*
@@ -307,6 +366,10 @@ These options are part of the **server:** clause.
     Larger numbers need extra resources from the operating system.
     For performance a very large value is best, use libevent to make this
     possible.
+    Should be higher (preferably double) than the value of
+    :ref:`num-queries-per-thread<unbound.conf.num-queries-per-thread>` to
+    account for cases where the request list is full and avoid file descriptor
+    starvation.
 
     Default: 4096 (libevent) / 960 (minievent) / 48 (windows)
 
@@ -496,6 +559,9 @@ These options are part of the **server:** clause.
     The wait time in msec where recursion requests are dropped.
     This is to stop a large number of replies from accumulating.
     They receive no reply, the work item continues to recurse.
+    For UDP the replies are dropped, for stream connections the reply
+    is not dropped if the stream connection is still open ready to receive
+    answers.
     It is nice to be a bit larger than
     :ref:`serve-expired-client-timeout<unbound.conf.serve-expired-client-timeout>`
     if that is enabled.
@@ -510,7 +576,7 @@ These options are part of the **server:** clause.
     This makes a ratelimit per IP address of waiting replies for recursion.
     It stops very large amounts of queries waiting to be returned to one
     destination.
-    The value ``0`` disables wait limits.
+    The value ``0`` disables all wait limits.
 
     Default: 1000
 
@@ -518,7 +584,11 @@ These options are part of the **server:** clause.
 @@UAHL@unbound.conf@wait-limit-cookie@@: *<number>*
     The number of replies that can wait for recursion, for an IP address
     that sent the query with a valid DNS Cookie.
-    Since the cookie validates the client address, this limit can be higher.
+    Since the cookie already validates the client address, this option allows
+    to override a configured
+    :ref:`wait-limit<unbound.conf.wait-limit>` value usually with a higher one
+    for cookie validated queries.
+    The value ``0`` disables wait limits for cookie validated queries.
 
     Default: 10000
 
@@ -978,9 +1048,13 @@ These options are part of the **server:** clause.
     certificate is in the :ref:`tls-service-pem<unbound.conf.tls-service-pem>`
     file and it must also be specified if
     :ref:`tls-service-key<unbound.conf.tls-service-key>` is specified.
-    Enabling or disabling this service requires a restart (a reload is not
-    enough), because the key is read while root permissions are held and before
-    chroot (if any).
+    If the key is stored with root permissions or outside of chroot, then
+    a change or enabling or disabling requires a restart (a reload is not
+    enough).
+    But if the key file (and tls-service-pem file) are accessible, then they
+    are read in on reload, and fast_reload.
+    The server checks the modification time of the file (and the filename)
+    to see if the file has changed for reload.
     The ports enabled implicitly or explicitly via
     :ref:`tls-port<unbound.conf.tls-port>` and
     :ref:`https-port<unbound.conf.https-port>` do not provide normal DNS TCP
@@ -1049,8 +1123,8 @@ These options are part of the **server:** clause.
 
 
 @@UAHL@unbound.conf@tls-system-cert@@: *<yes or no>*
-    This the same attribute as the
-    :ref:`tls-win-cert<unbound.conf.tls-win-cert>` attribute, under a
+    This the same as the
+    :ref:`tls-win-cert<unbound.conf.tls-win-cert>` option, under a
     different name.
     Because it is not windows specific.
 
@@ -1103,6 +1177,24 @@ These options are part of the **server:** clause.
     Default: ""
 
 
+@@UAHL@unbound.conf@tls-use-sni@@: *<yes or no>*
+    Enable or disable sending the SNI extension on TLS connections.
+
+    .. note:: Changing the value requires a restart.
+
+    Default: yes
+
+
+@@UAHL@unbound.conf@tls-protocols@@: *"<list of protocols>"*
+    Specify the allowed TLS protocol versions to use, in no particular order.
+    Possible values are ``TLSv1.2`` and ``TLSv1.3``.
+    Enclose list of protocols in quotes (``""``) and put spaces between them.
+
+    .. note:: Changing the value requires a restart.
+
+    Default: "TLSv1.2 TLSv1.3"
+
+
 @@UAHL@unbound.conf@pad-responses@@: *<yes or no>*
     If enabled, TLS serviced queries that contained an EDNS Padding option will
     cause responses padded to the closest multiple of the size specified in
@@ -1132,14 +1224,6 @@ These options are part of the **server:** clause.
     Default: 128
 
 
-@@UAHL@unbound.conf@tls-use-sni@@: *<yes or no>*
-    Enable or disable sending the SNI extension on TLS connections.
-
-    .. note:: Changing the value requires a reload.
-
-    Default: yes
-
-
 @@UAHL@unbound.conf@https-port@@: *<number>*
     The port number on which to provide DNS-over-HTTPS service.
     Only interfaces configured with that port number as @number get the HTTPS
@@ -1224,6 +1308,9 @@ These options are part of the **server:** clause.
     Only interfaces configured with that port number as @number get the QUIC
     service.
     The interface uses QUIC for the UDP traffic on that port number.
+    If it is set to 0, the server does not init QUIC code, and QUIC is
+    disabled.
+    This is similar to if QUIC is not in use, but then explicitly.
 
     Default: 853
 
@@ -1421,8 +1508,8 @@ These options are part of the **server:** clause.
     .. note::
         The interface needs to be already specified with
         :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.
 
 
 @@UAHL@unbound.conf@interface-tag@@: *<ip address or interface name [@port]> <"list of tags">*
@@ -1432,8 +1519,8 @@ These options are part of the **server:** clause.
     .. note::
         The interface needs to be already specified with
         :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.
 
 
 @@UAHL@unbound.conf@interface-tag-action@@: *<ip address or interface name [@port]> <tag> <action>*
@@ -1444,8 +1531,8 @@ These options are part of the **server:** clause.
     .. note::
         The interface needs to be already specified with
         :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.
 
 
 @@UAHL@unbound.conf@interface-tag-data@@: *<ip address or interface name [@port]> <tag> <"resource record string">*
@@ -1456,8 +1543,8 @@ These options are part of the **server:** clause.
     .. note::
         The interface needs to be already specified with
         :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.
 
 
 @@UAHL@unbound.conf@interface-view@@: *<ip address or interface name [@port]> <view name>*
@@ -1467,8 +1554,8 @@ These options are part of the **server:** clause.
     .. note::
         The interface needs to be already specified with
         :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.
 
 
 @@UAHL@unbound.conf@chroot@@: *<directory>*
@@ -1533,7 +1620,7 @@ These options are part of the **server:** clause.
         [seconds since 1970] unbound[pid:tid]: type: message.
 
     If this option is given, the :ref:`use-syslog<unbound.conf.use-syslog>`
-    attribute is internally set to ``no``.
+    option is internally set to ``no``.
 
     The logfile is reopened (for append) when the config file is reread, on
     SIGHUP.
@@ -1632,6 +1719,15 @@ These options are part of the **server:** clause.
     Default: no
 
 
+@@UAHL@unbound.conf@log-thread-id@@: *<yes or no>*
+    (Only on Linux and only when threads are available)
+    Logs the system-wide Linux thread ID instead of Unbound's internal thread
+    counter.
+    Can be useful when debugging with system tools.
+
+    Default: no
+
+
 @@UAHL@unbound.conf@pidfile@@: *<filename>*
     The process id is written to the file.
     Default is :file:`"@UNBOUND_PIDFILE@"`.
@@ -1657,8 +1753,8 @@ These options are part of the **server:** clause.
     Default is nothing, using builtin hints for the IN class.
     The file has the format of zone files, with root nameserver names and
     addresses only.
-    The default may become outdated, when servers change, therefore it is good
-    practice to use a root hints file.
+    The default may become outdated, when servers change, and then it is
+    possible to use a root hints file with specific servers.
 
     Default: ""
 
@@ -1744,7 +1840,7 @@ These options are part of the **server:** clause.
 @@UAHL@unbound.conf@harden-short-bufsize@@: *<yes or no>*
     Very small EDNS buffer sizes from queries are ignored.
 
-    Default: yes (as described in the standard)
+    Default: yes (per :rfc:`6891`)
 
 
 @@UAHL@unbound.conf@harden-large-queries@@: *<yes or no>*
@@ -1918,6 +2014,11 @@ These options are part of the **server:** clause.
     turned into a network proxy, allowing remote access through the browser to
     other parts of your private network.
 
+    The option removes resource records of types A, AAAA, SVCB and HTTPS
+    that match the filter.
+    Inside the SVCB and HTTPS records, the svcparams of type ipv4hint
+    and ipv6hint are checked for matches.
+
     Some names can be allowed to contain your private addresses, by default all
     the :ref:`local-data<unbound.conf.local-data>` that you configured is
     allowed to, and you can specify additional names using
@@ -2306,6 +2407,12 @@ These options are part of the **server:** clause.
     :ref:`serve-expired-client-timeout<unbound.conf.serve-expired-client-timeout>`
     is also used then it is RECOMMENDED to use 30 as the value (:rfc:`8767`).
 
+    This value is capped by the original TTL of the record.
+    This means that records with higher original TTL than this value will use
+    this value for expired replies.
+    Records with lower original TTL than this value will use their original TTL
+    for expired replies.
+
     Default: 30
 
 
@@ -2562,6 +2669,33 @@ These options are part of the **server:** clause.
         redirected, so that users with web browsers cannot access sites with
         suffix example.com.
 
+        A ``CNAME`` record can also be provided via local-data:
+
+        .. code-block:: text
+
+            local-zone: "example.com." redirect
+            local-data: "example.com. CNAME www.example.org."
+
+        In that case, the ``CNAME`` is resolved and the answer
+        includes resolved target records as well.
+        The ``CNAME`` record has to be with the zone name of the local-zone,
+        and there can be one CNAME, not more.
+        The ``CNAME`` record has to be at the zone apex of the
+        ``redirect`` zone, then it is used for redirection.
+        The resolution proceeds with upstream DNS resolution, and
+        that does not include the lookup in local zones.
+        So the record is not able to point in local zones, but it
+        can point to upstream DNS answers.
+
+        ``CNAME`` resolution is supported only in type ``redirect``
+        local-zone, and in type ``inform_redirect`` local-zone.
+
+        As different from ``CNAME`` records that are used elsewhere, in
+        the ``redirect`` type local-zone, it is supported that in the target
+        of the record a wildcard label gets expanded to the query name, with
+        for example: ``example.com. CNAME *.foo.net.`` gets expanded
+        to ``www.example.com. CNAME www.example.com.foo.net.``.
+
     @@UAHL@unbound.conf.local-zone.type@inform@@
         The query is answered normally, same as
         :ref:`transparent<unbound.conf.local-zone.type.transparent>`.
@@ -2601,6 +2735,9 @@ These options are part of the **server:** clause.
     @@UAHL@unbound.conf.local-zone.type@always_refuse@@
         Like :ref:`refuse<unbound.conf.local-zone.type.refuse>`, but ignores
         local data and refuses the query.
+        This type also blocks queries of type DS for the zone name.
+        That can break the DNSSEC chain of trust, but it is refused anyway.
+        The block for type DS assists in more completely blocking the zone.
 
     @@UAHL@unbound.conf.local-zone.type@always_nxdomain@@
         Like :ref:`static<unbound.conf.local-zone.type.static>`, but ignores
@@ -2808,7 +2945,7 @@ These options are part of the **server:** clause.
     Configure local data shorthand for a PTR record with the reversed IPv4 or
     IPv6 address and the host name.
     For example ``"192.0.2.4 www.example.com"``.
-    TTL can be inserted like this: ``"2001:DB8::4 7200 www.example.com"``
+    TTL can be inserted like this: ``"2001:db8::4 7200 www.example.com"``
 
 
 @@UAHL@unbound.conf@local-zone-tag@@: *<zone> <"list of tags">*
@@ -2861,7 +2998,7 @@ These options are part of the **server:** clause.
     :ref:`response-ip<unbound.conf.response-ip>` with action being to redirect
     as specified by *<"resource record string">*.
     *<"Resource record string">* is similar to that of
-    :ref:`access-control-tag-action<unbound.conf.access-control-tag-action>`,
+    :ref:`access-control-tag-data<unbound.conf.access-control-tag-data>`,
     but it must be of either AAAA, A or CNAME types.
     If the *<IP-netblock>* is an IPv6/IPv4 prefix, the record must be AAAA/A
     respectively, unless it is a CNAME (which can be used for both versions of
@@ -3123,6 +3260,10 @@ These options are part of the **server:** clause.
     Hard limit on the number of times Unbound is allowed to restart a query
     upon encountering a CNAME record.
     Results in SERVFAIL when reached.
+    This applies to chained CNAME records but not sporadic CNAME records that
+    could be encountered in the lifetime of the query's resolution effort.
+    When a CNAME chain concludes, the counter keeping track of this limit is
+    reset.
     Changing this value needs caution as it can allow long CNAME chains to be
     accepted, where Unbound needs to verify (resolve) each link individually.
 
@@ -3147,6 +3288,15 @@ These options are part of the **server:** clause.
     Default: 11
 
 
+@@UAHL@unbound.conf@iter-scrub-rrsig@@: *<number>*
+    Limit on the number of RRSIGs allowed for an RRset, from the iterator
+    scrubber.
+    This protects against an overly large number of RRSIGs.
+    Clips off the remainder of the RRSIG list at that point.
+
+    Default: 8
+
+
 @@UAHL@unbound.conf@max-global-quota@@: *<number>*
     Limit on the number of upstream queries sent out for an incoming query and
     its subqueries from recursion.
@@ -3290,17 +3440,18 @@ These options are part of the **server:** clause.
 .. _unbound.conf.remote:
 
 Remote Control Options
-^^^^^^^^^^^^^^^^^^^^^^
+----------------------
+
+These options are part of the ``remote-control:`` section and are the
+declarations for the remote control facility.
 
-In the **remote-control:** clause are the declarations for the remote control
-facility.
 If this is enabled, the :doc:`unbound-control(8)</manpages/unbound-control>`
 utility can be used to send commands to the running Unbound server.
-The server uses these clauses to setup TLSv1 security for the connection.
-The :doc:`unbound-control(8)</manpages/unbound-control>` utility also reads the
-**remote-control:** section for options.
+The server uses these options to setup TLS security for the connection.
+The :doc:`unbound-control(8)</manpages/unbound-control>` utility also reads
+this ``remote-control:`` section for options.
 To setup the correct self-signed certificates use the
-*unbound-control-setup(8)* utility.
+``unbound-control-setup(8)`` utility.
 
 
 @@UAHL@unbound.conf.remote@control-enable@@: *<yes or no>*
@@ -3310,7 +3461,7 @@ To setup the correct self-signed certificates use the
     Default: no
 
 
-@@UAHL@unbound.conf.remote@control-interface@@: *<IP address or interface name or path>*
+@@UAHL@unbound.conf.remote@control-interface@@: *<IP address or interface name[@port] or path>*
     Give IPv4 or IPv6 addresses or local socket path to listen on for control
     commands.
     If an interface name is used instead of an IP address, the list of IP
@@ -3392,9 +3543,11 @@ To setup the correct self-signed certificates use the
 .. _unbound.conf.stub:
 
 Stub Zone Options
-^^^^^^^^^^^^^^^^^
+-----------------
 
-There may be multiple **stub-zone:** clauses.
+These options are part of the ``stub-zone:`` section.
+
+There may be multiple ``stub-zone:`` sections.
 Each with a :ref:`name<unbound.conf.stub.name>` and zero or more hostnames or
 IP addresses.
 For the stub zone this list of nameservers is used.
@@ -3427,9 +3580,10 @@ Consider adding :ref:`server<unbound.conf.server>` statements for
 :ref:`domain-insecure<unbound.conf.domain-insecure>` and for
 :ref:`local-zone: \<name\> nodefault<unbound.conf.local-zone.type.nodefault>`
 for the zone if it is a locally served zone.
-The insecure clause stops DNSSEC from invalidating the zone.
+The :ref:`domain-insecure<unbound.conf.domain-insecure>` option stops DNSSEC
+from invalidating the zone.
 The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
-:ref:`transparent<unbound.conf.local-zone.type.transparent>`) clause makes the
+:ref:`transparent<unbound.conf.local-zone.type.transparent>`) option makes the
 (reverse-) zone bypass Unbound's filtering of :rfc:`1918` zones.
 
 
@@ -3442,6 +3596,19 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
     Name of stub zone nameserver.
     Is itself resolved before it is used.
 
+    .. caution::
+        If the domain (or a subdomain) from this zone is used as the host, it
+        will unavoidably introduce a circular dependency on retrieving the IP
+        addresses of the name server.
+        In that case, it is suggested to use
+        :ref:`stub-addr<unbound.conf.stub.stub-addr>` instead.
+        Alternatively,
+        :ref:`stub-first: yes<unbound.conf.stub.stub-first>` can also work
+        around the circular dependency by trying resolution outside of this
+        zone.
+        However this has the caveat that it would allow escaping this zone when
+        any resolution attempt fails within this zone.
+
     To use a non-default port for DNS communication append ``'@'`` with the
     port number.
 
@@ -3479,9 +3646,12 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
 
 
 @@UAHL@unbound.conf.stub@stub-first@@: *<yes or no>*
-    If enabled, a query is attempted without the stub clause if it fails.
+    If enabled, a query is attempted without this stub section if it fails.
     The data could not be retrieved and would have caused SERVFAIL because the
-    servers are unreachable, instead it is tried without this clause.
+    servers are unreachable, instead it is tried without this stub section.
+    This can lead to using less specific configured forward/stub/auth zones if
+    any, or end up to otherwise normal recursive resolution for that particular
+    query.
 
     Default: no
 
@@ -3513,9 +3683,11 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
 .. _unbound.conf.forward:
 
 Forward Zone Options
-^^^^^^^^^^^^^^^^^^^^
+--------------------
 
-There may be multiple **forward-zone:** clauses.
+These options are part of the ``forward-zone:`` section.
+
+There may be multiple ``forward-zone:`` sections.
 Each with a :ref:`name<unbound.conf.forward.name>` and zero or more hostnames
 or IP addresses.
 For the forward zone this list of nameservers is used to forward the queries
@@ -3545,6 +3717,19 @@ cache).
     Name of server to forward to.
     Is itself resolved before it is used.
 
+    .. caution::
+        If the domain (or a subdomain) from this zone is used as the host, it
+        will unavoidably introduce a circular dependency on retrieving the IP
+        addresses of the name server.
+        In that case, it is suggested to use
+        :ref:`forward-addr<unbound.conf.forward.forward-addr>` instead.
+        Alternatively,
+        :ref:`forward-first: yes<unbound.conf.forward.forward-first>` can also
+        work around the circular dependency by trying resolution outside of
+        this zone.
+        However this has the caveat that it would allow escaping this zone when
+        any resolution attempt fails within this zone.
+
     To use a non-default port for DNS communication append ``'@'`` with the
     port number.
 
@@ -3579,9 +3764,11 @@ cache).
 
 
 @@UAHL@unbound.conf.forward@forward-first@@: *<yes or no>*
-    If a forwarded query is met with a SERVFAIL error, and this option is
-    enabled, Unbound will fall back to normal recursive resolution for this
-    query as if no query forwarding had been specified.
+    If a forwarded query is met with a SERVFAIL error and this option is
+    enabled Unbound will fall back to less specific resolution.
+    This can lead to using less specific configured forward/stub/auth zones if
+    any, or end up to otherwise normal recursive resolution for that particular
+    query.
 
     Default: no
 
@@ -3618,12 +3805,14 @@ cache).
 .. _unbound.conf.auth:
 
 Authority Zone Options
-^^^^^^^^^^^^^^^^^^^^^^
+----------------------
 
-Authority zones are configured with **auth-zone:**, and each one must have a
+These options are part of the ``auth-zone:`` section.
+
+Authority zones are configured with ``auth-zone:``, and each one must have a
 :ref:`name<unbound.conf.auth.name>`.
-There can be multiple ones, by listing multiple auth-zone clauses, each with a
-different name, pertaining to that part of the namespace.
+There can be multiple ones, by listing multiple ``auth-zone`` section clauses,
+each with a different name, pertaining to that part of the namespace.
 The authority zone with the name closest to the name looked up is used.
 Authority zones can be processed on two distinct, non-exclusive, configurable
 stages.
@@ -3654,7 +3843,7 @@ consult the local zone data while resolving.
 In this case, the aforementioned CNAME example will result in a thoroughly
 resolved answer.
 
-Authority zones can be read from zonefile.
+Authority zones can be read from a zonefile.
 And can be kept updated via AXFR and IXFR.
 After update the zonefile is rewritten.
 The update mechanism uses the SOA timer values and performs SOA UDP queries to
@@ -3690,9 +3879,11 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
     :ref:`url<unbound.conf.auth.url>` to download the zonefile as a text file
     from a webserver that would work.
 
-    If you specify the hostname, you cannot use the domain from the zonefile,
-    because it may not have that when retrieving that data, instead use a plain
-    IP address to avoid a circular dependency on retrieving that IP address.
+    .. caution::
+        If you specify the hostname, you cannot use the domain from the
+        zonefile, because it may not have that when retrieving that data,
+        instead use a plain IP address to avoid a circular dependency on
+        retrieving that IP address.
 
 
 @@UAHL@unbound.conf.auth@master@@: *<IP address or host name>*
@@ -3823,18 +4014,20 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
 .. _unbound.conf.view:
 
 View Options
-^^^^^^^^^^^^
+------------
 
-There may be multiple **view:** clauses.
+These options are part of the ``view:`` section.
+
+There may be multiple ``view:`` sections.
 Each with a :ref:`name<unbound.conf.view.name>` and zero or more
 :ref:`local-zone<unbound.conf.view.local-zone>` and
-:ref:`local-data<unbound.conf.view.local-data>` attributes.
+:ref:`local-data<unbound.conf.view.local-data>` options.
 Views can also contain :ref:`view-first<unbound.conf.view.view-first>`,
 :ref:`response-ip<unbound.conf.response-ip>`,
 :ref:`response-ip-data<unbound.conf.response-ip-data>` and
-:ref:`local-data-ptr<unbound.conf.view.local-data-ptr>` attributes.
+:ref:`local-data-ptr<unbound.conf.view.local-data-ptr>` options.
 View can be mapped to requests by specifying the view name in an
-:ref:`access-control-view<unbound.conf.access-control-view>` attribute.
+:ref:`access-control-view<unbound.conf.access-control-view>` option.
 Options from matching views will override global options.
 Global options will be used if no matching view is found, or when the matching
 view does not have the option specified.
@@ -3844,7 +4037,7 @@ view does not have the option specified.
     Name of the view.
     Must be unique.
     This name is used in the
-    :ref:`access-control-view<unbound.conf.access-control-view>` attribute.
+    :ref:`access-control-view<unbound.conf.access-control-view>` option.
 
 
 @@UAHL@unbound.conf.view@local-zone@@: *<zone> <type>*
@@ -3873,6 +4066,20 @@ view does not have the option specified.
     :ref:`local-data-ptr<unbound.conf.local-data-ptr>` elements.
 
 
+@@UAHL@unbound.conf.view@response-ip@@: *<IP-netblock> <action>*
+    This requires use of the ``respip`` module.
+
+    Similar to :ref:`response-ip<unbound.conf.response-ip>` but
+    only applies to this view.
+
+
+@@UAHL@unbound.conf.view@response-ip-data@@: *<IP-netblock> <"resource record string">*
+    This requires use of the ``respip`` module.
+
+    Similar to :ref:`response-ip-data<unbound.conf.response-ip-data>` but
+    only applies to this view.
+
+
 @@UAHL@unbound.conf.view@view-first@@: *<yes or no>*
     If enabled, it attempts to use the global
     :ref:`local-zone<unbound.conf.local-zone>` and
@@ -3881,10 +4088,14 @@ view does not have the option specified.
 
     Default: no
 
-Python Module Options
-^^^^^^^^^^^^^^^^^^^^^
+.. _unbound.conf.python:
 
-The **python:** clause gives the settings for the *python(1)* script module.
+Python Module Options
+---------------------
+
+These options are part of the ``python:`` section.
+
+The ``python:`` section gives the settings for the *python(1)* script module.
 This module acts like the iterator and validator modules do, on queries and
 answers.
 To enable the script module it has to be compiled into the daemon, and the word
@@ -3907,15 +4118,19 @@ path to the working directory.
     Repeat this option for every python module instance added to the
     :ref:`module-config<unbound.conf.module-config>` option.
 
-Dynamic Library Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+.. _unbound.conf.dynlib:
 
-The **dynlib:** clause gives the settings for the ``dynlib`` module.
+Dynamic Library Module Options
+------------------------------
+
+These options are part of the ``dynlib:`` section.
+
+The ``dynlib:`` section gives the settings for the ``dynlib`` module.
 This module is only a very small wrapper that allows dynamic modules to be
 loaded on runtime instead of being compiled into the application.
 To enable the dynlib module it has to be compiled into the daemon, and the word
 ``dynlib`` has to be put in the
-:ref:`module-config<unbound.conf.module-config>` attribute.
+:ref:`module-config<unbound.conf.module-config>` option.
 Multiple instances of dynamic libraries are supported by adding the word
 ``dynlib`` more than once.
 
@@ -3931,7 +4146,9 @@ directory.
     :ref:`module-config<unbound.conf.module-config>` option.
 
 DNS64 Module Options
-^^^^^^^^^^^^^^^^^^^^
+--------------------
+
+These options are part of the ``server:`` section.
 
 The ``dns64`` module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -3943,7 +4160,11 @@ The ``dns64`` module must be configured in the
 and be compiled into the daemon to be enabled.
 
 .. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
+    If combining the ``respip`` and ``dns64`` modules, the ``respip`` module
+    needs to appear before the ``dns64`` module in the
+    :ref:`module-config<unbound.conf.module-config>`
+    configuration option so that response IP and/or RPZ feeds can properly
+    filter responses regardless of DNS64 synthesis.
 
 
 @@UAHL@unbound.conf.dns64@dns64-prefix@@: *<IPv6 prefix>*
@@ -3969,13 +4190,13 @@ and be compiled into the daemon to be enabled.
     per line.
     Applies also to names underneath the name given.
 
-NAT64 Operation
-^^^^^^^^^^^^^^^
+NAT64 Options
+-------------
+
+These options are part of the ``server:`` section.
 
 NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only
 servers.
-It is controlled by two options in the
-:ref:`server:<unbound.conf.server>` section:
 
 
 @@UAHL@unbound.conf.nat64@do-nat64@@: *<yes or no>*
@@ -3990,12 +4211,27 @@ It is controlled by two options in the
     Use a specific NAT64 prefix to reach IPv4-only servers.
     The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 
+    The NAT64 prefix is allowed by the
+    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` option,
+    so that there is a clear outcome of addresses in both; the NAT64 prefix
+    is allowed.
+    The IPv4 address could be filtered by the
+    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` option,
+    if needed.
+    Allowing the NAT64 prefix is useful when using do-not-query-address
+    for a cluster of machines that is IPv6-only and uses NAT64, but does
+    not have internet access.
+
     Default: 64:ff9b::/96 (same as :ref:`dns64-prefix<unbound.conf.dns64.dns64-prefix>`)
 
-DNSCrypt Options
-^^^^^^^^^^^^^^^^
+.. _unbound.conf.dnscrypt:
 
-The **dnscrypt:** clause gives the settings of the dnscrypt channel.
+DNSCrypt Options
+----------------
+
+These options are part of the ``dnscrypt:`` section.
+
+The ``dnscrypt:`` section gives the settings of the dnscrypt channel.
 While those options are available, they are only meaningful if Unbound was
 compiled with ``--enable-dnscrypt``.
 Currently certificate and secret/public keys cannot be generated by Unbound.
@@ -4102,7 +4338,9 @@ https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
     Default: (unconfigured)
 
 EDNS Client Subnet Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+---------------------------------
+
+These options are part of the ``server:`` section.
 
 The ECS module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4113,9 +4351,6 @@ The ECS module must be configured in the
 
 and be compiled into the daemon to be enabled.
 
-.. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
-
 If the destination address is allowed in the configuration Unbound will add the
 EDNS0 option to the query containing the relevant part of the client's address.
 When an answer contains the ECS option the response and the option are placed
@@ -4230,7 +4465,9 @@ This module does not interact with the
     Default: 100
 
 Opportunistic IPsec Support Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+------------------------------------------
+
+These options are part of the ``server:`` section.
 
 The IPsec module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4241,9 +4478,6 @@ The IPsec module must be configured in the
 
 and be compiled into Unbound by using ``--enable-ipsecmod`` to be enabled.
 
-.. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
-
 When Unbound receives an A/AAAA query that is not in the cache and finds a
 valid answer, it will withhold returning the answer and instead will generate
 an IPSECKEY subquery for the same domain name.
@@ -4333,8 +4567,12 @@ answer given from cache is still relevant for opportunistic IPsec.
 @@UAHL@unbound.conf@ipsecmod-whitelist@@: *<domain>*
     Alternate syntax for :ref:`ipsecmod-allow<unbound.conf.ipsecmod-allow>`.
 
+.. _unbound.conf.cachedb:
+
 Cache DB Module Options
-^^^^^^^^^^^^^^^^^^^^^^^
+-----------------------
+
+These options are part of the ``cachedb:`` section.
 
 The Cache DB module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4386,7 +4624,7 @@ If connection close or timeout happens too often, Unbound will be effectively
 unusable with this backend.
 It's the administrator's responsibility to make the assumption hold.
 
-The **cachedb:** clause gives custom settings of the cache DB module.
+The ``cachedb:`` section gives custom settings of the cache DB module.
 
 
 @@UAHL@unbound.conf.cachedb@backend@@: *<backend name>*
@@ -4434,7 +4672,7 @@ The **cachedb:** clause gives custom settings of the cache DB module.
 
     Default: yes
 
-The following **cachedb:** options are specific to the ``redis`` backend.
+The following ``cachedb:`` options are specific to the ``redis`` backend.
 
 
 @@UAHL@unbound.conf.cachedb@redis-server-host@@: *<server address or name>*
@@ -4593,11 +4831,14 @@ The following **cachedb:** options are specific to the ``redis`` backend.
 
 .. _unbound.conf.dnstap:
 
-DNSTAP Logging Options
-^^^^^^^^^^^^^^^^^^^^^^
+DNSTAP Options
+--------------
 
-DNSTAP support, when compiled in by using ``--enable-dnstap``, is enabled in
-the **dnstap:** section.
+These options are part of the ``dnstap:`` section.
+
+DNSTAP is a flexible, structured binary log format for DNS software.
+When compiled in by using ``--enable-dnstap``, it can be enabled in the
+``dnstap:`` section.
 This starts an extra thread (when compiled with threading) that writes the log
 information to the destination.
 If Unbound is compiled without threading it does not spawn a thread, but
@@ -4747,15 +4988,18 @@ connects per-process to the destination.
 .. _unbound.conf.rpz:
 
 Response Policy Zone Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+----------------------------
 
-Response Policy Zones are configured with **rpz:**, and each one must have a
-:ref:`name<unbound.conf.rpz.name>` attribute.
-There can be multiple ones, by listing multiple RPZ clauses, each with a
-different name.
-RPZ clauses are applied in order of configuration and any match from an earlier
-RPZ zone will terminate the RPZ lookup.
+These options are part of the ``rpz:`` section.
+
+Response Policy Zones are configured with ``rpz:`` section clauses, and each
+one must have a :ref:`name<unbound.conf.rpz.name>` option.
+There can be multiple ones, by listing multiple ``rpz:`` section clauses, each
+with a different name.
+RPZ sections are applied in order of configuration and any match from an
+earlier RPZ zone will terminate the RPZ lookup.
 Note that a PASSTHRU action is still considered a match.
+
 The respip module needs to be added to the
 :ref:`module-config<unbound.conf.module-config>`, e.g.:
 
@@ -4763,6 +5007,13 @@ The respip module needs to be added to the
 
     module-config: "respip validator iterator"
 
+.. note::
+    If combining the ``respip`` and ``dns64`` modules, the ``respip`` module
+    needs to appear before the ``dns64`` module in the
+    :ref:`module-config<unbound.conf.module-config>`
+    configuration option so that response IP and/or RPZ feeds can properly
+    filter responses regardless of DNS64 synthesis.
+
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
 Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
 and drop.
@@ -4814,9 +5065,6 @@ The actions are specified with the record on the right
 Other records like AAAA, TXT and other CNAMEs (not rpz-..) can also be used to
 answer queries with that content.
 
-The RPZ zones can be configured in the config file with these settings in the
-**rpz:** block.
-
 
 @@UAHL@unbound.conf.rpz@name@@: *<zone name>*
     Name of the authority zone.
@@ -4932,7 +5180,7 @@ The RPZ zones can be configured in the config file with these settings in the
 
 
 @@UAHL@unbound.conf.rpz@tags@@: *"<list of tags>"*
-    Limit the policies from this RPZ clause to clients with a matching tag.
+    Limit the policies from this RPZ section to clients with a matching tag.
 
     Tags need to be defined in :ref:`define-tag<unbound.conf.define-tag>` and
     can be assigned to client addresses using
@@ -4940,7 +5188,7 @@ The RPZ zones can be configured in the config file with these settings in the
     :ref:`interface-tag<unbound.conf.interface-tag>`.
     Enclose list of tags in quotes (``""``) and put spaces between tags.
 
-    If no tags are specified the policies from this clause will be applied for
+    If no tags are specified the policies from this section will be applied for
     all clients.
 
 Memory Control Example

doc/unbound.rst

@@ -42,7 +42,7 @@ unbound(8)
 Synopsis
 --------
 
-**unbound** [``-hdpv``] [``-c <cfgfile>``]
+**unbound** [``-hdpVv``] [``-c <cfgfile>``]
 
 Description
 -----------

edns-subnet/subnetmod.c

@@ -70,6 +70,7 @@ subnet_data_delete(void *d, void *ATTR_UNUSED(arg))
 	r = (struct subnet_msg_cache_data*)d;
 	addrtree_delete(r->tree4);
 	addrtree_delete(r->tree6);
+	free(r->reason_fail);
 	free(r);
 }
 
@@ -84,6 +85,8 @@ msg_cache_sizefunc(void *k, void *d)
 		+ q->key.qname_len + lock_get_mem(&q->entry.lock);
 	s += addrtree_size(r->tree4);
 	s += addrtree_size(r->tree6);
+	if(r->reason_fail)
+		s += strlen(r->reason_fail)+1;
 	return s;
 }
 
@@ -162,8 +165,15 @@ int ecs_whitelist_check(struct query_info* qinfo,
 			if(!ecs_is_whitelisted(sn_env->whitelist,
 				addr, addrlen, qinfo->qname, qinfo->qname_len,
 				qinfo->qclass)) {
-				verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.");
-				qstate->no_cache_store = 0;
+				/* The stub or forward can have no_cache set.*/
+				if(iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) {
+					verbose(VERB_ALGO, "subnet subquery is not stored globally, stuborfwd is no_cache");
+				} else {
+					verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.%s",
+						(sq->started_no_cache_store?
+						" But the subnet module was started with no_cache_store for the super query, and that is still applied to this query":""));
+					qstate->no_cache_store = sq->started_no_cache_store;
+				}
 			}
 		}
 		return 1;
@@ -193,12 +203,18 @@ int ecs_whitelist_check(struct query_info* qinfo,
 			if(sq->ecs_server_out.subnet_source_mask == 0) {
 				sq->subnet_sent_no_subnet = 1;
 				sq->subnet_sent = 0;
+				/* The result should end up in subnet cache,
+				 * not in global cache. */
+				qstate->no_cache_store = 1;
 				return 1;
 			}
 			subnet_ecs_opt_list_append(&sq->ecs_server_out,
 				&qstate->edns_opts_back_out, qstate, region);
 		}
 		sq->subnet_sent = 1;
+		/* Do not store servfails in global cache, since the subnet
+		 * option is sent out. */
+		qstate->no_cache_store = 1;
 	}
 	else {
 		/* Outgoing ECS option is set, but we don't want to sent it to
@@ -420,6 +436,35 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 	/* lru_entry->lock is locked regardless of how we got here,
 	 * either from the slabhash_lookup, or above in the new allocated */
+	if(!qstate->return_msg && qstate->error_response_cache) {
+		struct subnet_msg_cache_data *data =
+			(struct subnet_msg_cache_data*)lru_entry->data;
+		data->ttl_servfail = *qstate->env->now + NORR_TTL;
+		data->ede_fail = errinf_to_reason_bogus(qstate);
+		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0);
+		if(qstate->errinf) {
+			char* str = errinf_to_str_misc(qstate);
+			free(data->reason_fail);
+			data->reason_fail = NULL;
+			if(str)
+				data->reason_fail = strdup(str);
+		}
+		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0)
+			- diff_size;
+		lock_rw_unlock(&lru_entry->lock);
+		if (need_to_insert) {
+			slabhash_insert(subnet_msg_cache, h, lru_entry,
+				lru_entry->data, NULL);
+		} else {
+			slabhash_update_space_used(subnet_msg_cache, h, NULL,
+				diff_size);
+		}
+		return;
+	}
+	if(!qstate->return_msg) {
+		lock_rw_unlock(&lru_entry->lock);
+		return;
+	}
 	/* Step 2, find the correct tree */
 	if (!(tree = get_tree(lru_entry->data, edns, sne, qstate->env->cfg))) {
 		lock_rw_unlock(&lru_entry->lock);
@@ -463,6 +508,21 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 }
 
+/** See if there is a stored servfail, returns true if so, and sets reply. */
+static int
+lookup_check_servfail(struct module_qstate *qstate,
+	struct subnet_msg_cache_data *data)
+{
+	struct module_env *env = qstate->env;
+	if(!data)
+		return 0;
+	if(!data->ttl_servfail || TTL_IS_EXPIRED(data->ttl_servfail, *env->now))
+		return 0;
+	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
+	errinf_ede(qstate, data->reason_fail, data->ede_fail);
+	return 1;
+}
+
 /** Lookup in cache and reply true iff reply is sent. */
 static int
 lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq, int prefetch)
@@ -476,6 +536,8 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	struct addrtree *tree;
 	struct addrnode *node;
 	uint8_t scope;
+	int must_validate = (!(qstate->query_flags&BIT_CD)
+		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
 
 	memset(&sq->ecs_client_out, 0, sizeof(sq->ecs_client_out));
 
@@ -489,12 +551,20 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	tree = (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4)?
 		data->tree4 : data->tree6;
 	if (!tree) { /* qinfo in cache but not for this family */
+		if(lookup_check_servfail(qstate, data)) {
+			lock_rw_unlock(&e->lock);
+			return 1;
+		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
 	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr, 
 		ecs->subnet_source_mask, *env->now);
 	if (!node) { /* plain old cache miss */
+		if(lookup_check_servfail(qstate, data)) {
+			lock_rw_unlock(&e->lock);
+			return 1;
+		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
@@ -503,12 +573,24 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 		(struct reply_info *)node->elem, qstate->region, *env->now, 0,
 		env->scratch);
 	scope = (uint8_t)node->scope;
-	lock_rw_unlock(&e->lock);
 	
 	if (!qstate->return_msg) { /* Failed allocation or expired TTL */
+		if(lookup_check_servfail(qstate, data)) {
+			lock_rw_unlock(&e->lock);
+			return 1;
+		}
+		lock_rw_unlock(&e->lock);
 		return 0;
 	}
-	
+	lock_rw_unlock(&e->lock);
+	if(qstate->return_msg->rep->security == sec_status_unchecked
+		&& must_validate) {
+		/* The message has to be validated first. */
+		verbose(VERB_ALGO, "subnet: unchecked cache entry needs "
+			"validation");
+		return 0;
+	}
+
 	if (sq->subnet_downstream) { /* relay to interested client */
 		sq->ecs_client_out.subnet_scope_mask = scope;
 		sq->ecs_client_out.subnet_addr_fam = ecs->subnet_addr_fam;
@@ -563,12 +645,15 @@ generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate*
 	qflags |= BIT_RD;
 	if((qstate->query_flags & BIT_CD)!=0) {
 		qflags |= BIT_CD;
-		valrec = 1;
+		/* The valrec is left off. Leave out: valrec = 1;
+		 * So that the cache is protected with DNSSEC validation.
+		 * Just like the global cache. DNSSEC validation is performed
+		 * regardless of the setting of the querier's CD flag. */
 	}
 
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec,
-		&subq)) {
+	if(!(*qstate->env->attach_sub)(qstate, &qinf, qstate->client_info,
+		qflags, prime, valrec, &subq)) {
 		return 0;
 	}
 	if(subq) {
@@ -580,6 +665,7 @@ generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate*
 		}
 		subsq = (struct subnet_qstate*)subq->minfo[id];
 		subsq->is_subquery_nonsubnet = 1;
+		subsq->started_no_cache_store = sq->started_no_cache_store;
 
 		/* When the client asks 0.0.0.0/0 and the name is not treated
 		 * as subnet, it is to be stored in the global cache.
@@ -632,6 +718,12 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		/* already an answer and its not a message, but retain
 		 * the actual rcode, instead of module_error, so send
 		 * module_finished */
+		if(qstate->error_response_cache) {
+			verbose(VERB_ALGO, "subnet: store error response");
+			lock_rw_wrlock(&sne->biglock);
+			update_cache(qstate, id);
+			lock_rw_unlock(&sne->biglock);
+		}
 		return module_finished;
 	}
 
@@ -881,9 +973,11 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id,
 				sq->max_scope = sq->ecs_server_in.subnet_scope_mask;
 	} else if(sq->subnet_sent_no_subnet) {
 		/* The answer can be stored as scope 0, not in global cache. */
+		/* This was already set in ecs_whitelist_check */
 		qstate->no_cache_store = 1;
 	} else if(sq->subnet_sent) {
 		/* Need another query to be able to store in global cache. */
+		/* This was already set in ecs_whitelist_check */
 		qstate->no_cache_store = 1;
 	}
 

edns-subnet/subnetmod.h

@@ -69,8 +69,18 @@ struct subnet_env {
 };
 
 struct subnet_msg_cache_data {
+	/** Tree for nodes with IPv4 subnets. */
 	struct addrtree* tree4;
+	/** Tree for nodes with IPv6 subnets. */
 	struct addrtree* tree6;
+	/** If servfail is stored, for how long. Abs time in seconds.
+	 * This protects against too much recusion on the item when
+	 * resolution fails, for a couple of seconds. */
+	time_t ttl_servfail;
+	/** servfail ede */
+	sldns_ede_code ede_fail;
+	/** servfail reason */
+	char* reason_fail;
 };
 
 struct subnet_qstate {

install-sh

@@ -1,7 +1,7 @@
 #!/usr/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2024-06-19.01; # UTC
+scriptversion=2013-12-25.23; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -69,11 +69,6 @@ posix_mkdir=
 # Desired mode of installed file.
 mode=0755
 
-# Create dirs (including intermediate dirs) using mode 755.
-# This is like GNU 'install' as of coreutils 8.32 (2020).
-mkdir_umask=22
-
-backupsuffix=
 chgrpcmd=
 chmodcmd=$chmodprog
 chowncmd=
@@ -104,29 +99,19 @@ Options:
      --version  display version info and exit.
 
   -c            (ignored)
-  -C            install only if different (preserve data modification time)
+  -C            install only if different (preserve the last data modification time)
   -d            create directories instead of installing files.
   -g GROUP      $chgrpprog installed files to GROUP.
   -m MODE       $chmodprog installed files to MODE.
   -o USER       $chownprog installed files to USER.
-  -p            pass -p to $cpprog.
   -s            $stripprog installed files.
-  -S SUFFIX     attempt to back up existing files, with suffix SUFFIX.
   -t DIRECTORY  install into DIRECTORY.
   -T            report an error if DSTFILE is a directory.
 
 Environment variables override the default commands:
   CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
   RMPROG STRIPPROG
-
-By default, rm is invoked with -f; when overridden with RMPROG,
-it's up to you to specify -f if you want it.
-
-If -S is not specified, no backups are attempted.
-
-Report bugs to <bug-automake@gnu.org>.
-GNU Automake home page: <https://www.gnu.org/software/automake/>.
-General help using GNU software: <https://www.gnu.org/gethelp/>."
+"
 
 while test $# -ne 0; do
   case $1 in
@@ -152,13 +137,8 @@ while test $# -ne 0; do
     -o) chowncmd="$chownprog $2"
         shift;;
 
-    -p) cpprog="$cpprog -p";;
-
     -s) stripcmd=$stripprog;;
 
-    -S) backupsuffix="$2"
-        shift;;
-
     -t)
         is_target_a_directory=always
         dst_arg=$2
@@ -170,7 +150,7 @@ while test $# -ne 0; do
 
     -T) is_target_a_directory=never;;
 
-    --version) echo "$0 (GNU Automake) $scriptversion"; exit $?;;
+    --version) echo "$0 $scriptversion"; exit $?;;
 
     --) shift
         break;;
@@ -275,10 +255,6 @@ do
     dstdir=$dst
     test -d "$dstdir"
     dstdir_status=$?
-    # Don't chown directories that already exist.
-    if test $dstdir_status = 0; then
-      chowncmd=""
-    fi
   else
 
     # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
@@ -295,18 +271,15 @@ do
     fi
     dst=$dst_arg
 
-    # If destination is a directory, append the input filename.
+    # If destination is a directory, append the input filename; won't work
+    # if double slashes aren't ignored.
     if test -d "$dst"; then
       if test "$is_target_a_directory" = never; then
         echo "$0: $dst_arg: Is a directory" >&2
         exit 1
       fi
       dstdir=$dst
-      dstbase=`basename "$src"`
-      case $dst in
-	*/) dst=$dst$dstbase;;
-	*)  dst=$dst/$dstbase;;
-      esac
+      dst=$dstdir/`basename "$src"`
       dstdir_status=0
     else
       dstdir=`dirname "$dst"`
@@ -315,16 +288,27 @@ do
     fi
   fi
 
-  case $dstdir in
-    */) dstdirslash=$dstdir;;
-    *)  dstdirslash=$dstdir/;;
-  esac
-
   obsolete_mkdir_used=false
 
   if test $dstdir_status != 0; then
     case $posix_mkdir in
       '')
+        # Create intermediate dirs using mode 755 as modified by the umask.
+        # This is like FreeBSD 'install' as of 1997-10-28.
+        umask=`umask`
+        case $stripcmd.$umask in
+          # Optimize common cases.
+          *[2367][2367]) mkdir_umask=$umask;;
+          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
+
+          *[0-7])
+            mkdir_umask=`expr $umask + 22 \
+              - $umask % 100 % 40 + $umask % 20 \
+              - $umask % 10 % 4 + $umask % 2
+            `;;
+          *) mkdir_umask=$umask,go-w;;
+        esac
+
         # With -d, create the new directory with the user-specified mode.
         # Otherwise, rely on $mkdir_umask.
         if test -n "$dir_arg"; then
@@ -334,49 +318,43 @@ do
         fi
 
         posix_mkdir=false
-	# The $RANDOM variable is not portable (e.g., dash).  Use it
-	# here however when possible just to lower collision chance.
-	tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+        case $umask in
+          *[123567][0-7][0-7])
+            # POSIX mkdir -p sets u+wx bits regardless of umask, which
+            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
+            ;;
+          *)
+            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
 
-	trap '
-	  ret=$?
-	  rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null
-	  exit $ret
-	' 0
-
-	# Because "mkdir -p" follows existing symlinks and we likely work
-	# directly in world-writable /tmp, make sure that the '$tmpdir'
-	# directory is successfully created first before we actually test
-	# 'mkdir -p'.
-	if (umask $mkdir_umask &&
-	    $mkdirprog $mkdir_mode "$tmpdir" &&
-	    exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
-	then
-	  if test -z "$dir_arg" || {
-	       # Check for POSIX incompatibility with -m.
-	       # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-	       # other-writable bit of parent directory when it shouldn't.
-	       # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-	       test_tmpdir="$tmpdir/a"
-	       ls_ld_tmpdir=`ls -ld "$test_tmpdir"`
-	       case $ls_ld_tmpdir in
-		 d????-?r-*) different_mode=700;;
-		 d????-?--*) different_mode=755;;
-		 *) false;;
-	       esac &&
-	       $mkdirprog -m$different_mode -p -- "$test_tmpdir" && {
-		 ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"`
-		 test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-	       }
-	     }
-	  then posix_mkdir=:
-	  fi
-	  rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir"
-	else
-	  # Remove any dirs left behind by ancient mkdir implementations.
-	  rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null
-	fi
-	trap '' 0;;
+            if (umask $mkdir_umask &&
+                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+            then
+              if test -z "$dir_arg" || {
+                   # Check for POSIX incompatibilities with -m.
+                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+                   # other-writable bit of parent directory when it shouldn't.
+                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
+                   case $ls_ld_tmpdir in
+                     d????-?r-*) different_mode=700;;
+                     d????-?--*) different_mode=755;;
+                     *) false;;
+                   esac &&
+                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
+                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
+                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+                   }
+                 }
+              then posix_mkdir=:
+              fi
+              rmdir "$tmpdir/d" "$tmpdir"
+            else
+              # Remove any dirs left behind by ancient mkdir implementations.
+              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+            fi
+            trap '' 0;;
+        esac;;
     esac
 
     if
@@ -387,7 +365,7 @@ do
     then :
     else
 
-      # mkdir does not conform to POSIX,
+      # The umask is ridiculous, or mkdir does not conform to POSIX,
       # or it failed possibly due to a race condition.  Create the
       # directory the slow way, step by step, checking for races as we go.
 
@@ -416,7 +394,7 @@ do
           prefixes=
         else
           if $posix_mkdir; then
-            (umask $mkdir_umask &&
+            (umask=$mkdir_umask &&
              $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
             # Don't fail if two instances are running concurrently.
             test -d "$prefix" || exit 1
@@ -449,25 +427,14 @@ do
   else
 
     # Make a couple of temp file names in the proper directory.
-    dsttmp=${dstdirslash}_inst.$$_
-    rmtmp=${dstdirslash}_rm.$$_
+    dsttmp=$dstdir/_inst.$$_
+    rmtmp=$dstdir/_rm.$$_
 
     # Trap to clean up those temp files at exit.
     trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
 
     # Copy the file name to the temp name.
-    (umask $cp_umask &&
-     { test -z "$stripcmd" || {
-	 # Create $dsttmp read-write so that cp doesn't create it read-only,
-	 # which would cause strip to fail.
-	 if test -z "$doit"; then
-	   : >"$dsttmp" # No need to fork-exec 'touch'.
-	 else
-	   $doit touch "$dsttmp"
-	 fi
-       }
-     } &&
-     $doit_exec $cpprog "$src" "$dsttmp") &&
+    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
 
     # and set any options; do chmod last to preserve setuid bits.
     #
@@ -493,13 +460,6 @@ do
     then
       rm -f "$dsttmp"
     else
-      # If $backupsuffix is set, and the file being installed
-      # already exists, attempt a backup.  Don't worry if it fails,
-      # e.g., if mv doesn't support -f.
-      if test -n "$backupsuffix" && test -f "$dst"; then
-        $doit $mvcmd -f "$dst" "$dst$backupsuffix" 2>/dev/null
-      fi
-
       # Rename the file to the real destination.
       $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
 
@@ -514,9 +474,9 @@ do
         # file should still install successfully.
         {
           test ! -f "$dst" ||
-          $doit $rmcmd "$dst" 2>/dev/null ||
+          $doit $rmcmd -f "$dst" 2>/dev/null ||
           { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-            { $doit $rmcmd "$rmtmp" 2>/dev/null; :; }
+            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
           } ||
           { echo "$0: cannot unlink or rename $dst" >&2
             (exit 1); exit 1
@@ -533,9 +493,9 @@ do
 done
 
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp)
+# eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC0"
+# time-stamp-time-zone: "UTC"
 # time-stamp-end: "; # UTC"
 # End:

ipsecmod/ipsecmod.c

@@ -163,7 +163,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	}
 
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &ask,
+	if(!(*qstate->env->attach_sub)(qstate, &ask, NULL,
 		(uint16_t)(BIT_RD|flags), 0, 0, &newq)){
 		log_err("Could not generate request: out of memory");
 		return 0;

iterator/iter_fwd.c

@@ -228,6 +228,11 @@ read_fwds_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
+		if(dname_subdomain_c(dname, dp->name)) {
+			log_warn("forward-host '%s' may have a circular "
+				"dependency on forward-zone '%s'",
+				p->str, s->name);
+		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "

iterator/iter_hints.c

@@ -231,6 +231,11 @@ read_stubs_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
+		if(dname_subdomain_c(dname, dp->name)) {
+			log_warn("stub-host '%s' may have a circular "
+				"dependency on stub-zone '%s'",
+				p->str, s->name);
+		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "

iterator/iter_priv.c

@@ -207,6 +207,168 @@ size_t priv_get_mem(struct iter_priv* priv)
 	return sizeof(*priv) + regional_get_mem(priv->region);
 }
 
+/**
+ * Check if svcparam ipv4hint contains a private address.
+ * @param priv: private address lookup struct.
+ * @param d: the data bytes.
+ * @param data_len: number of data bytes in the svcparam.
+ * @param addr: address to return the private address to log in to.
+ *	It has space for IPv4 and IPv6 addresses.
+ * @param addrlen: length of the addr. Returns the correct size for the addr.
+ * @return true if the rdata contains a private address.
+ */
+static int svcb_ipv4hint_contains_priv_addr(struct iter_priv* priv,
+	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
+	socklen_t* addrlen)
+{
+	struct sockaddr_in sa;
+	*addrlen = (socklen_t)sizeof(struct sockaddr_in);
+	memset(&sa, 0, sizeof(struct sockaddr_in));
+	sa.sin_family = AF_INET;
+	sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
+
+	while(data_len >= LDNS_IP4ADDRLEN) {
+		memmove(&sa.sin_addr, d, LDNS_IP4ADDRLEN);
+		memmove(addr, &sa, *addrlen);
+		if(priv_lookup_addr(priv, addr, *addrlen))
+			return 1;
+
+		d += LDNS_IP4ADDRLEN;
+		data_len -= LDNS_IP4ADDRLEN;
+	}
+	/* if data_len != 0 here, then the svcparam is malformed. */
+	return 0;
+}
+
+/**
+ * Check if svcparam ipv6hint contains a private address.
+ * @param priv: private address lookup struct.
+ * @param d: the data bytes.
+ * @param data_len: number of data bytes in the svcparam.
+ * @param addr: address to return the private address to log in to.
+ *	It has space for IPv4 and IPv6 addresses.
+ * @param addrlen: length of the addr. Returns the correct size for the addr.
+ * @return true if the rdata contains a private address.
+ */
+static int svcb_ipv6hint_contains_priv_addr(struct iter_priv* priv,
+	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
+	socklen_t* addrlen)
+{
+	struct sockaddr_in6 sa;
+	*addrlen = (socklen_t)sizeof(struct sockaddr_in6);
+	memset(&sa, 0, sizeof(struct sockaddr_in6));
+	sa.sin6_family = AF_INET6;
+	sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
+
+	while(data_len >= LDNS_IP6ADDRLEN) {
+		memmove(&sa.sin6_addr, d, LDNS_IP6ADDRLEN);
+		memmove(addr, &sa, *addrlen);
+		if(priv_lookup_addr(priv, addr, *addrlen))
+			return 1;
+
+		d += LDNS_IP6ADDRLEN;
+		data_len -= LDNS_IP6ADDRLEN;
+	}
+	/* if data_len != 0 here, then the svcparam is malformed. */
+	return 0;
+}
+
+/**
+ * Check if type SVCB and HTTPS rdata contains a private address.
+ * @param priv: private address lookup struct.
+ * @param pkt: the packet.
+ * @param rr: the rr with rdata to check.
+ * @param addr: address to return the private address to log in to.
+ * @param addrlen: length of the addr. Initially the total size, on
+ *	return the correct size for the addr.
+ * @return true if the rdata contains a private address.
+ */
+static int svcb_rr_contains_priv_addr(struct iter_priv* priv,
+	sldns_buffer* pkt, struct rr_parse* rr, struct sockaddr_storage* addr,
+	socklen_t* addrlen)
+{
+	uint8_t* d = rr->ttl_data;
+	uint16_t svcparamkey, data_len, rdatalen;
+	size_t oldpos, dname_len, dname_start, dname_compr_len;
+	d += 4; /* skip TTL */
+	rdatalen = sldns_read_uint16(d); /* read rdata length */
+	d += 2;
+
+	if(rdatalen < 2 /* priority */ + 1 /* 1 length target */)
+		return 0; /* malformed, too short */
+	d += 2; /* skip priority */
+	rdatalen -= 2;
+	oldpos = sldns_buffer_position(pkt);
+	sldns_buffer_set_position(pkt, (size_t)(d - sldns_buffer_begin(pkt)));
+	dname_start = sldns_buffer_position(pkt);
+	dname_len = pkt_dname_len(pkt);
+	dname_compr_len = sldns_buffer_position(pkt) - dname_start;
+	sldns_buffer_set_position(pkt, oldpos);
+	if(dname_len == 0)
+		return 0; /* dname malformed */
+	if(dname_compr_len > rdatalen)
+		return 0; /* malformed */
+	d += dname_compr_len; /* skip target */
+	rdatalen -= dname_compr_len;
+
+	while(rdatalen >= 4) {
+		svcparamkey = sldns_read_uint16(d);
+		data_len = sldns_read_uint16(d+2);
+		d += 4;
+		rdatalen -= 4;
+
+		/* verify that we have data_len data */
+		if(data_len > rdatalen) {
+			/* It is malformed, but if there are addresses
+			 * in there it can be rejected. */
+			data_len = rdatalen;
+		}
+
+		if(!data_len)
+			continue; /* no data for the svcparamkey */
+
+		if(svcparamkey == SVCB_KEY_IPV4HINT) {
+			if(svcb_ipv4hint_contains_priv_addr(priv, d, data_len,
+				addr, addrlen))
+				return 1;
+		} else if(svcparamkey == SVCB_KEY_IPV6HINT) {
+			if(svcb_ipv6hint_contains_priv_addr(priv, d, data_len,
+				addr, addrlen))
+				return 1;
+		}
+		d += data_len;
+		rdatalen -= data_len;
+	}
+	/* If rdatalen != 0 here, then the svcb rdata is malformed. */
+	return 0;
+}
+
+/**
+ * Check if the SVCB and HTTPS rrset is bad.
+ * @param priv: private address lookup struct.
+ * @param pkt: the packet.
+ * @param rrset: the rrset to check.
+ * @return 1 if the entire rrset has to be removed. 0 if not.
+ * It removes RRs if they have private addresses, and log that.
+ */
+static int priv_svcb_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
+	struct rrset_parse* rrset)
+{
+	struct rr_parse* rr, *prev = NULL;
+	struct sockaddr_storage addr;
+	socklen_t addrlen = (socklen_t)sizeof(addr);
+	for(rr = rrset->rr_first; rr; rr = rr->next) {
+		if(svcb_rr_contains_priv_addr(priv, pkt, rr, &addr,
+			&addrlen)) {
+			if(msgparse_rrset_remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, rr, &addr, addrlen))
+				return 1;
+			continue;
+		}
+		prev = rr;
+	}
+	return 0;
+}
+
 int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
@@ -268,7 +430,11 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 				}
 				prev = rr;
 			}
-		} 
+		} else if(rrset->type == LDNS_RR_TYPE_SVCB ||
+			rrset->type == LDNS_RR_TYPE_HTTPS) {
+			if(priv_svcb_rrset_bad(priv, pkt, rrset))
+				return 1;
+		}
 	}
 	return 0;
 }

iterator/iter_scrub.c

@@ -285,6 +285,17 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 		return NULL;
 	memmove(cn->rr_first->ttl_data, rrset->rr_first->ttl_data,
 		sizeof(uint32_t)); /* RFC6672: synth CNAME TTL == DNAME TTL */
+	/* Apply cache TTL policy so DNAME and synthesized CNAME stay equal
+	 * and respect cache-min-ttl/cache-max-ttl (same as rdata_copy path). */
+	if(!SERVE_ORIGINAL_TTL) {
+		uint32_t ttl = sldns_read_uint32(cn->rr_first->ttl_data);
+		time_t ttl_t = (time_t)ttl;
+		if(ttl_t < MIN_TTL) ttl_t = MIN_TTL;
+		if(ttl_t > MAX_TTL) ttl_t = MAX_TTL;
+		ttl = (uint32_t)ttl_t;
+		sldns_write_uint32(cn->rr_first->ttl_data, ttl);
+		sldns_write_uint32(rrset->rr_first->ttl_data, ttl);
+	}
 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 	cn->rr_first->size = sizeof(uint16_t)+aliaslen;
@@ -408,6 +419,43 @@ shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
 	else	rrset->rr_first = NULL;
 }
 
+/** Shorten RRSIGs list */
+static void
+shorten_rrsig(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
+{
+	/* The too large list of RRSIGs on the RRset is shortened.
+	 * This is so that too large content does not overwhelm the cache.
+	 * The validator does not validate more than a max number of
+	 * RRSIGs as well. */
+	int i;
+	struct rr_parse* rr = rrset->rrsig_first, *prev = NULL;
+	if(!rr)
+		return;
+	for(i=0; i<count; i++) {
+		prev = rr;
+		rr = rr->next;
+		if(!rr)
+			return; /* The RRSIG list is already short. */
+	}
+	if(verbosity >= VERB_QUERY
+		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
+		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
+		dname_pkt_copy(pkt, buf, rrset->dname);
+		log_nametypeclass(VERB_QUERY, "normalize: shorten RRSIGs:",
+			buf, rrset->type, ntohs(rrset->rrset_class));
+	}
+	/* remove further rrsigs */
+	rrset->rrsig_last = prev;
+	rrset->rrsig_count = count;
+	while(rr) {
+		rrset->size -= rr->size;
+		rr = rr->next;
+	}
+	if(rrset->rrsig_last)
+		rrset->rrsig_last->next = NULL;
+	else	rrset->rrsig_first = NULL;
+}
+
 /**
  * This routine normalizes a response. This includes removing "irrelevant"
  * records from the answer and additional sections and (re)synthesizing
@@ -445,6 +493,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
+		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
+			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		if(cname_length > env->cfg->iter_scrub_cname) {
 			/* Too many CNAMEs, or DNAMEs, from the authority
 			 * server, scrub down the length to something
@@ -455,8 +505,9 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				pkt, msg, prev, &rrset);
 			continue;
 		}
-		if(rrset->type == LDNS_RR_TYPE_DNAME && 
-			pkt_strict_sub(pkt, sname, rrset->dname)) {
+		if(rrset->type == LDNS_RR_TYPE_DNAME &&
+			pkt_strict_sub(pkt, sname, rrset->dname) &&
+			pkt_sub(pkt, rrset->dname, zonename)) {
 			/* check if next rrset is correct CNAME. else,
 			 * synthesize a CNAME */
 			struct rrset_parse* nx = rrset->rrset_all_next;
@@ -502,8 +553,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				log_err("out of memory synthesizing CNAME");
 				return 0;
 			}
-			/* FIXME: resolve the conflict between synthesized 
-			 * CNAME ttls and the cache. */
 			rrset = nx;
 			continue;
 
@@ -525,7 +574,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			if(nx && nx->section == LDNS_SECTION_ANSWER &&
 				nx->type == LDNS_RR_TYPE_DNAME &&
 				nx->rr_count == 1 &&
-				pkt_strict_sub(pkt, sname, nx->dname)) {
+				pkt_strict_sub(pkt, sname, nx->dname) &&
+				pkt_sub(pkt, nx->dname, zonename)) {
 				/* there is a DNAME after this CNAME, it 
 				 * is in the ANSWER section, and the DNAME
 				 * applies to the name we cover */
@@ -620,6 +670,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
+		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
+			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		/* only one NS set allowed in authority section */
 		if(rrset->type==LDNS_RR_TYPE_NS) {
 			/* NS set must be pertinent to the query */
@@ -762,6 +814,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
+		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
+			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -972,8 +1026,10 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		}
 
 		/* remove private addresses */
-		if( (rrset->type == LDNS_RR_TYPE_A || 
-			rrset->type == LDNS_RR_TYPE_AAAA)) {
+		if(rrset->type == LDNS_RR_TYPE_A ||
+			rrset->type == LDNS_RR_TYPE_AAAA ||
+			rrset->type == LDNS_RR_TYPE_SVCB ||
+			rrset->type == LDNS_RR_TYPE_HTTPS) {
 
 			/* do not set servfail since this leads to too
 			 * many drops of other people using rfc1918 space */

iterator/iter_utils.c

@@ -253,7 +253,9 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	return 1;
 }
 
-/** filter out unsuitable targets
+/** filter out unsuitable targets.
+ * Applies NAT64 if needed as well by replacing the IPv4 with the synthesized
+ * IPv6 address.
  * @param iter_env: iterator environment with ipv6-support flag.
  * @param env: module environment with infra cache.
  * @param name: zone name
@@ -306,9 +308,30 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	if(a->bogus)
 		return -1; /* address of server is bogus */
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
-		log_addr(VERB_ALGO, "skip addr on the donotquery list",
-			&a->addr, a->addrlen);
-		return -1; /* server is on the donotquery list */
+		if(iter_env->nat64.use_nat64 &&
+			addr_is_ip6(&a->addr, a->addrlen) &&
+			a->addrlen == iter_env->nat64.nat64_prefix_addrlen &&
+			addr_in_common(&a->addr, 128,
+				&iter_env->nat64.nat64_prefix_addr,
+				iter_env->nat64.nat64_prefix_net,
+				iter_env->nat64.nat64_prefix_addrlen) ==
+				iter_env->nat64.nat64_prefix_net) {
+			/* The NAT64 is enabled, and address is IPv6, it is
+			 * in the NAT64 prefix. It is allowed.
+			 * So that in an IPv6-only cluster without internet
+			 * access, that makes the NAT64 translation continue
+			 * to work. The NAT64 prefix is allowed. */
+			/* Otherwise, after a timeout, the already NAT64
+			 * translated address would be treated differently,
+			 * and that causes confusion. */
+			log_addr(VERB_ALGO, "the addr is on the donotquery "
+				"list, but allowed because it is NAT64",
+				&a->addr, a->addrlen);
+		} else {
+			log_addr(VERB_ALGO, "skip addr on the donotquery list",
+				&a->addr, a->addrlen);
+			return -1; /* server is on the donotquery list */
+		}
 	}
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
@@ -317,6 +340,20 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	   !addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip4 available */
 	}
+	if(iter_env->nat64.use_nat64 && !addr_is_ip6(&a->addr, a->addrlen)) {
+		struct sockaddr_storage real_addr;
+		socklen_t real_addrlen;
+		addr_to_nat64(&a->addr, &iter_env->nat64.nat64_prefix_addr,
+			iter_env->nat64.nat64_prefix_addrlen,
+			iter_env->nat64.nat64_prefix_net,
+			&real_addr, &real_addrlen);
+		log_name_addr(VERB_QUERY, "NAT64 apply: from: ",
+			name, &a->addr, a->addrlen);
+		log_name_addr(VERB_QUERY, "NAT64 apply:   to: ",
+			name, &real_addr, real_addrlen);
+		a->addr = real_addr;
+		a->addrlen = real_addrlen;
+	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen,
 		name, namelen, qtype, &lame, &dnsseclame, &reclame,
@@ -1511,6 +1548,11 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,
 	struct delegpt *dp;
 	int nolock = 1;
 
+	log_assert((retdpname && retdpnamelen
+		&& dpname_storage && dpname_storage_len > 0) ||
+		(retdpname == NULL && retdpnamelen == NULL
+		 && dpname_storage == NULL && dpname_storage_len == 0));
+
 	/* Check for stub. */
 	/* Lock both forwards and hints for atomic read. */
 	lock_rw_rdlock(&qstate->env->fwds->lock);

iterator/iter_utils.h

@@ -84,6 +84,7 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
 /**
  * Select a valid, nice target to send query to.
  * Sorting and removing unsuitable targets is combined.
+ * Adds records to the infra cache if not already there.
  *
  * @param iter_env: iterator module global state, with ip6 enabled and 
  *	do-not-query-addresses.

iterator/iterator.c

@@ -297,6 +297,7 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 	struct reply_info err;
 	struct msgreply_entry* msg;
 	if(qstate->no_cache_store) {
+		qstate->error_response_cache = 1;
 		return error_response(qstate, id, rcode);
 	}
 	if(qstate->prefetch_leeway > NORR_TTL) {
@@ -829,7 +830,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		struct mesh_state* sub = NULL;
 		fptr_ok(fptr_whitelist_modenv_add_sub(
 			qstate->env->add_sub));
-		if(!(*qstate->env->add_sub)(qstate, &qinf,
+		if(!(*qstate->env->add_sub)(qstate, &qinf, NULL,
 			qflags, prime, valrec, &subq, &sub)){
 			return 0;
 		}
@@ -838,8 +839,8 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		/* attach subquery, lookup existing or make a new one */
 		fptr_ok(fptr_whitelist_modenv_attach_sub(
 			qstate->env->attach_sub));
-		if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime,
-			valrec, &subq)) {
+		if(!(*qstate->env->attach_sub)(qstate, &qinf, NULL, qflags,
+			prime, valrec, &subq)) {
 			return 0;
 		}
 	}
@@ -2436,8 +2437,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	int tf_policy;
 	struct delegpt_addr* target;
 	struct outbound_entry* outq;
-	struct sockaddr_storage real_addr;
-	socklen_t real_addrlen;
 	int auth_fallback = 0;
 	uint8_t* qout_orig = NULL;
 	size_t qout_orig_len = 0;
@@ -3060,17 +3059,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->dnssec_lame_query?" but lame_query anyway": "");
 	}
 
-	real_addr = target->addr;
-	real_addrlen = target->addrlen;
-
-	if(ie->nat64.use_nat64 && target->addr.ss_family == AF_INET) {
-		addr_to_nat64(&target->addr, &ie->nat64.nat64_prefix_addr,
-			ie->nat64.nat64_prefix_addrlen, ie->nat64.nat64_prefix_net,
-			&real_addr, &real_addrlen);
-		log_name_addr(VERB_QUERY, "applied NAT64:",
-			iq->dp->name, &real_addr, real_addrlen);
-	}
-
 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(&iq->qinfo_out,
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0),
@@ -3082,7 +3070,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		!qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env,
 		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD),
 		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
-		ie, iq), sq_check_ratelimit, &real_addr, real_addrlen,
+		ie, iq), sq_check_ratelimit, &target->addr, target->addrlen,
 		iq->dp->name, iq->dp->namelen,
 		(iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream),
 		(iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream),
@@ -3099,7 +3087,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		log_addr(VERB_QUERY, "error sending query to auth server",
-			&real_addr, real_addrlen);
+			&target->addr, target->addrlen);
 		if(qstate->env->cfg->qname_minimisation)
 			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		return next_state(iq, QUERYTARGETS_STATE);
@@ -3236,8 +3224,19 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	} else iter_scrub_ds(iq->response, NULL, NULL);
 	if(type == RESPONSE_TYPE_THROWAWAY &&
 		FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_YXDOMAIN) {
-		/* YXDOMAIN is a permanent error, no need to retry */
-		type = RESPONSE_TYPE_ANSWER;
+		/* YXDOMAIN is a permanent error for DNAME expansion overflow
+		 * (RFC 6672 Section 2.2). Only accept if the response
+		 * contains a DNAME record in the answer section; otherwise
+		 * treat as invalid, to make sure the authoritative answer
+		 * make sense. */
+		size_t i;
+		for(i=0; i<iq->response->rep->an_numrrsets; i++) {
+			if(ntohs(iq->response->rep->rrsets[i]->rk.type)
+				== LDNS_RR_TYPE_DNAME) {
+				type = RESPONSE_TYPE_ANSWER;
+				break;
+			}
+		}
 	}
 	if(type == RESPONSE_TYPE_CNAME)
 		origtypecname = 1;
@@ -3616,7 +3615,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		return next_state(iq, INIT_REQUEST_STATE);
 	} else if(type == RESPONSE_TYPE_LAME) {
 		/* Cache the LAMEness. */
-		verbose(VERB_DETAIL, "query response was %sLAME",
+		verbose(VERB_DETAIL, "query response was categorized as %sLAME",
 			dnsseclame?"DNSSEC ":"");
 		if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) {
 			log_err("mark lame: mismatch in qname and dpname");
@@ -3655,7 +3654,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * In this case, the event is just sent directly back to 
 		 * the QUERYTARGETS_STATE without resetting anything, 
 		 * because, clearly, the next target must be tried. */
-		verbose(VERB_DETAIL, "query response was THROWAWAY");
+		verbose(VERB_DETAIL, "query response was categorized as THROWAWAY");
 	} else {
 		log_warn("A query response came back with an unknown type: %d",
 			(int)type);

libunbound/python/libunbound.i

@@ -853,7 +853,7 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
 %{ 
   //printf("resolve_start(%lX)\n",(long unsigned int)arg1);
   Py_BEGIN_ALLOW_THREADS 
-  $function 
+  $action
   Py_END_ALLOW_THREADS 
   //printf("resolve_stop()\n");
 %} 

libunbound/unbound.h

@@ -853,6 +853,8 @@ struct ub_server_stats {
 	long long qquic;
 	/** number of queries removed due to discard-timeout */
 	long long num_queries_discard_timeout;
+	/** number of queries removed due to replyaddr limit */
+	long long num_queries_replyaddr_limit;
 	/** number of queries removed due to wait-limit */
 	long long num_queries_wait_limit;
 	/** number of dns error reports generated */
@@ -872,6 +874,8 @@ struct ub_stats_info {
 	long long mesh_num_states;
 	/** mesh stats: current number of reply (user) states */
 	long long mesh_num_reply_states;
+	/** mesh stats: current number of reply entries */
+	long long mesh_num_reply_addrs;
 	/** mesh stats: number of reply states overwritten with a new one */
 	long long mesh_jostled;
 	/** mesh stats: number of incoming queries dropped */

pythonmod/interface.i

@@ -732,8 +732,8 @@ struct module_env {
         char* tls_auth_name, struct module_qstate* q, int* was_ratelimited);
     void (*detach_subs)(struct module_qstate* qstate);
     int (*attach_sub)(struct module_qstate* qstate,
-        struct query_info* qinfo, uint16_t qflags, int prime,
-        int valrec, struct module_qstate** newq);
+        struct query_info* qinfo, struct respip_client_info* cinfo,
+        uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
     void (*kill_sub)(struct module_qstate* newq);
     int (*detect_cycle)(struct module_qstate* qstate,
         struct query_info* qinfo, uint16_t flags, int prime,

pythonmod/pythonmod.c

@@ -454,7 +454,7 @@ int pythonmod_init(struct module_env* env, int id)
    if(PyDict_SetItemString(pe->data, "script", fname) < 0) {
 	log_err("pythonmod: could not add item to dictionary");
 	Py_XDECREF(fname);
-	goto python_init_fail;
+	goto fail_close_file;
    }
    Py_XDECREF(fname);
    Py_XINCREF(pe->data);  /* reference will be stolen below */
@@ -462,7 +462,7 @@ int pythonmod_init(struct module_env* env, int id)
 	log_err("pythonmod: could not add mod_env object");
 	Py_XDECREF(pe->data);  /* 2 times, here and on python_init_fail; */
 	                       /* on failure the reference is not stolen */
-	goto python_init_fail;
+	goto fail_close_file;
    }
 
    if (PyRun_SimpleFile(script_py, pe->fname) < 0) {
@@ -493,31 +493,15 @@ int pythonmod_init(struct module_env* env, int id)
       flen = (size_t)ftell(script_py);
       fstr = malloc(flen+1);
       if(!fstr) {
-	      log_err("malloc failure to print parse error");
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-	      Py_XDECREF(PyFileObject);
-#else
-	      fclose(script_py);
-#endif
-
-	      goto python_init_fail;
+		log_err("malloc failure to print parse error");
+		goto fail_close_file;
       }
       fseek(script_py, 0, SEEK_SET);
       if(fread(fstr, flen, 1, script_py) < 1) {
-	      log_err("file read failed to print parse error: %s: %s",
+		log_err("file read failed to print parse error: %s: %s",
 		pe->fname, strerror(errno));
-	      free(fstr);
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-	      Py_XDECREF(PyFileObject);
-#else
-	      fclose(script_py);
-#endif
-
-	      goto python_init_fail;
+		free(fstr);
+		goto fail_close_file;
       }
       fstr[flen] = 0;
       /* we compile the string, but do not run it, to stop side-effects */
@@ -527,21 +511,13 @@ int pythonmod_init(struct module_env* env, int id)
 #endif
 
       log_py_err();
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-      Py_XDECREF(PyFileObject);
-#else
-      fclose(script_py);
-#endif
-
 #if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
       /* no cleanup needed for python before 3.9 */
 #else
       /* cleanup for python 3.9 and newer */
       free(fstr);
 #endif
-      goto python_init_fail;
+      goto fail_close_file;
    }
 
 /* close the file */
@@ -602,6 +578,13 @@ int pythonmod_init(struct module_env* env, int id)
    PyGILState_Release(gil);
    return 1;
 
+fail_close_file:
+#if PY_MAJOR_VERSION < 3
+   Py_XDECREF(PyFileObject);
+#else
+   fclose(script_py);
+#endif
+
 python_init_fail:
    Py_XDECREF(pe->module);
    Py_XDECREF(pe->dict);

respip/respip.c

@@ -973,6 +973,9 @@ respip_rewrite_reply(const struct query_info* qinfo,
 					lock_rw_unlock(&raddr->lock);
 					lock_rw_unlock(&a->lock);
 					lock_rw_unlock(&az->rpz_lock);
+					if(view) {
+                    	lock_rw_unlock(&view->lock);
+					}
 					return 0;
 				}
 				if(rpz_used) {
@@ -1074,7 +1077,8 @@ generate_cname_request(struct module_qstate* qstate,
 	subqi.qtype = qstate->qinfo.qtype;
 	subqi.qclass = qstate->qinfo.qclass;
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
+	return (*qstate->env->attach_sub)(qstate, &subqi,
+		qstate->client_info, BIT_RD, 0, 0, &subq);
 }
 
 void
@@ -1233,7 +1237,8 @@ respip_inform_super(struct module_qstate* qstate, int id,
 	struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
 	struct reply_info* new_rep = NULL;
 
-	rq->state = RESPIP_SUBQUERY_FINISHED;
+	if(rq)
+		rq->state = RESPIP_SUBQUERY_FINISHED;
 
 	/* respip subquery should have always been created with a valid reply
 	 * in super. */

services/authzone.c

@@ -171,7 +171,7 @@ get_rrset_ttl(struct ub_packed_rrset_key* k)
 /** Copy rrset into region from domain-datanode and packet rrset */
 static struct ub_packed_rrset_key*
 auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node,
-	struct auth_rrset* rrset, struct regional* region, time_t adjust)
+	struct auth_rrset* rrset, struct regional* region)
 {
 	struct ub_packed_rrset_key key;
 	memset(&key, 0, sizeof(key));
@@ -182,7 +182,7 @@ auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node,
 	key.rk.type = htons(rrset->type);
 	key.rk.rrset_class = htons(z->dclass);
 	key.entry.hash = rrset_key_hash(&key.rk);
-	return packed_rrset_copy_region(&key, region, adjust);
+	return packed_rrset_copy_region(&key, region, 0);
 }
 
 /** fix up msg->rep TTL and prefetch ttl */
@@ -236,7 +236,7 @@ msg_add_rrset_an(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->an_numrrsets++;
@@ -260,7 +260,7 @@ msg_add_rrset_ns(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->ns_numrrsets++;
@@ -283,7 +283,7 @@ msg_add_rrset_ar(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->ar_numrrsets++;
@@ -1369,6 +1369,10 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				uncompressed_len = pkt_dname_len(&pktbuf);
 				if(!uncompressed_len)
 					return 0; /* parse error in dname */
+				compressed_len = sldns_buffer_position(
+					&pktbuf) - oldpos;
+				if(compressed_len > rdlen)
+					return 0; /* dname exceeds rdata */
 				if(!sldns_buffer_available(buf,
 					uncompressed_len))
 					/* dname too long for buffer */
@@ -1376,14 +1380,15 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				dname_pkt_copy(&pktbuf, 
 					sldns_buffer_current(buf), rd);
 				sldns_buffer_skip(buf, (ssize_t)uncompressed_len);
-				compressed_len = sldns_buffer_position(
-					&pktbuf) - oldpos;
 				rd += compressed_len;
 				rdlen -= compressed_len;
 				count--;
 				len = 0;
 				break;
 			case LDNS_RDF_TYPE_STR:
+				/* Check rdlen for resilience, because it is
+				 * checked above, that rdlen > 0 */
+				if(rdlen < 1) return 0; /* malformed */
 				len = rd[0] + 1;
 				break;
 			default:
@@ -1391,6 +1396,8 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				break;
 			}
 			if(len) {
+				if(len > rdlen)
+					return 0; /* malformed */
 				if(!sldns_buffer_available(buf, len))
 					return 0; /* too long for buffer */
 				sldns_buffer_write(buf, rd, len);
@@ -1998,12 +2005,21 @@ auth_zone_get_serial(struct auth_zone* z, uint32_t* serial)
 	struct auth_data* apex;
 	struct auth_rrset* soa;
 	struct packed_rrset_data* d;
+	size_t primlen, mboxlen;
 	apex = az_find_name(z, z->name, z->namelen);
 	if(!apex) return 0;
 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
 	if(!soa || soa->data->count==0)
 		return 0; /* no RRset or no RRs in rrset */
 	if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */
+	if((primlen = dname_valid(soa->data->rr_data[0]+2,
+		soa->data->rr_len[0]-2)) == 0)
+		return 0; /* primary dname malformed */
+	if((mboxlen = dname_valid(soa->data->rr_data[0]+2+primlen,
+		soa->data->rr_len[0]-2-primlen)) == 0)
+		return 0; /* mailbox dname malformed */
+	if(2+primlen+mboxlen+4*5 != soa->data->rr_len[0])
+		return 0; /* rdata malformed */
 	d = soa->data;
 	*serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20));
 	return 1;
@@ -2016,12 +2032,21 @@ xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr)
 	struct auth_data* apex;
 	struct auth_rrset* soa;
 	struct packed_rrset_data* d;
+	size_t primlen, mboxlen;
 	apex = az_find_name(z, z->name, z->namelen);
 	if(!apex) return 0;
 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
 	if(!soa || soa->data->count==0)
 		return 0; /* no RRset or no RRs in rrset */
 	if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */
+	if((primlen = dname_valid(soa->data->rr_data[0]+2,
+		soa->data->rr_len[0]-2)) == 0)
+		return 0; /* primary dname malformed */
+	if((mboxlen = dname_valid(soa->data->rr_data[0]+2+primlen,
+		soa->data->rr_len[0]-2-primlen)) == 0)
+		return 0; /* mailbox dname malformed */
+	if(2+primlen+mboxlen+4*5 != soa->data->rr_len[0])
+		return 0; /* rdata malformed */
 	/* SOA record ends with serial, refresh, retry, expiry, minimum,
 	 * as 4 byte fields */
 	d = soa->data;
@@ -3990,6 +4015,22 @@ auth_master_copy(struct auth_master* o)
 	return m;
 }
 
+/** append the master to the copied list. */
+static int
+auth_master_copy_and_append(struct auth_master* p, struct auth_master** list,
+	struct auth_master** last)
+{
+	struct auth_master* m = auth_master_copy(p);
+	if(!m) {
+		return 0;
+	}
+	m->next = NULL;
+	if(*last) (*last)->next = m;
+	if(!*list) *list = m;
+	*last = m;
+	return 1;
+}
+
 /** copy the master addresses from the task_probe lookups to the allow_notify
  * list of masters */
 static void
@@ -3998,17 +4039,27 @@ probe_copy_masters_for_allow_notify(struct auth_xfer* xfr)
 	struct auth_master* list = NULL, *last = NULL;
 	struct auth_master* p;
 	/* build up new list with copies */
+	/* The list in task probe has been looked up before the list in
+	 * task transfer. */
+	for(p = xfr->task_probe->masters; p; p=p->next) {
+		if(!auth_master_copy_and_append(p, &list, &last)) {
+			auth_free_masters(list);
+			/* failed because of malloc failure, use old list */
+			return;
+		}
+	}
+	/* The list in task transfer also contains the http entries. */
 	for(p = xfr->task_transfer->masters; p; p=p->next) {
-		struct auth_master* m = auth_master_copy(p);
-		if(!m) {
+		/* Copy the http entries from this lookup. The allow_notify
+		 * entries are not looked up from this list. The other
+		 * ones are already in from the probe lookups. */
+		if(!p->http)
+			continue;
+		if(!auth_master_copy_and_append(p, &list, &last)) {
 			auth_free_masters(list);
 			/* failed because of malloc failure, use old list */
 			return;
 		}
-		m->next = NULL;
-		if(last) last->next = m;
-		if(!list) list = m;
-		last = m;
 	}
 	/* success, replace list */
 	auth_free_masters(xfr->allow_notify_list);
@@ -4556,6 +4607,23 @@ http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 	return 0;
 }
 
+/** remove newlines from collated line */
+static void
+chunkline_newline_removal(sldns_buffer* buf)
+{
+	size_t i, end=sldns_buffer_limit(buf);
+	for(i=0; i<end; i++) {
+		char c = (char)sldns_buffer_read_u8_at(buf, i);
+		if(c == '\n' && i==end-1) {
+			sldns_buffer_write_u8_at(buf, i, 0);
+			sldns_buffer_set_limit(buf, end-1);
+			return;
+		}
+		if(c == '\n')
+			sldns_buffer_write_u8_at(buf, i, (uint8_t)' ');
+	}
+}
+
 /** find noncomment RR line in chunks, collates lines if ( ) format */
 static int
 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
@@ -4563,6 +4631,7 @@ chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
 {
 	int ret;
 	while(chunkline_get_line_collated(chunk, chunk_pos, buf)) {
+		chunkline_newline_removal(buf);
 		if(chunkline_is_comment_line_or_empty(buf)) {
 			/* a comment, go to next line */
 			continue;
@@ -4638,23 +4707,6 @@ chunklist_sum(struct auth_chunk* list)
 	return s;
 }
 
-/** remove newlines from collated line */
-static void
-chunkline_newline_removal(sldns_buffer* buf)
-{
-	size_t i, end=sldns_buffer_limit(buf);
-	for(i=0; i<end; i++) {
-		char c = (char)sldns_buffer_read_u8_at(buf, i);
-		if(c == '\n' && i==end-1) {
-			sldns_buffer_write_u8_at(buf, i, 0);
-			sldns_buffer_set_limit(buf, end-1);
-			return;
-		}
-		if(c == '\n')
-			sldns_buffer_write_u8_at(buf, i, (uint8_t)' ');
-	}
-}
-
 /** for http download, parse and add RR to zone */
 static int
 http_parse_add_rr(struct auth_xfer* xfr, struct auth_zone* z,
@@ -6668,6 +6720,18 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
 	return 1;
 }
 
+/** return true if there are probe (SOA UDP query) targets in the master list*/
+static int
+have_probe_targets(struct auth_master* list)
+{
+	struct auth_master* p;
+	for(p=list; p; p = p->next) {
+		if(!p->allow_notify && p->host)
+			return 1;
+	}
+	return 0;
+}
+
 /** move to sending the probe packets, next if fails. task_probe */
 static void
 xfr_probe_send_or_end(struct auth_xfer* xfr, struct module_env* env)
@@ -6707,6 +6771,16 @@ xfr_probe_send_or_end(struct auth_xfer* xfr, struct module_env* env)
 			verbose(VERB_ALGO, "auth zone %s probe: finished only_lookup", zname);
 		}
 		xfr_probe_disown(xfr);
+		if(!have_probe_targets(xfr->task_probe->masters)) {
+			/* If there are no masters to probe, go to transfer. */
+			if(xfr->task_transfer->worker == NULL) {
+				xfr_start_transfer(xfr, env, NULL);
+				return;
+			}
+			/* The transfer is already in progress. */
+			lock_basic_unlock(&xfr->lock);
+			return;
+		}
 		if(xfr->task_nextprobe->worker == NULL)
 			xfr_set_timeout(xfr, env, 0, 0);
 		lock_basic_unlock(&xfr->lock);
@@ -6863,18 +6937,6 @@ auth_xfer_timer(void* arg)
 	}
 }
 
-/** return true if there are probe (SOA UDP query) targets in the master list*/
-static int
-have_probe_targets(struct auth_master* list)
-{
-	struct auth_master* p;
-	for(p=list; p; p = p->next) {
-		if(!p->allow_notify && p->host)
-			return 1;
-	}
-	return 0;
-}
-
 /** start task_probe if possible, if no masters for probe start task_transfer
  * returns true if task has been started, and false if the task is already
  * in progress. */
@@ -6886,7 +6948,9 @@ xfr_start_probe(struct auth_xfer* xfr, struct module_env* env,
 	 * progress (due to notify)) */
 	if(xfr->task_probe->worker == NULL) {
 		if(!have_probe_targets(xfr->task_probe->masters) &&
-			!(xfr->task_probe->only_lookup &&
+			xfr->task_probe->masters != NULL)
+			xfr->task_probe->only_lookup = 1;
+		if(!(xfr->task_probe->only_lookup &&
 			xfr->task_probe->masters != NULL)) {
 			/* useless to pick up task_probe, no masters to
 			 * probe. Instead attempt to pick up task transfer */

services/cache/dns.c

@@ -60,10 +60,10 @@
  * @param rep: contains list of rrsets to store.
  * @param now: current time.
  * @param leeway: during prefetch how much leeway to update TTLs.
- * 	This makes rrsets (other than type NS) timeout sooner so they get
- * 	updated with a new full TTL.
- * 	Type NS does not get this, because it must not be refreshed from the
- * 	child domain, but keep counting down properly.
+ * 	This makes rrsets expire sooner so they get updated with a new full
+ * 	TTL.
+ * 	Child side type NS does get this but TTL checks are done using the time
+ * 	the query was created rather than the time the answer was received.
  * @param pside: if from parentside discovered NS, so that its NS is okay
  * 	in a prefetch situation to be updated (without becoming sticky).
  * @param qrep: update rrsets here if cache is better
@@ -100,11 +100,20 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 					rep->ref[i].id != rep->ref[i].key->id)
 					ck = NULL;
 				else 	ck = packed_rrset_copy_region(
-					rep->ref[i].key, region, now);
+					rep->ref[i].key, region,
+					((ntohs(rep->ref[i].key->rk.type)==
+					LDNS_RR_TYPE_NS && !pside)?qstarttime:now));
 				lock_rw_unlock(&rep->ref[i].key->entry.lock);
 				if(ck) {
 					/* use cached copy if memory allows */
 					qrep->rrsets[i] = ck;
+					ttl = ((struct packed_rrset_data*)
+					    ck->entry.data)->ttl;
+					if(ttl < qrep->ttl) {
+						qrep->ttl = ttl;
+						qrep->prefetch_ttl = PREFETCH_TTL_CALC(qrep->ttl);
+						qrep->serve_expired_ttl = qrep->ttl + SERVE_EXPIRED_TTL;
+					}
 				}
 			}
 			/* no break: also copy key item */
@@ -169,10 +178,12 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 
 	/* there was a reply_info_sortref(rep) here but it seems to be
 	 * unnecessary, because the cache gets locked per rrset. */
-	reply_info_set_ttls(rep, *env->now);
+	if((flags & DNSCACHE_STORE_EXPIRED_MSG_CACHEDB)) {
+		reply_info_absolute_ttls(rep, *env->now, *env->now - ttl);
+	} else	reply_info_set_ttls(rep, *env->now);
 	store_rrsets(env, rep, *env->now, leeway, pside, qrep, region,
 		qstarttime);
-	if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
+	if(ttl == 0) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
 		verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
@@ -221,8 +232,15 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 
 	/* snip off front part of qname until the type is found */
 	while(qnamelen > 0) {
-		if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 
-			qnamelen, searchtype, qclass, 0, now, 0))) {
+		rrset = rrset_cache_lookup(env->rrset_cache, qname,
+			qnamelen, searchtype, qclass, 0, now, 0);
+		if(!rrset && searchtype == LDNS_RR_TYPE_DNAME)
+			/* If not found, for type DNAME, try 0TTL stored,
+			 * for its grace period. */
+			rrset = rrset_cache_lookup(env->rrset_cache, qname,
+				qnamelen, searchtype, qclass,
+				PACKED_RRSET_UPSTREAM_0TTL, now, 0);
+		if(rrset) {
 			uint8_t* origqname = qname;
 			size_t origqnamelen = qnamelen;
 			if(!noexpiredabove)
@@ -272,8 +290,10 @@ addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 {
 	if((msg->rep->rrsets[msg->rep->rrset_count] = 
 		packed_rrset_copy_region(rrset, region, now))) {
+		struct packed_rrset_data* d = rrset->entry.data;
 		msg->rep->ar_numrrsets++;
 		msg->rep->rrset_count++;
+		UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	}
 }
 
@@ -456,8 +476,10 @@ find_add_ds(struct module_env* env, struct regional* region,
 		/* add it to auth section. This is the second rrset. */
 		if((msg->rep->rrsets[msg->rep->rrset_count] = 
 			packed_rrset_copy_region(rrset, region, now))) {
+			struct packed_rrset_data* d = rrset->entry.data;
 			msg->rep->ns_numrrsets++;
 			msg->rep->rrset_count++;
+			UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 		}
 		lock_rw_unlock(&rrset->entry.lock);
 	}
@@ -487,6 +509,8 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		return NULL; /* integer overflow protection */
 	msg->rep->flags = BIT_QR; /* with QR, no AA */
 	msg->rep->qdcount = 1;
+	msg->rep->ttl = MAX_TTL; /* will be updated (brought down) while we add
+				  * rrsets to the message */
 	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
 		regional_alloc(region, 
@@ -497,24 +521,28 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 }
 
 int
-dns_msg_authadd(struct dns_msg* msg, struct regional* region, 
+dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+	struct packed_rrset_data* d = rrset->entry.data;
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 		packed_rrset_copy_region(rrset, region, now)))
 		return 0;
 	msg->rep->ns_numrrsets++;
+	UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	return 1;
 }
 
 int
-dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 
+dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+	struct packed_rrset_data* d = rrset->entry.data;
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 		packed_rrset_copy_region(rrset, region, now)))
 		return 0;
 	msg->rep->an_numrrsets++;
+	UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	return 1;
 }
 
@@ -585,6 +613,7 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
+	msg->rep->ttl = MAX_TTL;
 	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->reason_bogus_str = NULL;
 	if(num > RR_COUNT_MAX)
@@ -606,13 +635,13 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	size_t i;
 	int is_expired = 0;
 	time_t now_control = now;
-	if(now > r->ttl) {
+	if(TTL_IS_EXPIRED(r->ttl, now)) {
 		/* Check if we are allowed to serve expired */
 		if(!allow_expired || !reply_info_can_answer_expired(r, now))
 			return NULL;
-		/* Change the current time so we can pass the below TTL checks when
-		 * serving expired data. */
-		now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
+		/* Change the current time so we can pass the below TTL checks
+		 * when serving expired data. */
+		now_control = 0;
 		is_expired = 1;
 	}
 
@@ -620,15 +649,6 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	if(!msg) return NULL;
 	msg->rep->flags = r->flags;
 	msg->rep->qdcount = r->qdcount;
-	msg->rep->ttl = is_expired
-		?SERVE_EXPIRED_REPLY_TTL
-		:r->ttl - now;
-	if(r->prefetch_ttl > now)
-		msg->rep->prefetch_ttl = r->prefetch_ttl - now;
-	else
-		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-	msg->rep->serve_expired_norec_ttl = 0;
 	msg->rep->security = r->security;
 	msg->rep->an_numrrsets = r->an_numrrsets;
 	msg->rep->ns_numrrsets = r->ns_numrrsets;
@@ -656,13 +676,30 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 		return NULL;
 	}
 	for(i=0; i<msg->rep->rrset_count; i++) {
+		struct packed_rrset_data* d;
 		msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
 			region, now);
 		if(!msg->rep->rrsets[i]) {
 			rrset_array_unlock(r->ref, r->rrset_count);
 			return NULL;
 		}
+		d = msg->rep->rrsets[i]->entry.data;
+		UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	}
+	if(msg->rep->rrset_count < 1) {
+		msg->rep->ttl = is_expired
+			?SERVE_EXPIRED_REPLY_TTL
+			:r->ttl - now;
+		if(r->prefetch_ttl > now)
+			msg->rep->prefetch_ttl = r->prefetch_ttl - now;
+		else
+			msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+	} else {
+		/* msg->rep->ttl has been updated through the RRSets above */
+		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+	}
+	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
+	msg->rep->serve_expired_norec_ttl = 0;
 	if(env)
 		rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 
 		r->rrset_count);
@@ -701,7 +738,7 @@ rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	struct dns_msg* msg;
 	struct packed_rrset_data* d = (struct packed_rrset_data*)
 		rrset->entry.data;
-	if(now > d->ttl)
+	if(TTL_IS_EXPIRED(d->ttl, now))
 		return NULL;
 	msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
 	if(!msg)
@@ -736,8 +773,15 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 		rrset->entry.data;
 	uint8_t* newname, *dtarg = NULL;
 	size_t newlen, dtarglen;
-	if(now > d->ttl)
-		return NULL;
+	time_t rr_ttl;
+	if(TTL_IS_EXPIRED(d->ttl, now)) {
+		/* Allow TTL=0 DNAME from upstream within grace period */
+		if(!(rrset->rk.flags & PACKED_RRSET_UPSTREAM_0TTL))
+			return NULL;
+		rr_ttl = 0;
+	} else {
+		rr_ttl = d->ttl - now;
+	}
 	/* only allow validated (with DNSSEC) DNAMEs used from cache 
 	 * for insecure DNAMEs, query again. */
 	*sec_status = d->security;
@@ -749,7 +793,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	msg->rep->flags = BIT_QR; /* reply, no AA, no error */
         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 	msg->rep->qdcount = 1;
-	msg->rep->ttl = d->ttl - now;
+	msg->rep->ttl = rr_ttl;
 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
 	msg->rep->serve_expired_norec_ttl = 0;
@@ -801,7 +845,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	if(!newd)
 		return NULL;
 	ck->entry.data = newd;
-	newd->ttl = d->ttl - now; /* RFC6672: synth CNAME TTL == DNAME TTL */
+	newd->ttl = rr_ttl; /* RFC6672: synth CNAME TTL == DNAME TTL */
 	newd->count = 1;
 	newd->rrsig_count = 0;
 	newd->trust = rrset_trust_ans_noAA;
@@ -844,6 +888,8 @@ fill_any(struct module_env* env,
 		/* set NOTIMPL for RFC 8482 */
 		msg->rep->flags |= LDNS_RCODE_NOTIMPL;
 		msg->rep->security = sec_status_indeterminate;
+		msg->rep->ttl = 1; /* empty NOTIMPL response will never be
+				    * updated with rrsets, set TTL to 1 */
 		return msg;
 	}
 
@@ -1069,7 +1115,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 			msgqinf->qclass, flags, 0, 1);
 		if(e) {
 			struct reply_info* cached = e->entry.data;
-			if(cached->ttl < *env->now
+			if(TTL_IS_EXPIRED(cached->ttl, *env->now)
 				&& reply_info_could_use_expired(cached, *env->now)
 				/* If we are validating make sure only
 				 * validating modules can update such messages.

services/cache/dns.h

@@ -53,7 +53,7 @@ struct delegpt;
  *  Must be an unsigned 32-bit value larger than 0xffff */
 
 /** Allow caching a DNS message with a zero TTL. */
-#define DNSCACHE_STORE_ZEROTTL 0x100000
+#define DNSCACHE_STORE_EXPIRED_MSG_CACHEDB 0x100000
 
 /**
  * Region allocated message reply

services/cache/infra.c

@@ -1269,7 +1269,8 @@ int infra_wait_limit_allowed(struct infra_cache* infra, struct comm_reply* rep,
 	int cookie_valid, struct config_file* cfg)
 {
 	struct lruhash_entry* entry;
-	if(cfg->wait_limit == 0)
+	if(cfg->wait_limit == 0 ||
+		(cookie_valid && cfg->wait_limit_cookie == 0))
 		return 1;
 
 	entry = infra_find_ip_ratedata(infra, &rep->client_addr,

services/cache/rrset.c

@@ -131,7 +131,7 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
 	struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
 	struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
 	/*	o if new data is expired, cached data is better */
-	if( newd->ttl < timenow && timenow <= cached->ttl)
+	if( TTL_IS_EXPIRED(newd->ttl, timenow) && !TTL_IS_EXPIRED(cached->ttl, timenow))
 		return 0;
 	/* 	o store if rrset has been validated 
 	 *  		everything better than bogus data 
@@ -146,13 +146,13 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
         if( newd->trust > cached->trust ) {
 		/* if the cached rrset is bogus, and new is equal,
 		 * do not update the TTL - let it expire. */
-		if(equal && cached->ttl >= timenow && 
+		if(equal && !TTL_IS_EXPIRED(cached->ttl, timenow) &&
 			cached->security == sec_status_bogus)
 			return 0;
                 return 1;
 	}
 	/*	o item in cache has expired */
-	if( cached->ttl < timenow )
+	if( TTL_IS_EXPIRED(cached->ttl, timenow) )
 		return 1;
 	/*  o same trust, but different in data - insert it */
 	if( newd->trust == cached->trust && !equal ) {
@@ -278,6 +278,10 @@ void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	(void)rrset_cache_update(rrset_cache, &ref, alloc, timenow);
 }
 
+/** Grace period in seconds for TTL=0 DNAME rrsets (RFC 2308: do not cache).
+ * Allows synthesis from cache within this window to reduce recursion load. */
+#define DNAME_TTL0_GRACE_SECONDS 1
+
 struct ub_packed_rrset_key* 
 rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint32_t flags, time_t timenow,
@@ -300,27 +304,36 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 		/* check TTL */
 		struct packed_rrset_data* data = 
 			(struct packed_rrset_data*)e->data;
-		if(timenow > data->ttl) {
-			lock_rw_unlock(&e->lock);
-			return NULL;
+		struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key;
+		if(TTL_IS_EXPIRED(data->ttl, timenow)) {
+			/* Allow TTL=0 DNAME within grace period for synthesis */
+			if(qtype == LDNS_RR_TYPE_DNAME &&
+			   (k->rk.flags & PACKED_RRSET_UPSTREAM_0TTL) &&
+			   (timenow - data->ttl_add) <= DNAME_TTL0_GRACE_SECONDS) {
+				/* within grace: allow for synthesis */
+			} else {
+				lock_rw_unlock(&e->lock);
+				return NULL;
+			}
 		}
 		/* we're done */
-		return (struct ub_packed_rrset_key*)e->key;
+		return k;
 	}
 	return NULL;
 }
 
-int 
+int
 rrset_array_lock(struct rrset_ref* ref, size_t count, time_t timenow)
 {
 	size_t i;
+	struct packed_rrset_data* d;
 	for(i=0; i<count; i++) {
 		if(i>0 && ref[i].key == ref[i-1].key)
 			continue; /* only lock items once */
 		lock_rw_rdlock(&ref[i].key->entry.lock);
-		if(ref[i].id != ref[i].key->id || timenow >
-			((struct packed_rrset_data*)(ref[i].key->entry.data))
-			->ttl) {
+		d = ref[i].key->entry.data;
+		if(ref[i].id != ref[i].key->id ||
+			TTL_IS_EXPIRED(d->ttl, timenow)) {
 			/* failure! rollback our readlocks */
 			rrset_array_unlock(ref, i+1);
 			return 0;
@@ -511,7 +524,7 @@ rrset_cache_expired_above(struct rrset_cache* r, uint8_t** qname, size_t*
 			*qnamelen, searchtype, qclass, 0, 0, 0))) {
 			struct packed_rrset_data* data =
 				(struct packed_rrset_data*)rrset->entry.data;
-			if(now > data->ttl) {
+			if(TTL_IS_EXPIRED(data->ttl, now)) {
 				/* it is expired, this is not wanted */
 				lock_rw_unlock(&rrset->entry.lock);
 				log_nametypeclass(VERB_ALGO, "this rrset is expired", *qname, searchtype, qclass);

services/listen_dnsport.c

@@ -1564,7 +1564,7 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 			cp = comm_point_create_udp(base, ports->fd,
 				front->udp_buff, ports->pp2_enabled, cb,
 				cb_arg, ports->socket);
-		} else if(ports->ftype == listen_type_doq) {
+		} else if(ports->ftype == listen_type_doq && doq_table) {
 #ifndef HAVE_NGTCP2
 			log_warn("Unbound is not compiled with "
 				"ngtcp2. This is required to use DNS "
@@ -2300,21 +2300,8 @@ int
 tcp_req_info_handle_read_close(struct tcp_req_info* req)
 {
 	verbose(VERB_ALGO, "tcp channel read side closed %d", req->cp->fd);
-	/* reset byte count for (potential) partial read */
-	req->cp->tcp_byte_count = 0;
-	/* if we still have results to write, pick up next and write it */
-	if(req->num_done_req != 0) {
-		tcp_req_pickup_next_result(req);
-		tcp_req_info_setup_listen(req);
-		return 1;
-	}
-	/* if nothing to do, this closes the connection */
-	if(req->num_open_req == 0 && req->num_done_req == 0)
-		return 0;
-	/* otherwise, we must be waiting for dns resolve, wait with timeout */
-	req->read_is_closed = 1;
-	tcp_req_info_setup_listen(req);
-	return 1;
+	/* RFC 7766 6.2.4 says to drop pending replies when client closes. */
+	return 0; /* drop connection */
 }
 
 void
@@ -2884,6 +2871,7 @@ submit_http_error:
 	sldns_buffer_flip(h2_stream->qbuffer);
 	h2_session->postpone_drop = 1;
 	query_read_done = http2_query_read_done(h2_session, h2_stream);
+	h2_session->postpone_drop = 0;
 	if(query_read_done < 0)
 		return NGHTTP2_ERR_CALLBACK_FAILURE;
 	else if(!query_read_done) {
@@ -2893,11 +2881,9 @@ submit_http_error:
 			 * failure will result in reclaiming (and closing)
 			 * of comm point. */
 			verbose(VERB_QUERY, "http2 query dropped in worker cb");
-			h2_session->postpone_drop = 0;
 			return NGHTTP2_ERR_CALLBACK_FAILURE;
 		}
 		/* nothing to submit right now, query added to mesh. */
-		h2_session->postpone_drop = 0;
 		return 0;
 	}
 	if(!http2_submit_dns_response(h2_session)) {
@@ -3275,14 +3261,18 @@ nghttp2_session_callbacks* http2_req_callbacks_create(void)
 struct doq_table*
 doq_table_create(struct config_file* cfg, struct ub_randstate* rnd)
 {
-	struct doq_table* table = calloc(1, sizeof(*table));
+	struct doq_table* table;
+
+	if (!cfg->quic_port)
+		return NULL;
+	table = calloc(1, sizeof(*table));
 	if(!table)
 		return NULL;
 #ifdef USE_NGTCP2_CRYPTO_OSSL
 	/* Initialize the ossl crypto, it is harmless to call twice,
 	 * and this is before use of doq connections. */
 	if(ngtcp2_crypto_ossl_init() != 0) {
-		log_err("ngtcp2_crypto_oss_init failed");
+		log_err("ngtcp2_crypto_ossl_init failed");
 		free(table);
 		return NULL;
 	}
@@ -3354,7 +3344,7 @@ conn_tree_del(rbnode_type* node, void* arg)
 {
 	struct doq_table* table = (struct doq_table*)arg;
 	struct doq_conn* conn;
-	if(!node)
+	if(!node || !table)
 		return;
 	conn = (struct doq_conn*)node->key;
 	if(conn->timer.timer_in_list) {
@@ -3413,6 +3403,7 @@ doq_timer_find_time(struct doq_table* table, struct timeval* tv)
 {
 	struct doq_timer key;
 	struct rbnode_type* node;
+	log_assert(table != NULL);
 	memset(&key, 0, sizeof(key));
 	key.time.tv_sec = tv->tv_sec;
 	key.time.tv_usec = tv->tv_usec;
@@ -3776,7 +3767,7 @@ doq_repinfo_retrieve_localaddr(struct comm_reply* repinfo,
 		memset(sa6, 0, *localaddrlen);
 		sa6->sin6_family = AF_INET6;
 		memmove(&sa6->sin6_addr, &repinfo->pktinfo.v6info.ipi6_addr,
-			*localaddrlen);
+			sizeof(struct in6_addr));
 		sa6->sin6_port = repinfo->doq_srcport;
 #endif
 	} else {
@@ -3786,7 +3777,7 @@ doq_repinfo_retrieve_localaddr(struct comm_reply* repinfo,
 		memset(sa, 0, *localaddrlen);
 		sa->sin_family = AF_INET;
 		memmove(&sa->sin_addr, &repinfo->pktinfo.v4info.ipi_addr,
-			*localaddrlen);
+			sizeof(struct in_addr));
 		sa->sin_port = repinfo->doq_srcport;
 #elif defined(IP_RECVDSTADDR)
 		struct sockaddr_in* sa = (struct sockaddr_in*)localaddr;
@@ -4922,6 +4913,7 @@ doq_conid_find(struct doq_table* table, const uint8_t* data, size_t datalen)
 	key.node.key = &key;
 	key.cid = (void*)data;
 	key.cidlen = datalen;
+	log_assert(table != NULL);
 	node = rbtree_search(table->conid_tree, &key);
 	if(node)
 		return (struct doq_conid*)node->key;
@@ -5662,6 +5654,8 @@ doq_table_quic_size_available(struct doq_table* table,
 	struct config_file* cfg, size_t mem)
 {
 	size_t cur;
+	if (!table)
+		return 0;
 	lock_basic_lock(&table->size_lock);
 	cur = table->current_size;
 	lock_basic_unlock(&table->size_lock);

services/localzone.c

@@ -56,6 +56,24 @@
  * with 16 bytes for an A record, a 64K packet has about 4000 max */
 #define LOCALZONE_RRSET_COUNT_MAX 4096
 
+static const char* default_zones_reverse_array[] = {
+	"127.in-addr.arpa.", /* reverse ip4 zone */
+	"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", /* reverse ip6 zone */
+	0
+};
+const char** local_zones_default_reverse = default_zones_reverse_array;
+
+static const char* default_zones_special_array[] = {
+	"test.",		/* RFC 6761 */
+	"invalid.",		/* RFC 6761 */
+	"onion.",		/* RFC 7686 */
+	"home.arpa.",		/* RFC 8375 */
+	"resolver.arpa.",	/* RFC 9462 */
+	"service.arpa.",	/* RFC 9665 */
+	0
+};
+const char** local_zones_default_special = default_zones_special_array;
+
 /** print all RRsets in local zone */
 static void
 local_zone_out(struct local_zone* z)
@@ -650,7 +668,7 @@ lz_enter_rr_str(struct local_zones* zones, const char* rr)
 	}
 	labs = dname_count_size_labels(rr_name, &len);
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
+	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type, 1);
 	if(!z) {
 		lock_rw_unlock(&zones->lock);
 		fatal_exit("internal error: no zone for rr %s", rr);
@@ -834,7 +852,7 @@ lz_nodefault(struct config_file* cfg, const char* name)
 
 	for(p = cfg->local_zones_nodefault; p; p = p->next) {
 		/* compare zone name, lowercase, compare without ending . */
-		if(strncasecmp(p->str, name, len) == 0 && 
+		if(strncasecmp(p->str, name, len) == 0 &&
 			(strlen(p->str) == len || (strlen(p->str)==len+1 &&
 			p->str[len] == '.')))
 			return 1;
@@ -842,6 +860,45 @@ lz_nodefault(struct config_file* cfg, const char* name)
 	return 0;
 }
 
+/** enter reverse default zone */
+static int
+add_reverse_default(struct local_zones* zones, struct config_file* cfg,
+        const char* name)
+{
+	struct local_zone* z;
+	char str[1024]; /* known long enough */
+	if(lz_exists(zones, name) || lz_nodefault(cfg, name))
+		return 1; /* do not enter default content */
+	if(!(z=lz_enter_zone(zones, name, "static", LDNS_RR_CLASS_IN)))
+		return 0;
+	snprintf(str, sizeof(str), "%s 10800 IN SOA localhost. "
+		"nobody.invalid. 1 3600 1200 604800 10800", name);
+	if(!lz_enter_rr_into_zone(z, str)) {
+		lock_rw_unlock(&z->lock);
+		return 0;
+	}
+	snprintf(str, sizeof(str), "%s 10800 IN NS localhost. ", name);
+	if(!lz_enter_rr_into_zone(z, str)) {
+		lock_rw_unlock(&z->lock);
+		return 0;
+	}
+	if(strncasecmp("127.in-addr.arpa.", name, 17) ==  0) {
+		if(!lz_enter_rr_into_zone(z,
+			"1.0.0.127.in-addr.arpa. 10800 IN PTR localhost.")) {
+			lock_rw_unlock(&z->lock);
+			return 0;
+		}
+	} else if(strncasecmp("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", name, 73) ==  0) {
+		snprintf(str, sizeof(str), "%s 10800 IN PTR localhost.", name);
+		if(!lz_enter_rr_into_zone(z, str)) {
+			lock_rw_unlock(&z->lock);
+			return 0;
+		}
+	}
+	lock_rw_unlock(&z->lock);
+	return 1;
+}
+
 /** enter (AS112) empty default zone */
 static int
 add_empty_default(struct local_zones* zones, struct config_file* cfg,
@@ -902,72 +959,23 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 		}
 		lock_rw_unlock(&z->lock);
 	}
-	/* reverse ip4 zone */
-	if(!lz_exists(zones, "127.in-addr.arpa.") &&
-		!lz_nodefault(cfg, "127.in-addr.arpa.")) {
-		if(!(z=lz_enter_zone(zones, "127.in-addr.arpa.", "static", 
-			LDNS_RR_CLASS_IN)) ||
-		   !lz_enter_rr_into_zone(z,
-			"127.in-addr.arpa. 10800 IN NS localhost.") ||
-		   !lz_enter_rr_into_zone(z,
-			"127.in-addr.arpa. 10800 IN SOA localhost. "
-			"nobody.invalid. 1 3600 1200 604800 10800") ||
-		   !lz_enter_rr_into_zone(z,
-			"1.0.0.127.in-addr.arpa. 10800 IN PTR localhost.")) {
+
+	/* ip4 and ip6 reverse */
+	for(zstr = local_zones_default_reverse; *zstr; zstr++) {
+		if(!add_reverse_default(zones, cfg, *zstr)) {
 			log_err("out of memory adding default zone");
-			if(z) { lock_rw_unlock(&z->lock); }
 			return 0;
 		}
-		lock_rw_unlock(&z->lock);
 	}
-	/* reverse ip6 zone */
-	if(!lz_exists(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.") &&
-		!lz_nodefault(cfg, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.")) {
-		if(!(z=lz_enter_zone(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", "static", 
-			LDNS_RR_CLASS_IN)) ||
-		   !lz_enter_rr_into_zone(z,
-			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost.") ||
-		   !lz_enter_rr_into_zone(z,
-			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. "
-			"nobody.invalid. 1 3600 1200 604800 10800") ||
-		   !lz_enter_rr_into_zone(z,
-			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost.")) {
+
+	/* special-use zones */
+	for(zstr = local_zones_default_special; *zstr; zstr++) {
+		if(!add_empty_default(zones, cfg, *zstr)) {
 			log_err("out of memory adding default zone");
-			if(z) { lock_rw_unlock(&z->lock); }
 			return 0;
 		}
-		lock_rw_unlock(&z->lock);
-	}
-	/* home.arpa. zone (RFC 8375) */
-	if(!add_empty_default(zones, cfg, "home.arpa.")) {
-		log_err("out of memory adding default zone");
-		return 0;
-	}
-	/* resolver.arpa. zone (RFC 9462) */
-	if(!add_empty_default(zones, cfg, "resolver.arpa.")) {
-		log_err("out of memory adding default zone");
-		return 0;
-	}
-	/* service.arpa. zone (draft-ietf-dnssd-srp-25) */
-	if(!add_empty_default(zones, cfg, "service.arpa.")) {
-		log_err("out of memory adding default zone");
-		return 0;
-	}
-	/* onion. zone (RFC 7686) */
-	if(!add_empty_default(zones, cfg, "onion.")) {
-		log_err("out of memory adding default zone");
-		return 0;
-	}
-	/* test. zone (RFC 6761) */
-	if(!add_empty_default(zones, cfg, "test.")) {
-		log_err("out of memory adding default zone");
-		return 0;
-	}
-	/* invalid. zone (RFC 6761) */
-	if(!add_empty_default(zones, cfg, "invalid.")) {
-		log_err("out of memory adding default zone");
-		return 0;
 	}
+
 	/* block AS112 zones, unless asked not to */
 	if(!cfg->unblock_lan_zones) {
 		for(zstr = as112_zones; *zstr; zstr++) {
@@ -1062,14 +1070,15 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
 		labs = dname_count_size_labels(rr_name, &len);
 		lock_rw_rdlock(&zones->lock);
 		if(!local_zones_lookup(zones, rr_name, len, labs, rr_class,
-			rr_type)) {
+			rr_type, 1)) {
 			/* Check if there is a zone that this could go
 			 * under but for different class; created zones are
 			 * always for LDNS_RR_CLASS_IN. Create the zone with
 			 * a different class but the same configured
 			 * local_zone_type. */
 			struct local_zone* z = local_zones_lookup(zones,
-				rr_name, len, labs, LDNS_RR_CLASS_IN, rr_type);
+				rr_name, len, labs, LDNS_RR_CLASS_IN, rr_type,
+				1);
 			if(z) {
 				uint8_t* name = memdup(z->name, z->namelen);
 				size_t znamelen = z->namelen;
@@ -1231,28 +1240,48 @@ local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 
 struct local_zone* 
 local_zones_lookup(struct local_zones* zones,
-        uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype)
+        uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
+	int foradd)
 {
 	return local_zones_tags_lookup(zones, name, len, labs,
-		dclass, dtype, NULL, 0, 1);
+		dclass, dtype, NULL, 0, 1, foradd);
 }
 
 struct local_zone* 
 local_zones_tags_lookup(struct local_zones* zones,
         uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	uint8_t* taglist, size_t taglen, int ignoretags)
+	uint8_t* taglist, size_t taglen, int ignoretags, int foradd)
 {
 	rbnode_type* res = NULL;
 	struct local_zone *result;
 	struct local_zone key;
 	int m;
-	/* for type DS use a zone higher when on a zonecut */
-	if(dtype == LDNS_RR_TYPE_DS && !dname_is_root(name)) {
-		dname_remove_label(&name, &len);
-		labs--;
-	}
 	key.node.key = &key;
 	key.dclass = dclass;
+	/* for type DS use a zone higher when on a zonecut */
+	if(dtype == LDNS_RR_TYPE_DS && !dname_is_root(name)) {
+		/* If this is at a zone cut, of a local-zone, and it is
+		 * of type always_refuse. Then also refuse the type DS
+		 * for it. That could make it DNSSEC bogus, but it is
+		 * REFUSED anyway. It stops CNAME type answers in the
+		 * type DS lookup. */
+		key.name = name;
+		key.namelen = len;
+		key.namelabs = labs;
+		/* For additions and removals, use the ordinary rule,
+		 * to remove a label for type DS to locate the parent zone.
+		 * That is where the DS RR needs to be put. */
+		if(!foradd &&
+			(result=(struct local_zone*)rbtree_search(
+			&zones->ztree, &key)) != NULL &&
+			result->type == local_zone_always_refuse) {
+			/* The type DS does not go up one label. */
+			return result;
+		} else {
+			dname_remove_label(&name, &len);
+			labs--;
+		}
+	}
 	key.name = name;
 	key.namelen = len;
 	key.namelabs = labs;
@@ -1863,7 +1892,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		if(view->local_zones &&
 			(z = local_zones_lookup(view->local_zones,
 			qinfo->qname, qinfo->qname_len, labs,
-			qinfo->qclass, qinfo->qtype))) {
+			qinfo->qclass, qinfo->qtype, 0))) {
 			lock_rw_rdlock(&z->lock);
 			lzt = z->type;
 		}
@@ -1897,7 +1926,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		lock_rw_rdlock(&zones->lock);
 		if(!(z = local_zones_tags_lookup(zones, qinfo->qname,
 			qinfo->qname_len, labs, qinfo->qclass, qinfo->qtype,
-			taglist, taglen, 0))) {
+			taglist, taglen, 0, 0))) {
 			lock_rw_unlock(&zones->lock);
 			return 0;
 		}
@@ -2102,7 +2131,8 @@ local_zones_add_RR(struct local_zones* zones, const char* rr)
 	/* could first try readlock then get writelock if zone does not exist,
 	 * but we do not add enough RRs (from multiple threads) to optimize */
 	lock_rw_wrlock(&zones->lock);
-	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
+	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type,
+		1);
 	if(!z) {
 		z = local_zones_add_zone(zones, rr_name, len, labs, rr_class,
 			local_zone_transparent);
@@ -2180,7 +2210,8 @@ void local_zones_del_data(struct local_zones* zones,
 
 	/* remove DS */
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS);
+	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS,
+		1);
 	if(z) {
 		lock_rw_wrlock(&z->lock);
 		d = local_zone_find_data(z, name, len, labs);
@@ -2194,7 +2225,7 @@ void local_zones_del_data(struct local_zones* zones,
 
 	/* remove other types */
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, name, len, labs, dclass, 0);
+	z = local_zones_lookup(zones, name, len, labs, dclass, 0, 1);
 	if(!z) {
 		/* no such zone, we're done */
 		lock_rw_unlock(&zones->lock);

services/localzone.h

@@ -57,6 +57,9 @@ struct sldns_buffer;
 struct comm_reply;
 struct config_strlist;
 
+extern const char** local_zones_default_special;
+extern const char** local_zones_default_reverse;
+
 /**
  * Local zone type
  * This type determines processing for queries that did not match
@@ -262,11 +265,13 @@ void local_zone_delete(struct local_zone* z);
  * @param taglen: length of taglist.
  * @param ignoretags: lookup zone by name and class, regardless the
  * local-zone's tags.
+ * @param foradd: if the lookup is for addition or removal of the type.
+ *	Used for type DS. The lookup for answers turns this off.
  * @return closest local_zone or NULL if no covering zone is found.
  */
 struct local_zone* local_zones_tags_lookup(struct local_zones* zones, 
 	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	uint8_t* taglist, size_t taglen, int ignoretags);
+	uint8_t* taglist, size_t taglen, int ignoretags, int foradd);
 
 /**
  * Lookup zone that contains the given name, class.
@@ -278,10 +283,13 @@ struct local_zone* local_zones_tags_lookup(struct local_zones* zones,
  * @param dclass: class to lookup.
  * @param dtype: type of the record, if type DS then a zone higher up is found
  *   pass 0 to just plain find a zone for a name.
+ * @param foradd: if the lookup is for addition or removal of the type.
+ *	Used for type DS. The lookup for answers turns this off.
  * @return closest local_zone or NULL if no covering zone is found.
  */
 struct local_zone* local_zones_lookup(struct local_zones* zones, 
-	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype);
+	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
+	int foradd);
 
 /**
  * Debug helper. Print all zones 

services/mesh.c

@@ -231,6 +231,7 @@ mesh_create(struct module_stack* stack, struct module_env* env)
 	mesh->ans_expired = 0;
 	mesh->ans_cachedb = 0;
 	mesh->num_queries_discard_timeout = 0;
+	mesh->num_queries_replyaddr_limit = 0;
 	mesh->num_queries_wait_limit = 0;
 	mesh->num_dns_error_reports = 0;
 	mesh->max_reply_states = env->cfg->num_queries_per_thread;
@@ -348,7 +349,7 @@ mesh_serve_expired_lookup(struct module_qstate* qstate,
 
 	key = (struct msgreply_entry*)e->key;
 	data = (struct reply_info*)e->data;
-	if(data->ttl < timenow) *is_expired = 1;
+	if(TTL_IS_EXPIRED(data->ttl, timenow)) *is_expired = 1;
 	msg = tomsg(qstate->env, &key->key, data, qstate->region, timenow,
 		qstate->env->cfg->serve_expired, qstate->env->scratch);
 	if(!msg)
@@ -441,9 +442,18 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	if(!infra_wait_limit_allowed(mesh->env->infra_cache, rep,
 		edns->cookie_valid, mesh->env->cfg)) {
 		verbose(VERB_ALGO, "Too many queries waiting from the IP. "
-			"dropping incoming query.");
-		comm_point_drop_reply(rep);
+			"servfail incoming query.");
 		mesh->num_queries_wait_limit++;
+		edns_opt_list_append_ede(&edns->opt_list_out,
+			mesh->env->scratch, LDNS_EDE_OTHER,
+			"Too many queries queued up and waiting from the IP");
+		if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
+			LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
+				edns->opt_list_inplace_cb_out = NULL;
+		error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
+			qinfo, qid, qflags, edns);
+		regional_free_all(mesh->env->scratch);
+		comm_point_send_reply(rep);
 		return;
 	}
 	if(!unique)
@@ -453,6 +463,8 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(!mesh_make_new_space(mesh, rep->c->buffer)) {
 			verbose(VERB_ALGO, "Too many queries. dropping "
 				"incoming query.");
+			if(rep->c->use_h2)
+				http2_stream_remove_mesh_state(rep->c->h2_stream);
 			comm_point_drop_reply(rep);
 			mesh->stats_dropped++;
 			return;
@@ -464,8 +476,10 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(mesh->num_reply_addrs > mesh->max_reply_states*16) {
 			verbose(VERB_ALGO, "Too many requests queued. "
 				"dropping incoming query.");
+			if(rep->c->use_h2)
+				http2_stream_remove_mesh_state(rep->c->h2_stream);
 			comm_point_drop_reply(rep);
-			mesh->stats_dropped++;
+			mesh->num_queries_replyaddr_limit++;
 			return;
 		}
 	}
@@ -1022,6 +1036,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	mstate->s.no_cache_store = 0;
 	mstate->s.need_refetch = 0;
 	mstate->s.was_ratelimited = 0;
+	mstate->s.error_response_cache = 0;
 	mstate->s.qstarttime = *env->now;
 
 	/* init modules */
@@ -1061,6 +1076,14 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep = mstate->reply_list;
 		struct mesh_cb* cb;
+		/* One http2 stream could bring down its comm_point along with
+		 * the other streams which could share the same query. Do all
+		 * the http2 stream bookkeeping upfront. */
+		for(; rep; rep=rep->next) {
+			if(rep->query_reply.c->use_h2)
+				http2_stream_remove_mesh_state(rep->h2_stream);
+		}
+		rep = mstate->reply_list;
 		/* in tcp_req_info, the mstates linked are removed, but
 		 * the reply_list is now NULL, so the remove-from-empty-list
 		 * takes no time and also it does not do the mesh accounting */
@@ -1068,8 +1091,6 @@ mesh_state_cleanup(struct mesh_state* mstate)
 		for(; rep; rep=rep->next) {
 			infra_wait_limit_dec(mesh->env->infra_cache,
 				&rep->query_reply, mesh->env->cfg);
-			if(rep->query_reply.c->use_h2)
-				http2_stream_remove_mesh_state(rep->h2_stream);
 			comm_point_drop_reply(&rep->query_reply);
 			log_assert(mesh->num_reply_addrs > 0);
 			mesh->num_reply_addrs--;
@@ -1152,8 +1173,7 @@ mesh_detect_cycle_found(struct module_qstate* qstate, struct mesh_state* dep_m)
 {
 	struct mesh_state* cyc_m = qstate->mesh_info;
 	size_t counter = 0;
-	if(!dep_m)
-		return 0;
+	log_assert(dep_m);
 	if(dep_m == cyc_m || find_in_subsub(dep_m, cyc_m, &counter)) {
 		if(counter > MESH_MAX_SUBSUB)
 			return 2;
@@ -1190,24 +1210,19 @@ void mesh_detach_subs(struct module_qstate* qstate)
 }
 
 int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
-	struct mesh_state** sub)
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq, struct mesh_state** sub)
 {
 	/* find it, if not, create it */
 	struct mesh_area* mesh = qstate->env->mesh;
-	*sub = mesh_area_find(mesh, NULL, qinfo, qflags,
-		prime, valrec);
-	if(mesh_detect_cycle_found(qstate, *sub)) {
-		verbose(VERB_ALGO, "attach failed, cycle detected");
-		return 0;
-	}
+	*sub = mesh_area_find(mesh, cinfo, qinfo, qflags, prime, valrec);
 	if(!*sub) {
 #ifdef UNBOUND_DEBUG
 		struct rbnode_type* n;
 #endif
 		/* create a new one */
-		*sub = mesh_state_create(qstate->env, qinfo, NULL, qflags, prime,
-			valrec);
+		*sub = mesh_state_create(qstate->env, qinfo, cinfo, qflags,
+			prime, valrec);
 		if(!*sub) {
 			log_err("mesh_attach_sub: out of memory");
 			return 0;
@@ -1230,18 +1245,25 @@ int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
 		rbtree_insert(&mesh->run, &(*sub)->run_node);
 		log_assert(n != NULL);
 		*newq = &(*sub)->s;
-	} else
+	} else {
 		*newq = NULL;
+		if(mesh_detect_cycle_found(qstate, *sub)) {
+			verbose(VERB_ALGO, "attach failed, cycle detected");
+			return 0;
+		}
+	}
 	return 1;
 }
 
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq)
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq)
 {
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct mesh_state* sub = NULL;
 	int was_detached;
-	if(!mesh_add_sub(qstate, qinfo, qflags, prime, valrec, newq, &sub))
+	if(!mesh_add_sub(qstate, qinfo, cinfo, qflags, prime, valrec, newq,
+		&sub))
 		return 0;
 	was_detached = (sub->super_set.count == 0);
 	if(!mesh_state_attachment(qstate->mesh_info, sub))
@@ -1684,7 +1706,7 @@ static void dns_error_reporting(struct module_qstate* qstate,
 
 	log_query_info(VERB_ALGO, "DNS Error Reporting: generating report "
 		"query for", &qinfo);
-	if(mesh_add_sub(qstate, &qinfo, BIT_RD, 0, 0, &newq, &sub)) {
+	if(mesh_add_sub(qstate, &qinfo, NULL, BIT_RD, 0, 0, &newq, &sub)) {
 		qstate->env->mesh->num_dns_error_reports++;
 	}
 	return;
@@ -1727,28 +1749,39 @@ void mesh_query_done(struct mesh_state* mstate)
 		dns_error_reporting(&mstate->s, rep);
 
 	for(r = mstate->reply_list; r; r = r->next) {
-		struct timeval old;
-		timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
-		if(mstate->s.env->cfg->discard_timeout != 0 &&
-			((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
-			mstate->s.env->cfg->discard_timeout) {
-			/* Drop the reply, it is too old */
-			/* briefly set the reply_list to NULL, so that the
-			 * tcp req info cleanup routine that calls the mesh
-			 * to deregister the meshstate for it is not done
-			 * because the list is NULL and also accounting is not
-			 * done there, but instead we do that here. */
-			struct mesh_reply* reply_list = mstate->reply_list;
-			verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
-			infra_wait_limit_dec(mstate->s.env->infra_cache,
-				&r->query_reply, mstate->s.env->cfg);
-			mstate->reply_list = NULL;
-			if(r->query_reply.c->use_h2)
-				http2_stream_remove_mesh_state(r->h2_stream);
-			comm_point_drop_reply(&r->query_reply);
-			mstate->reply_list = reply_list;
-			mstate->s.env->mesh->num_queries_discard_timeout++;
-			continue;
+		if(mesh_is_udp(r)) {
+			/* For UDP queries, the old replies are discarded.
+			 * This stops a large volume of old replies from
+			 * building up.
+			 * The stream replies, are not discarded. The
+			 * stream is open, the other side is waiting.
+			 * Some answer is needed, even if servfail, but the
+			 * real reply is ready to go, so that is given. */
+			struct timeval old;
+			timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
+			if(mstate->s.env->cfg->discard_timeout != 0 &&
+				((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
+				mstate->s.env->cfg->discard_timeout) {
+				/* Drop the reply, it is too old */
+				/* briefly set the reply_list to NULL, so that the
+				 * tcp req info cleanup routine that calls the mesh
+				 * to deregister the meshstate for it is not done
+				 * because the list is NULL and also accounting is not
+				 * done there, but instead we do that here. */
+				struct mesh_reply* reply_list = mstate->reply_list;
+				verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
+				infra_wait_limit_dec(mstate->s.env->infra_cache,
+					&r->query_reply, mstate->s.env->cfg);
+				mstate->reply_list = NULL;
+				if(r->query_reply.c->use_h2)
+					http2_stream_remove_mesh_state(r->h2_stream);
+				comm_point_drop_reply(&r->query_reply);
+				mstate->reply_list = reply_list;
+				log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
+				mstate->s.env->mesh->num_reply_addrs--;
+				mstate->s.env->mesh->num_queries_discard_timeout++;
+				continue;
+			}
 		}
 
 		i++;
@@ -1782,6 +1815,8 @@ void mesh_query_done(struct mesh_state* mstate)
 			}
 			comm_point_drop_reply(&r->query_reply);
 			mstate->reply_list = reply_list;
+			log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
+			mstate->s.env->mesh->num_reply_addrs--;
 		} else {
 			struct sldns_buffer* r_buffer = r->query_reply.c->buffer;
 			if(r->query_reply.c->tcp_req_info) {
@@ -2272,6 +2307,7 @@ mesh_stats_clear(struct mesh_area* mesh)
 	memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM);
 	mesh->ans_nodata = 0;
 	mesh->num_queries_discard_timeout = 0;
+	mesh->num_queries_replyaddr_limit = 0;
 	mesh->num_queries_wait_limit = 0;
 	mesh->num_dns_error_reports = 0;
 }
@@ -2297,7 +2333,7 @@ mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct mesh_state* dep_m = NULL;
 	dep_m = mesh_area_find(mesh, NULL, qinfo, flags, prime, valrec);
-	return mesh_detect_cycle_found(qstate, dep_m);
+	return dep_m?mesh_detect_cycle_found(qstate, dep_m):0;
 }
 
 void mesh_list_insert(struct mesh_state* m, struct mesh_state** fp,
@@ -2341,6 +2377,10 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
 			mesh->num_reply_addrs--;
 			infra_wait_limit_dec(mesh->env->infra_cache,
 				&n->query_reply, mesh->env->cfg);
+			/* We may be removing more than one http2 stream (they
+			 * share the same comm_point); make sure the streams
+			 * don't point back. */
+			if(n->h2_stream) n->h2_stream->mesh_state = NULL;
 
 			/* prev = prev; */
 			n = n->next;

services/mesh.h

@@ -141,6 +141,8 @@ struct mesh_area {
 	size_t rpz_action[UB_STATS_RPZ_ACTION_NUM];
 	/** stats, number of queries removed due to discard-timeout */
 	size_t num_queries_discard_timeout;
+	/** stats, number of queries removed due to replyaddr limit */
+	size_t num_queries_replyaddr_limit;
 	/** stats, number of queries removed due to wait-limit */
 	size_t num_queries_wait_limit;
 	/** stats, number of dns error reports generated */
@@ -399,6 +401,8 @@ void mesh_detach_subs(struct module_qstate* qstate);
  * @param qstate: the state to find mesh state, and that wants to receive
  * 	the results from the new subquery.
  * @param qinfo: what to query for (copied).
+ * @param cinfo: if non-NULL client specific info that may affect IP-based
+ * 	actions that apply to the query result. It is copied.
  * @param qflags: what flags to use (RD / CD flag or not).
  * @param prime: if it is a (stub) priming query.
  * @param valrec: if it is a validation recursion query (lookup of key, DS).
@@ -407,7 +411,8 @@ void mesh_detach_subs(struct module_qstate* qstate);
  * @return: false on error, true if success (and init may be needed).
  */
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq);
 
 /**
  * Add detached query.
@@ -426,6 +431,8 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
  * @param qstate: the state to find mesh state, and that wants to receive
  * 	the results from the new subquery.
  * @param qinfo: what to query for (copied).
+ * @param cinfo: if non-NULL client specific info that may affect IP-based
+ * 	actions that apply to the query result. It is copied.
  * @param qflags: what flags to use (RD / CD flag or not).
  * @param prime: if it is a (stub) priming query.
  * @param valrec: if it is a validation recursion query (lookup of key, DS).
@@ -435,8 +442,8 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
  * @return: false on error, true if success (and init may be needed).
  */
 int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
-	struct mesh_state** sub);
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq, struct mesh_state** sub);
 
 /**
  * Query state is done, send messages to reply entries.

services/modstack.c

@@ -262,6 +262,7 @@ int
 modstack_call_init(struct module_stack* stack, const char* module_conf,
 	struct module_env* env)
 {
+	const char* orig_module_conf = module_conf;
         int i, changed = 0;
         env->need_to_validate = 0; /* set by module init below */
         for(i=0; i<stack->num; i++) {
@@ -276,11 +277,13 @@ modstack_call_init(struct module_stack* stack, const char* module_conf,
 				changed = 1;
 			}
 		}
-		module_conf += strlen(stack->mod[i]->name);
+		/* Skip this module name in module_conf. */
+		while(*module_conf && !isspace((unsigned char)*module_conf))
+			module_conf++;
 	}
 	if(changed) {
 		modstack_free(stack);
-		if(!modstack_config(stack, module_conf)) {
+		if(!modstack_config(stack, orig_module_conf)) {
 			return 0;
 		}
 	}

services/outside_network.c

@@ -160,6 +160,19 @@ reuse_cmp_addrportssl(const void* key1, const void* key2)
 		return 1;
 	if(!r1->is_ssl && r2->is_ssl)
 		return -1;
+
+	/* compare tls_auth_name if SSL-enabled */
+	if(r1->is_ssl) {
+		if(r1->tls_auth_name && !r2->tls_auth_name)
+			return 1;
+		if(!r1->tls_auth_name && r2->tls_auth_name)
+			return -1;
+		if(r1->tls_auth_name && r2->tls_auth_name) {
+			r = strcmp(r1->tls_auth_name, r2->tls_auth_name);
+			if(r != 0)
+				return r;
+		}
+	}
 	return 0;
 }
 
@@ -531,7 +544,7 @@ reuse_tcp_insert(struct outside_network* outnet, struct pending_tcp* pend_tcp)
 /** find reuse tcp stream to destination for query, or NULL if none */
 static struct reuse_tcp*
 reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr,
-	socklen_t addrlen, int use_ssl)
+	socklen_t addrlen, int use_ssl, char* tls_auth_name)
 {
 	struct waiting_tcp key_w;
 	struct pending_tcp key_p;
@@ -545,8 +558,10 @@ reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr,
 	key_p.c = &c;
 	key_p.reuse.pending = &key_p;
 	key_p.reuse.node.key = &key_p.reuse;
-	if(use_ssl)
+	if(use_ssl) {
 		key_p.reuse.is_ssl = 1;
+		key_p.reuse.tls_auth_name = tls_auth_name;
+	}
 	if(addrlen > (socklen_t)sizeof(key_p.reuse.addr))
 		return NULL;
 	memmove(&key_p.reuse.addr, addr, addrlen);
@@ -646,6 +661,7 @@ static int
 outnet_tcp_take_into_use(struct waiting_tcp* w)
 {
 	struct pending_tcp* pend = w->outnet->tcp_free;
+	char* tls_auth_name = NULL;
 	int s;
 	log_assert(pend);
 	log_assert(w->pkt);
@@ -746,7 +762,22 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 		comm_point_tcp_win_bio_cb(pend->c, pend->c->ssl);
 #endif
 		pend->c->ssl_shake_state = comm_ssl_shake_write;
-		if(!set_auth_name_on_ssl(pend->c->ssl, w->tls_auth_name,
+		if(w->tls_auth_name) {
+			/* strdup the auth name, while not linked the list yet,
+			 * in case of failure, easy cleanup. */
+			tls_auth_name = strdup(w->tls_auth_name);
+			if(!tls_auth_name) {
+				log_err("out of memory: alloc tls auth name");
+				pend->c->fd = s;
+#ifdef HAVE_SSL
+				SSL_free(pend->c->ssl);
+#endif
+				pend->c->ssl = NULL;
+				comm_point_close(pend->c);
+				return 0;
+			}
+		}
+		if(!set_auth_name_on_ssl(pend->c->ssl, tls_auth_name,
 			w->outnet->tls_use_sni)) {
 			pend->c->fd = s;
 #ifdef HAVE_SSL
@@ -754,6 +785,7 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 #endif
 			pend->c->ssl = NULL;
 			comm_point_close(pend->c);
+			free(tls_auth_name);
 			return 0;
 		}
 	}
@@ -778,9 +810,20 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 	if(pend->reuse.node.key)
 		reuse_tcp_remove_tree_list(w->outnet, &pend->reuse);
 
-	if(pend->c->ssl)
+	if(pend->c->ssl) {
 		pend->reuse.is_ssl = 1;
-	else	pend->reuse.is_ssl = 0;
+		if(pend->reuse.tls_auth_name)
+			free(pend->reuse.tls_auth_name);
+		pend->reuse.tls_auth_name = tls_auth_name;
+		tls_auth_name = NULL;
+	} else {
+		pend->reuse.is_ssl = 0;
+		if(pend->reuse.tls_auth_name)
+			free(pend->reuse.tls_auth_name);
+		pend->reuse.tls_auth_name = NULL;
+	}
+	/* free tls auth name if nonNULL */
+	free(tls_auth_name);
 	/* insert in reuse by address tree if not already inserted there */
 	(void)reuse_tcp_insert(w->outnet, pend);
 	reuse_tree_by_id_insert(&pend->reuse, w);
@@ -969,7 +1012,7 @@ use_free_buffer(struct outside_network* outnet)
 			(!outnet->tcp_reuse_first && !outnet->tcp_reuse_last) ||
 			(outnet->tcp_reuse_first && outnet->tcp_reuse_last));
 		reuse = reuse_tcp_find(outnet, &w->addr, w->addrlen,
-			w->ssl_upstream);
+			w->ssl_upstream, w->tls_auth_name);
 		/* re-select an ID when moving to a new TCP buffer */
 		w->id = tcp_select_id(outnet, reuse);
 		LDNS_ID_SET(w->pkt, w->id);
@@ -1198,6 +1241,10 @@ decommission_pending_tcp(struct outside_network* outnet,
 		/* needs unlink from the reuse tree to get deleted */
 		reuse_tcp_remove_tree_list(outnet, &pend->reuse);
 	}
+	if(pend->reuse.tls_auth_name) {
+		free(pend->reuse.tls_auth_name);
+		pend->reuse.tls_auth_name = NULL;
+	}
 	/* free SSL structure after remove from outnet tcp reuse tree,
 	 * because the c->ssl null or not is used for sorting in the tree */
 	if(pend->c->ssl) {
@@ -1922,6 +1969,10 @@ outside_network_delete(struct outside_network* outnet)
 					 * the tcp conn is working on */
 					decommission_pending_tcp(outnet, pend);
 				}
+				if(pend->reuse.tls_auth_name) {
+					free(pend->reuse.tls_auth_name);
+					pend->reuse.tls_auth_name = NULL;
+				}
 				comm_point_delete(outnet->tcp_conns[i]->c);
 				free(outnet->tcp_conns[i]);
 				outnet->tcp_conns[i] = NULL;
@@ -2447,7 +2498,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 	/* find out if a reused stream to the target exists */
 	/* if so, take it into use */
 	reuse = reuse_tcp_find(sq->outnet, &sq->addr, sq->addrlen,
-		sq->ssl_upstream);
+		sq->ssl_upstream, sq->tls_auth_name);
 	if(reuse) {
 		log_reuse_tcp(VERB_CLIENT, "pending_tcp_query: found reuse", reuse);
 		log_assert(reuse->pending);

services/outside_network.h

@@ -48,6 +48,10 @@
 #include "util/regional.h"
 #include "util/netevent.h"
 #include "dnstap/dnstap_config.h"
+#ifdef __QNX__
+/* For struct timeval */
+#include <sys/time.h>
+#endif /* __QNX__ */
 struct pending;
 struct pending_timeout;
 struct ub_randstate;
@@ -260,6 +264,9 @@ struct reuse_tcp {
 	socklen_t addrlen;
 	/** also key for tcp_reuse tree, if ssl is used */
 	int is_ssl;
+	/** If is_ssl is enabled, tls_auth_name is part of the key for
+	 * tcp_reuse tree. If the string is NULL, it without a tls_auth_name */
+	char* tls_auth_name;
 	/** lru chain, so that the oldest can be removed to get a new
 	 * connection when all are in (re)use. oldest is last in list.
 	 * The lru only contains empty connections waiting for reuse,

services/rpz.c

@@ -153,6 +153,7 @@ rpz_type_ignored(uint16_t rr_type)
 		case LDNS_RR_TYPE_SOA:
 		case LDNS_RR_TYPE_NS:
 		case LDNS_RR_TYPE_DNAME:
+		case LDNS_RR_TYPE_ZONEMD:
 		/* all DNSSEC-related RRs must be ignored */
 		case LDNS_RR_TYPE_DNSKEY:
 		case LDNS_RR_TYPE_DS:

sldns/rrdef.h

@@ -480,11 +480,13 @@ enum sldns_enum_ede_code
 	LDNS_EDE_TOO_EARLY = 26,
 	LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS = 27,
 	LDNS_EDE_BADPROXYPOLICY = 28,
-	LDNS_EDE_SYNTHESIZED = 29
+	LDNS_EDE_SYNTHESIZED = 29,
+	LDNS_EDE_INVALID_QUERY_TYPE = 30
 };
 typedef enum sldns_enum_ede_code sldns_ede_code;
 
 #define LDNS_EDNS_MASK_DO_BIT 0x8000
+#define LDNS_EDNS_MASK_CO_BIT 0x4000
 
 /** TSIG and TKEY extended rcodes (16bit), 0-15 are the normal rcodes. */
 #define LDNS_TSIG_ERROR_NOERROR  0

sldns/wire2str.c

@@ -233,6 +233,7 @@ static sldns_lookup_table sldns_edns_ede_codes_data[] = {
 	{ LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS, "Unsupported NSEC3 Iterations Value" },
 	{ LDNS_EDE_BADPROXYPOLICY, "Unable to Conform to Policy" },
 	{ LDNS_EDE_SYNTHESIZED, "Synthesized Answer" },
+	{ LDNS_EDE_INVALID_QUERY_TYPE, "Invalid Query Type" },
 	{ 0, NULL}
 };
 sldns_lookup_table* sldns_edns_ede_codes = sldns_edns_ede_codes_data;
@@ -2485,6 +2486,8 @@ int sldns_wire2str_edns_scan(uint8_t** data, size_t* data_len, char** str,
 	w += sldns_str_print(str, str_len, " flags:");
 	if((edns_bits & LDNS_EDNS_MASK_DO_BIT))
 		w += sldns_str_print(str, str_len, " do");
+	if((edns_bits & LDNS_EDNS_MASK_CO_BIT))
+		w += sldns_str_print(str, str_len, " co");
 	/* the extended rcode is the value set, shifted four bits,
 	 * and or'd with the original rcode */
 	if(ext_rcode) {

smallapp/unbound-anchor.c

@@ -2430,12 +2430,20 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 
 	if(dolist) do_list_builtin();

smallapp/unbound-checkconf.c

@@ -44,6 +44,7 @@
 
 #include "config.h"
 #include <ctype.h>
+#include "util/as112.h"
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/module.h"
@@ -188,11 +189,56 @@ donotquerylocalhostcheck(struct config_file* cfg)
 	}
 }
 
+static void
+nodefaultzonescheck(struct config_file* cfg)
+{
+	struct config_strlist* d;
+	const char** zstr;
+	size_t len;
+
+#define COMPARE_ZONE_NAME(confname, builtname, len)		\
+	(strncasecmp(confname, builtname, (len)) == 0 &&	\
+	(strlen(confname) == (len) ||				\
+	(strlen(confname) == (len) + 1				\
+	&& confname[(len)] == '.')))
+
+	for(d = cfg->local_zones_nodefault; d; d = d->next) {
+		if(!cfg->unblock_lan_zones) {
+			for(zstr = as112_zones; *zstr; zstr++) {
+				len = strlen(*zstr) - 1; /* trailing '.' */
+				if(COMPARE_ZONE_NAME(d->str, *zstr, len))
+					goto default_continue;
+			}
+		}
+		for(zstr = local_zones_default_special; *zstr; zstr++) {
+			len = strlen(*zstr) - 1; /* trailing '.' */
+			if(COMPARE_ZONE_NAME(d->str, *zstr, len))
+				goto default_continue;
+		}
+		for(zstr = local_zones_default_reverse; *zstr; zstr++) {
+			len = strlen(*zstr) - 1; /* trailing '.' */
+			if(COMPARE_ZONE_NAME(d->str, *zstr, len))
+				goto default_continue;
+		}
+		if(COMPARE_ZONE_NAME(d->str, "localhost.", 10 - 1))
+			goto default_continue;
+		fprintf(stderr, "unbound-checkconf: warning: local-zone: '%s' "
+			"is configured as 'nodefault' but there is no such "
+			"default local-zone. Check the unbound.conf "
+			"documentation for default configured local-zones.\n",
+			d->str);
+default_continue:
+		; /* statement to jump to, for older gcc. */
+	}
+#undef COMPARE_ZONE_NAME
+}
+
 /** check localzones */
 static void
 localzonechecks(struct config_file* cfg)
 {
 	struct local_zones* zs;
+	nodefaultzonescheck(cfg);
 	if(!(zs = local_zones_create()))
 		fatal_exit("out of memory");
 	if(!local_zones_apply_cfg(zs, cfg))
@@ -783,7 +829,6 @@ morechecks(struct config_file* cfg)
 	/* check that the modules listed in module_conf exist */
 	check_modules_exist(cfg->module_conf);
 
-	/* Respip is known to *not* work with dns64. */
 	if(strcmp(cfg->module_conf, "iterator") != 0
 		&& strcmp(cfg->module_conf, "validator iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 validator iterator") != 0
@@ -869,6 +914,7 @@ morechecks(struct config_file* cfg)
 		&& strcmp(cfg->module_conf, "respip cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
+		&& strcmp(cfg->module_conf, "respip dns64 validator cachedb iterator") != 0
 #endif
 #if defined(WITH_PYTHONMODULE) && defined(USE_CACHEDB)
 		&& strcmp(cfg->module_conf, "python dns64 cachedb iterator") != 0

smallapp/unbound-control.c

@@ -236,6 +236,8 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
 		s->svr.num_queries_cookie_invalid);
 	PR_UL_NM("num.queries_discard_timeout",
 		s->svr.num_queries_discard_timeout);
+	PR_UL_NM("num.queries_replyaddr_limit",
+		s->svr.num_queries_replyaddr_limit);
 	PR_UL_NM("num.queries_wait_limit", s->svr.num_queries_wait_limit);
 	PR_UL_NM("num.cachehits",
 		s->svr.num_queries - s->svr.num_queries_missed_cache);
@@ -263,6 +265,7 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
 	PR_UL_NM("requestlist.exceeded", s->mesh_dropped);
 	PR_UL_NM("requestlist.current.all", s->mesh_num_states);
 	PR_UL_NM("requestlist.current.user", s->mesh_num_reply_states);
+	PR_UL_NM("requestlist.current.replies", s->mesh_num_reply_addrs);
 #ifndef S_SPLINT_S
 	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
 	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
@@ -1049,12 +1052,20 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 
 	if(!RAND_status()) {

smallapp/unbound-host.c

@@ -521,12 +521,20 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #endif /* HAVE_SSL */
 #ifdef HAVE_NSS

testcode/asynclook.c

@@ -488,12 +488,20 @@ int main(int argc, char** argv)
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #endif /* HAVE_SSL */
 

testcode/checklocks.h

@@ -360,6 +360,7 @@ typedef pthread_key_t ub_thread_key_type;
 #define ub_thread_key_create(key, f) LOCKRET(pthread_key_create(key, f))
 #define ub_thread_key_set(key, v) LOCKRET(pthread_setspecific(key, v))
 #define ub_thread_key_get(key) pthread_getspecific(key)
+#define ub_thread_setname(thread, name) /* nop */
 
 #endif /* USE_THREAD_DEBUG */
 #endif /* TESTCODE_CHECK_LOCKS_H */

testcode/dohclient.c

@@ -642,12 +642,20 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 	}
 	run(h2_session, port, no_tls, argc, argv);

testcode/doqclient.c

@@ -2255,7 +2255,7 @@ create_doq_client_data(const char* svr, int port, struct ub_event_base* base,
 	/* Initialize the ossl crypto, it is harmless to call twice,
 	 * and this is before use of doq connections. */
 	if(ngtcp2_crypto_ossl_init() != 0)
-		fatal_exit("ngtcp2_crypto_oss_init failed");
+		fatal_exit("ngtcp2_crypto_ossl_init failed");
 #elif defined(HAVE_NGTCP2_CRYPTO_QUICTLS_INIT)
 	if(ngtcp2_crypto_quictls_init() != 0)
 		fatal_exit("ngtcp2_crypto_quictls_init failed");

testcode/mini_tdir.sh

@@ -141,6 +141,13 @@ if test -f $done; then
 	exit 0
 fi
 
+# always clear the skip mark file in case something changed in the environment
+# in between runs
+if test -f $skip; then
+	echo "minitdir $skip exists; removing."
+	rm $skip
+fi
+
 # Copy
 if test $quiet = 0; then
 	echo "minitdir copy $1 to $dir"

testcode/petal.c

@@ -160,11 +160,26 @@ read_ssl_line(SSL* ssl, char* buf, size_t len)
 			return 0;
 		}
 		if((r = SSL_read(ssl, buf+n, 1)) <= 0) {
-			if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) {
+			int e = SSL_get_error(ssl, r);
+			if(e == SSL_ERROR_ZERO_RETURN) {
 				/* EOF */
 				break;
+			} else if(e == SSL_ERROR_WANT_READ) {
+				continue;
+			} else if(e == SSL_ERROR_WANT_WRITE) {
+				continue;
+			} else if(e == SSL_ERROR_SYSCALL) {
+				if(verb) printf("could not SSL_read %s\n",
+					strerror(errno));
+			} else if(e == SSL_ERROR_SSL) {
+				int er = ERR_peek_error();
+				if(er)
+					printf("could not SSL_read: %s\n",
+						ERR_reason_error_string(er));
+			} else {
+				if(verb) printf("could not SSL_read "
+						"(SSL_get_error %d)\n", e);
 			}
-			if(verb) printf("could not SSL_read\n");
 			return 0;
 		}
 		if(endnl && buf[n] == '\n') {
@@ -222,7 +237,8 @@ read_http_headers(SSL* ssl, char* file, size_t flen, char* host, size_t hlen,
 		if(verb>=2) printf("read: %s\n", buf);
 		if(buf[0] == 0) {
 			int e = ERR_peek_error();
-			printf("error string: %s\n", ERR_reason_error_string(e));
+			if(e)
+				printf("error string: %s\n", ERR_reason_error_string(e));
 			return 1;
 		}
 		if(!process_one_header(buf, file, flen, host, hlen, vs))
@@ -246,7 +262,8 @@ setup_ctx(char* key, char* cert)
 #endif
 	if(!SSL_CTX_use_certificate_chain_file(ctx, cert)) {
 		int e = ERR_peek_error();
-		printf("error string: %s\n", ERR_reason_error_string(e));
+		if(e)
+			printf("error string: %s\n", ERR_reason_error_string(e));
 		print_exit("cannot read cert");
 	}
 	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM))
@@ -673,12 +690,20 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+		| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+		, NULL);
 #endif
 
 	do_service(addr, port, key, cert);

testcode/pktview.c

@@ -59,12 +59,16 @@ static void usage(char* argv[])
 /** read hex input */
 static void read_input(sldns_buffer* pkt, FILE* in)
 {
-	char buf[102400];
+	/* Buffer for 64Kib packet, in hex, with spaces and comments. */
+	char buf[1024000];
 	char* np = buf;
 	while(fgets(np, (int)sizeof(buf) - (np-buf), in)) {
 		if(buf[0] == ';') /* comment */
 			continue;
 		np = &np[strlen(np)];
+		if((size_t)(np-buf) >= sizeof(buf)-1)
+			fatal_exit("input too large (%lu bytes)",
+				(unsigned long)sizeof(buf));
 	}
 	hex_to_buf(pkt, buf);
 }
@@ -188,10 +192,16 @@ static void analyze(sldns_buffer* pkt)
 /** main program for pktview */
 int main(int argc, char* argv[]) 
 {
-	sldns_buffer* pkt = sldns_buffer_new(65553);
+	sldns_buffer* pkt;
+
+	log_init(NULL, 0, NULL);
+	log_ident_set("pktview");
+
 	if(argc != 1) {
 		usage(argv);
 	}
+
+	pkt = sldns_buffer_new(65553);
 	if(!pkt) fatal_exit("out of memory");
 
 	read_input(pkt, stdin);

testcode/replay.h

@@ -142,6 +142,10 @@
 #include "util/netevent.h"
 #include "testcode/testpkts.h"
 #include "util/rbtree.h"
+#ifdef __QNX__
+/* For struct timeval */
+#include <sys/time.h>
+#endif /* __QNX__ */
 struct replay_answer;
 struct replay_moment;
 struct replay_range;

testcode/streamtcp.c

@@ -652,12 +652,20 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+			| OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+			, NULL);
 #endif
 	}
 	send_em(svr, pp2_client, udp, usessl, noanswer, onarrival, delay, argc, argv);

testcode/testpkts.c

@@ -135,6 +135,8 @@ static void matchline(char* line, struct entry* e)
 			e->match_ttl = 1;
 		} else if(str_keyword(&parse, "DO")) {
 			e->match_do = 1;
+		} else if(str_keyword(&parse, "CO")) {
+			e->match_co = 1;
 		} else if(str_keyword(&parse, "noedns")) {
 			e->match_noedns = 1;
 		} else if(str_keyword(&parse, "ednsdata")) {
@@ -178,7 +180,7 @@ static void matchline(char* line, struct entry* e)
 
 /** parse REPLY line */
 static void replyline(char* line, uint8_t* reply, size_t reply_len,
-	int* do_flag)
+	int* do_flag, int* co_flag)
 {
 	char* parse = line;
 	if(reply_len < LDNS_HEADER_SIZE) error("packet too short for header");
@@ -236,6 +238,8 @@ static void replyline(char* line, uint8_t* reply, size_t reply_len,
 			LDNS_AD_SET(reply);
 		} else if(str_keyword(&parse, "DO")) {
 			*do_flag = 1;
+		} else if(str_keyword(&parse, "CO")) {
+			*co_flag = 1;
 		} else {
 			error("could not parse REPLY: '%s'", parse);
 		}
@@ -289,6 +293,7 @@ static struct entry* new_entry(void)
 	e->match_all_noedns = 0;
 	e->match_ttl = 0;
 	e->match_do = 0;
+	e->match_co = 0;
 	e->match_noedns = 0;
 	e->match_serial = 0;
 	e->ixfr_soa_serial = 0;
@@ -521,15 +526,17 @@ static void add_rr(char* rrstr, uint8_t* pktbuf, size_t pktsize,
 
 /* add EDNS 4096 opt record */
 static void
-add_edns(uint8_t* pktbuf, size_t pktsize, int do_flag, uint8_t *ednsdata,
-	uint16_t ednslen, size_t* pktlen)
+add_edns(uint8_t* pktbuf, size_t pktsize, int do_flag, int co_flag,
+	uint8_t *ednsdata, uint16_t ednslen, size_t* pktlen)
 {
 	uint8_t edns[] = {0x00, /* root label */
 		0x00, LDNS_RR_TYPE_OPT, /* type */
 		0x04, 0xD0, /* class is UDPSIZE 1232 */
 		0x00, /* TTL[0] is ext rcode */
 		0x00, /* TTL[1] is edns version */
-		(uint8_t)(do_flag?0x80:0x00), 0x00, /* TTL[2-3] is edns flags, DO */
+		(uint8_t)(do_flag?0x80:0x00)
+		| (uint8_t)(co_flag?0x40:0x00)
+		, 0x00, /* TTL[2-3] is edns flags, DO */
 		(uint8_t)((ednslen >> 8) & 0xff),
 		(uint8_t)(ednslen  & 0xff), /* rdatalength */
 	};
@@ -561,6 +568,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 	uint8_t pktbuf[MAX_PACKETLEN];
 	size_t pktlen = LDNS_HEADER_SIZE;
 	int do_flag = 0; /* DO flag in EDNS */
+	int co_flag = 0; /* CO flag in EDNS */
 	memset(pktbuf, 0, pktlen); /* ID = 0, FLAGS="", and rr counts 0 */
 
 	while(fgets(line, (int)sizeof(line), in) != NULL) {
@@ -598,7 +606,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 		if(str_keyword(&parse, "MATCH")) {
 			matchline(parse, current);
 		} else if(str_keyword(&parse, "REPLY")) {
-			replyline(parse, pktbuf, pktlen, &do_flag);
+			replyline(parse, pktbuf, pktlen, &do_flag, &co_flag);
 		} else if(str_keyword(&parse, "ADJUST")) {
 			adjustline(parse, current, cur_reply);
 		} else if(str_keyword(&parse, "EXTRA_PACKET")) {
@@ -654,15 +662,16 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 			if(hex_ednsdata_buffer)
 				sldns_buffer_free(hex_ednsdata_buffer);
 			if(pktlen != 0) {
-				if(do_flag || cur_reply->raw_ednsdata) {
+				if(do_flag || co_flag
+					|| cur_reply->raw_ednsdata) {
 					if(cur_reply->raw_ednsdata &&
 						sldns_buffer_limit(cur_reply->raw_ednsdata))
-						add_edns(pktbuf, sizeof(pktbuf), do_flag,
+						add_edns(pktbuf, sizeof(pktbuf), do_flag, co_flag,
 							sldns_buffer_begin(cur_reply->raw_ednsdata),
 							(uint16_t)sldns_buffer_limit(cur_reply->raw_ednsdata),
 							&pktlen);
 					else
-						add_edns(pktbuf, sizeof(pktbuf), do_flag,
+						add_edns(pktbuf, sizeof(pktbuf), do_flag, co_flag,
 							NULL, 0, &pktlen);
 				}
 				cur_reply->reply_pkt = memdup(pktbuf, pktlen);
@@ -909,6 +918,22 @@ get_do_flag(uint8_t* pkt, size_t len)
 	return (int)(edns_bits&LDNS_EDNS_MASK_DO_BIT);
 }
 
+/** return true if the CO flag is set */
+static int
+get_co_flag(uint8_t* pkt, size_t len)
+{
+	uint16_t edns_bits;
+	uint8_t* walk = pkt;
+	size_t walk_len = len;
+	if(!pkt_find_edns_opt(&walk, &walk_len)) {
+		return 0;
+	}
+	if(walk_len < 6)
+		return 0; /* malformed */
+	edns_bits = sldns_read_uint16(walk+4);
+	return (int)(edns_bits&LDNS_EDNS_MASK_CO_BIT);
+}
+
 /** Snips the specified EDNS option out of the OPT record and puts it in the
  *  provided buffer. The buffer should be able to hold any opt data ie 65535.
  *  Returns the length of the option written,
@@ -1654,6 +1679,10 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 			verbose(3, "no DO bit set\n");
 			continue;
 		}
+		if(p->match_co && !get_co_flag(query_pkt, len)) {
+			verbose(3, "no CO bit set\n");
+			continue;
+		}
 		if(p->match_noedns && get_has_edns(query_pkt, len)) {
 			verbose(3, "bad; EDNS OPT present\n");
 			continue;
@@ -1745,11 +1774,14 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 		memmove(res+LDNS_HEADER_SIZE+dlen+4,
 			orig+LDNS_HEADER_SIZE+olen+4,
 			reslen-(LDNS_HEADER_SIZE+dlen+4));
+	} else if(origlen == 0) {
+		res = NULL;
+		reslen = 0;
 	} else {
 		res = memdup(orig, origlen);
 		reslen = origlen;
 	}
-	if(!res) {
+	if(!res && reslen > 0) {
 		verbose(1, "out of memory; send without adjust\n");
 		return;
 	}

testcode/testpkts.h

@@ -218,6 +218,8 @@ struct entry {
 	uint8_t match_ttl;
 	/** match DO bit */
 	uint8_t match_do;
+	/** match CO bit */
+	uint8_t match_co;
 	/** match absence of EDNS OPT record in query */
 	uint8_t match_noedns;
 	/** match edns data field given in hex */

testcode/unitldns.c

@@ -207,7 +207,11 @@ rr_test_file(const char* input, const char* check)
 #define xstr(s) str(s)
 #define str(s) #s
 
+#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
+#else /* !__QNX__ */
+#define SRCDIRSTR "."
+#endif /* __QNX__ */
 
 /** read rrs to and from string, to and from wireformat */
 static void

testcode/unitmain.c

@@ -283,7 +283,7 @@ net_test(void)
 		unit_assert(strcmp(astr, "1.2.3.0") == 0);
 		unit_assert(ntohs(((struct sockaddr_in*)&a)->sin_port)==53);
 
-		res = netblockstrtoaddr("2001:DB8:33:44::/64", 53,
+		res = netblockstrtoaddr("2001:db8:33:44::/64", 53,
 			&a, &alen, &net);
 		unit_assert(res!=0 && net == 64);
 		addr_to_str(&a, alen, astr, sizeof(astr));

testcode/unitmsgparse.c

@@ -498,7 +498,11 @@ testfromdrillfile(sldns_buffer* pkt, struct alloc_cache* alloc,
 #define xstr(s) str(s)
 #define str(s) #s
 
+#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
+#else /* !__QNX__ */
+#define SRCDIRSTR "."
+#endif /* __QNX__ */
 
 void msgparse_test(void)
 {

testcode/unitverify.c

@@ -513,8 +513,11 @@ nsec3_hash_test(const char* fname)
 #define xstr(s) str(s)
 #define str(s) #s
 
+#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-
+#else /* !__QNX__ */
+#define SRCDIRSTR "."
+#endif /* __QNX__ */
 #if defined(HAVE_SSL) && defined(USE_SHA1)
 /* Detect if openssl is configured to disable RSASHA1 signatures,
  * with the rh-allow-sha1-signatures disabled. */
@@ -631,6 +634,7 @@ rh_allow_sha1_signatures_disabled(void)
 void 
 verify_test(void)
 {
+	int do_sha1 = 1;
 	unit_show_feature("signature verify");
 
 #if defined(HAVE_SSL) && defined(USE_SHA1)
@@ -643,27 +647,40 @@ verify_test(void)
 #else
 		_putenv("OPENSSL_ENABLE_SHA1_SIGNATURES=1");
 #endif
+		do_sha1 = 1;
 	}
+#ifdef HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED
+	if (EVP_default_properties_is_fips_enabled(NULL))
+		do_sha1 = 0;
 #endif
+#endif /* HAVE_SSL and USE_SHA1 */
 
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
+	}
 #endif
 #if defined(USE_DSA) && defined(USE_SHA1)
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
+	}
 #endif /* USE_DSA */
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
+	}
 #endif
 #if (defined(HAVE_EVP_SHA256) || defined(HAVE_NSS) || defined(HAVE_NETTLE)) && defined(USE_SHA2)
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256", "20070829144150");
 #  ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
+	}
 #  endif
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256_draft", "20090101000000");
 #endif
@@ -672,8 +689,10 @@ verify_test(void)
 	verifytest_file(SRCDIRSTR "/testdata/test_signatures.9", "20171215000000");
 #endif
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
+	}
 #endif
 #ifdef USE_GOST
 	if(sldns_key_EVP_load_gost_id())
@@ -699,7 +718,9 @@ verify_test(void)
 	}
 #endif
 #ifdef USE_SHA1
-	dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
+	if(do_sha1) {
+		dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
+	}
 #endif
 	nsectest();
 	nsec3_hash_test(SRCDIRSTR "/testdata/test_nsec3_hash.1");

testcode/unitzonemd.c

@@ -50,7 +50,11 @@
 
 #define xstr(s) str(s)
 #define str(s) #s
+#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
+#else /* !__QNX__ */
+#define SRCDIRSTR "."
+#endif /* __QNX__ */
 
 /** Add zone from file for testing */
 struct auth_zone* authtest_addzone(struct auth_zones* az, const char* name,

testdata/04-checkconf.tdir/good.all

@@ -24,7 +24,7 @@ server:
 	# specify every interface on a new 'interface:' labelled line.
 	interface: 192.0.2.153
 	interface: 192.0.2.154
-	interface: 2001:DB8::5
+	interface: 2001:db8::5
 
 	# port to answer queries from
 	port: 53