Merge branch 'master' into features/downstream-cookies

diff --cc Makefile.in
index 66141846e2576cbe8178df6710e9d8fe45663dc2,74e45bc5e75577e86463fa4108569bcb53b91c1a..0a2e7f9b6f08f824b77ac7f8dbea35532d00f502
--- 1/Makefile.in
--- 2/Makefile.in
+++ b/Makefile.in
@@@ -128,9 -128,9 +128,9 @@@ util/config_file.c util/configlexer.c u
  util/shm_side/shm_main.c services/authzone.c \
  util/fptr_wlist.c util/locks.c util/log.c util/mini_event.c util/module.c \
  util/netevent.c util/net_help.c util/random.c util/rbtree.c util/regional.c \
 -util/rtt.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
 +util/rtt.c util/siphash.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
  util/storage/lruhash.c util/storage/slabhash.c util/tcp_conn_limit.c \
- util/timehist.c util/tube.c util/proxy_protocol.c \
+ util/timehist.c util/tube.c util/proxy_protocol.c util/timeval_func.c \
  util/ub_event.c util/ub_event_pluggable.c util/winsock_event.c \
  validator/autotrust.c validator/val_anchor.c validator/validator.c \
  validator/val_kcache.c validator/val_kentry.c validator/val_neg.c \

diff --cc daemon/worker.c
Simple merge

diff --cc doc/unbound.conf.5.in
Simple merge

diff --cc libunbound/libworker.c
Simple merge

diff --cc services/authzone.c
Simple merge

diff --cc sldns/rrdef.h
Simple merge

diff --cc testcode/fake_event.c
Simple merge

diff --cc testcode/unitmain.c
index 6309dbcd336bc88939668931b300bc1dd8b9addf,b0bf6bb5457a2b84ba0be1768841061fad6bf85a..f7eec421ebf9c646a630ef8d06867ade65727f02
--- 1/testcode/unitmain.c
--- 2/testcode/unitmain.c
+++ b/testcode/unitmain.c
@@@ -1040,6 -839,218 +1040,218 @@@ static void respip_test(void
        respip_conf_actions_test();
  }
  
 -      unit_assert(
 -              parse_edns_from_query_pkt(pkt, edns, NULL, NULL, region)==0);
+ #include "util/regional.h"
+ #include "sldns/sbuffer.h"
+ #include "util/data/dname.h"
+ #include "util/data/msgreply.h"
+ #include "util/data/msgencode.h"
+ #include "sldns/str2wire.h"
+ 
+ static void edns_ede_encode_setup(struct edns_data* edns,
+       struct regional* region)
+ {
+       memset(edns, 0, sizeof(*edns));
+       edns->edns_present = 1;
+       edns->edns_version = EDNS_ADVERTISED_VERSION;
+       edns->udp_size = EDNS_ADVERTISED_SIZE;
+       edns->bits &= EDNS_DO;
+       /* Fill up opt_list_out with EDEs */
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_out, region,
+               LDNS_EDE_OTHER, "Too long other text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_out, region,
+               LDNS_EDE_OTHER, "Too long other text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_out, region,
+               LDNS_EDE_BLOCKED, "Too long blocked text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_out, region,
+               LDNS_EDE_OTHER, "Too long other text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_out, region,
+               LDNS_EDE_BLOCKED, "Too long blocked text"));
+       /* Fill up opt_list_inplace_cb_out with EDEs */
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region,
+               LDNS_EDE_OTHER, "Too long other text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region,
+               LDNS_EDE_OTHER, "Too long other text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region,
+               LDNS_EDE_BLOCKED, "Too long blocked text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region,
+               LDNS_EDE_OTHER, "Too long other text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region,
+               LDNS_EDE_BLOCKED, "Too long blocked text"));
+       /* append another EDNS option to both lists */
+       unit_assert(
+               edns_opt_list_append(&edns->opt_list_out,
+               LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST, 0, NULL, region));
+       unit_assert(
+               edns_opt_list_append(&edns->opt_list_inplace_cb_out,
+               LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST, 0, NULL, region));
+       /* append LDNS_EDE_OTHER at the end of both lists */
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_out, region,
+               LDNS_EDE_OTHER, "Too long other text"));
+       unit_assert(
+               edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region,
+               LDNS_EDE_OTHER, "Too long other text"));
+ }
+ 
+ static void edns_ede_encode_encodedecode(struct query_info* qinfo,
+       struct reply_info* rep, struct regional* region,
+       struct edns_data* edns, sldns_buffer* pkt)
+ {
+       /* encode */
+       unit_assert(
+               reply_info_answer_encode(qinfo, rep, 1, rep->flags, pkt,
+               0, 0, region, 65535, edns, 0, 0));
+       /* buffer ready for reading; skip after the question section */
+       sldns_buffer_skip(pkt, LDNS_HEADER_SIZE);
+       (void)query_dname_len(pkt);
+       sldns_buffer_skip(pkt, 2 + 2);
+       /* decode */
++      unit_assert(parse_edns_from_query_pkt(pkt, edns, NULL, NULL, NULL, 0,
++              region) == 0);
+ }
+ 
+ static void edns_ede_encode_check(struct edns_data* edns, int* found_ede,
+       int* found_ede_other, int* found_ede_txt, int* found_other_edns)
+ {
+       struct edns_option* opt;
+       for(opt = edns->opt_list_in; opt; opt = opt->next) {
+               if(opt->opt_code == LDNS_EDNS_EDE) {
+                       (*found_ede)++;
+                       if(opt->opt_len > 2)
+                               (*found_ede_txt)++;
+                       if(opt->opt_len >= 2 && sldns_read_uint16(
+                               opt->opt_data) == LDNS_EDE_OTHER)
+                               (*found_ede_other)++;
+               } else {
+                       (*found_other_edns)++;
+               }
+       }
+ 
+ }
+ 
+ static void edns_ede_encode_fit_test(struct query_info* qinfo,
+       struct reply_info* rep, struct regional* region)
+ {
+       struct edns_data edns;
+       int found_ede = 0, found_ede_other = 0, found_ede_txt = 0;
+       int found_other_edns = 0;
+       sldns_buffer* pkt = sldns_buffer_new(65535);
+       unit_assert(pkt);
+       edns_ede_encode_setup(&edns, region);
+       /* leave the pkt buffer as is; everything should fit */
+       edns_ede_encode_encodedecode(qinfo, rep, region, &edns, pkt);
+       edns_ede_encode_check(&edns, &found_ede, &found_ede_other,
+               &found_ede_txt, &found_other_edns);
+       unit_assert(found_ede == 12);
+       unit_assert(found_ede_other == 8);
+       unit_assert(found_ede_txt == 12);
+       unit_assert(found_other_edns == 2);
+       /* cleanup */
+       sldns_buffer_free(pkt);
+ }
+ 
+ static void edns_ede_encode_notxt_fit_test( struct query_info* qinfo,
+       struct reply_info* rep, struct regional* region)
+ {
+       struct edns_data edns;
+       sldns_buffer* pkt;
+       uint16_t edns_field_size, ede_txt_size;
+       int found_ede = 0, found_ede_other = 0, found_ede_txt = 0;
+       int found_other_edns = 0;
+       edns_ede_encode_setup(&edns, region);
+       /* pkt buffer should fit everything if the ede txt is cropped.
+        * OTHER EDE should not be there since it is useless without text. */
+       edns_field_size = calc_edns_field_size(&edns);
+       (void)calc_ede_option_size(&edns, &ede_txt_size);
+       pkt = sldns_buffer_new(LDNS_HEADER_SIZE
+               + qinfo->qname_len
+               + 2 + 2 /* qtype + qclass */
+               + 11 /* opt record */
+               + edns_field_size
+               - ede_txt_size);
+       unit_assert(pkt);
+       edns_ede_encode_encodedecode(qinfo, rep, region, &edns, pkt);
+       edns_ede_encode_check(&edns, &found_ede, &found_ede_other,
+               &found_ede_txt, &found_other_edns);
+       unit_assert(found_ede == 4);
+       unit_assert(found_ede_other == 0);
+       unit_assert(found_ede_txt == 0);
+       unit_assert(found_other_edns == 2);
+       /* cleanup */
+       sldns_buffer_free(pkt);
+ }
+ 
+ static void edns_ede_encode_no_fit_test( struct query_info* qinfo,
+       struct reply_info* rep, struct regional* region)
+ {
+       struct edns_data edns;
+       sldns_buffer* pkt;
+       uint16_t edns_field_size, ede_size, ede_txt_size;
+       int found_ede = 0, found_ede_other = 0, found_ede_txt = 0;
+       int found_other_edns = 0;
+       edns_ede_encode_setup(&edns, region);
+       /* pkt buffer should fit only non-EDE options. */
+       edns_field_size = calc_edns_field_size(&edns);
+       ede_size = calc_ede_option_size(&edns, &ede_txt_size);
+       pkt = sldns_buffer_new(LDNS_HEADER_SIZE
+               + qinfo->qname_len
+               + 2 + 2 /* qtype + qclass */
+               + 11 /* opt record */
+               + edns_field_size
+               - ede_size);
+       unit_assert(pkt);
+       edns_ede_encode_encodedecode(qinfo, rep, region, &edns, pkt);
+       edns_ede_encode_check(&edns, &found_ede, &found_ede_other,
+               &found_ede_txt, &found_other_edns);
+       unit_assert(found_ede == 0);
+       unit_assert(found_ede_other == 0);
+       unit_assert(found_ede_txt == 0);
+       unit_assert(found_other_edns == 2);
+       /* cleanup */
+       sldns_buffer_free(pkt);
+ }
+ 
+ /** test optional EDE encoding with various buffer
+  *  available sizes */
+ static void edns_ede_answer_encode_test(void)
+ {
+       struct regional* region = regional_create();
+       struct reply_info* rep;
+       struct query_info qinfo;
+       unit_show_feature("edns ede optional encoding");
+       unit_assert(region);
+       rep = construct_reply_info_base(region,
+               LDNS_RCODE_NOERROR | BIT_QR, 1,
+               3600, 3600, 3600,
+               0, 0, 0, 0,
+               sec_status_unchecked, LDNS_EDE_NONE);
+       unit_assert(rep);
+       memset(&qinfo, 0, sizeof(qinfo));
+       qinfo.qname = sldns_str2wire_dname("encode.ede.", &qinfo.qname_len);
+       unit_assert(qinfo.qname);
+       qinfo.qtype = LDNS_RR_TYPE_TXT;
+       qinfo.qclass = LDNS_RR_CLASS_IN;
+ 
+       edns_ede_encode_fit_test(&qinfo, rep, region);
+       edns_ede_encode_notxt_fit_test(&qinfo, rep, region);
+       edns_ede_encode_no_fit_test(&qinfo, rep, region);
+ 
+       /* cleanup */
+       free(qinfo.qname);
+       regional_free_all(region);
+       regional_destroy(region);
+ }
+ 
  void unit_show_func(const char* file, const char* func)
  {
        printf("test %s:%s\n", file, func);

diff --cc util/config_file.c
index 57beeae50b133897d8b3955f5f39d97a1171d19d,54bd5f952e8785da20845b9ae5a968026d5b0e60..1c73f839b3113aea853e0926e3be40786d3f0be9
--- 1/util/config_file.c
--- 2/util/config_file.c
+++ b/util/config_file.c
@@@ -88,10 -87,7 +88,10 @@@ struct config_parser_state* cfg_parser 
  /** init ports possible for use */
  static void init_outgoing_availports(int* array, int num);
  
- struct config_file* 
 +/** init cookie with random data */
 +static void init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len);
 +
+ struct config_file*
  config_create(void)
  {
        struct config_file* cfg;
@@@ -1671,22 -1685,7 +1693,21 @@@ config_delete(struct config_file* cfg
        free(cfg);
  }
  
- 
- static void 
 +static void
 +init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len)
 +{
 +      struct ub_randstate *rand = ub_initstate(NULL);
 +
 +      if (!rand)
 +              fatal_exit("could not init random generator");
 +      while (cookie_secret_len) {
 +              *cookie_secret++ = (uint8_t)ub_random(rand);
 +              cookie_secret_len--;
 +      }
 +      ub_randfree(rand);
 +}
 +
+ static void
  init_outgoing_availports(int* a, int num)
  {
        /* generated with make iana_update */

diff --cc util/config_file.h
Simple merge

diff --cc util/configlexer.lex
Simple merge

diff --cc util/configparser.y
Simple merge

diff --cc util/data/msgencode.c
index ec93ca071dae5d07a30ce6a8919e3e448418d43d,81d3fe7efb3487858605e95dbaf8424583367d8a..a170eb7b8a67b052721411abdb3bac055a2f8d46
--- 1/util/data/msgencode.c
--- 2/util/data/msgencode.c
+++ b/util/data/msgencode.c
@@@ -995,11 -1097,17 +1099,17 @@@ extended_error_encode(sldns_buffer* buf
                struct edns_data es = *edns;
                es.edns_version = EDNS_ADVERTISED_VERSION;
                es.udp_size = EDNS_ADVERTISED_SIZE;
 -              es.ext_rcode = 0;
 +              es.ext_rcode = (uint8_t)(rcode >> 4);
                es.bits &= EDNS_DO;
                if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) >
-                       edns->udp_size)
-                       return;
+                       edns->udp_size) {
+                       edns_opt_list_remove(&es.opt_list_inplace_cb_out, LDNS_EDNS_EDE);
+                       edns_opt_list_remove(&es.opt_list_out, LDNS_EDNS_EDE);
+                       if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) >
+                               edns->udp_size) {
+                               return;
+                       }
+               }
                attach_edns_record(buf, &es);
        }
  }

diff --cc util/data/msgencode.h
Simple merge

diff --cc util/data/msgreply.c
Simple merge

diff --cc util/data/msgreply.h
Simple merge

diff --cc validator/val_sigcrypt.c
Simple merge