Merge branch 'master' into update-with-branches/poisonlicious

diff --cc configure
Simple merge

diff --cc configure.ac
Simple merge

diff --cc daemon/remote.c
Simple merge

diff --cc doc/example.conf.in
Simple merge

diff --cc doc/unbound-control.rst
Simple merge

diff --cc doc/unbound.conf.rst
index 3c2b1781e8e472d88183ce4a0d0066768d9a9939,8f78fb31d60ce1bdc596e4144356d61587355799..ed9cdef008c631428e1bd59abed12d20b5ba8a09
--- 1/doc/unbound.conf.rst
--- 2/doc/unbound.conf.rst
+++ b/doc/unbound.conf.rst
@@@ -4978,45 -5110,9 +5134,45 @@@ answer queries with that content
      :ref:`interface-tag<unbound.conf.interface-tag>`.
      Enclose list of tags in quotes (``""``) and put spaces between tags.
  
-     If no tags are specified the policies from this clause will be applied for
+     If no tags are specified the policies from this section will be applied for
      all clients.
  
 +.. _unbound.conf.tsig-key:
 +
 +TSIG Key Options
 +^^^^^^^^^^^^^^^^^
 +
 +The **tsig-key:** clauses specify the TSIG keys that are used.
 +There can be multiple **tsig-key:** clauses, with each specifying a
 +different key.
 +Each key has a name, algorithm and secret key material.
 +
 +TSIG keys are shared secrets.
 +Both sides of the connection share the secret information.
 +Also they must both use the same name for the key, and same algorithm.
 +
 +With ``include: "key.conf"`` it is possible to put the declaration of the key
 +or some lines of it in an external file from the main configuration file.
 +It can also be used without such an include, with it the config statements
 +and key material can be put in separate files.
 +
 +
 +@@UAHL@unbound.conf.tsig-key@name@@: *"<key name>"*
 +    Name of the TSIG key.
 +    The key name is transferred in DNS wireformat in the TSIG record, and
 +    is used to reference the TSIG key from where it is configured to be used.
 +
 +
 +@@UAHL@unbound.conf.tsig-key@algorithm@@: *<algorithm name>*
 +    Name of the algorithm to use with this TSIG key.
 +    This can be md5, sha1, sha224, sha256, sha384 or sha512.
 +
 +
 +@@UAHL@unbound.conf.tsig-key@secret@@: *"<base64 blob>"*
 +    The secret contents is a base64 string.
 +    A way to get random base64 bytes is e.g.
 +    from ``dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64``
 +
  Memory Control Example
  ----------------------
  

diff --cc services/mesh.c
index a092915d54f81c48a83baf5eed4e3313daf34c37,af217210207e7c9e156ef7a736fe763ce2c4c7df..d3cac3204e58128ff86418134a4e942b6dfffbee
--- 1/services/mesh.c
--- 2/services/mesh.c
+++ b/services/mesh.c
@@@ -1728,50 -1736,38 +1737,59 @@@ void mesh_query_done(struct mesh_state
        if(mstate->reply_list && mstate->s.env->cfg->dns_error_reporting)
                dns_error_reporting(&mstate->s, rep);
  
 +      if(mstate->reply_list && rep) {
 +              uint8_t data[8192];
 +              struct sldns_buffer dest;
 +              int i;
 +
 +              sldns_buffer_init_frm_data(&dest, data, sizeof(data));
 +              reply_info_answer_encode(&mstate->s.qinfo, rep, 0 /* id */,
 +                              0 /* qflags */, &dest, 0 /* current time */,
 +                              1 /* cached */, mstate->s.env->scratch,
 +                              sizeof(data) /* udpsize */, NULL /* edns */,
 +                              1 /* dnssec */, 0 /* secure */);
 +              log_err("Answer to be send to other unbounds, size: %d",
 +                              (int)sldns_buffer_limit(&dest));
 +              for(i = 0; i < mstate->s.env->outnet->num_dist; i++) {
 +                      if(mstate->s.env->outnet->dist[i] != -1)
 +                              send(mstate->s.env->outnet->dist[i],
 +                                      data, sldns_buffer_limit(&dest), 0);
 +              }
 +                      
 +      }
 +
        for(r = mstate->reply_list; r; r = r->next) {
-               struct timeval old;
-               timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
-               if(mstate->s.env->cfg->discard_timeout != 0 &&
-                       ((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
-                       mstate->s.env->cfg->discard_timeout) {
-                       /* Drop the reply, it is too old */
-                       /* briefly set the reply_list to NULL, so that the
-                        * tcp req info cleanup routine that calls the mesh
-                        * to deregister the meshstate for it is not done
-                        * because the list is NULL and also accounting is not
-                        * done there, but instead we do that here. */
-                       struct mesh_reply* reply_list = mstate->reply_list;
-                       verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
-                       infra_wait_limit_dec(mstate->s.env->infra_cache,
-                               &r->query_reply, mstate->s.env->cfg);
-                       mstate->reply_list = NULL;
-                       if(r->query_reply.c->use_h2)
-                               http2_stream_remove_mesh_state(r->h2_stream);
-                       comm_point_drop_reply(&r->query_reply);
-                       mstate->reply_list = reply_list;
-                       mstate->s.env->mesh->num_queries_discard_timeout++;
-                       continue;
+               if(mesh_is_udp(r)) {
+                       /* For UDP queries, the old replies are discarded.
+                        * This stops a large volume of old replies from
+                        * building up.
+                        * The stream replies, are not discarded. The
+                        * stream is open, the other side is waiting.
+                        * Some answer is needed, even if servfail, but the
+                        * real reply is ready to go, so that is given. */
+                       struct timeval old;
+                       timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
+                       if(mstate->s.env->cfg->discard_timeout != 0 &&
+                               ((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
+                               mstate->s.env->cfg->discard_timeout) {
+                               /* Drop the reply, it is too old */
+                               /* briefly set the reply_list to NULL, so that the
+                                * tcp req info cleanup routine that calls the mesh
+                                * to deregister the meshstate for it is not done
+                                * because the list is NULL and also accounting is not
+                                * done there, but instead we do that here. */
+                               struct mesh_reply* reply_list = mstate->reply_list;
+                               verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
+                               infra_wait_limit_dec(mstate->s.env->infra_cache,
+                                       &r->query_reply, mstate->s.env->cfg);
+                               mstate->reply_list = NULL;
+                               if(r->query_reply.c->use_h2)
+                                       http2_stream_remove_mesh_state(r->h2_stream);
+                               comm_point_drop_reply(&r->query_reply);
+                               mstate->reply_list = reply_list;
+                               mstate->s.env->mesh->num_queries_discard_timeout++;
+                               continue;
+                       }
                }
  
                i++;

diff --cc sldns/rrdef.h
Simple merge

diff --cc sldns/wire2str.c
Simple merge

diff --cc util/config_file.c
Simple merge

diff --cc util/config_file.h
Simple merge

diff --cc util/configlexer.lex
index 2268e3e65940e88698c9a876c7cde7f431f2b8a4,22f98e46429eefb7384aeae1318569479381f65e..f01b4f59a4505262696937c4a5b1987bec7118f4
--- 1/util/configlexer.lex
--- 2/util/configlexer.lex
+++ b/util/configlexer.lex
@@@ -612,9 -607,7 +612,10 @@@ proxy-protocol-port{COLON}        { YDVAR(1, V
  iter-scrub-ns{COLON}          { YDVAR(1, VAR_ITER_SCRUB_NS) }
  iter-scrub-cname{COLON}               { YDVAR(1, VAR_ITER_SCRUB_CNAME) }
  max-global-quota{COLON}               { YDVAR(1, VAR_MAX_GLOBAL_QUOTA) }
+ iter-scrub-promiscuous{COLON} { YDVAR(1, VAR_ITER_SCRUB_PROMISCUOUS) }
 +tsig-key{COLON}                       { YDVAR(0, VAR_TSIG_KEY) }
 +algorithm{COLON}              { YDVAR(1, VAR_ALGORITHM) }
 +secret{COLON}                 { YDVAR(1, VAR_SECRET) }
  <INITIAL,val>{NEWLINE}                { LEXOUT(("NL\n")); cfg_parser->line++; }
  
        /* Quoted strings. Strip leading and ending quotes */

diff --cc util/configparser.y
index 732212a374f92973686fb161d0df1be6a4a5c317,bf9c196fcf2230f5e534ba03be3b05582bd57c89..cd01fbcbd882459375c6eeb5fedd2331fd41ceb7
--- 1/util/configparser.y
--- 2/util/configparser.y
+++ b/util/configparser.y
@@@ -220,7 -216,7 +220,8 @@@ extern struct config_parser_state* cfg_
  %token VAR_LOG_DESTADDR VAR_CACHEDB_CHECK_WHEN_SERVE_EXPIRED
  %token VAR_COOKIE_SECRET_FILE VAR_ITER_SCRUB_NS VAR_ITER_SCRUB_CNAME
  %token VAR_MAX_GLOBAL_QUOTA VAR_HARDEN_UNVERIFIED_GLUE VAR_LOG_TIME_ISO
+ %token VAR_ITER_SCRUB_PROMISCUOUS
 +%token VAR_TSIG_KEY VAR_ALGORITHM VAR_SECRET
  
  %%
  toplevelvars: /* empty */ | toplevelvars toplevelvar ;