Merge 'origin/master' into 6.0 - last merge before rename

This is the last commit in `6.0` before it is shifted into `master`,
with 5.x support being moved to `master-5`.

diff --cc .gitignore
Simple merge

diff --cc .gitlab-ci.yml
Simple merge

diff --cc daemon/bindings/net.c
index d278ed175e22cf967626d20c1a1966b15063cdf5,0075d0f2d4c21a76cff69ff64cd19acc317fb6fd..aaeef2387b94748865640ec9c467a23658664ded
--- 1/daemon/bindings/net.c
--- 2/daemon/bindings/net.c
+++ b/daemon/bindings/net.c
@@@ -1031,12 -1042,18 +1031,16 @@@ static int net_tls_sticket_secret_file(
                                STR(net_tls_sticket_MIN_SECRET_LEN) " bytes",
                        file_name);
        }
-       fclose(fp);
+       if (fclose(fp) == EOF) {
+               lua_error_p(L,
+                       "net.tls_sticket_secret_file - reading of file '%s' failed",
+                       file_name);
+       }
  
 -      struct network *net = &the_worker->engine->net;
 -
 -      tls_session_ticket_ctx_destroy(net->tls_session_ticket_ctx);
 -      net->tls_session_ticket_ctx =
 -              tls_session_ticket_ctx_create(net->loop, secret_buf, secret_len);
 -      if (net->tls_session_ticket_ctx == NULL) {
 +      tls_session_ticket_ctx_destroy(the_network->tls_session_ticket_ctx);
 +      the_network->tls_session_ticket_ctx =
 +              tls_session_ticket_ctx_create(the_network->loop, secret_buf, secret_len);
 +      if (the_network->tls_session_ticket_ctx == NULL) {
                lua_error_p(L,
                        "net.tls_sticket_secret_file - can't create session ticket context");
        }

diff --cc daemon/engine.c
index 275718eee9cae95974cf5c5804136fd395182e39,8c00a5befdf351d1167a16385129c33f146a1bd3..509915df36f2626fc9b8cd1b5af3b87a91d49492
--- 1/daemon/engine.c
--- 2/daemon/engine.c
+++ b/daemon/engine.c
@@@ -29,8 -29,28 +29,6 @@@
  #include "lib/dnssec/ta.h"
  #include "lib/log.h"
  
- /* Cleanup engine state every 5 minutes */
- const size_t CLEANUP_TIMER = 5*60*1000;
 -/* Magic defaults for the engine. */
 -#ifndef LRU_RTT_SIZE
 -#define LRU_RTT_SIZE 65536 /**< NS RTT cache size */
 -#endif
 -#ifndef LRU_REP_SIZE
 -#define LRU_REP_SIZE (LRU_RTT_SIZE / 4) /**< NS reputation cache size */
 -#endif
 -#ifndef LRU_COOKIES_SIZE
 -      #if ENABLE_COOKIES
 -      #define LRU_COOKIES_SIZE LRU_RTT_SIZE /**< DNS cookies cache size. */
 -      #else
 -      #define LRU_COOKIES_SIZE LRU_ASSOC /* simpler than guards everywhere */
 -      #endif
 -#endif
 -
 -/**@internal Maximum number of incomplete TCP connections in queue.
 -* Default is from empirical testing - in our case, more isn't necessarily better.
 -* See https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/968
 -* */
 -#ifndef TCP_BACKLOG_DEFAULT
 -#define TCP_BACKLOG_DEFAULT 128
 -#endif
  
  /* Execute byte code */
  #define l_dobytecode(L, arr, len, name) \

diff --cc daemon/io.c
index ea98a7f0e65bc79e84b3b253a98a5dd1dad99ed5,9299ff2ad2178236e65342c2d2e13d6f3bde39d8..a32f5a3fe907fe76178f87c3f5ee7eb7afe0a1e4
--- 1/daemon/io.c
--- 2/daemon/io.c
+++ b/daemon/io.c
@@@ -790,19 -834,25 +790,28 @@@ void io_tty_process_input(uv_stream_t *
                                len_s = 0;
                        }
                        uint32_t len_n = htonl(len_s);
-                       fwrite(&len_n, sizeof(len_n), 1, out);
-                       if (len_s > 0)
-                               fwrite(message, len_s, 1, out);
+                       if (fwrite(&len_n, sizeof(len_n), 1, out) != 1)
+                               goto finish;
+                       if (len_s > 0) {
+                               if (fwrite(message, len_s, 1, out) != 1)
+                                       goto finish;
+                       }
 -              } else {
 +                      break;
 +              case IO_MODE_TEXT:
 +                      /* Human-readable and console-printable mode */
-                       if (message)
-                               fprintf(out, "%s", message);
-                       if (message || !args->quiet)
-                               fprintf(out, "\n");
-                       if (!args->quiet)
-                               fprintf(out, "> ");
+                       if (message) {
+                               if (fprintf(out, "%s", message) < 0)
+                                       goto finish;
+                       }
+                       if (message || !args->quiet) {
+                               if (fprintf(out, "\n") < 0)
+                                       goto finish;
+                       }
+                       if (!args->quiet) {
+                               if (fprintf(out, "> ") < 0)
+                                       goto finish;
+                       }
 +                      break;
                }
  
                /* Duplicate command and output to logs */
@@@ -824,12 -874,8 +833,12 @@@
  finish:
        /* Close if redirected */
        if (stream_fd != STDIN_FILENO) {
-               fclose(out);
+               (void)fclose(out);
        }
 +      /* If a LMDB transaction got open, we can't leave it hanging.
 +       * We accept the changes, if any. */
 +      kr_cache_commit(&the_resolver->cache);
 +      kr_rules_commit(true);
  }
  
  void io_tty_alloc(uv_handle_t *handle, size_t suggested, uv_buf_t *buf)

diff --cc daemon/main.c
Simple merge

diff --cc daemon/proxyv2.c
Simple merge

diff --cc daemon/tls.c
index e8dff76c5ac98bf205a2a7e008f62c84d7f14353,0ab3968272a8624fb1739d4004631ba5421f7b8a..09c99508447733756c025bd0481925b90818a128
--- 1/daemon/tls.c
--- 2/daemon/tls.c
+++ b/daemon/tls.c
@@@ -22,12 -21,10 +22,12 @@@
  #include "contrib/base64.h"
  #include "daemon/tls.h"
  #include "daemon/worker.h"
 -#include "daemon/session.h"
 +#include "daemon/session2.h"
  
- #define EPHEMERAL_CERT_EXPIRATION_SECONDS_RENEW_BEFORE (60*60*24*7)
+ #define EPHEMERAL_CERT_EXPIRATION_SECONDS_RENEW_BEFORE ((time_t)60*60*24*7)
  #define GNUTLS_PIN_MIN_VERSION  0x030400
 +#define UNWRAP_BUF_SIZE 131072
 +#define TLS_CHUNK_SIZE (16 * 1024)
  
  #define VERBOSE_MSG(cl_side, ...)\
        if (cl_side) \
@@@ -514,14 -731,14 +514,14 @@@ int tls_certificate_set(const char *tls
                return kr_error(EINVAL);
        }
        /* record the expiration date: */
-       tls_credentials->valid_until = _get_end_entity_expiration(tls_credentials->credentials);
+       tls_credentials->valid_until = get_end_entity_expiration(tls_credentials->credentials);
  
        /* Exchange the x509 credentials */
 -      struct tls_credentials *old_credentials = net->tls_credentials;
 +      struct tls_credentials *old_credentials = the_network->tls_credentials;
  
        /* Start using the new x509_credentials */
 -      net->tls_credentials = tls_credentials;
 -      tls_credentials_log_pins(net->tls_credentials);
 +      the_network->tls_credentials = tls_credentials;
 +      tls_credentials_log_pins(the_network->tls_credentials);
  
        if (old_credentials) {
                err = tls_credentials_release(old_credentials);

diff --cc daemon/tls.h
index b8cf7af6f92c6ef912ccb4e54bd1b5b7ce9ad917,c30444bea1a43752d43f1558070e38986f619ec2..9fd45fb6f75d2b5badce75de93aaffd9ecdf5b99
--- 1/daemon/tls.h
--- 2/daemon/tls.h
+++ b/daemon/tls.h
@@@ -30,10 -30,10 +30,10 @@@
   * So it takes 2 RTT.
   * As we use session tickets, there are additional messages, add one RTT mode.
   */
- #define TLS_MAX_HANDSHAKE_TIME (KR_CONN_RTT_MAX * 3)
 - #define TLS_MAX_HANDSHAKE_TIME (KR_CONN_RTT_MAX * (uint64_t)3)
++#define TLS_MAX_HANDSHAKE_TIME (KR_CONN_RTT_MAX * (uint64_t)3)
  
  /** Transport session (opaque). */
 -struct session;
 +struct session2;
  
  struct tls_ctx;
  struct tls_client_ctx;

diff --cc daemon/tls_ephemeral_credentials.c
Simple merge

diff --cc daemon/udp_queue.c
Simple merge

diff --cc daemon/worker.c
index 2d293ba9f1ba91f5d023f1c754eca68b30496011,12c08f160eb96066b501609a2eeaa7c79914c43b..2e9f4523641ffa64bb19bca76f7e4111aca03436
--- 1/daemon/worker.c
--- 2/daemon/worker.c
+++ b/daemon/worker.c
@@@ -194,10 -195,10 +194,10 @@@ static inline struct mempool *pool_borr
  {
        /* The implementation used to have extra caching layer,
         * but it didn't work well.  Now it's very simple. */
-       return mp_new(16 * 1024);
+       return mp_new((size_t)16 * 1024);
  }
  /** Return a mempool. */
 -static inline void pool_release(struct worker_ctx *worker, struct mempool *mp)
 +static inline void pool_release(struct mempool *mp)
  {
        mp_delete(mp);
  }

diff --cc daemon/zimport.c
Simple merge

diff --cc lib/cache/peek.c
Simple merge

diff --cc lib/dnssec.c
Simple merge

diff --cc lib/log.c
Simple merge

diff --cc lib/resolve.c
Simple merge

diff --cc lib/selection.c
Simple merge

diff --cc modules/dnstap/dnstap.c
Simple merge

diff --cc modules/stats/stats.c
index a8a29de2ce7ebf7183ad2d51fc59f6214f78520e,129023f83f8c931e7c0c74d8bf7e1d17e8ef02c9..d0386738b1fd0102f1d04b50b1623f02b1a6793a
--- 1/modules/stats/stats.c
--- 2/modules/stats/stats.c
+++ b/modules/stats/stats.c
@@@ -366,32 -356,9 +366,32 @@@ static int list_entry(const char *key, 
        struct list_entry_context *ctx = baton;
        if (!key_matches_prefix(key, key_len, ctx->key_prefix, ctx->key_prefix_len))
                return 0;
-       size_t number = (size_t) *val;
+       size_t number = (size_t)*val;
 -      auto_free char *key_nt = strndup(key, key_len);
 -      json_append_member(ctx->root, key_nt, json_mknumber((double)number));
 +
 +      uint32_t dot_index = 0;
 +      for (uint32_t i = 0; i < key_len; i++) {
 +              if (!key[i])
 +                      break;
 +              if (key[i] == '.') {
 +                      dot_index = i;
 +              }
 +      }
 +
 +      if (dot_index) {
 +              auto_free char *sup_key_nt = strndup(key, dot_index);
 +              auto_free char *sub_key_nt = strndup(key + dot_index + 1, key_len - dot_index - 1);
 +              JsonNode *sup = json_find_member(ctx->root, sup_key_nt);
 +              if (!sup) {
 +                      sup = json_mkobject();
 +                      json_append_member(ctx->root, sup_key_nt, sup);
 +              }
 +              if (kr_fails_assert(sup))
 +                      return 0;
-               json_append_member(sup, sub_key_nt, json_mknumber(number));
++              json_append_member(sup, sub_key_nt, json_mknumber((double)number));
 +      } else {
 +              auto_free char *key_nt = strndup(key, key_len);
-               json_append_member(ctx->root, key_nt, json_mknumber(number));
++              json_append_member(ctx->root, key_nt, json_mknumber((double)number));
 +      }
        return 0;
  }
  
@@@ -407,15 -374,8 +407,15 @@@ static char* stats_list(void *env, stru
        size_t args_len = args ? strlen(args) : 0;
        for (unsigned i = 0; i < metric_const_end; ++i) {
                struct const_metric_elm *elm = &const_metrics[i];
 -              if (!args || strncmp(elm->key, args, args_len) == 0) {
 -                      json_append_member(root, elm->key, json_mknumber((double)elm->val));
 +              if (!args || strcmp(elm->sup_key, args) == 0) {
 +                      JsonNode *sup = json_find_member(root, elm->sup_key);
 +                      if (!sup) {
 +                              sup = json_mkobject();
 +                              json_append_member(root, elm->sup_key, sup);
 +                      }
 +                      if (kr_fails_assert(sup))
 +                              break;
-                       json_append_member(sup, elm->sub_key, json_mknumber(elm->val));
++                      json_append_member(sup, elm->sub_key, json_mknumber((double)elm->val));
                }
        }
        struct list_entry_context ctx = {

diff --cc utils/cache_gc/db.c
Simple merge