- contrib/aaaa-filter-iterator.patch file renewed diff content to

  apply cleanly to the current coderepo for the current code version.

diff --git a/contrib/aaaa-filter-iterator.patch b/contrib/aaaa-filter-iterator.patch
index f51de2a40d9b330087dba21578e330fb0087a7ad..818b73a11078e6911319e876867dfe0f70c98e9b 100644 (file)
--- a/contrib/aaaa-filter-iterator.patch
+++ b/contrib/aaaa-filter-iterator.patch
@@ -1,8 +1,8 @@
 diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
-index f426ac5f..147fbfa9 100644
+index 50f9224..09456f5 100644
 --- a/doc/unbound.conf.5.in
 +++ b/doc/unbound.conf.5.in
-@@ -872,6 +872,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when
+@@ -970,6 +970,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when
  this option in enabled. Only use if you know what you are doing.
  This option only has effect when qname-minimisation is enabled. Default is no.
  .TP
@@ -17,14 +17,13 @@ index f426ac5f..147fbfa9 100644
  Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
  and other denials, using information from previous NXDOMAINs answers.
 diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
-index aae934dd..55c55de0 100644
+index f093c1b..e55a224 100644
 --- a/iterator/iter_scrub.c
 +++ b/iterator/iter_scrub.c
-@@ -667,6 +667,32 @@ static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
-       return 0;
+@@ -680,6 +680,32 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt,
  }
  
-+/**
+ /**
 + * ASN: Lookup A records from rrset cache.
 + * @param qinfo: the question originally asked.
 + * @param env: module environment with config and cache.
@@ -50,10 +49,11 @@ index aae934dd..55c55de0 100644
 +      return 0;
 +}
 +
- /**
++/**
   * Given a response event, remove suspect RRsets from the response.
   * "Suspect" rrsets are potentially poison. Note that this routine expects
-@@ -686,6 +712,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+  * the response to be in a "normalized" state -- that is, all "irrelevant"
+@@ -698,6 +724,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
        struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
        struct iter_env* ie)
  {
@@ -61,7 +61,7 @@ index aae934dd..55c55de0 100644
        int del_addi = 0; /* if additional-holding rrsets are deleted, we
                do not trust the normalized additional-A-AAAA any more */
        struct rrset_parse* rrset, *prev;
-@@ -721,6 +748,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+@@ -733,6 +760,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
                rrset = rrset->rrset_all_next;
        }
  
@@ -75,7 +75,7 @@ index aae934dd..55c55de0 100644
        /* At this point, we brutally remove ALL rrsets that aren't 
         * children of the originating zone. The idea here is that, 
         * as far as we know, the server that we contacted is ONLY 
-@@ -732,6 +766,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
+@@ -744,6 +778,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
        rrset = msg->rrset_first;
        while(rrset) {
  
@@ -101,22 +101,22 @@ index aae934dd..55c55de0 100644
                if( (rrset->type == LDNS_RR_TYPE_A || 
                        rrset->type == LDNS_RR_TYPE_AAAA)) {
 diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
-index 7bc67da6..e10f547a 100644
+index 2482a1f..bd5ba24 100644
 --- a/iterator/iter_utils.c
 +++ b/iterator/iter_utils.c
-@@ -175,6 +175,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
-       }
+@@ -177,6 +177,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
        iter_env->supports_ipv6 = cfg->do_ip6;
        iter_env->supports_ipv4 = cfg->do_ip4;
+       iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
 +      iter_env->aaaa_filter = cfg->aaaa_filter;
        return 1;
  }
  
 diff --git a/iterator/iterator.c b/iterator/iterator.c
-index 23b07ea9..ca29b48c 100644
+index 48238a2..34ba249 100644
 --- a/iterator/iterator.c
 +++ b/iterator/iterator.c
-@@ -2127,6 +2127,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
+@@ -2184,6 +2184,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
  
        return 0;
  }
@@ -170,7 +170,7 @@ index 23b07ea9..ca29b48c 100644
        
  /** 
   * This is the request event state where the request will be sent to one of
-@@ -2186,6 +2233,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -2243,6 +2290,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
                return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
        }
        
@@ -184,7 +184,7 @@ index 23b07ea9..ca29b48c 100644
        /* Make sure we have a delegation point, otherwise priming failed
         * or another failure occurred */
        if(!iq->dp) {
-@@ -3574,6 +3628,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3688,6 +3742,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
        return 0;
  }
  
@@ -246,7 +246,7 @@ index 23b07ea9..ca29b48c 100644
  /*
   * Return priming query results to interested super querystates.
   * 
-@@ -3593,6 +3702,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
+@@ -3707,6 +3816,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
        else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
                super->minfo[id])->state == DSNS_FIND_STATE)
                processDSNSResponse(qstate, id, super);
@@ -256,7 +256,7 @@ index 23b07ea9..ca29b48c 100644
        else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
                error_supers(qstate, id, super);
        else if(qstate->is_priming)
-@@ -3630,6 +3742,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
+@@ -3744,6 +3856,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
                        case INIT_REQUEST_3_STATE:
                                cont = processInitRequest3(qstate, iq, id);
                                break;
@@ -266,7 +266,7 @@ index 23b07ea9..ca29b48c 100644
                        case QUERYTARGETS_STATE:
                                cont = processQueryTargets(qstate, iq, ie, id);
                                break;
-@@ -3961,6 +4076,8 @@ iter_state_to_string(enum iter_state state)
+@@ -4080,6 +4195,8 @@ iter_state_to_string(enum iter_state state)
                return "INIT REQUEST STATE (stage 2)";
        case INIT_REQUEST_3_STATE:
                return "INIT REQUEST STATE (stage 3)";
@@ -275,7 +275,7 @@ index 23b07ea9..ca29b48c 100644
        case QUERYTARGETS_STATE :
                return "QUERY TARGETS STATE";
        case PRIME_RESP_STATE :
-@@ -3985,6 +4102,7 @@ iter_state_is_responsestate(enum iter_state s)
+@@ -4104,6 +4221,7 @@ iter_state_is_responsestate(enum iter_state s)
                case INIT_REQUEST_STATE :
                case INIT_REQUEST_2_STATE :
                case INIT_REQUEST_3_STATE :
@@ -284,10 +284,10 @@ index 23b07ea9..ca29b48c 100644
                case COLLECT_CLASS_STATE :
                        return 0;
 diff --git a/iterator/iterator.h b/iterator/iterator.h
-index 342ac207..731948d1 100644
+index a9e5856..ace68c6 100644
 --- a/iterator/iterator.h
 +++ b/iterator/iterator.h
-@@ -135,6 +135,9 @@ struct iter_env {
+@@ -133,6 +133,9 @@ struct iter_env {
         */
        int* target_fetch_policy;
  
@@ -297,11 +297,10 @@ index 342ac207..731948d1 100644
        /** lock on ratelimit counter */
        lock_basic_type queries_ratelimit_lock;
        /** number of queries that have been ratelimited */
-@@ -186,6 +189,14 @@ enum iter_state {
-        */
+@@ -188,6 +191,14 @@ enum iter_state {
        INIT_REQUEST_3_STATE,
  
-+      /**
+       /**
 +       * This state is responsible for intercepting AAAA queries,
 +       * and launch a A subquery on the same target, to populate the
 +       * cache with A records, so the AAAA filter scrubbing logic can
@@ -309,10 +308,11 @@ index 342ac207..731948d1 100644
 +       */
 +      ASN_FETCH_A_FOR_AAAA_STATE,
 +
-       /**
++      /**
         * Each time a delegation point changes for a given query or a 
         * query times out and/or wakes up, this state is (re)visited. 
-@@ -375,6 +386,13 @@ struct iter_qstate {
+        * This state is responsible for iterating through a list of 
+@@ -376,6 +387,13 @@ struct iter_qstate {
         */
        int refetch_glue;
  
@@ -327,10 +327,10 @@ index 342ac207..731948d1 100644
        struct outbound_list outlist;
  
 diff --git a/pythonmod/interface.i b/pythonmod/interface.i
-index f08b575d..47f1bb2e 100644
+index 03483ab..a8c30b5 100644
 --- a/pythonmod/interface.i
 +++ b/pythonmod/interface.i
-@@ -975,6 +975,7 @@ struct config_file {
+@@ -994,6 +994,7 @@ struct config_file {
     int harden_dnssec_stripped;
     int harden_referral_path;
     int use_caps_bits_for_id;
@@ -339,10 +339,10 @@ index f08b575d..47f1bb2e 100644
     struct config_strlist* private_domain;
     size_t unwanted_threshold;
 diff --git a/util/config_file.c b/util/config_file.c
-index 0ab8614a..729fb147 100644
+index 39050f5..326b0b9 100644
 --- a/util/config_file.c
 +++ b/util/config_file.c
-@@ -218,6 +218,7 @@ config_create(void)
+@@ -231,6 +231,7 @@ config_create(void)
        cfg->harden_referral_path = 0;
        cfg->harden_algo_downgrade = 0;
        cfg->use_caps_bits_for_id = 0;
@@ -351,10 +351,10 @@ index 0ab8614a..729fb147 100644
        cfg->private_address = NULL;
        cfg->private_domain = NULL;
 diff --git a/util/config_file.h b/util/config_file.h
-index e61257a3..dabaa7bb 100644
+index 18910be..bd59144 100644
 --- a/util/config_file.h
 +++ b/util/config_file.h
-@@ -260,6 +260,8 @@ struct config_file {
+@@ -285,6 +285,8 @@ struct config_file {
        int harden_algo_downgrade;
        /** use 0x20 bits in query as random ID bits */
        int use_caps_bits_for_id;
@@ -364,38 +364,38 @@ index e61257a3..dabaa7bb 100644
        struct config_strlist* caps_whitelist;
        /** strip away these private addrs from answers, no DNS Rebinding */
 diff --git a/util/configlexer.lex b/util/configlexer.lex
-index 79a0edca..4eaec678 100644
+index 71da924..b58b4b6 100644
 --- a/util/configlexer.lex
 +++ b/util/configlexer.lex
-@@ -304,6 +304,7 @@ harden-algo-downgrade{COLON}       { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
- use-caps-for-id{COLON}                { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+@@ -317,6 +317,7 @@ use-caps-for-id{COLON}             { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
  caps-whitelist{COLON}         { YDVAR(1, VAR_CAPS_WHITELIST) }
+ caps-exempt{COLON}            { YDVAR(1, VAR_CAPS_WHITELIST) }
  unwanted-reply-threshold{COLON}       { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 +aaaa-filter{COLON}            { YDVAR(1, VAR_AAAA_FILTER) }
  private-address{COLON}                { YDVAR(1, VAR_PRIVATE_ADDRESS) }
  private-domain{COLON}         { YDVAR(1, VAR_PRIVATE_DOMAIN) }
  prefetch-key{COLON}           { YDVAR(1, VAR_PREFETCH_KEY) }
 diff --git a/util/configparser.y b/util/configparser.y
-index 1d0e8658..f284dd43 100644
+index 1daf853..cd39618 100644
 --- a/util/configparser.y
 +++ b/util/configparser.y
 @@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser;
- %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
+ %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
  %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
  %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
 +%token VAR_AAAA_FILTER
  %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
  %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
  %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -233,6 +234,7 @@ content_server: server_num_threads | server_verbosity | server_port |
+@@ -245,6 +246,7 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
        server_harden_referral_path | server_private_address |
-       server_private_domain | server_extended_statistics | 
+       server_private_domain | server_extended_statistics |
 +      server_aaaa_filter |
-       server_local_data_ptr | server_jostle_timeout | 
-       server_unwanted_reply_threshold | server_log_time_ascii | 
-       server_domain_insecure | server_val_sig_skew_min | 
-@@ -1563,6 +1565,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
+       server_local_data_ptr | server_jostle_timeout |
+       server_unwanted_reply_threshold | server_log_time_ascii |
+       server_domain_insecure | server_val_sig_skew_min |
+@@ -1742,6 +1744,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
                        yyerror("out of memory");
        }
        ;

diff --git a/doc/Changelog b/doc/Changelog
index 3dc60ab486a877f6341b008bcfd4b3bf7725f36a..a69cf06b753d09422725bc2cee566fbfc6c323e8 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+22 December 2021: George
+       - contrib/aaaa-filter-iterator.patch file renewed diff content to
+         apply cleanly to the current coderepo for the current code version.
+
 20 December 2021: George
        - Fix #591: Unbound-anchor manpage links to non-existent license file.