- Fix contrib/fastrpz.patch to apply cleanly.

diff --git a/contrib/fastrpz.patch b/contrib/fastrpz.patch
index 2cd6a71827e732b49acf85d5717f560036291c9e..aacd5ab826b8254cf98040f7315c7ebe25a251aa 100644 (file)
--- a/contrib/fastrpz.patch
+++ b/contrib/fastrpz.patch
@@ -2,7 +2,7 @@ Description: based on the included patch contrib/fastrpz.patch
 Author: fastrpz@farsightsecurity.com
 ---
 diff --git a/Makefile.in b/Makefile.in
-index 1a2e2c54..028b6cf3 100644
+index a20058cc..495779cc 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -23,6 +23,8 @@ CHECKLOCK_SRC=testcode/checklocks.c
@@ -14,7 +14,7 @@ index 1a2e2c54..028b6cf3 100644
  DNSCRYPT_SRC=@DNSCRYPT_SRC@
  DNSCRYPT_OBJ=@DNSCRYPT_OBJ@
  WITH_PYTHONMODULE=@WITH_PYTHONMODULE@
-@@ -126,7 +128,7 @@ validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
+@@ -127,7 +129,7 @@ validator/val_sigcrypt.c validator/val_utils.c dns64/dns64.c \
  edns-subnet/edns-subnet.c edns-subnet/subnetmod.c \
  edns-subnet/addrtree.c edns-subnet/subnet-whitelist.c \
  cachedb/cachedb.c cachedb/redis.c respip/respip.c $(CHECKLOCK_SRC) \
@@ -23,7 +23,7 @@ index 1a2e2c54..028b6cf3 100644
  COMMON_OBJ_WITHOUT_NETCALL=dns.lo infra.lo rrset.lo dname.lo msgencode.lo \
  as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \
  iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \
-@@ -139,7 +141,7 @@ autotrust.lo val_anchor.lo \
+@@ -140,7 +142,7 @@ autotrust.lo val_anchor.lo rpz.lo \
  validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
  val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo cachedb.lo redis.lo authzone.lo \
  $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \
@@ -32,7 +32,7 @@ index 1a2e2c54..028b6cf3 100644
  COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \
  outside_network.lo
  COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo
-@@ -409,6 +411,11 @@ dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
+@@ -410,6 +412,11 @@ dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \
        $(srcdir)/util/config_file.h $(srcdir)/util/log.h \
        $(srcdir)/util/netevent.h
  
@@ -62,7 +62,7 @@ index 78d47fed..e33073e4 100644
 +/** turn on fastrpz response policy zones */
 +#undef ENABLE_FASTRPZ
 diff --git a/configure.ac b/configure.ac
-index 9a32c577..cc4344ff 100644
+index 2b91dd3c..e6063d17 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -6,6 +6,7 @@ sinclude(ax_pthread.m4)
@@ -84,7 +84,7 @@ index 9a32c577..cc4344ff 100644
  # on openBSD, the implicit rule make $< work.
  # on Solaris, it does not work ($? is changed sources, $^ lists dependencies).
 diff --git a/daemon/daemon.c b/daemon/daemon.c
-index 0b1200a2..5857c18b 100644
+index 8b0fc348..7ffb9221 100644
 --- a/daemon/daemon.c
 +++ b/daemon/daemon.c
 @@ -91,6 +91,9 @@
@@ -112,7 +112,7 @@ index 0b1200a2..5857c18b 100644
  #endif
        }
        for(i=0; i<daemon->num; i++) {
-@@ -724,6 +735,9 @@ daemon_cleanup(struct daemon* daemon)
+@@ -731,6 +742,9 @@ daemon_cleanup(struct daemon* daemon)
  #ifdef USE_DNSCRYPT
        dnsc_delete(daemon->dnscenv);
        daemon->dnscenv = NULL;
@@ -123,10 +123,10 @@ index 0b1200a2..5857c18b 100644
        daemon->cfg = NULL;
  }
 diff --git a/daemon/daemon.h b/daemon/daemon.h
-index 5749dbef..64ce230f 100644
+index 3effbafb..4d4c34da 100644
 --- a/daemon/daemon.h
 +++ b/daemon/daemon.h
-@@ -136,6 +136,11 @@ struct daemon {
+@@ -138,6 +138,11 @@ struct daemon {
        /** the dnscrypt environment */
        struct dnsc_env* dnscenv;
  #endif
@@ -139,10 +139,10 @@ index 5749dbef..64ce230f 100644
  
  /**
 diff --git a/daemon/worker.c b/daemon/worker.c
-index aa16650e..c7c05828 100644
+index eb7fdf2f..1982228d 100644
 --- a/daemon/worker.c
 +++ b/daemon/worker.c
-@@ -75,6 +75,9 @@
+@@ -76,6 +76,9 @@
  #include "libunbound/context.h"
  #include "libunbound/libworker.h"
  #include "sldns/sbuffer.h"
@@ -152,7 +152,7 @@ index aa16650e..c7c05828 100644
  #include "sldns/wire2str.h"
  #include "util/shm_side/shm_main.h"
  #include "dnscrypt/dnscrypt.h"
-@@ -533,8 +536,27 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
+@@ -534,8 +537,27 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
                        /* not secure */
                        secure = 0;
                        break;
@@ -180,10 +180,10 @@ index aa16650e..c7c05828 100644
        /* return this delegation from the cache */
        edns_bak = *edns;
        edns->edns_version = EDNS_ADVERTISED_VERSION;
-@@ -699,6 +721,23 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
-                       secure = 0;
+@@ -710,6 +732,23 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
+                       *is_secure_answer = 0;
                }
-       } else  secure = 0;
+       } else *is_secure_answer = 0;
 +#ifdef ENABLE_FASTRPZ
 +      if(repinfo->rpz) {
 +              /* Scan the cached answer for RPZ hits.
@@ -204,7 +204,7 @@ index aa16650e..c7c05828 100644
  
        edns_bak = *edns;
        edns->edns_version = EDNS_ADVERTISED_VERSION;
-@@ -1410,6 +1449,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
+@@ -1435,6 +1474,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
                log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
                        &repinfo->addr, repinfo->addrlen);
                goto send_reply;
@@ -220,14 +220,14 @@ index aa16650e..c7c05828 100644
        }
  
        /* If we've found a local alias, replace the qname with the alias
-@@ -1458,12 +1506,21 @@ lookup_cache:
+@@ -1485,12 +1533,21 @@ lookup_cache:
                h = query_info_hash(lookup_qinfo, sldns_buffer_read_u16_at(c->buffer, 2));
                if((e=slabhash_lookup(worker->env.msg_cache, h, lookup_qinfo, 0))) {
                        /* answer from cache - we have acquired a readlock on it */
 -                      if(answer_from_cache(worker, &qinfo,
 +                      ret = answer_from_cache(worker, &qinfo,
-                               cinfo, &need_drop, &alias_rrset, &partial_rep,
-                               (struct reply_info*)e->data,
+                               cinfo, &need_drop, &is_expired_answer, &is_secure_answer,
+                               &alias_rrset, &partial_rep, (struct reply_info*)e->data,
                                *(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
                                sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
 -                              &edns)) {
@@ -244,7 +244,7 @@ index aa16650e..c7c05828 100644
                                /* prefetch it if the prefetch TTL expired.
                                 * Note that if there is more than one pass
                                 * its qname must be that used for cache
-@@ -1520,11 +1577,19 @@ lookup_cache:
+@@ -1547,11 +1604,19 @@ lookup_cache:
                        lock_rw_unlock(&e->lock);
                }
                if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
@@ -267,10 +267,10 @@ index aa16650e..c7c05828 100644
                        }
                        verbose(VERB_ALGO, "answer norec from cache -- "
 diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
-index 6292f0d4..7e91a91f 100644
+index 38c2d298..3b07f392 100644
 --- a/doc/unbound.conf.5.in
 +++ b/doc/unbound.conf.5.in
-@@ -1811,6 +1811,81 @@ List domain for which the AAAA records are ignored and the A record is
+@@ -1828,6 +1828,81 @@ List domain for which the AAAA records are ignored and the A record is
  used by dns64 processing instead.  Can be entered multiple times, list a
  new domain for which it applies, one per line.  Applies also to names
  underneath the name given.
@@ -3106,10 +3106,10 @@ index a2f1b570..e1e4a738 100644
         * Count number of time-outs. Used to prevent resolving failures when
         * the QNAME minimisation QTYPE is blocked. */
 diff --git a/services/cache/dns.c b/services/cache/dns.c
-index aa4efec7..5dd3412e 100644
+index 2a5bca4a..6de8863a 100644
 --- a/services/cache/dns.c
 +++ b/services/cache/dns.c
-@@ -945,6 +945,14 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
+@@ -967,6 +967,14 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
        struct regional* region, uint32_t flags)
  {
        struct reply_info* rep = NULL;
@@ -3125,10 +3125,10 @@ index aa4efec7..5dd3412e 100644
        rep = reply_info_copy(msgrep, env->alloc, NULL);
        if(!rep)
 diff --git a/services/mesh.c b/services/mesh.c
-index d4f814d5..624a9d95 100644
+index 9114ef4c..3dc518e5 100644
 --- a/services/mesh.c
 +++ b/services/mesh.c
-@@ -60,6 +60,9 @@
+@@ -61,6 +61,9 @@
  #include "sldns/wire2str.h"
  #include "services/localzone.h"
  #include "util/data/dname.h"
@@ -3138,7 +3138,7 @@ index d4f814d5..624a9d95 100644
  #include "respip/respip.h"
  #include "services/listen_dnsport.h"
  
-@@ -1076,6 +1079,13 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
+@@ -1195,6 +1198,13 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
        else    secure = 0;
        if(!rep && rcode == LDNS_RCODE_NOERROR)
                rcode = LDNS_RCODE_SERVFAIL;
@@ -3152,7 +3152,7 @@ index d4f814d5..624a9d95 100644
        /* send the reply */
        /* We don't reuse the encoded answer if either the previous or current
         * response has a local alias.  We could compare the alias records
-@@ -1255,6 +1265,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
+@@ -1415,6 +1425,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
        key.s.is_valrec = valrec;
        key.s.qinfo = *qinfo;
        key.s.query_flags = qflags;
@@ -3160,7 +3160,7 @@ index d4f814d5..624a9d95 100644
        /* We are searching for a similar mesh state when we DO want to
         * aggregate the state. Thus unique is set to NULL. (default when we
         * desire aggregation).*/
-@@ -1301,6 +1312,10 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
+@@ -1461,6 +1472,10 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
        if(!r)
                return 0;
        r->query_reply = *rep;
@@ -3172,10 +3172,10 @@ index d4f814d5..624a9d95 100644
        if(edns->opt_list) {
                r->edns.opt_list = edns_opt_copy_region(edns->opt_list,
 diff --git a/util/config_file.c b/util/config_file.c
-index 104c3f83..a5015594 100644
+index 52ca5a18..0660248f 100644
 --- a/util/config_file.c
 +++ b/util/config_file.c
-@@ -1434,6 +1434,8 @@ config_delete(struct config_file* cfg)
+@@ -1460,6 +1460,8 @@ config_delete(struct config_file* cfg)
        free(cfg->dnstap_socket_path);
        free(cfg->dnstap_identity);
        free(cfg->dnstap_version);
@@ -3185,10 +3185,10 @@ index 104c3f83..a5015594 100644
        config_deldblstrlist(cfg->ratelimit_below_domain);
        config_delstrlist(cfg->python_script);
 diff --git a/util/config_file.h b/util/config_file.h
-index b3ef930a..56173b80 100644
+index 8739ca2a..a2dcf215 100644
 --- a/util/config_file.h
 +++ b/util/config_file.h
-@@ -494,6 +494,11 @@ struct config_file {
+@@ -499,6 +499,11 @@ struct config_file {
        /** true to disable DNSSEC lameness check in iterator */
        int disable_dnssec_lame_check;
  
@@ -3201,10 +3201,10 @@ index b3ef930a..56173b80 100644
        int ip_ratelimit;
        /** number of slabs for ip_ratelimit cache */
 diff --git a/util/configlexer.lex b/util/configlexer.lex
-index a86ddf55..b56bcfb4 100644
+index deedffa5..301458a3 100644
 --- a/util/configlexer.lex
 +++ b/util/configlexer.lex
-@@ -438,6 +438,10 @@ dnstap-log-forwarder-query-messages{COLON}        {
+@@ -446,6 +446,10 @@ dnstap-log-forwarder-query-messages{COLON}        {
                YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) }
  dnstap-log-forwarder-response-messages{COLON} {
                YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) }
@@ -3216,7 +3216,7 @@ index a86ddf55..b56bcfb4 100644
  ip-ratelimit{COLON}           { YDVAR(1, VAR_IP_RATELIMIT) }
  ratelimit{COLON}              { YDVAR(1, VAR_RATELIMIT) }
 diff --git a/util/configparser.y b/util/configparser.y
-index 8be6bd3e..74d885ad 100644
+index d471babe..cb6b1d63 100644
 --- a/util/configparser.y
 +++ b/util/configparser.y
 @@ -125,6 +125,7 @@ extern struct config_parser_state* cfg_parser;
@@ -3227,7 +3227,7 @@ index 8be6bd3e..74d885ad 100644
  %token VAR_RESPONSE_IP_TAG VAR_RESPONSE_IP VAR_RESPONSE_IP_DATA
  %token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
  %token VAR_DISABLE_DNSSEC_LAME_CHECK
-@@ -171,7 +172,7 @@ extern struct config_parser_state* cfg_parser;
+@@ -173,7 +174,7 @@ extern struct config_parser_state* cfg_parser;
  
  %%
  toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -3236,7 +3236,7 @@ index 8be6bd3e..74d885ad 100644
        forwardstart contents_forward | pythonstart contents_py | 
        rcstart contents_rc | dtstart contents_dt | viewstart contents_view |
        dnscstart contents_dnsc | cachedbstart contents_cachedb |
-@@ -2728,6 +2729,50 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES
+@@ -2837,6 +2838,50 @@ dt_dnstap_log_forwarder_response_messages: VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MES
                free($2);
        }
        ;
@@ -3288,10 +3288,10 @@ index 8be6bd3e..74d885ad 100644
        { 
                OUTYY(("\nP(python:)\n")); 
 diff --git a/util/data/msgencode.c b/util/data/msgencode.c
-index a51a4b9b..475dfce9 100644
+index be69f628..f10773aa 100644
 --- a/util/data/msgencode.c
 +++ b/util/data/msgencode.c
-@@ -590,6 +590,35 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
+@@ -592,6 +592,35 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
        return RETVAL_OK;
  }
  
@@ -3327,7 +3327,7 @@ index a51a4b9b..475dfce9 100644
  /** store query section in wireformat buffer, return RETVAL */
  static int
  insert_query(struct query_info* qinfo, struct compress_tree_node** tree, 
-@@ -777,6 +806,19 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep,
+@@ -779,6 +808,19 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep,
                        }
                        sldns_buffer_write_u16_at(buffer, 10, arcount);
                }
@@ -3348,10 +3348,10 @@ index a51a4b9b..475dfce9 100644
        sldns_buffer_flip(buffer);
        return 1;
 diff --git a/util/data/packed_rrset.c b/util/data/packed_rrset.c
-index 7b9d5494..e44b2ce5 100644
+index 4b0294f9..3b3838f6 100644
 --- a/util/data/packed_rrset.c
 +++ b/util/data/packed_rrset.c
-@@ -255,6 +255,10 @@ sec_status_to_string(enum sec_status s)
+@@ -256,6 +256,10 @@ sec_status_to_string(enum sec_status s)
        case sec_status_insecure:       return "sec_status_insecure";
        case sec_status_secure_sentinel_fail:   return "sec_status_secure_sentinel_fail";
        case sec_status_secure:         return "sec_status_secure";
@@ -3363,7 +3363,7 @@ index 7b9d5494..e44b2ce5 100644
        return "unknown_sec_status_value";
  }
 diff --git a/util/data/packed_rrset.h b/util/data/packed_rrset.h
-index 3a5335dd..20113217 100644
+index 729877ba..ccd1a0c2 100644
 --- a/util/data/packed_rrset.h
 +++ b/util/data/packed_rrset.h
 @@ -193,7 +193,15 @@ enum sec_status {

diff --git a/doc/Changelog b/doc/Changelog
index 28e87687312dda28b5d9c5bf1d2817047ed7efbb..fafca5111bccf95fedba353cc4880e5e93796f09 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,6 @@
 12 February 2020: Wouter
        - Fix with libnettle make test with dsa disabled.
+       - Fix contrib/fastrpz.patch to apply cleanly.
 
 10 February 2020: George
        - Document 'ub_result.was_ratelimited' in libunbound.