Merge branch 'master' into fast-reload-option

diff --cc Makefile.in
Simple merge

diff --cc config.h.in
Simple merge

diff --cc configure
Simple merge

diff --cc configure.ac
Simple merge

diff --cc daemon/acl_list.c
Simple merge

diff --cc daemon/acl_list.h
Simple merge

diff --cc daemon/daemon.c
Simple merge

diff --cc daemon/daemon.h
index 1e5a4a9bde98312e1e6d2de912e418ed2445833a,54ab97b2d31b7d242f423010a36c783b924ccb45..2295761ab7e30316c3779e7f606aa260824c3d35
--- 1/daemon/daemon.h
--- 2/daemon/daemon.h
+++ b/daemon/daemon.h
@@@ -58,9 -58,8 +58,10 @@@ struct ub_randstate
  struct daemon_remote;
  struct respip_set;
  struct shm_main_info;
+ struct doq_table;
  struct cookie_secrets;
 +struct fast_reload_thread;
 +struct fast_reload_printq;
  
  #include "dnstap/dnstap_config.h"
  #ifdef USE_DNSTAP

diff --cc daemon/remote.c
Simple merge

diff --cc daemon/unbound.c
Simple merge

diff --cc daemon/worker.c
Simple merge

diff --cc dnstap/unbound-dnstap-socket.c
index 1f3f87ddb5f1b27f72754ed197e669aa319ac6b0,cfa0c8f95bcbc8adbdae7a644608a506adad3d23..a01627de965021d5358170d009a8ba8c6356c5b4
--- 1/dnstap/unbound-dnstap-socket.c
--- 2/dnstap/unbound-dnstap-socket.c
+++ b/dnstap/unbound-dnstap-socket.c
@@@ -1784,16 -1787,18 +1787,32 @@@ void remote_get_opt_ssl(char* ATTR_UNUS
          log_assert(0);
  }
  
 +void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 +      void* ATTR_UNUSED(arg))
 +{
 +      log_assert(0);
 +}
 +
 +int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c),
 +      void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
 +        struct comm_reply* ATTR_UNUSED(repinfo))
 +{
 +      log_assert(0);
 +      return 0;
 +}
++
+ #ifdef HAVE_NGTCP2
+ void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
+       void* ATTR_UNUSED(arg))
+ {
+       log_assert(0);
+ }
+ #endif
+ 
+ #ifdef HAVE_NGTCP2
+ void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
+       void* ATTR_UNUSED(arg))
+ {
+       log_assert(0);
+ }
+ #endif

diff --cc doc/unbound-control.8.in
Simple merge

diff --cc iterator/iter_fwd.c
Simple merge

diff --cc iterator/iter_hints.c
Simple merge

diff --cc iterator/iter_utils.c
Simple merge

diff --cc iterator/iter_utils.h
index a3f33a48230ee0cd081c916fc1566bf54e8379f9,30b3dbe5f0bfe938947bd6ba2c92b0ae83656552..b17b091e6639a87d393ff4118e59d9081f4c529d
--- 1/iterator/iter_utils.h
--- 2/iterator/iter_utils.h
+++ b/iterator/iter_utils.h
@@@ -429,41 -430,18 +431,55 @@@ int iter_stub_fwd_no_cache(struct modul
  void iterator_set_ip46_support(struct module_stack* mods,
        struct module_env* env, struct outside_network* outnet);
  
 +/**
 + * Read config string that represents the target fetch policy.
 + * @param target_fetch_policy: alloced on return.
 + * @param max_dependency_depth: set on return.
 + * @param str: the config string
 + * @return false on failure.
 + */
 +int read_fetch_policy(int** target_fetch_policy, int* max_dependency_depth,
 +      const char* str);
 +
 +/**
 + * Create caps exempt data structure.
 + * @return NULL on failure.
 + */
 +struct rbtree_type* caps_white_create(void);
 +
 +/**
 + * Delete caps exempt data structure.
 + * @param caps_white: caps exempt tree.
 + */
 +void caps_white_delete(struct rbtree_type* caps_white);
 +
 +/**
 + * Apply config caps whitelist items to name tree
 + * @param ntree: caps exempt tree.
 + * @param cfg: config with options.
 + */
 +int caps_white_apply_cfg(struct rbtree_type* ntree, struct config_file* cfg);
 +
 +/**
 + * Apply config for nat64
 + * @param nat64: the nat64 state.
 + * @param cfg: config with options.
 + * @return false on failure.
 + */
 +int nat64_apply_cfg(struct iter_nat64* nat64, struct config_file* cfg);
 +
+ /**
+  * Limit NSEC and NSEC3 TTL in response, RFC9077
+  * @param msg: dns message, the SOA record ttl is used to restrict ttls
+  *    of NSEC and NSEC3 RRsets. If no SOA record, nothing happens.
+  */
+ void limit_nsec_ttl(struct dns_msg* msg);
+ 
+ /**
+  * Make the response minimal. Removed authority and additional section,
+  * that works when there is an answer in the answer section.
+  * @param rep: reply to modify.
+  */
+ void iter_make_minimal(struct reply_info* rep);
+ 
  #endif /* ITERATOR_ITER_UTILS_H */

diff --cc iterator/iterator.c
Simple merge

diff --cc iterator/iterator.h
Simple merge

diff --cc libunbound/libworker.c
index 9539f817eee830f1223bc3f72252418e6cb5242e,6b2bf7a3c53b482fa77574406dfd76900b0411e5..f0496452b521a6f7ad02b01c97657c1ef1d4d8b7
--- 1/libunbound/libworker.c
--- 2/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@@ -1059,16 -1059,18 +1059,32 @@@ void dtio_mainfdcallback(int ATTR_UNUSE
  }
  #endif
  
 +void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 +      void* ATTR_UNUSED(arg))
 +{
 +      log_assert(0);
 +}
 +
 +int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c),
 +      void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
 +        struct comm_reply* ATTR_UNUSED(repinfo))
 +{
 +      log_assert(0);
 +      return 0;
 +}
++
+ #ifdef HAVE_NGTCP2
+ void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
+       void* ATTR_UNUSED(arg))
+ {
+       log_assert(0);
+ }
+ #endif
+ 
+ #ifdef HAVE_NGTCP2
+ void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
+       void* ATTR_UNUSED(arg))
+ {
+       log_assert(0);
+ }
+ #endif

diff --cc respip/respip.c
Simple merge

diff --cc services/authzone.c
Simple merge

diff --cc services/authzone.h
Simple merge

diff --cc services/cache/infra.c
Simple merge

diff --cc services/cache/infra.h
index b93919e9494fc844c891fcd81e63a4ffec8e6626,752a141a8dbf940f958b2f9aba43b637c1650dda..903048cb286ea6717a69766476561d9656d1be42
--- 1/services/cache/infra.h
--- 2/services/cache/infra.h
+++ b/services/cache/infra.h
@@@ -502,19 -515,7 +515,22 @@@ void infra_wait_limit_inc(struct infra_
  void infra_wait_limit_dec(struct infra_cache* infra, struct comm_reply* rep,
        struct config_file* cfg);
  
 +/** setup wait limits tree (0 on failure) */
 +int setup_wait_limits(struct rbtree_type* wait_limits_netblock,
 +      struct rbtree_type* wait_limits_cookie_netblock,
 +      struct config_file* cfg);
 +
 +/** Free the wait limits and wait cookie limits tree. */
 +void wait_limits_free(struct rbtree_type* wait_limits_tree);
 +
 +/** setup domain limits tree (0 on failure) */
 +int setup_domain_limits(struct rbtree_type* domain_limits,
 +      struct config_file* cfg);
 +
 +/** Free the domain limits tree. */
 +void domain_limits_free(struct rbtree_type* domain_limits);
 +
+ /** exported for unit test */
+ int still_useful_timeout();
+ 
  #endif /* SERVICES_CACHE_INFRA_H */

diff --cc services/localzone.c
Simple merge

diff --cc services/mesh.c
Simple merge

diff --cc services/mesh.h
Simple merge

diff --cc services/rpz.c
Simple merge

diff --cc smallapp/unbound-control.c
Simple merge

diff --cc smallapp/worker_cb.c
index 5987e76220e753237f9c4fff1268c1fc61c1755f,1d71a0945154fe9f2ebc7ad6d7201cbcd3a0d8ef..92ebe386d2697d52806d89534660f676fc8f2c00
--- 1/smallapp/worker_cb.c
--- 2/smallapp/worker_cb.c
+++ b/smallapp/worker_cb.c
@@@ -256,16 -256,18 +256,32 @@@ void dtio_mainfdcallback(int ATTR_UNUSE
  }
  #endif
  
 +void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
 +      void* ATTR_UNUSED(arg))
 +{
 +      log_assert(0);
 +}
 +
 +int fast_reload_client_callback(struct comm_point* ATTR_UNUSED(c),
 +      void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
 +        struct comm_reply* ATTR_UNUSED(repinfo))
 +{
 +      log_assert(0);
 +      return 0;
 +}
++
+ #ifdef HAVE_NGTCP2
+ void doq_client_event_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
+       void* ATTR_UNUSED(arg))
+ {
+       log_assert(0);
+ }
+ #endif
+ 
+ #ifdef HAVE_NGTCP2
+ void doq_client_timer_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev),
+       void* ATTR_UNUSED(arg))
+ {
+       log_assert(0);
+ }
+ #endif

diff --cc testcode/checklocks.c
index ac3e70ad1bce8bd184e313bfc4811944e5b5c28a,fdc1b8af16dea0535d482a85f795a188cd3c6049..93bbf70f4af210f1939bf4276c024d721e9f187b
--- 1/testcode/checklocks.c
--- 2/testcode/checklocks.c
+++ b/testcode/checklocks.c
@@@ -684,21 -697,11 +700,21 @@@ open_lockorder(struct thr_check* thr
  {
        char buf[24];
        time_t t;
-       snprintf(buf, sizeof(buf), "ublocktrace.%d", thr->num);
+       snprintf(buf, sizeof(buf), "%s.%d", output_name, thr->num);
 -      thr->order_info = fopen(buf, "w");
 -      if(!thr->order_info)
 -              fatal_exit("could not open %s: %s", buf, strerror(errno));
 -      thr->locks_created = 0;
 +      thr->locks_created = thread_lockcount[thr->num];
 +      if(thr->locks_created == 0) {
 +              thr->order_info = fopen(buf, "w");
 +              if(!thr->order_info)
 +                      fatal_exit("could not open %s: %s", buf, strerror(errno));
 +      } else {
 +              /* There is already a file to append on with the previous
 +               * thread information. */
 +              thr->order_info = fopen(buf, "a");
 +              if(!thr->order_info)
 +                      fatal_exit("could not open for append %s: %s", buf, strerror(errno));
 +              return;
 +      }
 +
        t = time(NULL);
        /* write: <time_stamp> <runpid> <thread_num> */
        if(fwrite(&t, sizeof(t), 1, thr->order_info) != 1 ||

diff --cc testcode/fake_event.c
Simple merge

diff --cc testcode/testbound.c
index d5807e8b7b9814151870e9674b601af29dd035ce,f9ea86e699ca1a03a54263e2730821f9a556e125..6da4ceaf2ebf0bf902f68b6949dd20a1d1bb0009
--- 1/testcode/testbound.c
--- 2/testcode/testbound.c
+++ b/testcode/testbound.c
@@@ -601,13 -601,57 +601,68 @@@ void listen_desetup_locks(void
        /* nothing */
  }
  
 +void fast_reload_printq_list_delete(
 +      struct fast_reload_printq* ATTR_UNUSED(list))
 +{
 +      /* nothing */
 +}
 +
 +void fast_reload_worker_pickup_changes(struct worker* ATTR_UNUSED(worker))
 +{
 +      /* nothing */
 +}
++
+ #ifdef HAVE_NGTCP2
+ void* quic_sslctx_create(char* ATTR_UNUSED(key), char* ATTR_UNUSED(pem),
+       char* ATTR_UNUSED(verifypem))
+ {
+     return NULL;
+ }
+ 
+ void comm_point_doq_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(event),
+       void* ATTR_UNUSED(arg))
+ {
+       /* nothing */
+ }
+ 
+ int doq_conn_cmp(const void* ATTR_UNUSED(key1), const void* ATTR_UNUSED(key2))
+ {
+       return 0;
+ }
+ 
+ int doq_conid_cmp(const void* ATTR_UNUSED(key1), const void* ATTR_UNUSED(key2))
+ {
+       return 0;
+ }
+ 
+ int doq_timer_cmp(const void* ATTR_UNUSED(key1), const void* ATTR_UNUSED(key2))
+ {
+       return 0;
+ }
+ 
+ int doq_stream_cmp(const void* ATTR_UNUSED(key1), const void* ATTR_UNUSED(key2))
+ {
+       return 0;
+ }
+ 
+ struct doq_table* doq_table_create(struct config_file* ATTR_UNUSED(cfg),
+       struct ub_randstate* ATTR_UNUSED(rnd))
+ {
+       return calloc(1, sizeof(struct doq_table));
+ }
+ 
+ void doq_table_delete(struct doq_table* table)
+ {
+       free(table);
+ }
+ 
+ void doq_timer_cb(void* ATTR_UNUSED(arg))
+ {
+       /* nothing */
+ }
+ 
+ size_t doq_table_quic_size_get(struct doq_table* ATTR_UNUSED(table))
+ {
+       return 0;
+ }
+ #endif

diff --cc util/config_file.c
index ce1bc1fe9c419d7051a5e23a45e4f82cdb5c9382,f6e25a1ea37b9f8210e689c5c962b8dc6ab3d280..f763cea321630ce57930187744000dea92a5a6f6
--- 1/util/config_file.c
--- 2/util/config_file.c
+++ b/util/config_file.c
@@@ -2797,9 -2834,42 +2835,49 @@@ if_is_dnscrypt(const char* ifname, int 
  #endif
  }
  
 +size_t
 +getmem_str(char* str)
 +{
 +      if(!str) return 0;
 +      return strlen(str)+1;
 +}
++
+ int
+ if_is_quic(const char* ifname, int default_port, int quic_port)
+ {
+ #ifdef HAVE_NGTCP2
+       return if_listens_on(ifname, default_port, quic_port, NULL);
+ #else
+       (void)ifname;
+       (void)default_port;
+       (void)quic_port;
+       return 0;
+ #endif
+ }
+ 
+ int
+ cfg_has_https(struct config_file* cfg)
+ {
+       int i;
+       for(i = 0; i<cfg->num_ifs; i++) {
+               if(if_is_https(cfg->ifs[i], cfg->port, cfg->https_port))
+                       return 1;
+       }
+       return 0;
+ }
+ 
+ int
+ cfg_has_quic(struct config_file* cfg)
+ {
+ #ifdef HAVE_NGTCP2
+       int i;
+       for(i = 0; i<cfg->num_ifs; i++) {
+               if(if_is_quic(cfg->ifs[i], cfg->port, cfg->quic_port))
+                       return 1;
+       }
+       return 0;
+ #else
+       (void)cfg;
+       return 0;
+ #endif
+ }

diff --cc util/config_file.h
Simple merge

diff --cc util/fptr_wlist.c
index 2021b4ca5f45f398aab186111f5980c4f96c79c0,e94ec5bbce850ec1debb7b242d2e429e747cbf96..c6f3ca24aeed029ae69a773da0c9af2f75830bd9
--- 1/util/fptr_wlist.c
--- 2/util/fptr_wlist.c
+++ b/util/fptr_wlist.c
@@@ -183,7 -185,9 +187,10 @@@ fptr_whitelist_event(void (*fptr)(int, 
        else if(fptr == &tube_handle_signal) return 1;
        else if(fptr == &comm_base_handle_slow_accept) return 1;
        else if(fptr == &comm_point_http_handle_callback) return 1;
+ #ifdef HAVE_NGTCP2
+       else if(fptr == &comm_point_doq_callback) return 1;
+ #endif
 +      else if(fptr == &fast_reload_service_cb) return 1;
  #ifdef USE_DNSTAP
        else if(fptr == &dtio_output_cb) return 1;
        else if(fptr == &dtio_cmd_cb) return 1;

diff --cc util/module.h
Simple merge

diff --cc util/netevent.c
Simple merge

diff --cc util/netevent.h
Simple merge

diff --cc validator/autotrust.c
Simple merge

diff --cc validator/val_anchor.c
Simple merge

diff --cc validator/val_neg.c
Simple merge

diff --cc validator/validator.c
index 171135a7f4151c2b91a9bb6dfd3714647388a5b1,7bfc467371117473d0a58a5f0081bede9034687a..a0550b484eaeb69db5a0e1a45068f5b67f099af3
--- 1/validator/validator.c
--- 2/validator/validator.c
+++ b/validator/validator.c
@@@ -95,13 -95,11 +95,13 @@@ fill_nsec3_iter(size_t** keysize, size_
  {
        char* e;
        int i;
-       *keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
-       *maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
 -      free(ve->nsec3_keysize);
 -      free(ve->nsec3_maxiter);
 -      ve->nsec3_keysize = (size_t*)calloc((size_t)c, sizeof(size_t));
 -      ve->nsec3_maxiter = (size_t*)calloc((size_t)c, sizeof(size_t));
 -      if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
++      *keysize = (size_t*)calloc((size_t)c, sizeof(size_t));
++      *maxiter = (size_t*)calloc((size_t)c, sizeof(size_t));
 +      if(!*keysize || !*maxiter) {
 +              free(*keysize);
 +              *keysize = NULL;
 +              free(*maxiter);
 +              *maxiter = NULL;
                log_err("out of memory");
                return 0;
        }

diff --cc validator/validator.h
Simple merge