From: George Thessalonikefs Date: Wed, 22 Dec 2021 14:02:44 +0000 (+0100) Subject: - contrib/aaaa-filter-iterator.patch file renewed diff content to X-Git-Tag: release-1.15.0rc1~46 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4e492725e1764c579ef3bef2bbcddffc5159629f;p=thirdparty%2Funbound.git - contrib/aaaa-filter-iterator.patch file renewed diff content to apply cleanly to the current coderepo for the current code version. --- diff --git a/contrib/aaaa-filter-iterator.patch b/contrib/aaaa-filter-iterator.patch index f51de2a40..818b73a11 100644 --- a/contrib/aaaa-filter-iterator.patch +++ b/contrib/aaaa-filter-iterator.patch @@ -1,8 +1,8 @@ diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in -index f426ac5f..147fbfa9 100644 +index 50f9224..09456f5 100644 --- a/doc/unbound.conf.5.in +++ b/doc/unbound.conf.5.in -@@ -872,6 +872,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when +@@ -970,6 +970,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when this option in enabled. Only use if you know what you are doing. This option only has effect when qname-minimisation is enabled. Default is no. .TP @@ -17,14 +17,13 @@ index f426ac5f..147fbfa9 100644 Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN and other denials, using information from previous NXDOMAINs answers. diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c -index aae934dd..55c55de0 100644 +index f093c1b..e55a224 100644 --- a/iterator/iter_scrub.c +++ b/iterator/iter_scrub.c -@@ -667,6 +667,32 @@ static int sanitize_nsec_is_overreach(struct rrset_parse* rrset, - return 0; +@@ -680,6 +680,32 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt, } -+/** + /** + * ASN: Lookup A records from rrset cache. + * @param qinfo: the question originally asked. + * @param env: module environment with config and cache. @@ -50,10 +49,11 @@ index aae934dd..55c55de0 100644 + return 0; +} + - /** ++/** * Given a response event, remove suspect RRsets from the response. * "Suspect" rrsets are potentially poison. Note that this routine expects -@@ -686,6 +712,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, + * the response to be in a "normalized" state -- that is, all "irrelevant" +@@ -698,6 +724,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, struct query_info* qinfo, uint8_t* zonename, struct module_env* env, struct iter_env* ie) { @@ -61,7 +61,7 @@ index aae934dd..55c55de0 100644 int del_addi = 0; /* if additional-holding rrsets are deleted, we do not trust the normalized additional-A-AAAA any more */ struct rrset_parse* rrset, *prev; -@@ -721,6 +748,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, +@@ -733,6 +760,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, rrset = rrset->rrset_all_next; } @@ -75,7 +75,7 @@ index aae934dd..55c55de0 100644 /* At this point, we brutally remove ALL rrsets that aren't * children of the originating zone. The idea here is that, * as far as we know, the server that we contacted is ONLY -@@ -732,6 +766,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, +@@ -744,6 +778,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, rrset = msg->rrset_first; while(rrset) { @@ -101,22 +101,22 @@ index aae934dd..55c55de0 100644 if( (rrset->type == LDNS_RR_TYPE_A || rrset->type == LDNS_RR_TYPE_AAAA)) { diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c -index 7bc67da6..e10f547a 100644 +index 2482a1f..bd5ba24 100644 --- a/iterator/iter_utils.c +++ b/iterator/iter_utils.c -@@ -175,6 +175,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) - } +@@ -177,6 +177,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) iter_env->supports_ipv6 = cfg->do_ip6; iter_env->supports_ipv4 = cfg->do_ip4; + iter_env->outbound_msg_retry = cfg->outbound_msg_retry; + iter_env->aaaa_filter = cfg->aaaa_filter; return 1; } diff --git a/iterator/iterator.c b/iterator/iterator.c -index 23b07ea9..ca29b48c 100644 +index 48238a2..34ba249 100644 --- a/iterator/iterator.c +++ b/iterator/iterator.c -@@ -2127,6 +2127,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id) +@@ -2184,6 +2184,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id) return 0; } @@ -170,7 +170,7 @@ index 23b07ea9..ca29b48c 100644 /** * This is the request event state where the request will be sent to one of -@@ -2186,6 +2233,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, +@@ -2243,6 +2290,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, return error_response(qstate, id, LDNS_RCODE_SERVFAIL); } @@ -184,7 +184,7 @@ index 23b07ea9..ca29b48c 100644 /* Make sure we have a delegation point, otherwise priming failed * or another failure occurred */ if(!iq->dp) { -@@ -3574,6 +3628,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq, +@@ -3688,6 +3742,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq, return 0; } @@ -246,7 +246,7 @@ index 23b07ea9..ca29b48c 100644 /* * Return priming query results to interested super querystates. * -@@ -3593,6 +3702,9 @@ iter_inform_super(struct module_qstate* qstate, int id, +@@ -3707,6 +3816,9 @@ iter_inform_super(struct module_qstate* qstate, int id, else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*) super->minfo[id])->state == DSNS_FIND_STATE) processDSNSResponse(qstate, id, super); @@ -256,7 +256,7 @@ index 23b07ea9..ca29b48c 100644 else if(qstate->return_rcode != LDNS_RCODE_NOERROR) error_supers(qstate, id, super); else if(qstate->is_priming) -@@ -3630,6 +3742,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq, +@@ -3744,6 +3856,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq, case INIT_REQUEST_3_STATE: cont = processInitRequest3(qstate, iq, id); break; @@ -266,7 +266,7 @@ index 23b07ea9..ca29b48c 100644 case QUERYTARGETS_STATE: cont = processQueryTargets(qstate, iq, ie, id); break; -@@ -3961,6 +4076,8 @@ iter_state_to_string(enum iter_state state) +@@ -4080,6 +4195,8 @@ iter_state_to_string(enum iter_state state) return "INIT REQUEST STATE (stage 2)"; case INIT_REQUEST_3_STATE: return "INIT REQUEST STATE (stage 3)"; @@ -275,7 +275,7 @@ index 23b07ea9..ca29b48c 100644 case QUERYTARGETS_STATE : return "QUERY TARGETS STATE"; case PRIME_RESP_STATE : -@@ -3985,6 +4102,7 @@ iter_state_is_responsestate(enum iter_state s) +@@ -4104,6 +4221,7 @@ iter_state_is_responsestate(enum iter_state s) case INIT_REQUEST_STATE : case INIT_REQUEST_2_STATE : case INIT_REQUEST_3_STATE : @@ -284,10 +284,10 @@ index 23b07ea9..ca29b48c 100644 case COLLECT_CLASS_STATE : return 0; diff --git a/iterator/iterator.h b/iterator/iterator.h -index 342ac207..731948d1 100644 +index a9e5856..ace68c6 100644 --- a/iterator/iterator.h +++ b/iterator/iterator.h -@@ -135,6 +135,9 @@ struct iter_env { +@@ -133,6 +133,9 @@ struct iter_env { */ int* target_fetch_policy; @@ -297,11 +297,10 @@ index 342ac207..731948d1 100644 /** lock on ratelimit counter */ lock_basic_type queries_ratelimit_lock; /** number of queries that have been ratelimited */ -@@ -186,6 +189,14 @@ enum iter_state { - */ +@@ -188,6 +191,14 @@ enum iter_state { INIT_REQUEST_3_STATE, -+ /** + /** + * This state is responsible for intercepting AAAA queries, + * and launch a A subquery on the same target, to populate the + * cache with A records, so the AAAA filter scrubbing logic can @@ -309,10 +308,11 @@ index 342ac207..731948d1 100644 + */ + ASN_FETCH_A_FOR_AAAA_STATE, + - /** ++ /** * Each time a delegation point changes for a given query or a * query times out and/or wakes up, this state is (re)visited. -@@ -375,6 +386,13 @@ struct iter_qstate { + * This state is responsible for iterating through a list of +@@ -376,6 +387,13 @@ struct iter_qstate { */ int refetch_glue; @@ -327,10 +327,10 @@ index 342ac207..731948d1 100644 struct outbound_list outlist; diff --git a/pythonmod/interface.i b/pythonmod/interface.i -index f08b575d..47f1bb2e 100644 +index 03483ab..a8c30b5 100644 --- a/pythonmod/interface.i +++ b/pythonmod/interface.i -@@ -975,6 +975,7 @@ struct config_file { +@@ -994,6 +994,7 @@ struct config_file { int harden_dnssec_stripped; int harden_referral_path; int use_caps_bits_for_id; @@ -339,10 +339,10 @@ index f08b575d..47f1bb2e 100644 struct config_strlist* private_domain; size_t unwanted_threshold; diff --git a/util/config_file.c b/util/config_file.c -index 0ab8614a..729fb147 100644 +index 39050f5..326b0b9 100644 --- a/util/config_file.c +++ b/util/config_file.c -@@ -218,6 +218,7 @@ config_create(void) +@@ -231,6 +231,7 @@ config_create(void) cfg->harden_referral_path = 0; cfg->harden_algo_downgrade = 0; cfg->use_caps_bits_for_id = 0; @@ -351,10 +351,10 @@ index 0ab8614a..729fb147 100644 cfg->private_address = NULL; cfg->private_domain = NULL; diff --git a/util/config_file.h b/util/config_file.h -index e61257a3..dabaa7bb 100644 +index 18910be..bd59144 100644 --- a/util/config_file.h +++ b/util/config_file.h -@@ -260,6 +260,8 @@ struct config_file { +@@ -285,6 +285,8 @@ struct config_file { int harden_algo_downgrade; /** use 0x20 bits in query as random ID bits */ int use_caps_bits_for_id; @@ -364,38 +364,38 @@ index e61257a3..dabaa7bb 100644 struct config_strlist* caps_whitelist; /** strip away these private addrs from answers, no DNS Rebinding */ diff --git a/util/configlexer.lex b/util/configlexer.lex -index 79a0edca..4eaec678 100644 +index 71da924..b58b4b6 100644 --- a/util/configlexer.lex +++ b/util/configlexer.lex -@@ -304,6 +304,7 @@ harden-algo-downgrade{COLON} { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) } - use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) } +@@ -317,6 +317,7 @@ use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) } caps-whitelist{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) } + caps-exempt{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) } unwanted-reply-threshold{COLON} { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) } +aaaa-filter{COLON} { YDVAR(1, VAR_AAAA_FILTER) } private-address{COLON} { YDVAR(1, VAR_PRIVATE_ADDRESS) } private-domain{COLON} { YDVAR(1, VAR_PRIVATE_DOMAIN) } prefetch-key{COLON} { YDVAR(1, VAR_PREFETCH_KEY) } diff --git a/util/configparser.y b/util/configparser.y -index 1d0e8658..f284dd43 100644 +index 1daf853..cd39618 100644 --- a/util/configparser.y +++ b/util/configparser.y @@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser; - %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT + %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS +%token VAR_AAAA_FILTER %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE -@@ -233,6 +234,7 @@ content_server: server_num_threads | server_verbosity | server_port | +@@ -245,6 +246,7 @@ content_server: server_num_threads | server_verbosity | server_port | server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size | server_harden_referral_path | server_private_address | - server_private_domain | server_extended_statistics | + server_private_domain | server_extended_statistics | + server_aaaa_filter | - server_local_data_ptr | server_jostle_timeout | - server_unwanted_reply_threshold | server_log_time_ascii | - server_domain_insecure | server_val_sig_skew_min | -@@ -1563,6 +1565,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG + server_local_data_ptr | server_jostle_timeout | + server_unwanted_reply_threshold | server_log_time_ascii | + server_domain_insecure | server_val_sig_skew_min | +@@ -1742,6 +1744,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG yyerror("out of memory"); } ; diff --git a/doc/Changelog b/doc/Changelog index 3dc60ab48..a69cf06b7 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -1,3 +1,7 @@ +22 December 2021: George + - contrib/aaaa-filter-iterator.patch file renewed diff content to + apply cleanly to the current coderepo for the current code version. + 20 December 2021: George - Fix #591: Unbound-anchor manpage links to non-existent license file.