update unbound from upstream

external/unbound/util/alloc.c

@@ -367,8 +367,12 @@ void *unbound_stat_malloc(size_t size)
 /** calloc with stats */
 void *unbound_stat_calloc(size_t nmemb, size_t size)
 {
-	size_t s = (nmemb*size==0)?(size_t)1:nmemb*size;
-	void* res = calloc(1, s+16);
+	size_t s;
+	void* res;
+	if(nmemb != 0 && INT_MAX/nmemb < size)
+		return NULL; /* integer overflow check */
+	s = (nmemb*size==0)?(size_t)1:nmemb*size;
+	res = calloc(1, s+16);
 	if(!res) return NULL;
 	log_info("stat %p=calloc(%u, %u)", res+16, (unsigned)nmemb, (unsigned)size);
 	unbound_mem_alloc += s;
@@ -503,8 +507,12 @@ void *unbound_stat_malloc_lite(size_t size, const char* file, int line,
 void *unbound_stat_calloc_lite(size_t nmemb, size_t size, const char* file,
         int line, const char* func)
 {
-	size_t req = nmemb * size;
-	void* res = malloc(req+lite_pad*2+sizeof(size_t));
+	size_t req;
+	void* res;
+	if(nmemb != 0 && INT_MAX/nmemb < size)
+		return NULL; /* integer overflow check */
+	req = nmemb * size;
+	res = malloc(req+lite_pad*2+sizeof(size_t));
 	if(!res) return NULL;
 	memmove(res, lite_pre, lite_pad);
 	memmove(res+lite_pad, &req, sizeof(size_t));

external/unbound/util/alloc.h

@@ -177,8 +177,8 @@ void alloc_set_id_cleanup(struct alloc_cache* alloc, void (*cleanup)(void*),
 	void* arg);
 
 #ifdef UNBOUND_ALLOC_LITE
-#  include <ldns/ldns.h>
-#  include <ldns/packet.h>
+#  include <sldns/ldns.h>
+#  include <sldns/packet.h>
 #  ifdef HAVE_OPENSSL_SSL_H
 #    include <openssl/ssl.h>
 #  endif

external/unbound/util/config_file.c

@@ -55,11 +55,20 @@
 #include "util/regional.h"
 #include "util/fptr_wlist.h"
 #include "util/data/dname.h"
-#include "ldns/wire2str.h"
-#include "ldns/parseutil.h"
+#include "util/rtt.h"
+#include "sldns/wire2str.h"
+#include "sldns/parseutil.h"
 #ifdef HAVE_GLOB_H
 # include <glob.h>
 #endif
+#ifdef HAVE_PWD_H
+#include <pwd.h>
+#endif
+
+/** from cfg username, after daemonise setup performed */
+uid_t cfg_uid = (uid_t)-1;
+/** from cfg username, after daemonise setup performed */
+gid_t cfg_gid = (gid_t)-1;
 
 /** global config during parsing */
 struct config_parser_state* cfg_parser = 0;
@@ -126,6 +135,7 @@ config_create(void)
 	cfg->prefetch_key = 0;
 	cfg->infra_cache_slabs = 4;
 	cfg->infra_cache_numhosts = 10000;
+	cfg->infra_cache_min_rtt = 50;
 	cfg->delay_close = 0;
 	if(!(cfg->outgoing_avail_ports = (int*)calloc(65536, sizeof(int))))
 		goto error_exit;
@@ -146,6 +156,7 @@ config_create(void)
 	cfg->so_rcvbuf = 0;
 	cfg->so_sndbuf = 0;
 	cfg->so_reuseport = 0;
+	cfg->ip_transparent = 0;
 	cfg->num_ifs = 0;
 	cfg->ifs = NULL;
 	cfg->num_out_ifs = 0;
@@ -159,6 +170,7 @@ config_create(void)
 	cfg->harden_dnssec_stripped = 1;
 	cfg->harden_below_nxdomain = 0;
 	cfg->harden_referral_path = 0;
+	cfg->harden_algo_downgrade = 1;
 	cfg->use_caps_bits_for_id = 0;
 	cfg->private_address = NULL;
 	cfg->private_domain = NULL;
@@ -196,6 +208,7 @@ config_create(void)
 	cfg->remote_control_enable = 0;
 	cfg->control_ifs = NULL;
 	cfg->control_port = UNBOUND_CONTROL_PORT;
+	cfg->remote_control_use_cert = 1;
 	cfg->minimal_responses = 0;
 	cfg->rrset_roundrobin = 0;
 	cfg->max_udp_size = 4096;
@@ -361,6 +374,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_MEMSIZE("so-rcvbuf:", so_rcvbuf)
 	else S_MEMSIZE("so-sndbuf:", so_sndbuf)
 	else S_YNO("so-reuseport:", so_reuseport)
+	else S_YNO("ip-transparent:", ip_transparent)
 	else S_MEMSIZE("rrset-cache-size:", rrset_cache_size)
 	else S_POW2("rrset-cache-slabs:", rrset_cache_slabs)
 	else S_YNO("prefetch:", prefetch)
@@ -369,6 +383,10 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->max_ttl = atoi(val); MAX_TTL=(time_t)cfg->max_ttl;}
 	else if(strcmp(opt, "cache-min-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->min_ttl = atoi(val); MIN_TTL=(time_t)cfg->min_ttl;}
+	else if(strcmp(opt, "infra-cache-min-rtt:") == 0) {
+	    IS_NUMBER_OR_ZERO; cfg->infra_cache_min_rtt = atoi(val);
+	    RTT_MIN_TIMEOUT=cfg->infra_cache_min_rtt;
+	}
 	else S_NUMBER_OR_ZERO("infra-host-ttl:", host_ttl)
 	else S_POW2("infra-cache-slabs:", infra_cache_slabs)
 	else S_SIZET_NONZERO("infra-cache-numhosts:", infra_cache_numhosts)
@@ -389,6 +407,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("harden-dnssec-stripped:", harden_dnssec_stripped)
 	else S_YNO("harden-below-nxdomain:", harden_below_nxdomain)
 	else S_YNO("harden-referral-path:", harden_referral_path)
+	else S_YNO("harden-algo-downgrade:", harden_algo_downgrade)
 	else S_YNO("use-caps-for-id", use_caps_bits_for_id)
 	else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold)
 	else S_STRLIST("private-address:", private_address)
@@ -437,7 +456,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->val_sig_skew_max = (int32_t)atoi(val); }
 	else if (strcmp(opt, "outgoing-interface:") == 0) {
 		char* d = strdup(val);
-		char** oi = (char**)malloc((cfg->num_out_ifs+1)*sizeof(char*));
+		char** oi = 
+		(char**)reallocarray(NULL, (size_t)cfg->num_out_ifs+1, sizeof(char*));
 		if(!d || !oi) { free(d); free(oi); return -1; }
 		if(cfg->out_ifs && cfg->num_out_ifs) {
 			memmove(oi, cfg->out_ifs, cfg->num_out_ifs*sizeof(char*));
@@ -609,6 +629,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_MEM(opt, "so-rcvbuf", so_rcvbuf)
 	else O_MEM(opt, "so-sndbuf", so_sndbuf)
 	else O_YNO(opt, "so-reuseport", so_reuseport)
+	else O_YNO(opt, "ip-transparent", ip_transparent)
 	else O_MEM(opt, "rrset-cache-size", rrset_cache_size)
 	else O_DEC(opt, "rrset-cache-slabs", rrset_cache_slabs)
 	else O_YNO(opt, "prefetch-key", prefetch_key)
@@ -617,6 +638,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "cache-min-ttl", min_ttl)
 	else O_DEC(opt, "infra-host-ttl", host_ttl)
 	else O_DEC(opt, "infra-cache-slabs", infra_cache_slabs)
+	else O_DEC(opt, "infra-cache-min-rtt", infra_cache_min_rtt)
 	else O_MEM(opt, "infra-cache-numhosts", infra_cache_numhosts)
 	else O_UNS(opt, "delay-close", delay_close)
 	else O_YNO(opt, "do-ip4", do_ip4)
@@ -646,6 +668,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "harden-dnssec-stripped", harden_dnssec_stripped)
 	else O_YNO(opt, "harden-below-nxdomain", harden_below_nxdomain)
 	else O_YNO(opt, "harden-referral-path", harden_referral_path)
+	else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade)
 	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
 	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
 	else O_YNO(opt, "do-not-query-localhost", donotquery_localhost)
@@ -799,6 +822,7 @@ config_read(struct config_file* cfg, const char* filename, const char* chroot)
 		errno=EINVAL;
 		return 0;
 	}
+
 	return 1;
 }
 
@@ -981,7 +1005,7 @@ int cfg_condense_ports(struct config_file* cfg, int** avail)
 	*avail = NULL;
 	if(num == 0)
 		return 0;
-	*avail = (int*)malloc(sizeof(int)*num);
+	*avail = (int*)reallocarray(NULL, (size_t)num, sizeof(int));
 	if(!*avail)
 		return 0;
 	for(i=0; i<65536; i++) {
@@ -1181,12 +1205,29 @@ config_apply(struct config_file* config)
 {
 	MAX_TTL = (time_t)config->max_ttl;
 	MIN_TTL = (time_t)config->min_ttl;
+	RTT_MIN_TIMEOUT = config->infra_cache_min_rtt;
 	EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
 	MINIMAL_RESPONSES = config->minimal_responses;
 	RRSET_ROUNDROBIN = config->rrset_roundrobin;
 	log_set_time_asc(config->log_time_ascii);
 }
 
+void config_lookup_uid(struct config_file* cfg)
+{
+#ifdef HAVE_GETPWNAM
+	/* translate username into uid and gid */
+	if(cfg->username && cfg->username[0]) {
+		struct passwd *pwd;
+		if((pwd = getpwnam(cfg->username)) != NULL) {
+			cfg_uid = pwd->pw_uid;
+			cfg_gid = pwd->pw_gid;
+		}
+	}
+#else
+	(void)cfg;
+#endif
+}
+
 /** 
  * Calculate string length of full pathname in original filesys
  * @param fname: the path name to convert.

external/unbound/util/config_file.h

@@ -119,6 +119,8 @@ struct config_file {
 	size_t infra_cache_slabs;
 	/** max number of hosts in the infra cache */
 	size_t infra_cache_numhosts;
+	/** min value for infra cache rtt */
+	int infra_cache_min_rtt;
 	/** delay close of udp-timeouted ports, if 0 no delayclose. in msec */
 	int delay_close;
 
@@ -134,6 +136,8 @@ struct config_file {
 	size_t so_sndbuf;
 	/** SO_REUSEPORT requested on port 53 sockets */
 	int so_reuseport;
+	/** IP_TRANSPARENT socket option requested on port 53 sockets */
+	int ip_transparent;
 
 	/** number of interfaces to open. If 0 default all interfaces. */
 	int num_ifs;
@@ -171,6 +175,8 @@ struct config_file {
 	int harden_below_nxdomain;
 	/** harden the referral path, query for NS,A,AAAA and validate */
 	int harden_referral_path;
+	/** harden against algorithm downgrade */
+	int harden_algo_downgrade;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
 	/** strip away these private addrs from answers, no DNS Rebinding */
@@ -282,6 +288,8 @@ struct config_file {
 	struct config_strlist* control_ifs;
 	/** port number for the control port */
 	int control_port;
+	/** use certificates for remote control */
+	int remote_control_use_cert;
 	/** private key file for server */
 	char* server_key_file;
 	/** certificate file for server */
@@ -339,6 +347,11 @@ struct config_file {
 	int dnstap_log_forwarder_response_messages;
 };
 
+/** from cfg username, after daemonise setup performed */
+extern uid_t cfg_uid;
+/** from cfg username, after daemonise setup performed */
+extern gid_t cfg_gid;
+
 /**
  * Stub config options
  */
@@ -422,6 +435,12 @@ void config_delete(struct config_file* config);
  */
 void config_apply(struct config_file* config);
 
+/**
+ * Find username, sets cfg_uid and cfg_gid.
+ * @param config: the config structure.
+ */
+void config_lookup_uid(struct config_file* config);
+
 /**
  * Set the given keyword to the given value.
  * @param config: where to store config

external/unbound/util/configlexer.lex

@@ -226,6 +226,7 @@ interface-automatic{COLON}	{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) }
 so-rcvbuf{COLON}		{ YDVAR(1, VAR_SO_RCVBUF) }
 so-sndbuf{COLON}		{ YDVAR(1, VAR_SO_SNDBUF) }
 so-reuseport{COLON}		{ YDVAR(1, VAR_SO_REUSEPORT) }
+ip-transparent{COLON}		{ YDVAR(1, VAR_IP_TRANSPARENT) }
 chroot{COLON}			{ YDVAR(1, VAR_CHROOT) }
 username{COLON}			{ YDVAR(1, VAR_USERNAME) }
 directory{COLON}		{ YDVAR(1, VAR_DIRECTORY) }
@@ -245,6 +246,7 @@ infra-lame-ttl{COLON}		{ YDVAR(1, VAR_INFRA_LAME_TTL) }
 infra-cache-slabs{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_SLABS) }
 infra-cache-numhosts{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) }
 infra-cache-lame-size{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) }
+infra-cache-min-rtt{COLON}	{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) }
 num-queries-per-thread{COLON}	{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) }
 jostle-timeout{COLON}		{ YDVAR(1, VAR_JOSTLE_TIMEOUT) }
 delay-close{COLON}		{ YDVAR(1, VAR_DELAY_CLOSE) }
@@ -255,6 +257,7 @@ harden-glue{COLON}		{ YDVAR(1, VAR_HARDEN_GLUE) }
 harden-dnssec-stripped{COLON}	{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) }
 harden-below-nxdomain{COLON}	{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+harden-algo-downgrade{COLON}	{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
@@ -315,6 +318,7 @@ remote-control{COLON}		{ YDVAR(0, VAR_REMOTE_CONTROL) }
 control-enable{COLON}		{ YDVAR(1, VAR_CONTROL_ENABLE) }
 control-interface{COLON}	{ YDVAR(1, VAR_CONTROL_INTERFACE) }
 control-port{COLON}		{ YDVAR(1, VAR_CONTROL_PORT) }
+control-use-cert{COLON}		{ YDVAR(1, VAR_CONTROL_USE_CERT) }
 server-key-file{COLON}		{ YDVAR(1, VAR_SERVER_KEY_FILE) }
 server-cert-file{COLON}		{ YDVAR(1, VAR_SERVER_CERT_FILE) }
 control-key-file{COLON}		{ YDVAR(1, VAR_CONTROL_KEY_FILE) }

external/unbound/util/configparser.h

@@ -139,59 +139,63 @@ extern int yydebug;
      VAR_SERVER_CERT_FILE = 348,
      VAR_CONTROL_KEY_FILE = 349,
      VAR_CONTROL_CERT_FILE = 350,
-     VAR_EXTENDED_STATISTICS = 351,
-     VAR_LOCAL_DATA_PTR = 352,
-     VAR_JOSTLE_TIMEOUT = 353,
-     VAR_STUB_PRIME = 354,
-     VAR_UNWANTED_REPLY_THRESHOLD = 355,
-     VAR_LOG_TIME_ASCII = 356,
-     VAR_DOMAIN_INSECURE = 357,
-     VAR_PYTHON = 358,
-     VAR_PYTHON_SCRIPT = 359,
-     VAR_VAL_SIG_SKEW_MIN = 360,
-     VAR_VAL_SIG_SKEW_MAX = 361,
-     VAR_CACHE_MIN_TTL = 362,
-     VAR_VAL_LOG_LEVEL = 363,
-     VAR_AUTO_TRUST_ANCHOR_FILE = 364,
-     VAR_KEEP_MISSING = 365,
-     VAR_ADD_HOLDDOWN = 366,
-     VAR_DEL_HOLDDOWN = 367,
-     VAR_SO_RCVBUF = 368,
-     VAR_EDNS_BUFFER_SIZE = 369,
-     VAR_PREFETCH = 370,
-     VAR_PREFETCH_KEY = 371,
-     VAR_SO_SNDBUF = 372,
-     VAR_SO_REUSEPORT = 373,
-     VAR_HARDEN_BELOW_NXDOMAIN = 374,
-     VAR_IGNORE_CD_FLAG = 375,
-     VAR_LOG_QUERIES = 376,
-     VAR_TCP_UPSTREAM = 377,
-     VAR_SSL_UPSTREAM = 378,
-     VAR_SSL_SERVICE_KEY = 379,
-     VAR_SSL_SERVICE_PEM = 380,
-     VAR_SSL_PORT = 381,
-     VAR_FORWARD_FIRST = 382,
-     VAR_STUB_FIRST = 383,
-     VAR_MINIMAL_RESPONSES = 384,
-     VAR_RRSET_ROUNDROBIN = 385,
-     VAR_MAX_UDP_SIZE = 386,
-     VAR_DELAY_CLOSE = 387,
-     VAR_UNBLOCK_LAN_ZONES = 388,
-     VAR_DNS64_PREFIX = 389,
-     VAR_DNS64_SYNTHALL = 390,
-     VAR_DNSTAP = 391,
-     VAR_DNSTAP_ENABLE = 392,
-     VAR_DNSTAP_SOCKET_PATH = 393,
-     VAR_DNSTAP_SEND_IDENTITY = 394,
-     VAR_DNSTAP_SEND_VERSION = 395,
-     VAR_DNSTAP_IDENTITY = 396,
-     VAR_DNSTAP_VERSION = 397,
-     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 398,
-     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 399,
-     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 400,
-     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 401,
-     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 402,
-     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 403
+     VAR_CONTROL_USE_CERT = 351,
+     VAR_EXTENDED_STATISTICS = 352,
+     VAR_LOCAL_DATA_PTR = 353,
+     VAR_JOSTLE_TIMEOUT = 354,
+     VAR_STUB_PRIME = 355,
+     VAR_UNWANTED_REPLY_THRESHOLD = 356,
+     VAR_LOG_TIME_ASCII = 357,
+     VAR_DOMAIN_INSECURE = 358,
+     VAR_PYTHON = 359,
+     VAR_PYTHON_SCRIPT = 360,
+     VAR_VAL_SIG_SKEW_MIN = 361,
+     VAR_VAL_SIG_SKEW_MAX = 362,
+     VAR_CACHE_MIN_TTL = 363,
+     VAR_VAL_LOG_LEVEL = 364,
+     VAR_AUTO_TRUST_ANCHOR_FILE = 365,
+     VAR_KEEP_MISSING = 366,
+     VAR_ADD_HOLDDOWN = 367,
+     VAR_DEL_HOLDDOWN = 368,
+     VAR_SO_RCVBUF = 369,
+     VAR_EDNS_BUFFER_SIZE = 370,
+     VAR_PREFETCH = 371,
+     VAR_PREFETCH_KEY = 372,
+     VAR_SO_SNDBUF = 373,
+     VAR_SO_REUSEPORT = 374,
+     VAR_HARDEN_BELOW_NXDOMAIN = 375,
+     VAR_IGNORE_CD_FLAG = 376,
+     VAR_LOG_QUERIES = 377,
+     VAR_TCP_UPSTREAM = 378,
+     VAR_SSL_UPSTREAM = 379,
+     VAR_SSL_SERVICE_KEY = 380,
+     VAR_SSL_SERVICE_PEM = 381,
+     VAR_SSL_PORT = 382,
+     VAR_FORWARD_FIRST = 383,
+     VAR_STUB_FIRST = 384,
+     VAR_MINIMAL_RESPONSES = 385,
+     VAR_RRSET_ROUNDROBIN = 386,
+     VAR_MAX_UDP_SIZE = 387,
+     VAR_DELAY_CLOSE = 388,
+     VAR_UNBLOCK_LAN_ZONES = 389,
+     VAR_INFRA_CACHE_MIN_RTT = 390,
+     VAR_DNS64_PREFIX = 391,
+     VAR_DNS64_SYNTHALL = 392,
+     VAR_DNSTAP = 393,
+     VAR_DNSTAP_ENABLE = 394,
+     VAR_DNSTAP_SOCKET_PATH = 395,
+     VAR_DNSTAP_SEND_IDENTITY = 396,
+     VAR_DNSTAP_SEND_VERSION = 397,
+     VAR_DNSTAP_IDENTITY = 398,
+     VAR_DNSTAP_VERSION = 399,
+     VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES = 400,
+     VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES = 401,
+     VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES = 402,
+     VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES = 403,
+     VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES = 404,
+     VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES = 405,
+     VAR_HARDEN_ALGO_DOWNGRADE = 406,
+     VAR_IP_TRANSPARENT = 407
    };
 #endif
 /* Tokens.  */
@@ -288,59 +292,63 @@ extern int yydebug;
 #define VAR_SERVER_CERT_FILE 348
 #define VAR_CONTROL_KEY_FILE 349
 #define VAR_CONTROL_CERT_FILE 350
-#define VAR_EXTENDED_STATISTICS 351
-#define VAR_LOCAL_DATA_PTR 352
-#define VAR_JOSTLE_TIMEOUT 353
-#define VAR_STUB_PRIME 354
-#define VAR_UNWANTED_REPLY_THRESHOLD 355
-#define VAR_LOG_TIME_ASCII 356
-#define VAR_DOMAIN_INSECURE 357
-#define VAR_PYTHON 358
-#define VAR_PYTHON_SCRIPT 359
-#define VAR_VAL_SIG_SKEW_MIN 360
-#define VAR_VAL_SIG_SKEW_MAX 361
-#define VAR_CACHE_MIN_TTL 362
-#define VAR_VAL_LOG_LEVEL 363
-#define VAR_AUTO_TRUST_ANCHOR_FILE 364
-#define VAR_KEEP_MISSING 365
-#define VAR_ADD_HOLDDOWN 366
-#define VAR_DEL_HOLDDOWN 367
-#define VAR_SO_RCVBUF 368
-#define VAR_EDNS_BUFFER_SIZE 369
-#define VAR_PREFETCH 370
-#define VAR_PREFETCH_KEY 371
-#define VAR_SO_SNDBUF 372
-#define VAR_SO_REUSEPORT 373
-#define VAR_HARDEN_BELOW_NXDOMAIN 374
-#define VAR_IGNORE_CD_FLAG 375
-#define VAR_LOG_QUERIES 376
-#define VAR_TCP_UPSTREAM 377
-#define VAR_SSL_UPSTREAM 378
-#define VAR_SSL_SERVICE_KEY 379
-#define VAR_SSL_SERVICE_PEM 380
-#define VAR_SSL_PORT 381
-#define VAR_FORWARD_FIRST 382
-#define VAR_STUB_FIRST 383
-#define VAR_MINIMAL_RESPONSES 384
-#define VAR_RRSET_ROUNDROBIN 385
-#define VAR_MAX_UDP_SIZE 386
-#define VAR_DELAY_CLOSE 387
-#define VAR_UNBLOCK_LAN_ZONES 388
-#define VAR_DNS64_PREFIX 389
-#define VAR_DNS64_SYNTHALL 390
-#define VAR_DNSTAP 391
-#define VAR_DNSTAP_ENABLE 392
-#define VAR_DNSTAP_SOCKET_PATH 393
-#define VAR_DNSTAP_SEND_IDENTITY 394
-#define VAR_DNSTAP_SEND_VERSION 395
-#define VAR_DNSTAP_IDENTITY 396
-#define VAR_DNSTAP_VERSION 397
-#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 398
-#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 399
-#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 400
-#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 401
-#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 402
-#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 403
+#define VAR_CONTROL_USE_CERT 351
+#define VAR_EXTENDED_STATISTICS 352
+#define VAR_LOCAL_DATA_PTR 353
+#define VAR_JOSTLE_TIMEOUT 354
+#define VAR_STUB_PRIME 355
+#define VAR_UNWANTED_REPLY_THRESHOLD 356
+#define VAR_LOG_TIME_ASCII 357
+#define VAR_DOMAIN_INSECURE 358
+#define VAR_PYTHON 359
+#define VAR_PYTHON_SCRIPT 360
+#define VAR_VAL_SIG_SKEW_MIN 361
+#define VAR_VAL_SIG_SKEW_MAX 362
+#define VAR_CACHE_MIN_TTL 363
+#define VAR_VAL_LOG_LEVEL 364
+#define VAR_AUTO_TRUST_ANCHOR_FILE 365
+#define VAR_KEEP_MISSING 366
+#define VAR_ADD_HOLDDOWN 367
+#define VAR_DEL_HOLDDOWN 368
+#define VAR_SO_RCVBUF 369
+#define VAR_EDNS_BUFFER_SIZE 370
+#define VAR_PREFETCH 371
+#define VAR_PREFETCH_KEY 372
+#define VAR_SO_SNDBUF 373
+#define VAR_SO_REUSEPORT 374
+#define VAR_HARDEN_BELOW_NXDOMAIN 375
+#define VAR_IGNORE_CD_FLAG 376
+#define VAR_LOG_QUERIES 377
+#define VAR_TCP_UPSTREAM 378
+#define VAR_SSL_UPSTREAM 379
+#define VAR_SSL_SERVICE_KEY 380
+#define VAR_SSL_SERVICE_PEM 381
+#define VAR_SSL_PORT 382
+#define VAR_FORWARD_FIRST 383
+#define VAR_STUB_FIRST 384
+#define VAR_MINIMAL_RESPONSES 385
+#define VAR_RRSET_ROUNDROBIN 386
+#define VAR_MAX_UDP_SIZE 387
+#define VAR_DELAY_CLOSE 388
+#define VAR_UNBLOCK_LAN_ZONES 389
+#define VAR_INFRA_CACHE_MIN_RTT 390
+#define VAR_DNS64_PREFIX 391
+#define VAR_DNS64_SYNTHALL 392
+#define VAR_DNSTAP 393
+#define VAR_DNSTAP_ENABLE 394
+#define VAR_DNSTAP_SOCKET_PATH 395
+#define VAR_DNSTAP_SEND_IDENTITY 396
+#define VAR_DNSTAP_SEND_VERSION 397
+#define VAR_DNSTAP_IDENTITY 398
+#define VAR_DNSTAP_VERSION 399
+#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 400
+#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 401
+#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 402
+#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 403
+#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 404
+#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 405
+#define VAR_HARDEN_ALGO_DOWNGRADE 406
+#define VAR_IP_TRANSPARENT 407
 
 
 
@@ -354,7 +362,7 @@ typedef union YYSTYPE
 
 
 /* Line 2058 of yacc.c  */
-#line 358 "util/configparser.h"
+#line 366 "util/configparser.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */

external/unbound/util/configparser.y

@@ -95,6 +95,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
+%token VAR_CONTROL_USE_CERT
 %token VAR_EXTENDED_STATISTICS VAR_LOCAL_DATA_PTR VAR_JOSTLE_TIMEOUT
 %token VAR_STUB_PRIME VAR_UNWANTED_REPLY_THRESHOLD VAR_LOG_TIME_ASCII
 %token VAR_DOMAIN_INSECURE VAR_PYTHON VAR_PYTHON_SCRIPT VAR_VAL_SIG_SKEW_MIN
@@ -106,6 +107,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_SSL_SERVICE_KEY VAR_SSL_SERVICE_PEM VAR_SSL_PORT VAR_FORWARD_FIRST
 %token VAR_STUB_FIRST VAR_MINIMAL_RESPONSES VAR_RRSET_ROUNDROBIN
 %token VAR_MAX_UDP_SIZE VAR_DELAY_CLOSE VAR_UNBLOCK_LAN_ZONES
+%token VAR_INFRA_CACHE_MIN_RTT
 %token VAR_DNS64_PREFIX VAR_DNS64_SYNTHALL
 %token VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH
 %token VAR_DNSTAP_SEND_IDENTITY VAR_DNSTAP_SEND_VERSION
@@ -116,6 +118,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES
 %token VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES
+%token VAR_HARDEN_ALGO_DOWNGRADE VAR_IP_TRANSPARENT
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -174,7 +177,9 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_ssl_service_key | server_ssl_service_pem | server_ssl_port |
 	server_minimal_responses | server_rrset_roundrobin | server_max_udp_size |
 	server_so_reuseport | server_delay_close | server_unblock_lan_zones |
-	server_dns64_prefix | server_dns64_synthall
+	server_dns64_prefix | server_dns64_synthall |
+	server_infra_cache_min_rtt | server_harden_algo_downgrade |
+	server_ip_transparent
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -617,6 +622,16 @@ server_so_reuseport: VAR_SO_REUSEPORT STRING_ARG
         free($2);
     }
     ;
+server_ip_transparent: VAR_IP_TRANSPARENT STRING_ARG
+    {
+        OUTYY(("P(server_ip_transparent:%s)\n", $2));
+        if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+            yyerror("expected yes or no.");
+        else cfg_parser->cfg->ip_transparent =
+            (strcmp($2, "yes")==0);
+        free($2);
+    }
+    ;
 server_edns_buffer_size: VAR_EDNS_BUFFER_SIZE STRING_ARG
 	{
 		OUTYY(("P(server_edns_buffer_size:%s)\n", $2));
@@ -767,6 +782,15 @@ server_infra_cache_slabs: VAR_INFRA_CACHE_SLABS STRING_ARG
 		free($2);
 	}
 	;
+server_infra_cache_min_rtt: VAR_INFRA_CACHE_MIN_RTT STRING_ARG
+	{
+		OUTYY(("P(server_infra_cache_min_rtt:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->infra_cache_min_rtt = atoi($2);
+		free($2);
+	}
+	;
 server_target_fetch_policy: VAR_TARGET_FETCH_POLICY STRING_ARG
 	{
 		OUTYY(("P(server_target_fetch_policy:%s)\n", $2));
@@ -834,6 +858,16 @@ server_harden_referral_path: VAR_HARDEN_REFERRAL_PATH STRING_ARG
 		free($2);
 	}
 	;
+server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG
+	{
+		OUTYY(("P(server_harden_algo_downgrade:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->harden_algo_downgrade = 
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG
 	{
 		OUTYY(("P(server_use_caps_for_id:%s)\n", $2));
@@ -1104,10 +1138,11 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 		if(strcmp($3, "static")!=0 && strcmp($3, "deny")!=0 &&
 		   strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
 		   strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
-		   && strcmp($3, "typetransparent")!=0)
+		   && strcmp($3, "typetransparent")!=0 &&
+		   strcmp($3, "inform")!=0)
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
-				"typetransparent or nodefault");
+				"typetransparent, inform or nodefault");
 		else if(strcmp($3, "nodefault")==0) {
 			if(!cfg_strlist_insert(&cfg_parser->cfg->
 				local_zones_nodefault, $2))
@@ -1270,7 +1305,7 @@ contents_rc: contents_rc content_rc
 	| ;
 content_rc: rc_control_enable | rc_control_interface | rc_control_port |
 	rc_server_key_file | rc_server_cert_file | rc_control_key_file |
-	rc_control_cert_file
+	rc_control_cert_file | rc_control_use_cert
 	;
 rc_control_enable: VAR_CONTROL_ENABLE STRING_ARG
 	{
@@ -1298,6 +1333,16 @@ rc_control_interface: VAR_CONTROL_INTERFACE STRING_ARG
 			yyerror("out of memory");
 	}
 	;
+rc_control_use_cert: VAR_CONTROL_USE_CERT STRING_ARG
+	{
+		OUTYY(("P(control_use_cert:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->remote_control_use_cert =
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 rc_server_key_file: VAR_SERVER_KEY_FILE STRING_ARG
 	{
 		OUTYY(("P(rc_server_key_file:%s)\n", $2));

external/unbound/util/data/dname.c

@@ -45,7 +45,7 @@
 #include "util/data/msgparse.h"
 #include "util/log.h"
 #include "util/storage/lookup3.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /* determine length of a dname in buffer, no compression pointers allowed */
 size_t

external/unbound/util/data/msgencode.c

@@ -47,7 +47,7 @@
 #include "util/log.h"
 #include "util/regional.h"
 #include "util/net_help.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 
 /** return code that means the function ran out of memory. negative so it does
  * not conflict with DNS rcodes. */

external/unbound/util/data/msgparse.c

@@ -42,10 +42,10 @@
 #include "util/data/packed_rrset.h"
 #include "util/storage/lookup3.h"
 #include "util/regional.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
 
 /** smart comparison of (compressed, valid) dnames from packet */
 static int

external/unbound/util/data/msgparse.h

@@ -63,8 +63,8 @@
 #ifndef UTIL_DATA_MSGPARSE_H
 #define UTIL_DATA_MSGPARSE_H
 #include "util/storage/lruhash.h"
-#include "ldns/pkthdr.h"
-#include "ldns/rrdef.h"
+#include "sldns/pkthdr.h"
+#include "sldns/rrdef.h"
 struct sldns_buffer;
 struct rrset_parse;
 struct rr_parse;

external/unbound/util/data/msgreply.c

@@ -50,8 +50,8 @@
 #include "util/regional.h"
 #include "util/data/msgparse.h"
 #include "util/data/msgencode.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
 
 /** MAX TTL default for messages and rrsets */
 time_t MAX_TTL = 3600 * 24 * 10; /* ten days */
@@ -87,6 +87,7 @@ construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
 	/* rrset_count-1 because the first ref is part of the struct. */
 	size_t s = sizeof(struct reply_info) - sizeof(struct rrset_ref) +
 		sizeof(struct ub_packed_rrset_key*) * total;
+	if(total >= RR_COUNT_MAX) return NULL; /* sanity check on numRRS*/
 	if(region)
 		rep = (struct reply_info*)regional_alloc(region, s);
 	else	rep = (struct reply_info*)malloc(s + 
@@ -277,7 +278,11 @@ parse_create_rrset(sldns_buffer* pkt, struct rrset_parse* pset,
 	struct packed_rrset_data** data, struct regional* region)
 {
 	/* allocate */
-	size_t s = sizeof(struct packed_rrset_data) + 
+	size_t s;
+	if(pset->rr_count > RR_COUNT_MAX || pset->rrsig_count > RR_COUNT_MAX ||
+		pset->size > RR_COUNT_MAX)
+		return 0; /* protect against integer overflow */
+	s = sizeof(struct packed_rrset_data) + 
 		(pset->rr_count + pset->rrsig_count) * 
 		(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)) + 
 		pset->size;

external/unbound/util/data/packed_rrset.c

@@ -47,9 +47,9 @@
 #include "util/alloc.h"
 #include "util/regional.h"
 #include "util/net_help.h"
-#include "ldns/rrdef.h"
-#include "ldns/sbuffer.h"
-#include "ldns/wire2str.h"
+#include "sldns/rrdef.h"
+#include "sldns/sbuffer.h"
+#include "sldns/wire2str.h"
 
 void
 ub_packed_rrset_parsedelete(struct ub_packed_rrset_key* pkey,

external/unbound/util/data/packed_rrset.h

@@ -58,6 +58,12 @@ typedef uint64_t rrset_id_t;
  * from the SOA in the answer section from a direct SOA query or ANY query. */
 #define PACKED_RRSET_SOA_NEG 0x4
 
+/** number of rrs and rrsets for integer overflow protection.  More than
+ * this is not really possible (64K packet has much less RRs and RRsets) in
+ * a message.  And this is small enough that also multiplied there is no
+ * integer overflow. */
+#define RR_COUNT_MAX 0xffffff
+
 /**
  * The identifying information for an RRset.
  */

external/unbound/util/iana_ports.inc

@@ -3819,6 +3819,7 @@
 4359,
 4361,
 4362,
+4366,
 4368,
 4369,
 4370,
@@ -4358,6 +4359,7 @@
 6072,
 6073,
 6074,
+6080,
 6081,
 6082,
 6083,
@@ -4399,6 +4401,7 @@
 6163,
 6200,
 6201,
+6209,
 6222,
 6241,
 6242,
@@ -4488,6 +4491,8 @@
 6628,
 6633,
 6634,
+6635,
+6636,
 6653,
 6657,
 6670,
@@ -4671,6 +4676,7 @@
 7778,
 7779,
 7781,
+7784,
 7786,
 7787,
 7789,
@@ -4839,6 +4845,8 @@
 8912,
 8913,
 8954,
+8980,
+8981,
 8989,
 8990,
 8991,
@@ -4846,6 +4854,7 @@
 9000,
 9001,
 9002,
+9006,
 9007,
 9009,
 9020,
@@ -5230,6 +5239,7 @@
 22005,
 22273,
 22305,
+22335,
 22343,
 22347,
 22350,

external/unbound/util/log.c

@@ -40,7 +40,7 @@
 #include "config.h"
 #include "util/log.h"
 #include "util/locks.h"
-#include "ldns/sbuffer.h"
+#include "sldns/sbuffer.h"
 #include <stdarg.h>
 #ifdef HAVE_TIME_H
 #include <time.h>
@@ -164,6 +164,14 @@ void log_thread_set(int* num)
 	ub_thread_key_set(logkey, num);
 }
 
+int log_thread_get(void)
+{
+	unsigned int* tid;
+	if(!key_created) return 0;
+	tid = (unsigned int*)ub_thread_key_get(logkey);
+	return (int)(tid?*tid:0);
+}
+
 void log_ident_set(const char* id)
 {
 	ident = id;

external/unbound/util/log.h

@@ -97,6 +97,15 @@ void log_file(FILE *f);
  */
 void log_thread_set(int* num);
 
+/**
+ * Get the thread id from logging system.  Set after log_init is
+ * initialised, or log_thread_set for newly created threads.
+ * This initialisation happens in unbound as a daemon, in daemon
+ * startup code, when that spawns threads.
+ * @return thread number, from 0 and up.  Before initialised, returns 0.
+ */
+int log_thread_get(void);
+
 /**
  * Set identity to print, default is 'unbound'. 
  * @param id: string to print. Name of executable.

external/unbound/util/net_help.c

@@ -43,8 +43,8 @@
 #include "util/data/dname.h"
 #include "util/module.h"
 #include "util/regional.h"
-#include "ldns/parseutil.h"
-#include "ldns/wire2str.h"
+#include "sldns/parseutil.h"
+#include "sldns/wire2str.h"
 #include <fcntl.h>
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -156,7 +156,12 @@ log_addr(enum verbosity_value v, const char* str,
 		case AF_INET6: family="ip6";
 			sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
 			break;
-		case AF_UNIX: family="unix"; break;
+		case AF_LOCAL:
+			dest[0]=0;
+			(void)inet_ntop(af, sinaddr, dest,
+				(socklen_t)sizeof(dest));
+			verbose(v, "%s local %s", str, dest);
+			return; /* do not continue and try to get port */
 		default: break;
 	}
 	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
@@ -313,7 +318,7 @@ void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone,
 		case AF_INET6: family="";
 			sinaddr = &((struct sockaddr_in6*)addr)->sin6_addr;
 			break;
-		case AF_UNIX: family="unix_family "; break;
+		case AF_LOCAL: family="local "; break;
 		default: break;
 	}
 	if(inet_ntop(af, sinaddr, dest, (socklen_t)sizeof(dest)) == 0) {
@@ -765,7 +770,7 @@ static lock_basic_t *ub_openssl_locks = NULL;
 static unsigned long
 ub_crypto_id_cb(void)
 {
-	return (unsigned long)ub_thread_self();
+	return (unsigned long)log_thread_get();
 }
 
 static void
@@ -784,8 +789,8 @@ int ub_openssl_lock_init(void)
 {
 #if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	int i;
-	ub_openssl_locks = (lock_basic_t*)malloc(
-		sizeof(lock_basic_t)*CRYPTO_num_locks());
+	ub_openssl_locks = (lock_basic_t*)reallocarray(
+		NULL, (size_t)CRYPTO_num_locks(), sizeof(lock_basic_t));
 	if(!ub_openssl_locks)
 		return 0;
 	for(i=0; i<CRYPTO_num_locks(); i++) {

external/unbound/util/netevent.c

@@ -43,8 +43,8 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/fptr_wlist.h"
-#include "ldns/pkthdr.h"
-#include "ldns/sbuffer.h"
+#include "sldns/pkthdr.h"
+#include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
@@ -879,12 +879,12 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
 	}
 
 	/* grab the tcp handler buffers */
+	c->cur_tcp_count++;
 	c->tcp_free = c_hdl->tcp_free;
 	if(!c->tcp_free) {
 		/* stop accepting incoming queries for now. */
 		comm_point_stop_listening(c);
 	}
-	/* addr is dropped. Not needed for tcp reply. */
 	setup_tcp_handler(c_hdl, new_fd);
 }
 
@@ -902,6 +902,7 @@ reclaim_tcp_handler(struct comm_point* c)
 	}
 	comm_point_close(c);
 	if(c->tcp_parent) {
+		c->tcp_parent->cur_tcp_count--;
 		c->tcp_free = c->tcp_parent->tcp_free;
 		c->tcp_parent->tcp_free = c;
 		if(!c->tcp_free) {
@@ -1528,6 +1529,7 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_udp;
@@ -1578,6 +1580,7 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_udp;
@@ -1639,6 +1642,7 @@ comm_point_create_tcp_handler(struct comm_base *base,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = parent;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_tcp;
@@ -1691,6 +1695,7 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = num;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = (struct comm_point**)calloc((size_t)num,
 		sizeof(struct comm_point*));
 	if(!c->tcp_handlers) {
@@ -1758,6 +1763,7 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_tcp;
@@ -1810,6 +1816,7 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_local;
@@ -1857,6 +1864,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
 	c->tcp_byte_count = 0;
 	c->tcp_parent = NULL;
 	c->max_tcp_count = 0;
+	c->cur_tcp_count = 0;
 	c->tcp_handlers = NULL;
 	c->tcp_free = NULL;
 	c->type = comm_raw;

external/unbound/util/netevent.h

@@ -164,6 +164,8 @@ struct comm_point {
 	/* -------- TCP Accept -------- */
 	/** the number of TCP handlers for this tcp-accept socket */
 	int max_tcp_count;
+	/** current number of tcp handler in-use for this accept socket */
+	int cur_tcp_count;
 	/** malloced array of tcp handlers for a tcp-accept, 
 	    of size max_tcp_count. */
 	struct comm_point** tcp_handlers;

external/unbound/util/rtt.c

@@ -42,6 +42,8 @@
 #include "config.h"
 #include "util/rtt.h"
 
+/* overwritten by config: infra_cache_min_rtt: */
+int RTT_MIN_TIMEOUT = 50;
 /** calculate RTO from rtt information */
 static int
 calc_rto(const struct rtt_info* rtt)

external/unbound/util/rtt.h

@@ -56,7 +56,7 @@ struct rtt_info {
 };
 
 /** min retransmit timeout value, in milliseconds */
-#define RTT_MIN_TIMEOUT	50
+extern int RTT_MIN_TIMEOUT;
 /** max retransmit timeout value, in milliseconds */
 #define RTT_MAX_TIMEOUT 120000