diff --git a/.gitignore b/.gitignore index a231159..2c71b75 100644 --- a/.gitignore +++ b/.gitignore @@ -85,3 +85,5 @@ unbound-1.4.5.tar.gz /unbound-1.19.0.tar.gz.asc /unbound-1.20.0.tar.gz /unbound-1.20.0.tar.gz.asc +/unbound-1.24.2.tar.gz +/unbound-1.24.2.tar.gz.asc diff --git a/sources b/sources index 5a055a7..7d4806d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (unbound-1.20.0.tar.gz) = 2f6bc76c03b71ca1c2cd2331dc72d62f51493d15e17c59af46b400e542fcabff22e6b9d33f750a3e5f918a0116f45afa760651b2d5aa2feadac151cbbd71b0bd -SHA512 (unbound-1.20.0.tar.gz.asc) = 1586a320077c606c5c19f251615df54a61854f51acca02df1d391dcc2287aff2c641b009aeee1a98392f63719d70b6bac23ebb7d86b780f8a27cda6e114fc0ad +SHA512 (unbound-1.24.2.tar.gz) = 655d63ec5305323e84d82691425d74d98c332d0028517bd729d191e5f968ce9481b49ec7447d4c4906dce7997a998a115db36e911a59d2d877da5840c2080261 +SHA512 (unbound-1.24.2.tar.gz.asc) = 66a3e569a606cc3ed7dac9b411fba347da150728427619bdbf12ac57a5d7db1fc17963b1ba052a95d6c6fed67a6f0c1b5920318f6cd34e5091750626dd63fb21 diff --git a/unbound-1.21-CVE-2024-8508.patch b/unbound-1.21-CVE-2024-8508.patch deleted file mode 100644 index 36b3cdd..0000000 --- a/unbound-1.21-CVE-2024-8508.patch +++ /dev/null @@ -1,249 +0,0 @@ -From 34de24d58bb5aa6fe3551512fc17cac08f65d93e Mon Sep 17 00:00:00 2001 -From: Yorgos Thessalonikefs -Date: Thu, 3 Oct 2024 14:46:57 +0200 -Subject: [PATCH] - Fix CVE-2024-8508, unbounded name compression could lead to - denial of service. - ---- - unbound-1.16.2/util/data/msgencode.c | 77 +++++++++++++++++----------- - 1 file changed, 46 insertions(+), 31 deletions(-) - -diff --git a/unbound-1.16.2/util/data/msgencode.c b/unbound-1.16.2/util/data/msgencode.c -index fe21cfb..f9e95e6 100644 ---- a/unbound-1.16.2/util/data/msgencode.c -+++ b/unbound-1.16.2/util/data/msgencode.c -@@ -62,6 +62,10 @@ - #define RETVAL_TRUNC -4 - /** return code that means all is peachy keen. Equal to DNS rcode NOERROR */ - #define RETVAL_OK 0 -+/** Max compressions we are willing to perform; more than that will result -+ * in semi-compressed messages, or truncated even on TCP for huge messages, to -+ * avoid locking the CPU for long */ -+#define MAX_COMPRESSION_PER_MESSAGE 120 - - /** - * Data structure to help domain name compression in outgoing messages. -@@ -284,15 +288,17 @@ write_compressed_dname(sldns_buffer* pkt, uint8_t* dname, int labs, - - /** compress owner name of RR, return RETVAL_OUTMEM RETVAL_TRUNC */ - static int --compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt, -- struct regional* region, struct compress_tree_node** tree, -- size_t owner_pos, uint16_t* owner_ptr, int owner_labs) -+compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt, -+ struct regional* region, struct compress_tree_node** tree, -+ size_t owner_pos, uint16_t* owner_ptr, int owner_labs, -+ size_t* compress_count) - { - struct compress_tree_node* p; - struct compress_tree_node** insertpt = NULL; - if(!*owner_ptr) { - /* compress first time dname */ -- if((p = compress_tree_lookup(tree, key->rk.dname, -+ if(*compress_count < MAX_COMPRESSION_PER_MESSAGE && -+ (p = compress_tree_lookup(tree, key->rk.dname, - owner_labs, &insertpt))) { - if(p->labs == owner_labs) - /* avoid ptr chains, since some software is -@@ -301,6 +307,7 @@ compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt, - if(!write_compressed_dname(pkt, key->rk.dname, - owner_labs, p)) - return RETVAL_TRUNC; -+ (*compress_count)++; - /* check if typeclass+4 ttl + rdatalen is available */ - if(sldns_buffer_remaining(pkt) < 4+4+2) - return RETVAL_TRUNC; -@@ -313,7 +320,8 @@ compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt, - if(owner_pos <= PTR_MAX_OFFSET) - *owner_ptr = htons(PTR_CREATE(owner_pos)); - } -- if(!compress_tree_store(key->rk.dname, owner_labs, -+ if(*compress_count < MAX_COMPRESSION_PER_MESSAGE && -+ !compress_tree_store(key->rk.dname, owner_labs, - owner_pos, region, p, insertpt)) - return RETVAL_OUTMEM; - } else { -@@ -333,20 +341,24 @@ compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt, - - /** compress any domain name to the packet, return RETVAL_* */ - static int --compress_any_dname(uint8_t* dname, sldns_buffer* pkt, int labs, -- struct regional* region, struct compress_tree_node** tree) -+compress_any_dname(uint8_t* dname, sldns_buffer* pkt, int labs, -+ struct regional* region, struct compress_tree_node** tree, -+ size_t* compress_count) - { - struct compress_tree_node* p; - struct compress_tree_node** insertpt = NULL; - size_t pos = sldns_buffer_position(pkt); -- if((p = compress_tree_lookup(tree, dname, labs, &insertpt))) { -+ if(*compress_count < MAX_COMPRESSION_PER_MESSAGE && -+ (p = compress_tree_lookup(tree, dname, labs, &insertpt))) { - if(!write_compressed_dname(pkt, dname, labs, p)) - return RETVAL_TRUNC; -+ (*compress_count)++; - } else { - if(!dname_buffer_write(pkt, dname)) - return RETVAL_TRUNC; - } -- if(!compress_tree_store(dname, labs, pos, region, p, insertpt)) -+ if(*compress_count < MAX_COMPRESSION_PER_MESSAGE && -+ !compress_tree_store(dname, labs, pos, region, p, insertpt)) - return RETVAL_OUTMEM; - return RETVAL_OK; - } -@@ -364,9 +376,9 @@ type_rdata_compressable(struct ub_packed_rrset_key* key) - - /** compress domain names in rdata, return RETVAL_* */ - static int --compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen, -- struct regional* region, struct compress_tree_node** tree, -- const sldns_rr_descriptor* desc) -+compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen, -+ struct regional* region, struct compress_tree_node** tree, -+ const sldns_rr_descriptor* desc, size_t* compress_count) - { - int labs, r, rdf = 0; - size_t dname_len, len, pos = sldns_buffer_position(pkt); -@@ -380,8 +392,8 @@ compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen, - switch(desc->_wireformat[rdf]) { - case LDNS_RDF_TYPE_DNAME: - labs = dname_count_size_labels(rdata, &dname_len); -- if((r=compress_any_dname(rdata, pkt, labs, region, -- tree)) != RETVAL_OK) -+ if((r=compress_any_dname(rdata, pkt, labs, region, -+ tree, compress_count)) != RETVAL_OK) - return r; - rdata += dname_len; - todolen -= dname_len; -@@ -449,7 +461,8 @@ static int - packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt, - uint16_t* num_rrs, time_t timenow, struct regional* region, - int do_data, int do_sig, struct compress_tree_node** tree, -- sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset) -+ sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset, -+ size_t* compress_count) - { - size_t i, j, owner_pos; - int r, owner_labs; -@@ -477,9 +490,9 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt, - for(i=0; icount; i++) { - /* rrset roundrobin */ - j = (i + rr_offset) % data->count; -- if((r=compress_owner(key, pkt, region, tree, -- owner_pos, &owner_ptr, owner_labs)) -- != RETVAL_OK) -+ if((r=compress_owner(key, pkt, region, tree, -+ owner_pos, &owner_ptr, owner_labs, -+ compress_count)) != RETVAL_OK) - return r; - sldns_buffer_write(pkt, &key->rk.type, 2); - sldns_buffer_write(pkt, &key->rk.rrset_class, 2); -@@ -489,8 +502,8 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt, - else sldns_buffer_write_u32(pkt, data->rr_ttl[j]-adjust); - if(c) { - if((r=compress_rdata(pkt, data->rr_data[j], -- data->rr_len[j], region, tree, c)) -- != RETVAL_OK) -+ data->rr_len[j], region, tree, c, -+ compress_count)) != RETVAL_OK) - return r; - } else { - if(sldns_buffer_remaining(pkt) < data->rr_len[j]) -@@ -510,9 +523,9 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt, - return RETVAL_TRUNC; - sldns_buffer_write(pkt, &owner_ptr, 2); - } else { -- if((r=compress_any_dname(key->rk.dname, -- pkt, owner_labs, region, tree)) -- != RETVAL_OK) -+ if((r=compress_any_dname(key->rk.dname, -+ pkt, owner_labs, region, tree, -+ compress_count)) != RETVAL_OK) - return r; - if(sldns_buffer_remaining(pkt) < - 4+4+data->rr_len[i]) -@@ -544,7 +557,8 @@ static int - insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs, - sldns_buffer* pkt, size_t rrsets_before, time_t timenow, - struct regional* region, struct compress_tree_node** tree, -- sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset) -+ sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset, -+ size_t* compress_count) - { - int r; - size_t i, setstart; -@@ -560,7 +574,7 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs, - setstart = sldns_buffer_position(pkt); - if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], - pkt, num_rrs, timenow, region, 1, 1, tree, -- s, qtype, dnssec, rr_offset)) -+ s, qtype, dnssec, rr_offset, compress_count)) - != RETVAL_OK) { - /* Bad, but if due to size must set TC bit */ - /* trim off the rrset neatly. */ -@@ -573,7 +587,7 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs, - setstart = sldns_buffer_position(pkt); - if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], - pkt, num_rrs, timenow, region, 1, 0, tree, -- s, qtype, dnssec, rr_offset)) -+ s, qtype, dnssec, rr_offset, compress_count)) - != RETVAL_OK) { - sldns_buffer_set_position(pkt, setstart); - return r; -@@ -584,7 +598,7 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs, - setstart = sldns_buffer_position(pkt); - if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], - pkt, num_rrs, timenow, region, 0, 1, tree, -- s, qtype, dnssec, rr_offset)) -+ s, qtype, dnssec, rr_offset, compress_count)) - != RETVAL_OK) { - sldns_buffer_set_position(pkt, setstart); - return r; -@@ -677,6 +691,7 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep, - struct compress_tree_node* tree = 0; - int r; - size_t rr_offset; -+ size_t compress_count=0; - - sldns_buffer_clear(buffer); - if(udpsize < sldns_buffer_limit(buffer)) -@@ -723,7 +738,7 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep, - arep.rrsets = &qinfo->local_alias->rrset; - if((r=insert_section(&arep, 1, &ancount, buffer, 0, - timezero, region, &tree, LDNS_SECTION_ANSWER, -- qinfo->qtype, dnssec, rr_offset)) != RETVAL_OK) { -+ qinfo->qtype, dnssec, rr_offset, &compress_count)) != RETVAL_OK) { - if(r == RETVAL_TRUNC) { - /* create truncated message */ - sldns_buffer_write_u16_at(buffer, 6, ancount); -@@ -738,7 +753,7 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep, - /* insert answer section */ - if((r=insert_section(rep, rep->an_numrrsets, &ancount, buffer, - 0, timenow, region, &tree, LDNS_SECTION_ANSWER, qinfo->qtype, -- dnssec, rr_offset)) != RETVAL_OK) { -+ dnssec, rr_offset, &compress_count)) != RETVAL_OK) { - if(r == RETVAL_TRUNC) { - /* create truncated message */ - sldns_buffer_write_u16_at(buffer, 6, ancount); -@@ -756,7 +771,7 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep, - if((r=insert_section(rep, rep->ns_numrrsets, &nscount, buffer, - rep->an_numrrsets, timenow, region, &tree, - LDNS_SECTION_AUTHORITY, qinfo->qtype, -- dnssec, rr_offset)) != RETVAL_OK) { -+ dnssec, rr_offset, &compress_count)) != RETVAL_OK) { - if(r == RETVAL_TRUNC) { - /* create truncated message */ - sldns_buffer_write_u16_at(buffer, 8, nscount); -@@ -773,7 +788,7 @@ reply_info_encode(struct query_info* qinfo, struct reply_info* rep, - if((r=insert_section(rep, rep->ar_numrrsets, &arcount, buffer, - rep->an_numrrsets + rep->ns_numrrsets, timenow, region, - &tree, LDNS_SECTION_ADDITIONAL, qinfo->qtype, -- dnssec, rr_offset)) != RETVAL_OK) { -+ dnssec, rr_offset, &compress_count)) != RETVAL_OK) { - if(r == RETVAL_TRUNC) { - /* no need to set TC bit, this is the additional */ - sldns_buffer_write_u16_at(buffer, 10, arcount); --- -2.47.0 - diff --git a/unbound-1.23-unbound-control-perms.patch b/unbound-1.23-unbound-control-perms.patch deleted file mode 100644 index caa1d92..0000000 --- a/unbound-1.23-unbound-control-perms.patch +++ /dev/null @@ -1,31 +0,0 @@ -From bf85823eb03d749ef2beb7b22464d1d0bb9f5952 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Tue, 14 Jan 2025 13:55:10 +0100 -Subject: [PATCH] Add unbound members group access to control key - -Recent openssl genrsa does not use umask for generated keys. There is no -strong reason why every member of unbound group should be able read -server key. But control key would be quite useful to be group readable -and to allow control access to whole group. Allowing access to control -by group membership, not via sudo. ---- - unbound-1.20.0/smallapp/unbound-control-setup.sh.in | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/unbound-1.20.0/smallapp/unbound-control-setup.sh.in b/unbound-1.20.0/smallapp/unbound-control-setup.sh.in -index eaf1d08..c38c186 100644 ---- a/unbound-1.20.0/smallapp/unbound-control-setup.sh.in -+++ b/unbound-1.20.0/smallapp/unbound-control-setup.sh.in -@@ -200,7 +200,8 @@ fi - # remove unused permissions - chmod o-rw \ - "$SVR_BASE.pem" \ -- "$SVR_BASE.key" \ -+ "$SVR_BASE.key" -+chmod g+r,o-rw \ - "$CTL_BASE.pem" \ - "$CTL_BASE.key" - --- -2.49.0 - diff --git a/unbound-1.23.1-CVE-2025-5994.patch b/unbound-1.23.1-CVE-2025-5994.patch deleted file mode 100644 index 1b4c30c..0000000 --- a/unbound-1.23.1-CVE-2025-5994.patch +++ /dev/null @@ -1,906 +0,0 @@ -commit 81cb270d19a0e016b8b74af931d9c6647ae00b16 -Author: Tomas Korbar -Date: Tue Jul 22 09:26:44 2025 +0200 - - Fix CVE-2025-5994 and add tests for it - -diff --git a/unbound-1.20.0/edns-subnet/subnetmod.c b/unbound-1.20.0/edns-subnet/subnetmod.c -index 1dff429..d31ecb3 100644 ---- a/unbound-1.20.0/edns-subnet/subnetmod.c -+++ b/unbound-1.20.0/edns-subnet/subnetmod.c -@@ -51,6 +51,7 @@ - #include "services/cache/dns.h" - #include "util/module.h" - #include "util/regional.h" -+#include "util/fptr_wlist.h" - #include "util/storage/slabhash.h" - #include "util/config_file.h" - #include "util/data/msgreply.h" -@@ -155,7 +156,8 @@ int ecs_whitelist_check(struct query_info* qinfo, - - /* Cache by default, might be disabled after parsing EDNS option - * received from nameserver. */ -- if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) { -+ if(!iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0) -+ && sq->ecs_client_in.subnet_validdata) { - qstate->no_cache_store = 0; - } - -@@ -522,6 +524,69 @@ common_prefix(uint8_t *a, uint8_t *b, uint8_t net) - return !memcmp(a, b, n) && ((net % 8) == 0 || a[n] == b[n]); - } - -+/** -+ * Create sub request that looks up the query. -+ * @param qstate: query state -+ * @param sq: subnet qstate -+ * @return false on failure. -+ */ -+static int -+generate_sub_request(struct module_qstate *qstate, struct subnet_qstate* sq) -+{ -+ struct module_qstate* subq = NULL; -+ uint16_t qflags = 0; /* OPCODE QUERY, no flags */ -+ int prime = 0; -+ int valrec = 0; -+ struct query_info qinf; -+ qinf.qname = qstate->qinfo.qname; -+ qinf.qname_len = qstate->qinfo.qname_len; -+ qinf.qtype = qstate->qinfo.qtype; -+ qinf.qclass = qstate->qinfo.qclass; -+ qinf.local_alias = NULL; -+ -+ qflags |= BIT_RD; -+ if((qstate->query_flags & BIT_CD)!=0) { -+ qflags |= BIT_CD; -+ valrec = 1; -+ } -+ -+ fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub)); -+ if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec, -+ &subq)) { -+ return 0; -+ } -+ if(subq) { -+ /* It is possible to access the subquery module state. */ -+ if(sq->ecs_client_in.subnet_source_mask == 0 && -+ edns_opt_list_find(qstate->edns_opts_front_in, -+ qstate->env->cfg->client_subnet_opcode)) { -+ subq->no_cache_store = 1; -+ } -+ } -+ return 1; -+} -+ -+/** -+ * Perform the query without subnet -+ * @param qstate: query state -+ * @param sq: subnet qstate -+ * @return module state -+ */ -+static enum module_ext_state -+generate_lookup_without_subnet(struct module_qstate *qstate, -+ struct subnet_qstate* sq) -+{ -+ verbose(VERB_ALGO, "subnetcache: make subquery to look up without subnet"); -+ if(!generate_sub_request(qstate, sq)) { -+ verbose(VERB_ALGO, "Could not generate sub query"); -+ qstate->return_rcode = LDNS_RCODE_FORMERR; -+ qstate->return_msg = NULL; -+ return module_finished; -+ } -+ sq->wait_subquery = 1; -+ return module_wait_subquery; -+} -+ - static enum module_ext_state - eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq) - { -@@ -557,14 +622,7 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq) - * is still useful to put it in the edns subnet cache for - * when a client explicitly asks for subnet specific answer. */ - verbose(VERB_QUERY, "subnetcache: Authority indicates no support"); -- if(!sq->started_no_cache_store) { -- lock_rw_wrlock(&sne->biglock); -- update_cache(qstate, id); -- lock_rw_unlock(&sne->biglock); -- } -- if (sq->subnet_downstream) -- cp_edns_bad_response(c_out, c_in); -- return module_finished; -+ return generate_lookup_without_subnet(qstate, sq); - } - - /* Purposefully there was no sent subnet, and there is consequently -@@ -589,14 +647,14 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq) - !common_prefix(s_out->subnet_addr, s_in->subnet_addr, - s_out->subnet_source_mask)) - { -- /* we can not accept, restart query without option */ -+ /* we can not accept, perform query without option */ - verbose(VERB_QUERY, "subnetcache: forged data"); - s_out->subnet_validdata = 0; - (void)edns_opt_list_remove(&qstate->edns_opts_back_out, - qstate->env->cfg->client_subnet_opcode); - sq->subnet_sent = 0; - sq->subnet_sent_no_subnet = 0; -- return module_restart_next; -+ return generate_lookup_without_subnet(qstate, sq); - } - - lock_rw_wrlock(&sne->biglock); -@@ -795,6 +853,9 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id, - } else if(sq->subnet_sent_no_subnet) { - /* The answer can be stored as scope 0, not in global cache. */ - qstate->no_cache_store = 1; -+ } else if(sq->subnet_sent) { -+ /* Need another query to be able to store in global cache. */ -+ qstate->no_cache_store = 1; - } - - return 1; -@@ -812,6 +873,32 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event, - strmodulevent(event)); - log_query_info(VERB_QUERY, "subnetcache operate: query", &qstate->qinfo); - -+ if(sq && sq->wait_subquery_done) { -+ /* The subquery lookup returned. */ -+ if(sq->ecs_client_in.subnet_source_mask == 0 && -+ edns_opt_list_find(qstate->edns_opts_front_in, -+ qstate->env->cfg->client_subnet_opcode)) { -+ if(!sq->started_no_cache_store && -+ qstate->return_msg) { -+ lock_rw_wrlock(&sne->biglock); -+ update_cache(qstate, id); -+ lock_rw_unlock(&sne->biglock); -+ } -+ if (sq->subnet_downstream) -+ cp_edns_bad_response(&sq->ecs_client_out, -+ &sq->ecs_client_in); -+ /* It is a scope zero lookup, append edns subnet -+ * option to the querier. */ -+ subnet_ecs_opt_list_append(&sq->ecs_client_out, -+ &qstate->edns_opts_front_out, qstate, -+ qstate->region); -+ } -+ sq->wait_subquery_done = 0; -+ qstate->ext_state[id] = module_finished; -+ qstate->no_cache_store = sq->started_no_cache_store; -+ qstate->no_cache_lookup = sq->started_no_cache_lookup; -+ return; -+ } - if((event == module_event_new || event == module_event_pass) && - sq == NULL) { - struct edns_option* ecs_opt; -@@ -822,6 +909,8 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event, - } - - sq = (struct subnet_qstate*)qstate->minfo[id]; -+ if(sq->wait_subquery) -+ return; /* Wait for that subquery to return */ - - if((ecs_opt = edns_opt_list_find( - qstate->edns_opts_front_in, -@@ -851,6 +940,14 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event, - /* No clients are interested in result or we could not - * parse it, we don't do client subnet */ - sq->ecs_server_out.subnet_validdata = 0; -+ if(edns_opt_list_find(qstate->edns_opts_front_in, -+ qstate->env->cfg->client_subnet_opcode)) { -+ /* aggregated this deaggregated state */ -+ qstate->ext_state[id] = -+ generate_lookup_without_subnet( -+ qstate, sq); -+ return; -+ } - verbose(VERB_ALGO, "subnetcache: pass to next module"); - qstate->ext_state[id] = module_wait_module; - return; -@@ -891,6 +988,14 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event, - } - lock_rw_unlock(&sne->biglock); - } -+ if(sq->ecs_client_in.subnet_source_mask == 0 && -+ edns_opt_list_find(qstate->edns_opts_front_in, -+ qstate->env->cfg->client_subnet_opcode)) { -+ /* client asked for resolution without edns subnet */ -+ qstate->ext_state[id] = generate_lookup_without_subnet( -+ qstate, sq); -+ return; -+ } - - sq->ecs_server_out.subnet_addr_fam = - sq->ecs_client_in.subnet_addr_fam; -@@ -927,6 +1032,8 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event, - qstate->ext_state[id] = module_wait_module; - return; - } -+ if(sq && sq->wait_subquery) -+ return; /* Wait for that subquery to return */ - /* Query handed back by next module, we have a 'final' answer */ - if(sq && event == module_event_moddone) { - qstate->ext_state[id] = eval_response(qstate, id, sq); -@@ -975,10 +1082,27 @@ subnetmod_clear(struct module_qstate *ATTR_UNUSED(qstate), - } - - void --subnetmod_inform_super(struct module_qstate *ATTR_UNUSED(qstate), -- int ATTR_UNUSED(id), struct module_qstate *ATTR_UNUSED(super)) -+subnetmod_inform_super(struct module_qstate *qstate, int id, -+ struct module_qstate *super) - { -- /* Not used */ -+ struct subnet_qstate* super_sq = -+ (struct subnet_qstate*)super->minfo[id]; -+ log_query_info(VERB_ALGO, "subnetcache inform_super: query", -+ &super->qinfo); -+ super_sq->wait_subquery = 0; -+ super_sq->wait_subquery_done = 1; -+ if(qstate->return_rcode != LDNS_RCODE_NOERROR || -+ !qstate->return_msg) { -+ super->return_msg = NULL; -+ super->return_rcode = LDNS_RCODE_SERVFAIL; -+ return; -+ } -+ super->return_rcode = LDNS_RCODE_NOERROR; -+ super->return_msg = dns_copy_msg(qstate->return_msg, super->region); -+ if(!super->return_msg) { -+ log_err("subnetcache: copy response, out of memory"); -+ super->return_rcode = LDNS_RCODE_SERVFAIL; -+ } - } - - size_t -diff --git a/unbound-1.20.0/edns-subnet/subnetmod.h b/unbound-1.20.0/edns-subnet/subnetmod.h -index 1ff8a23..3893820 100644 ---- a/unbound-1.20.0/edns-subnet/subnetmod.h -+++ b/unbound-1.20.0/edns-subnet/subnetmod.h -@@ -102,6 +102,10 @@ struct subnet_qstate { - int started_no_cache_store; - /** has the subnet module been started with no_cache_lookup? */ - int started_no_cache_lookup; -+ /** Wait for subquery that has been started for nonsubnet lookup. */ -+ int wait_subquery; -+ /** The subquery waited for is done. */ -+ int wait_subquery_done; - }; - - void subnet_data_delete(void* d, void* ATTR_UNUSED(arg)); -diff --git a/unbound-1.20.0/testdata/subnet_noecs_mult.rpl b/unbound-1.20.0/testdata/subnet_noecs_mult.rpl -new file mode 100644 -index 0000000..3e2acef ---- /dev/null -+++ b/unbound-1.20.0/testdata/subnet_noecs_mult.rpl -@@ -0,0 +1,334 @@ -+# config -+server: -+ send-client-subnet: 1.2.3.4 -+ max-client-subnet-ipv4: 17 -+ module-config: "subnetcache iterator" -+ qname-minimisation: no -+ minimal-responses: yes -+ target-fetch-policy: "0 0 0 0 0" -+ -+stub-zone: -+ name: "." -+ stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. -+CONFIG_END -+ -+SCENARIO_BEGIN Test subnet with no edns subnet from server multiple times -+; Multiple queries are sent to a server that does not reply with the -+; edns-subnet option. -+ -+; K.ROOT-SERVERS.NET. -+RANGE_BEGIN 0 100 -+ ADDRESS 193.0.14.129 -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR NOERROR -+SECTION QUESTION -+. IN NS -+SECTION ANSWER -+. IN NS K.ROOT-SERVERS.NET. -+SECTION ADDITIONAL -+K.ROOT-SERVERS.NET. IN A 193.0.14.129 -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode subdomain -+ADJUST copy_id copy_query -+REPLY QR NOERROR -+SECTION QUESTION -+com. IN NS -+SECTION AUTHORITY -+com. IN NS a.gtld-servers.net. -+SECTION ADDITIONAL -+a.gtld-servers.net. IN A 192.5.6.30 -+ENTRY_END -+RANGE_END -+ -+; a.gtld-servers.net. -+RANGE_BEGIN 0 100 -+ ADDRESS 192.5.6.30 -+ -+ENTRY_BEGIN -+MATCH opcode subdomain -+ADJUST copy_id copy_query -+REPLY QR NOERROR -+SECTION QUESTION -+example.com. IN NS -+SECTION AUTHORITY -+example.com. IN NS ns.example.com. -+SECTION ADDITIONAL -+ns.example.com. IN A 1.2.3.4 -+ENTRY_END -+RANGE_END -+ -+; ns.example.com. -+RANGE_BEGIN 50 52 -+ ADDRESS 1.2.3.4 -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+example.com. IN NS -+SECTION ANSWER -+example.com. IN NS ns.example.com. -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+ns.example.com. IN A -+SECTION ANSWER -+ns.example.com. IN A 1.2.3.4 -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+ns.example.com. IN AAAA -+SECTION ANSWER -+SECTION AUTHORITY -+example.com. IN SOA ns.example.com. host.example.com. 4 86400 3600 86400 3600 -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname ednsdata -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+SECTION ADDITIONAL -+ ; Match this subnet option -+ HEX_EDNSDATA_BEGIN -+ ; client is 127.0.0.1 -+ 00 08 ; OPC -+ 00 07 ; option length -+ 00 01 ; Family -+ 11 00 ; source mask, scopemask -+ 7f 00 00 ; address -+ HEX_EDNSDATA_END -+ ; This is the response, without the subnet option -+ HEX_ANSWER_BEGIN; -+ 00 00 84 00 00 01 00 01 ; ID 0 QR AA NOERROR -+ 00 00 00 01 03 77 77 77 ; www.example.com A (DO) -+ 07 65 78 61 6d 70 6c 65 -+ 03 63 6f 6d 00 00 01 00 -+ 01 -+ C0 0C 00 01 00 01 00 00 0E 10 ; www.example.com. A IN 3600 -+ 00 04 0A 14 1E 2C ; rdata 10.20.30.44 -+ 00 00 29 10 00 00 00 -+ 80 00 00 00 -+ HEX_ANSWER_END -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname ednsdata -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+SECTION ADDITIONAL -+ ; Match this subnet option -+ HEX_EDNSDATA_BEGIN -+ ; client is 127.2.0.1 -+ 00 08 ; OPC -+ 00 07 ; option length -+ 00 01 ; Family -+ 11 00 ; source mask, scopemask -+ 7f 02 00 ; address -+ HEX_EDNSDATA_END -+ ; This is the response, without the subnet option -+ HEX_ANSWER_BEGIN; -+ 00 00 84 00 00 01 00 01 ; ID 0 QR AA NOERROR -+ 00 00 00 01 03 77 77 77 ; www.example.com A (DO) -+ 07 65 78 61 6d 70 6c 65 -+ 03 63 6f 6d 00 00 01 00 -+ 01 -+ C0 0C 00 01 00 01 00 00 0E 10 ; www.example.com. A IN 3600 -+ 00 04 0A 14 1E 2C ; rdata 10.20.30.44 -+ 00 00 29 10 00 00 00 -+ 80 00 00 00 -+ HEX_ANSWER_END -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname ednsdata -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+SECTION ADDITIONAL -+ ; Match this subnet option -+ HEX_EDNSDATA_BEGIN -+ ; client is 127.3.0.1 -+ 00 08 ; OPC -+ 00 07 ; option length -+ 00 01 ; Family -+ 11 00 ; source mask, scopemask -+ 7f 03 00 ; address -+ HEX_EDNSDATA_END -+ ; This is the response, without the subnet option -+ HEX_ANSWER_BEGIN; -+ 00 00 84 00 00 01 00 01 ; ID 0 QR AA NOERROR -+ 00 00 00 01 03 77 77 77 ; www.example.com A (DO) -+ 07 65 78 61 6d 70 6c 65 -+ 03 63 6f 6d 00 00 01 00 -+ 01 -+ C0 0C 00 01 00 01 00 00 0E 10 ; www.example.com. A IN 3600 -+ 00 04 0A 14 1E 2C ; rdata 10.20.30.44 -+ 00 00 29 10 00 00 00 -+ 80 00 00 00 -+ HEX_ANSWER_END -+ENTRY_END -+ -+; The answer for a query without subnet -+;ENTRY_BEGIN -+;MATCH opcode qtype qname -+;ADJUST copy_id -+;REPLY QR AA NOERROR -+;SECTION QUESTION -+;www.example.com. IN A -+;SECTION ANSWER -+;www.example.com. IN A 10.20.30.40 -+;ENTRY_END -+RANGE_END -+ -+; ns.example.com. -+RANGE_BEGIN 53 57 -+ ADDRESS 1.2.3.4 -+; The answer for a query without subnet -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+www.example.com. IN A 10.20.30.40 -+ENTRY_END -+RANGE_END -+ -+STEP 10 QUERY -+ENTRY_BEGIN -+ HEX_ANSWER_BEGIN; -+ 00 00 01 00 00 01 00 00 ; ID 0 -+ 00 00 00 01 03 77 77 77 ; www.example.com A? (DO) -+ 07 65 78 61 6d 70 6c 65 -+ 03 63 6f 6d 00 00 01 00 -+ 01 00 00 29 10 00 00 00 -+ 80 00 00 0b -+ -+ 00 08 00 07 ; OPC, optlen -+ 00 01 11 00 ; ip4, scope 17, source 0 -+ 7f 00 00 ; 127.0.0.0/17 -+ HEX_ANSWER_END -+ENTRY_END -+ -+STEP 20 QUERY -+ENTRY_BEGIN -+ HEX_ANSWER_BEGIN; -+ 00 00 01 00 00 01 00 00 ; ID 0 -+ 00 00 00 01 03 77 77 77 ; www.example.com A? (DO) -+ 07 65 78 61 6d 70 6c 65 -+ 03 63 6f 6d 00 00 01 00 -+ 01 00 00 29 10 00 00 00 -+ 80 00 00 0b -+ -+ 00 08 00 07 ; OPC, optlen -+ 00 01 11 00 ; ip4, scope 17, source 0 -+ 7f 02 00 ; 127.2.0.0/17 -+ HEX_ANSWER_END -+ENTRY_END -+ -+STEP 30 QUERY -+ENTRY_BEGIN -+ HEX_ANSWER_BEGIN; -+ 00 00 01 00 00 01 00 00 ; ID 0 -+ 00 00 00 01 03 77 77 77 ; www.example.com A? (DO) -+ 07 65 78 61 6d 70 6c 65 -+ 03 63 6f 6d 00 00 01 00 -+ 01 00 00 29 10 00 00 00 -+ 80 00 00 0b -+ -+ 00 08 00 07 ; OPC, optlen -+ 00 01 11 00 ; ip4, scope 17, source 0 -+ 7f 03 00 ; 127.3.0.0/17 -+ HEX_ANSWER_END -+ENTRY_END -+ -+; recursion happens here. -+; The upstream server RANGE starts responding at STEP 50. -+STEP 50 TRAFFIC -+ -+; The upstream server now responds for the nonsubnet response. -+STEP 55 TRAFFIC -+ -+STEP 60 CHECK_ANSWER -+ENTRY_BEGIN -+MATCH all ednsdata -+REPLY QR RD RA DO NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+www.example.com. IN A 10.20.30.40 -+;www.example.com. IN A 10.20.30.44 -+SECTION ADDITIONAL -+; HEX_EDNSDATA_BEGIN -+; ; client is 127.3.0.1 -+; 00 08 ; OPC -+; 00 07 ; option length -+; 00 01 ; Family -+; 11 00 ; source mask, scopemask -+; 7f 03 00 ; address -+; HEX_EDNSDATA_END -+ENTRY_END -+ -+STEP 70 CHECK_ANSWER -+ENTRY_BEGIN -+MATCH all ednsdata -+REPLY QR RD RA DO NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+www.example.com. IN A 10.20.30.40 -+;www.example.com. IN A 10.20.30.44 -+SECTION ADDITIONAL -+; HEX_EDNSDATA_BEGIN -+; ; client is 127.2.0.1 -+; 00 08 ; OPC -+; 00 07 ; option length -+; 00 01 ; Family -+; 11 00 ; source mask, scopemask -+; 7f 02 00 ; address -+; HEX_EDNSDATA_END -+ENTRY_END -+ -+STEP 80 CHECK_ANSWER -+ENTRY_BEGIN -+MATCH all ednsdata -+REPLY QR RD RA DO NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+www.example.com. IN A 10.20.30.40 -+;www.example.com. IN A 10.20.30.44 -+SECTION ADDITIONAL -+; HEX_EDNSDATA_BEGIN -+; ; client is 127.0.0.1 -+; 00 08 ; OPC -+; 00 07 ; option length -+; 00 01 ; Family -+; 11 00 ; source mask, scopemask -+; 7f 00 00 ; address -+; HEX_EDNSDATA_END -+ENTRY_END -+ -+SCENARIO_END -diff --git a/unbound-1.20.0/testdata/subnet_noecs_refused.rpl b/unbound-1.20.0/testdata/subnet_noecs_refused.rpl -new file mode 100644 -index 0000000..39fbe85 ---- /dev/null -+++ b/unbound-1.20.0/testdata/subnet_noecs_refused.rpl -@@ -0,0 +1,159 @@ -+# config -+server: -+ send-client-subnet: 1.2.3.4 -+ max-client-subnet-ipv4: 17 -+ module-config: "subnetcache iterator" -+ qname-minimisation: no -+ minimal-responses: yes -+ target-fetch-policy: "0 0 0 0 0" -+ -+stub-zone: -+ name: "." -+ stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. -+CONFIG_END -+ -+SCENARIO_BEGIN Test subnet with no edns subnet support but it is refused -+; The query is sent to a server that does not reply with the edns-subnet -+; option. The upstream server sends rcode refused. That results in a -+; NULL return_msg. -+ -+; K.ROOT-SERVERS.NET. -+RANGE_BEGIN 0 100 -+ ADDRESS 193.0.14.129 -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR NOERROR -+SECTION QUESTION -+. IN NS -+SECTION ANSWER -+. IN NS K.ROOT-SERVERS.NET. -+SECTION ADDITIONAL -+K.ROOT-SERVERS.NET. IN A 193.0.14.129 -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode subdomain -+ADJUST copy_id copy_query -+REPLY QR NOERROR -+SECTION QUESTION -+com. IN NS -+SECTION AUTHORITY -+com. IN NS a.gtld-servers.net. -+SECTION ADDITIONAL -+a.gtld-servers.net. IN A 192.5.6.30 -+ENTRY_END -+RANGE_END -+ -+; a.gtld-servers.net. -+RANGE_BEGIN 0 100 -+ ADDRESS 192.5.6.30 -+ -+ENTRY_BEGIN -+MATCH opcode subdomain -+ADJUST copy_id copy_query -+REPLY QR NOERROR -+SECTION QUESTION -+example.com. IN NS -+SECTION AUTHORITY -+example.com. IN NS ns.example.com. -+SECTION ADDITIONAL -+ns.example.com. IN A 1.2.3.4 -+ENTRY_END -+RANGE_END -+ -+; ns.example.com. -+RANGE_BEGIN 0 100 -+ ADDRESS 1.2.3.4 -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+example.com. IN NS -+SECTION ANSWER -+example.com. IN NS ns.example.com. -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+ns.example.com. IN A -+SECTION ANSWER -+ns.example.com. IN A 1.2.3.4 -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+ns.example.com. IN AAAA -+SECTION ANSWER -+SECTION AUTHORITY -+example.com. IN SOA ns.example.com. host.example.com. 4 86400 3600 86400 3600 -+ENTRY_END -+ -+; This matches the no EDNS subnet info queries that are made for the -+; fallback without subnet. The answer is refused. -+ENTRY_BEGIN -+MATCH opcode qtype qname ednsdata -+ADJUST copy_id -+REPLY QR AA REFUSED -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+;www.example.com. IN A 10.20.30.40 -+ENTRY_END -+ -+; This matches the initial query with edns subnet in the query, -+; the answer has no edns subnet in the reply. -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+www.example.com. IN A 10.20.30.40 -+ENTRY_END -+RANGE_END -+ -+STEP 1 QUERY -+;ENTRY_BEGIN -+;REPLY RD DO -+;SECTION QUESTION -+;www.example.com. IN A -+; but send this query with subnet scope zero in the query, because that -+; makes the reply possibly get stored in the cache. -+; -+; query with subnet 0.0.0.0/0. -+ENTRY_BEGIN -+HEX_ANSWER_BEGIN -+ 00 00 01 00 00 01 00 00 ;ID 0 -+ 00 00 00 01 03 77 77 77 ; www.example.com A? (DO) -+ 07 65 78 61 6d 70 6c 65 -+ 03 63 6f 6d 00 00 01 00 -+ 01 00 00 29 10 00 00 00 -+ 80 00 00 08 -+ -+ 00 08 00 04 ; OPC, optlen -+ 00 01 00 00 ; ip4, scope 0, source 0 -+ ;0.0.0.0/0 -+HEX_ANSWER_END -+ENTRY_END -+ -+; recursion happens here. -+STEP 10 CHECK_ANSWER -+ENTRY_BEGIN -+MATCH all ednsdata -+REPLY QR RD RA DO SERVFAIL -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+;www.example.com. IN A 10.20.30.40 -+ENTRY_END -+SCENARIO_END -diff --git a/unbound-1.20.0/testdata/subnet_noecs_support.rpl b/unbound-1.20.0/testdata/subnet_noecs_support.rpl -new file mode 100644 -index 0000000..0c9826c ---- /dev/null -+++ b/unbound-1.20.0/testdata/subnet_noecs_support.rpl -@@ -0,0 +1,127 @@ -+# config -+server: -+ send-client-subnet: 1.2.3.4 -+ max-client-subnet-ipv4: 17 -+ module-config: "subnetcache iterator" -+ qname-minimisation: no -+ minimal-responses: yes -+ target-fetch-policy: "0 0 0 0 0" -+ -+stub-zone: -+ name: "." -+ stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. -+CONFIG_END -+ -+SCENARIO_BEGIN Test subnet with no edns subnet support from the server -+; The query is sent to a server that does not reply with the edns-subnet -+; option. -+ -+; K.ROOT-SERVERS.NET. -+RANGE_BEGIN 0 100 -+ ADDRESS 193.0.14.129 -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR NOERROR -+SECTION QUESTION -+. IN NS -+SECTION ANSWER -+. IN NS K.ROOT-SERVERS.NET. -+SECTION ADDITIONAL -+K.ROOT-SERVERS.NET. IN A 193.0.14.129 -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode subdomain -+ADJUST copy_id copy_query -+REPLY QR NOERROR -+SECTION QUESTION -+com. IN NS -+SECTION AUTHORITY -+com. IN NS a.gtld-servers.net. -+SECTION ADDITIONAL -+a.gtld-servers.net. IN A 192.5.6.30 -+ENTRY_END -+RANGE_END -+ -+; a.gtld-servers.net. -+RANGE_BEGIN 0 100 -+ ADDRESS 192.5.6.30 -+ -+ENTRY_BEGIN -+MATCH opcode subdomain -+ADJUST copy_id copy_query -+REPLY QR NOERROR -+SECTION QUESTION -+example.com. IN NS -+SECTION AUTHORITY -+example.com. IN NS ns.example.com. -+SECTION ADDITIONAL -+ns.example.com. IN A 1.2.3.4 -+ENTRY_END -+RANGE_END -+ -+; ns.example.com. -+RANGE_BEGIN 0 100 -+ ADDRESS 1.2.3.4 -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+example.com. IN NS -+SECTION ANSWER -+example.com. IN NS ns.example.com. -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+ns.example.com. IN A -+SECTION ANSWER -+ns.example.com. IN A 1.2.3.4 -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+ns.example.com. IN AAAA -+SECTION ANSWER -+SECTION AUTHORITY -+example.com. IN SOA ns.example.com. host.example.com. 4 86400 3600 86400 3600 -+ENTRY_END -+ -+ENTRY_BEGIN -+MATCH opcode qtype qname -+ADJUST copy_id -+REPLY QR AA NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+www.example.com. IN A 10.20.30.40 -+ENTRY_END -+RANGE_END -+ -+STEP 1 QUERY -+ENTRY_BEGIN -+REPLY RD DO -+SECTION QUESTION -+www.example.com. IN A -+ENTRY_END -+ -+; recursion happens here. -+STEP 10 CHECK_ANSWER -+ENTRY_BEGIN -+MATCH all ednsdata -+REPLY QR RD RA DO NOERROR -+SECTION QUESTION -+www.example.com. IN A -+SECTION ANSWER -+www.example.com. IN A 10.20.30.40 -+ENTRY_END -+SCENARIO_END diff --git a/unbound.spec b/unbound.spec index a50fc0a..90f447e 100644 --- a/unbound.spec +++ b/unbound.spec @@ -30,7 +30,7 @@ Summary: Validating, recursive, and caching DNS(SEC) resolver Name: unbound -Version: 1.20.0 +Version: 1.24.2 Release: %autorelease %{?extra_version:-e %{extra_version}} License: BSD-3-Clause Url: https://nlnetlabs.nl/projects/unbound/ @@ -65,19 +65,12 @@ Source30: tmpfiles-unbound-libs.conf # Downstream configuration changes Patch1: unbound-fedora-config.patch -# https://github.com/NLnetLabs/unbound/commit/b7c61d7cc256d6a174e6179622c7fa968272c259 -Patch2: unbound-1.21-CVE-2024-8508.patch -# https://github.com/NLnetLabs/unbound/commit/5bf82f246481098a6473f296b21fc1229d276c0f -# https://github.com/NLnetLabs/unbound/commit/a1150078f29e14b36c8e4d9d05a263a5e6abbc5b -Patch3: unbound-1.23.1-CVE-2025-5994.patch -# https://github.com/NLnetLabs/unbound/pull/1220 -Patch4: unbound-1.23-unbound-control-perms.patch BuildRequires: gcc, make BuildRequires: flex, openssl-devel BuildRequires: libevent-devel expat-devel BuildRequires: pkgconfig -%if 0%{?fedora} +%if 0%{?fedora} || 0%{?rhel} >= 10 BuildRequires: gnupg2 %endif %if 0%{with_python2} @@ -207,7 +200,7 @@ Unbound dracut module allowing use of Unbound for name resolution in initramfs. %prep -%if 0%{?fedora} +%if 0%{?fedora} || 0%{?rhel} >= 10 %{gpgverify} --keyring='%{SOURCE19}' --signature='%{SOURCE18}' --data='%{SOURCE0}' %endif %global pkgname %{name}-%{version}%{?extra_version}